6978cc2b0e0beee5d68f7cb4438ebfd04403fa7166390771c6596ac953af4b59

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 16.5MB
Sample260803-ebwxwsbf69
SHA256 6978cc2b0e0beee5d68f7cb4438ebfd04403fa7166390771c6596ac953af4b59
MD5 1fd4cd395b2aa5a4fa3f839d021920c5
SHA1 7c1a54fcc437d7b423db7ada98bd3119f338242a
SHA512 edcfb00b72345608a9d9b979067e00824a147f71811f212a9f3f8b0b69ac7a0c9aa01228a264598589f425d18537a17db9ca7db0cd4d4bf74d3c1ab1038b2a26
SSDEEP 196608:hVCzDy/Ok1LwsdOJSkUgEqStKszfxKb+zdY4HciD1KK7lDJI/PoaYGMOwSWb:DCzO1YSkP1gvzfRzCklKK7aYGMOwS
TLSH
T1EB07AD43F66280F8C16AC074835A6232FB31BC4947357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe
5884	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3304	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5884	Nexomia.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 5884 wrote to memory of 3304	5884	Nexomia.exe	89
PID 3304 wrote to memory of 5952	3304	msedgewebview2.exe	90
PID 3304 wrote to memory of 476	3304	msedgewebview2.exe	91
PID 3304 wrote to memory of 476	3304	msedgewebview2.exe	91
PID 3304 wrote to memory of 476	3304	msedgewebview2.exe	91
PID 3304 wrote to memory of 476	3304	msedgewebview2.exe	91
PID 3304 wrote to memory of 5188	3304	msedgewebview2.exe	92
PID 3304 wrote to memory of 1160	3304	msedgewebview2.exe	93
PID 3304 wrote to memory of 1160	3304	msedgewebview2.exe	93
PID 3304 wrote to memory of 1160	3304	msedgewebview2.exe	93
PID 3304 wrote to memory of 4564	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 4564	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 4564	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 4564	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 4564	3304	msedgewebview2.exe	94
PID 3304 wrote to memory of 2972	3304	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5884.5828.9398177743394339580 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc2ac35fd8,0x7ffc2ac35fe4,0x7ffc2ac35ff0
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,12749522530703361426,321319632824823522,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1956 --field-trial-handle=1788,i,12749522530703361426,321319632824823522,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1788,i,12749522530703361426,321319632824823522,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3356 --field-trial-handle=1788,i,12749522530703361426,321319632824823522,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:4564
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=828 --field-trial-handle=1788,i,12749522530703361426,321319632824823522,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e07f0aa5bb3dcd974893685226661a960d3da096b5e38a6241c4ff1533dd764a
MD5 f85b043b57c34a136913213016d5573a
SHA1 5571a5331fe03b64bef6691a5c3573dc29c28fc1
SHA512 753edc1585024cc1874a2a9c2b51e557081a1ae4cb7773bcd8565bcddaaa833a3c9b9423a8041797e3db93887d6d8276d7bde535700755900c600f9caee41ae2
TLSH
T1D7D0121232130634C02026335C53A74C1800D14B4546C005A828891D2B140540902841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 63b3f4e6e667053980b2c93404ea138c5eaecb559e7c0a2532b8c248e2d31006
MD5 e342b91cd0c80da72912c07c6be4184f
SHA1 f026e033366f120170eb839878960871ea43c33f
SHA512 e3a595dd21d558d578c31500d0301570d8dff38ecad6bcbf7705474ea01359955621e995eec60ff70f72025a67c073425108ec1905085fbd69462762de3d194a
TLSH
T169D0041051130500C1151737DC71C744151054C10D43C5155550040415500054001400
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

6d029a2b-868a-4dfd-bed9-44956d95773a.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\6d029a2b-868a-4dfd-bed9-44956d95773a.tmp
Size 6KB
SHA256 b28d9240948c27e503fa9933a1d92ff1280df71c087fdf72dd8505682d31c9bd
MD5 14cd0779bbb616507d9d90d3dd759dc0
SHA1 949a6d694f0abf74706194b902f200ff94cd8f67
SHA512 5390d3deeb1a6f7aaeb3060cc6790f26bbd01c87c6bc47d27ee083e2aec9cd741aa62c85936a08f51ba82e3089f67d410ae74592e3c963bcb27d339fa4832899
SSDEEP 96:stA/dpaJ4b9gkJo5h16Z0ds7/x+6MhmuecJOz1ejemK+gxYE28XM1C7K:st030WondsV+FdOzQj+pG6K
TLSH
T1DFD1B5015E64797B4CCAF509BB39BB57E2F9603260D51D68F7F8462C04EA6DC6343A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 ac78df54cc134d9ed1ef35cb955eec519d915072247b586845e68ab13ba40930
MD5 05879e8aa9d19d6c923a843c9c266148
SHA1 f9c0d919e23b1e5f462242871eafc686982a69c8
SHA512 d3cb9843769559b61c43f94c2652090dd7d84d91cd94b14bf50a4542c59553df46daac6cac6239a6e794d1eb4f433a2cd7b7850ca4e559b99f7f249cc562b0e7
TLSH
T184F04F9871D10412CF2F1278B8804B56B4A92B3C196F3FCB04B0CF6E880F2E450C8921
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59aafc.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59aafc.TMP
Size 48B
SHA256 b662bc38914ab079aaa5924282094d3c52b71b4b7417ecf9e34f4e4e9be28dab
MD5 7c3c4df75370af37c921f453426f5cc0
SHA1 0b97162afacfcd26736bf51429e0528b915c1750
SHA512 7d82f2b00d5a9a38e68561bcd31fc866fa1803e58d476c70d5bdb381b63180757b2318238903ed0766b159af455a95540d0bb73959e9fd4b97e08b72450073d5
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 686B
SHA256 77589930169c5f1d845088ba14d37b3b318a0d0fd0dd9d8098a0bd99b897c8b7
MD5 13e9ff656de31a568b89c8976b7b87e1
SHA1 40713b8a94d2538c7bc8e9724c32e2d692e76e08
SHA512 ed56604b3628a4f638606814de79991b032951fa9de189f434483ae954155e0a85c8c2d3f4c3d9bfed6667ddbc81e173ad0c057ba907ced9d25f84f6cc8e6674
TLSH
T10D0194A5C7E0C67D4A5117E427347413CD3D040592287D26DDD9FBE59BD20B2E11150B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a6785.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe5a6785.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 9b26588bf7b94eada33908e6e275bbcf9ae3ab79a494af493c08fbd4e521dda5
MD5 145f20038406c2efcf8377a898765411
SHA1 0a1482bfd10d96aaf4d5744452f5a641cb1f4622
SHA512 c21016b39bc0dc99ef18a78a02baf86b483782e35f6d571d9bad2f12767af36374f8788ad59ede9e36220131b5beee49b77d1373b58507924642a996786b0962
SSDEEP 96:stA/dpaAG4b9gkJo5h16Z0ds7/x+6MhmuecJOz1ejemK+gxYQl28XM1C7K:st03qWondsV+FdOzQj+1G6K
TLSH
T152D1A5015E64797B4CC6E509BB397B53E2F9607260D51E58F7FC4A2C04EA6DC624390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 5dc83167077271c262db8166120107b9be64f5305af51bd65b5f0be0513f6af8
MD5 b1a488d6a0882018252095b549e628a5
SHA1 87725f505a656f2396176474466ca1e7a59ffec1
SHA512 753527683358a1757fd26f93f46ea170ecbd4b8c4fbf7364f5fb7d2370350e3491bdd714b3fd8715f707906595b49c20a9a579630dd7d7ae1db90c850512829e
TLSH
T15C5195326D61AB3789B357067D4B3F238E798162AA522F10E5DC1B0C00C765C6782C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 3d349b11847009bb6aa76e10859a3eeeefeffa4d040074df771146da846cfc3b
MD5 d63efe548cab54084b9e3054af5d5d32
SHA1 a267df44a5d65929bf79cbcb45ac896c68c0bb7c
SHA512 f7937f94480aed5c15f62473ce0a4070760752a5489a4b83d01fbf4a9409965c6a98d0f99f9244e28c934cf7b3a2aa1c385e7b4e175e02d9ff03bb2ac6d1e175
TLSH
T11861A6366DB0AA2B4DB39B067D863B12ABA98123E5813F65D5EC1F0C01C779C1382C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 15KB
SHA256 5c92fe2020403cd992cf3a7a97eb27ef79d617ab8999bb99fa19117c5567b418
MD5 82afc42e35bafa72970b3afc0ef0cb67
SHA1 ee5f76689280c945a7327adf87ea2eb9c0d0619a
SHA512 a6aaf75a68cf133f6e0f847fe3f199fa74d44d11c27faa48f355393df728cc316e46b07b7491b602b938b25f07c28939e3aa50fd430b57ade0616ea243000410
SSDEEP 384:F+aQikB+z/xvxjg/qhEwNBScyDnsUn9OlNAVdpeqk9zW:Q/UxvxjgC+QU6NUeqkFW
TLSH
T192729F2759797E23A5F3FA157D4D078BCBB884B254C16EB88AAD6F0D06C73E80342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594e84.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe594e84.TMP
Size 1KB
SHA256 deeb6c786a8898443fd9c33064e5d5b7f41d8ce9b6086184d16401fcf6411f5e
MD5 4f6103cd93a5b2b1fb2671584a91f08f
SHA1 c36bc01b8e4396c5782260d8a7f0015fdc36b7f6
SHA512 416e65938f0fab7181c01b7f3ccb1a57db3c5712ddcf44cc02b19ba449ee59193fa59eb69cf055b7d9e22187c6234c62c294558a94b12f860f75e262cf95b2fe
TLSH
T1792184B2A9F06F33AD52234B35077A575E748027D1404F00F1ED1B1C459724CEAA3C36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/476-245-0x000001D380BA0000-0x000001D380D39000-memory.dmp

Download

memory/476-26-0x00007FFC4BD30000-0x00007FFC4BD31000-memory.dmp

Download

memory/2972-329-0x0000022993A60000-0x0000022993A61000-memory.dmp

Download

memory/2972-330-0x0000022993A60000-0x0000022993A61000-memory.dmp

Download

memory/2972-332-0x0000022993A60000-0x0000022993A61000-memory.dmp

Download

memory/2972-328-0x0000022993A60000-0x0000022993A61000-memory.dmp

Download

memory/2972-331-0x0000022993A60000-0x0000022993A61000-memory.dmp

Download

memory/2972-333-0x0000022993A60000-0x0000022993A61000-memory.dmp

Download

memory/2972-324-0x0000022993A60000-0x0000022993A61000-memory.dmp

Download

memory/2972-322-0x0000022993A60000-0x0000022993A61000-memory.dmp

Download

memory/4564-89-0x00007FFC4BD30000-0x00007FFC4BD31000-memory.dmp

Download

memory/5884-170-0x000002977C4F0000-0x000002977C4F1000-memory.dmp

Download

memory/5884-164-0x000002977C370000-0x000002977C371000-memory.dmp

Download

memory/5884-165-0x000002977C490000-0x000002977C491000-memory.dmp

Download

memory/5884-166-0x000002977C4A0000-0x000002977C4A1000-memory.dmp

Download

memory/5884-167-0x000002977C4B0000-0x000002977C4B1000-memory.dmp

Download

memory/5884-168-0x000002977C4C0000-0x000002977C4C1000-memory.dmp

Download