35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7

Resubmissions

22/08/2026, 03:59

260822-ekb9vaep8y8

05/08/2026, 11:13

260805-nbes2sem5x8

05/08/2026, 10:50

260805-mxpppszvgv7

Analysis

max time kernel
901s
max time network
792s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 16.5MB
Sample260805-mxpppszvgv
SHA256 35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7
MD5 411e27893f6e210f32cea7e28662adb2
SHA1 2c1f7771a8e24691bc39f7bf17609fa9cf628e2e
SHA512 1528111cc2a8313ccae7ec49c7b7ad911c0603ff4583a2fd19810dbf808142182628d0441baa0ffd42cb78f17a3f11e914b50f9595cf422d357771a4862622e6
SSDEEP 196608:GVXku+QMSrEM6IJZCsQdYXK7lDJl2zRwRLKAyWMsSt3K+zdY4HciDnzjW:MXkZXC/QdYXKoz0mAAsgrzCkXzj
TLSH
T12B07AD43F66280F8C16AC074935A6232FB31BC4907357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4240	Nexomia.exe
5296	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3000	tasklist.exe
6924	tasklist.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1810229397\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1083433423\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_458299892\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_458299892\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_559269404\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Mu\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_460387805\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_460387805\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_672446703\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_801698793\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_460387805\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_672446703\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Mu\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Sigma\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_460387805\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_559269404\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Mu\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_458299892\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Sigma\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_460387805\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_460387805\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1083433423\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Sigma\Cryptomining	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_460387805\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_559269404\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1848308082\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_672446703\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_672446703\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Mu\Analytics	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Sigma\Content	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_778503126\surnames.txt	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1168	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
1844	timeout.exe
936	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
1452	Nexomia.exe
4240	Nexomia.exe
4240	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3144	msedgewebview2.exe
6892	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	tasklist.exe
Token: SeDebugPrivilege	6924	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1452	Nexomia.exe
4240	Nexomia.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 3144	1452	Nexomia.exe	91
PID 3144 wrote to memory of 6352	3144	msedgewebview2.exe	92
PID 3144 wrote to memory of 1536	3144	msedgewebview2.exe	93
PID 3144 wrote to memory of 1536	3144	msedgewebview2.exe	93
PID 3144 wrote to memory of 1536	3144	msedgewebview2.exe	93
PID 3144 wrote to memory of 1536	3144	msedgewebview2.exe	93
PID 3144 wrote to memory of 4536	3144	msedgewebview2.exe	94
PID 3144 wrote to memory of 5540	3144	msedgewebview2.exe	95
PID 3144 wrote to memory of 5540	3144	msedgewebview2.exe	95
PID 3144 wrote to memory of 5540	3144	msedgewebview2.exe	95
PID 3144 wrote to memory of 52	3144	msedgewebview2.exe	96
PID 3144 wrote to memory of 52	3144	msedgewebview2.exe	96
PID 3144 wrote to memory of 52	3144	msedgewebview2.exe	96
PID 3144 wrote to memory of 52	3144	msedgewebview2.exe	96
PID 3144 wrote to memory of 52	3144	msedgewebview2.exe	96
PID 1452 wrote to memory of 1168	1452	Nexomia.exe	97
PID 1168 wrote to memory of 3000	1168	cmd.exe	99
PID 1168 wrote to memory of 3900	1168	cmd.exe	100
PID 1168 wrote to memory of 1844	1168	cmd.exe	101
PID 1168 wrote to memory of 6924	1168	cmd.exe	102
PID 1168 wrote to memory of 6032	1168	cmd.exe	103
PID 1168 wrote to memory of 4240	1168	cmd.exe	104
PID 1168 wrote to memory of 936	1168	cmd.exe	105
PID 4240 wrote to memory of 6892	4240	Nexomia.exe	106
PID 6892 wrote to memory of 5320	6892	msedgewebview2.exe	107
PID 6892 wrote to memory of 2352	6892	msedgewebview2.exe	108
PID 6892 wrote to memory of 2352	6892	msedgewebview2.exe	108
PID 6892 wrote to memory of 2352	6892	msedgewebview2.exe	108
PID 6892 wrote to memory of 2352	6892	msedgewebview2.exe	108
PID 6892 wrote to memory of 844	6892	msedgewebview2.exe	109
PID 6892 wrote to memory of 3352	6892	msedgewebview2.exe	110
PID 6892 wrote to memory of 3352	6892	msedgewebview2.exe	110
PID 6892 wrote to memory of 3352	6892	msedgewebview2.exe	110
PID 6892 wrote to memory of 4616	6892	msedgewebview2.exe	111
PID 6892 wrote to memory of 4616	6892	msedgewebview2.exe	111
PID 6892 wrote to memory of 4616	6892	msedgewebview2.exe	111
PID 6892 wrote to memory of 4616	6892	msedgewebview2.exe	111
PID 6892 wrote to memory of 4616	6892	msedgewebview2.exe	111
PID 4240 wrote to memory of 5296	4240	Nexomia.exe	112
PID 6892 wrote to memory of 2900	6892	msedgewebview2.exe	116
PID 6892 wrote to memory of 2900	6892	msedgewebview2.exe	116
PID 6892 wrote to memory of 2900	6892	msedgewebview2.exe	116
PID 6892 wrote to memory of 4852	6892	msedgewebview2.exe	117
PID 6892 wrote to memory of 4852	6892	msedgewebview2.exe	117
PID 6892 wrote to memory of 4852	6892	msedgewebview2.exe	117
PID 6892 wrote to memory of 6500	6892	msedgewebview2.exe	118
PID 6892 wrote to memory of 6500	6892	msedgewebview2.exe	118
PID 6892 wrote to memory of 6500	6892	msedgewebview2.exe	118
PID 6892 wrote to memory of 5360	6892	msedgewebview2.exe	119
PID 6892 wrote to memory of 4780	6892	msedgewebview2.exe	120
PID 6892 wrote to memory of 4780	6892	msedgewebview2.exe	120
PID 6892 wrote to memory of 4780	6892	msedgewebview2.exe	120
PID 6892 wrote to memory of 1552	6892	msedgewebview2.exe	121
PID 6892 wrote to memory of 1552	6892	msedgewebview2.exe	121
PID 6892 wrote to memory of 1552	6892	msedgewebview2.exe	121
PID 6892 wrote to memory of 1604	6892	msedgewebview2.exe	122
PID 6892 wrote to memory of 1604	6892	msedgewebview2.exe	122
PID 6892 wrote to memory of 1604	6892	msedgewebview2.exe	122
PID 6892 wrote to memory of 7160	6892	msedgewebview2.exe	123
PID 6892 wrote to memory of 7160	6892	msedgewebview2.exe	123
PID 6892 wrote to memory of 7160	6892	msedgewebview2.exe	123
PID 6892 wrote to memory of 2968	6892	msedgewebview2.exe	130
PID 6892 wrote to memory of 2968	6892	msedgewebview2.exe	130
PID 6892 wrote to memory of 2968	6892	msedgewebview2.exe	130

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1452.6476.7625525025392464598 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffbbac85fd8,0x7ffbbac85fe4,0x7ffbbac85ff0
    3⤵
    PID:6352
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1856 --field-trial-handle=1848,i,8033137367318461473,1581651710246379164,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:1536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=1848,i,8033137367318461473,1581651710246379164,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1848,i,8033137367318461473,1581651710246379164,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3336 --field-trial-handle=1848,i,8033137367318461473,1581651710246379164,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:52
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1168
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3000
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:3900
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1844
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:6924
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:6032
- - C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4240.1436.12013812061298529143 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:6892
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1cc,0x7ffbbac85fd8,0x7ffbbac85fe4,0x7ffbbac85ff0
        5⤵
        
        PID:5320
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1744 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:2352
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1924 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:844
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2400 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:3352
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3484 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
        5⤵
        
        PID:4616
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3364 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:2900
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:4852
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=832 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:6500
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4640 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:5360
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=964 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:4780
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4560 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:1552
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4468 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:1604
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3388 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:7160
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=3972 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:2968
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4604 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:3428
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4060 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4020 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:4360
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4288 --field-trial-handle=1748,i,2761917880600193612,7334291290466361942,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:4448
  - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp
      4⤵
      Executes dropped EXE
      PID:5296
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5664

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:6328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\Nexomia.exe
Size 16.5MB
SHA256 6978cc2b0e0beee5d68f7cb4438ebfd04403fa7166390771c6596ac953af4b59
MD5 1fd4cd395b2aa5a4fa3f839d021920c5
SHA1 7c1a54fcc437d7b423db7ada98bd3119f338242a
SHA512 edcfb00b72345608a9d9b979067e00824a147f71811f212a9f3f8b0b69ac7a0c9aa01228a264598589f425d18537a17db9ca7db0cd4d4bf74d3c1ab1038b2a26
SSDEEP 196608:hVCzDy/Ok1LwsdOJSkUgEqStKszfxKb+zdY4HciD1KK7lDJI/PoaYGMOwSWb:DCzO1YSkP1gvzfRzCklKK7aYGMOwS
TLSH
T1EB07AD43F66280F8C16AC074835A6232FB31BC4947357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat
Size 532B
SHA256 ed38812e0842092c5151a9a3f764a3d6a211aa667e20e69c0e51173b14fc2a32
MD5 179a1a9d55c426b7d0e6d3a01f72f514
SHA1 7de19f747badcdff65627c4dd6cac5a3341ccd59
SHA512 f6c584ae77a464408806528ff73b341f18766c7664c57df37acbbd50eaf295da4eaa51776ae49f945dcc4160f69ebe56736db16b4910ecf95e35f717be93f23c
TLSH
T123F05038891A06B500645A99CF5E3544D5FEDA4FA79D7AC014C0D68D366F18A1E873C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 76df212c337aba281e1a5af52a1b4e4f584a455eadc6a79c523445b4f94f771c
MD5 35e38a51bc4e74b251393ffc1e5c03de
SHA1 d8192db186d44a3bca5babe43d7c3b36f3f34962
SHA512 edf1806ecf6d92699a7c3067727e6c775eb91cb60db6a5fa96930c539c35807947fa51f046f123a90177d9bfccbeeed1bb49a2fc231af59b2496109d9f0543c4
TLSH
T115D0121333410538C01121332443A38C0801C90F40058200A429C52D1F481900D12482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 41b7e4241924bb2f6a2c742036ba8aad372d3bcdeb9b52d7c7e1e4b31722c34b
MD5 2ca3a257b34b364bd085a3bf002615a1
SHA1 b237591a8497d232fcc6ec854dc0357df207243e
SHA512 1bb1b34961aa2817e39758fb70eb8fd9aedb44fd75f15a95fa7431bac5a58f8513507b76599ac329600e3fd2af0735cb66139f210e106a91d97324a37449d426
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f60de235c778c7c006d0e9cf3c06a799ca8c68bac8d033063ca31248ec4f9aa4
MD5 7a89210115cbca9d670e7db3663cb782
SHA1 a30e4ab93ccbe45831b4d3368188196569fcc5ed
SHA512 c35e40c1f5461251f2d353790434e4ec38b14a8142c0d8730a86318c27e2cc56a4657d41c94c28fe645576e7b92134629fdde6fd0699d5e0b0ec7300a0184a12
TLSH
T1CAD0121337410138C01122332403A38C0901C80E41058300A429C53D1F491900D12482
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 d5a4e093c68801cfc8433d4e597c2947577a14b6478d0b5c13b1ddce6e2ef101
MD5 0d22ab361c27a4010bbcf31e7743be3b
SHA1 f94d5eb46a34a83226ee80479b433c2a334dc1ca
SHA512 6b336f8e5e51b5bef866201c4f6be918032097bf3c682b00910456e9833199429629711b1633d18befff62e9257f6977afed223030ba54c939d17e5833283387
SSDEEP 3:MsFl9tlGallOFTKIK6//+flExLKSkMszkdE6Z89a7554Slll:/F3XGuUpWNEx/8s55l
TLSH
T1821392FC58801E7AE584487D1E97B3368AB49481DA8B4363B0EC3F2EE4557D9005A42C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d3aa5cc203454eadaefe03a6ef82d2e47313e1150753f5e7f091cab716252f26
MD5 216dd1645618d77c38d7fa5b3ced684c
SHA1 4d2a6e2cb5ba35ac79936a5061d287bc05d3ffb7
SHA512 3973f1dc0d3b355304c133cef2e50a1d097ea9b4fda0fb201fac531ba7b2883bb02e844cdd407f21955787f51e7bd773ee5df3a71328918dbfb83cfcdf9e5e90
SSDEEP 12:U/skKZaVKU9kTGLBDDSuHNB9kTG68y8ShqN1pV9kTGLA:aqGLBkG6ap+GLA
TLSH
T1CC4426CE8F05F006CB7816F6A7B9E83D863B12D01499B605F9E0480199917ED2C6071C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 5b8def8e486d5cf69f05bf3a42be3a8a762d78be6008a16219135380f5e39935
MD5 ef7ed52a4cb87a33b2f21d314f505eb3
SHA1 c99a68c82fc56dff7950d5082480ca80a4ed51ce
SHA512 9f510739ae94e40634c60cab6a87028cbfb74d0cde9b5a77a96d3d9a9240992b8d8bcb8a5cd3b89fb26d3aa0b9bf4bfe7865c6e2ce789b2da76112da648222be
SSDEEP 192:oaVan9b+FqtnPan9b+FqtJv6han9b+Fqt:oBn9b+Fhn9b+Fzwn9b+F
TLSH
T10B250AD52F34A6A2DBE2EE30BED1C41A2FF81086AFD6F0535586C76910C3BC61E5524E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 7e284356b9c2538890ceeb582b9c7ee2f727c147be0c7914d9d53324bcc37456
MD5 f27c1c9703e5aa0b01ce500bbd608964
SHA1 282a12df796ae360798c29e402898e70d9f87b09
SHA512 3e35ca5853394444584080e101bc06b5223d6ef5dcd4573b8250ecf4dc5612517ac114d75c6d487eb7f58d8f820e92d76e2dbe3083222f13e062abb36859d4d2
SSDEEP 192:wE3q7kQuQKYTAOC4ck5ygVleuHi6u2pUtlIhcFgmwG7rhlfVCPJxtT8pEC/T:J3q7luI8OC4PygPH+2p1ZOrhlfVClTv
TLSH
T1A816C097617F3461EF9E1EF13E14BB214052BC68A48A53A448823A29D7D17C2CB6E768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000001
Size 17KB
SHA256 aa62be4b0740c463cef75abbc29482e33ab9c91c75d8aedabe63264cadcc4d12
MD5 d332bb6ee1ab608975ee5f769b6fc4e5
SHA1 1dd7f35cf3da01f6409d011179b41c43925cae6b
SHA512 572a6a8886f97e848fde95285d81137cbd32fba1501566a5d2e95c34a2684cb17b21be75b91d6bac5da0313fba3406f7c835c0d45afab676c3e995f3011da79f
SSDEEP 384:6Y9YCcLTuYTNqgOpRdzVDEhf8yUK5lL7CuiIrXWNn2Ut:68YCaTNqgOTXDWLv5FfX+d
TLSH
T11382E19D68A599E0E0548716B217EBEE03770EC15F13940080E4EDB787475FDAB1F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000002
Size 31KB
SHA256 28af44cd3766699962d197f103d31ba2e1bf48f4eb942ed1283755167dcd4c30
MD5 26e562fc6595c461cead42c79310e4cd
SHA1 f31f15822a1cbcb6d4d26d14a5a21d1334ce5f0d
SHA512 626f750f7876c741aec07b40035c3dc21584b2cb080ff398a610ba1176c42a1b02cdfcc9dd4d2d9143aaf3df8a5b4accb2ad4d261ed3ea2c20f7193f23b8a511
SSDEEP 768:0SHPcUru0CvXdkb3DYST0+YRQVcewqHa19iVy:0SHPcX0Cv4cST0+YRQ53Ha19z
TLSH
T129E2F1EA1390F5BB374EA2161226C4BC91C11F9E2DB7B72E8BB31B54B07140225395A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 6168281efd086898d951b8dd4f47981e711b72be2b5ee17fbf2ae3b02dff4db2
MD5 126385232594cf794d227223f0f2d9cb
SHA1 96704eae1f70c3f1ea7c43f47babae1d3c79a0fb
SHA512 5e3cf108b7ec6fc36ddcea4907dc24b34295e66273c9ea5394ffb02839413e7dd9d08ccdc944d03a702857b368e4fd2c3f776b81fba996559fbbc8ca9ff57495
SSDEEP 3:LsFlklNllkll/lOk6klW911PlXlmNtlAl:Lsk3lEtOkfN
TLSH
T1FB44016D179A0C1AE9D102BC84C793751328C401860BC3530344032118827900E4D040
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03ae38ee19e172a6_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\03ae38ee19e172a6_0
Size 275B
SHA256 d6e01743361172f5a2789bf37c3d74b5d1beb639a9c55e5037975984e77a8555
MD5 9833646395a2acb9a4db901bd077c100
SHA1 6b84ada8a92997d7f58995e3476b658c90622e1b
SHA512 4cab9dc93d7febbfa95bab7913f6539b434ec6153d388b45bb87c8bec3bc208c6383d832ea9e45b8ea3ae7c4d6f1a26f515f28ff0ac9faa7634e9c998e185bd2
TLSH
T164D095CF8E68C100E1895CFCCFE5524BE343D0F00469510C600CD545C3902187285311
MD5 SHA1 SHA512 TLSH

Submit Download

09f4703a13aac448_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\09f4703a13aac448_0
Size 258B
SHA256 f06421a2801c07557b884a7aec781c0dc796bbd153ba284e0f72ee632590e9b5
MD5 71dd1685bd46b7e78d454b883737234f
SHA1 fa09118532e93d18f5a2c445e0b451f2076748da
SHA512 9a07c0792687a4d68edfe7fb3e2b7b89b642c665162fdad691895a4e574487e58b9ddf6e3ed20cda9951463aac30ae1815b1b506fe9a0fef1666802b848a7fe7
TLSH
T1A4D0A78FC6A2818CC7AE95F2CBDDCE0F9767A0F4159B89518012FE1263D127975343C1
MD5 SHA1 SHA512 TLSH

Submit Download

0ac4c2e70312a0ee_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0ac4c2e70312a0ee_0
Size 279B
SHA256 8f1b7e6fd377f4ba498298ece47d153729bcfa8b618210f580a13a3c1b309423
MD5 2ed13d039660a80b16939dabbb947430
SHA1 36d49685fdbcb00bb0c249ce8e095ff631af816a
SHA512 b58ea1d2d5089520b3f63078c79abced179e6a01c01d420c1c119b94b1f2cb911f4a15bdff153165abd3626e6138c6e895524e7eabcd7f92a6137a542b307cc8
TLSH
T1F0D095DFC0405745C5AE95F08AD6CD0D431791E330FDD473A004E85234517383D14316
MD5 SHA1 SHA512 TLSH

Submit Download

0bb15a86094610e7_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0bb15a86094610e7_0
Size 266B
SHA256 68dab5ec327c73cc2240c03c4443f17b7f963231a01d469e0b916b75e20b98fc
MD5 f6ee7a8d0a5a9e969dce72ae59556e88
SHA1 656de2dcb6f570e25ef433c2b88948f7242d0bdd
SHA512 1970acb09a36aca2f6c510e4c842a753e1c449c7e5541f7451ab0bf3c14706bdb0ba2247dc2aad2bc48ffc5d55326b5541601b383700a8024f26b79c14a1ffe7
TLSH
T135D0A7CF0D10D529C39589F08BBE4D8A87A352F5189894214854E99561C2979F669206
MD5 SHA1 SHA512 TLSH

Submit Download

1a427df813dcfaae_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\1a427df813dcfaae_0
Size 267B
SHA256 839ba3406e0ac578f8cefd30c7256a5d088ffea3380a6e9f6ec48c0ab6f2d483
MD5 d545c646344a393df4ac4e99273721e2
SHA1 a8d44ce5a9db7ad2104c41fcef45120edd9ec4fd
SHA512 85c35074d4d5f8a20883ae82aede7e30dc7e811740c5539239ccb4fe097eac72e5c49ec832bc71111c79bd901e427073e67ecd3083597ee0c1fcfc1a13e00db5
TLSH
T14DD095CF0A791754CFB9B7F7CFEF8E8F435240D015599C020058DD03704067C2111210
MD5 SHA1 SHA512 TLSH

Submit Download

328cff54b1aaf628_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\328cff54b1aaf628_0
Size 270B
SHA256 03a76384b21d6dc3e624913568bac7152a21220124962c1ca0ff9e479b2a9742
MD5 492c7872fed4a0be6148bd30a3125c40
SHA1 db59c6757208216603c514f76b0e4037207a4b44
SHA512 2e8d26b60df7570131c7161ccffc3795ded541a17ebbec130236e186340c5c3f60c6bf8ba34d2ae6fef02f311e06e6ad49b4bd5439e672cb8e211a2802f149e5
TLSH
T1AAD02BCF49418604D58608F7DB7B9A0B538311A0209554511860DC5300826A4667479C
MD5 SHA1 SHA512 TLSH

Submit Download

39a65d4ef01580b9_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\39a65d4ef01580b9_0
Size 275B
SHA256 7abdd2ec507dd332480262701290d983555d18191c3724f0cc5e097b77c64948
MD5 f432695c77bb146d20758becc1197d29
SHA1 7283a2bf3283550051509f6ac5c662dd9503b928
SHA512 b700e7f78358838a4b66281abb4a36fd9e2f81491b7ccbc83d84a46bfaac833a8569a9fa5a44a9134c31786d9bbd9c49d5c1cd1b35d09de84326d4c88325b668
TLSH
T100D02B8F85786484D55089F4C7EF495AC72E40F0149D60296041E4D1318061C1119304
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 2813543e1ab33389ade3fd4e9666a16d772382e6fa9486ba6eae4a29bd65f27d
MD5 84c8ac319f58e75c88604be164d013e2
SHA1 7aeb45df06bc4dc6c96b12784c607f2d6938daa3
SHA512 e9d8e6bbb03108b7f95a7f2f2bcf90b53a1c80bd48beb2281f435bc4fd5ea6bfe978d5fbea75e04fa154d2dcd97dea3ba3df1f1994541fa8274a258648cc8f31
TLSH
T11DF094C61080266CDFCD90F02CDE0E8735B9B95038830FC701E9C3B1040F3EB8881968
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ca79d153d8af19127ae281242b4a2a30d752cc0f4d3d7141526bcab5da20c3aa
MD5 364ac0affa49b1a091be5e8995bf91fc
SHA1 3ff664ce11a4c6e2202cdbeb3ccc09990d00e246
SHA512 e3c5e8077a6d20ed5fcf36481adf959328ccf2070bedfba7938d420958d65b9e216325a9434a2e7a406479a5d3d72f3ec1995d168b510d54df9bbedc858287e0
TLSH
T19321CAC9418A1ABDDB9C91B66ECD4FB335B4E55038430FC603DCC3B5440B7ABA551968
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bffb.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59bffb.TMP
Size 48B
SHA256 3dbeac509412465f7ee55e85a521d457003e80de7948169412e7dcbbfd711330
MD5 d16ee2d9bfec78fbf171db368712243b
SHA1 de4ff47b8497b606a47a9eca4af796da9887b59e
SHA512 596c1b76af1aa7439f3048d22a1cbdbbdbaa5698609ec3e37f7c412c89ae756bbefb955f189318314cc8920d2c49d197bf5526bf09382d1bf75b7f339ed6c4fe
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\History
Size 164KB
SHA256 6c033d73386afa33baafa1c3580eaa2c5735063b70e65bfbe06b988920f8a86b
MD5 e194a4466f8ea97f854d9079f8ad5be2
SHA1 e5816d6d02099bdf84d95066d55e816b74327b32
SHA512 b4fc781ac4b1b7db9597fcc087f6c071eebf807b6b941c426c384af520cd5ac866024a05ad1182b25351e768099dbeaeaded5180a294385be26f7d224291bc20
SSDEEP 192:8BF5qL/tH+bF+UI3iWGVzWNVVV63a0gfqV:iF5qL/tIkUI3ijVzWNAK0gfqV
TLSH
T15CF30A2E5F243211CDBE917A68E749A35D7DF03F872366C66C6104B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 559B
SHA256 02deabcdb82f44b6d09f4960255091dbea5147e4585bd75d9a64d4e20882e317
MD5 604202b7fb081f605dc792f92b93ebea
SHA1 4eedf3555e1e428a6ae3833ab91959bd6a66a202
SHA512 5aa7ac856d22ab612c50054f1d46ef8fd6cef6115459e314226acbdc8e88427abb16c117f8c513a7599db5997f354bc7df5eca566cef851fed0bf1def8e60880
TLSH
T14CF02091C6D0C27E8A5113E02B307413C83E0409A1387D27EDEEFBEAD7E10B9E12110B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 686B
SHA256 cd734ccb420cb074de62e3639d7ff3317b973507980f49bd745bbf1756941c42
MD5 e0258fc37bdbe5250ff43a34506d328d
SHA1 96c9e830645cd247a3361e9178b47bc9481eda76
SHA512 251dcc255d46175b60a383a54ee6379c3b1cf6ecfed0b9bca6cd1b8ce6d2f33d6a52c8df22a8232a4dccedc3039e6fd3415ab84e29a643959c0eeffe4765b737
TLSH
T14C01F4A187E0C57D4B5117E427347413CC3D041592287D27DDDAFBE597D2076E11150B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59c078.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe59c078.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 6a20bbd9e85374b1bf20ad9bca3d46ee10825419ce77032f2b2948e12aafeb49
MD5 118c125e622a7c6ebe9fbbe899723735
SHA1 c0b5e772ad1705a07087e04008d0e7f940bb5006
SHA512 ec457fd1292e85f3ed8628f043afda7fba81838c3b10b2059c869e32eed0e005ef428661bcb4f200c3ee7f76db1222ac25d448f9e22902ed14d651b17f619be0
SSDEEP 48:T0IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBeqE:YIEumQv8m1ccnvS6hWaWnfH
TLSH
T1A9F2CBDE0B19B644C0E4A534E6D449C7BD2E002E8B95EF996EE946F1FF421F2B938205
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 99b85ed14e6bde7e4cca9e1bdc22abc04848ed3ba1b77d6dd1606f59da45f2bf
MD5 a2c91a7f010d98681dfc51adf6f6cae8
SHA1 d3d1bfafe1d0e17d261ef219fe1e600d8e513271
SHA512 6d897468052f9764992461efb6067b5d440597e8a8d3ecc371e6932d41874bbb413e69100826753350015c0188bb844767e7fcdfa445c80ede55772a5d984f23
TLSH
T150C01262447AE47610680A251D84ADC59F77A53B014168E8D752466890505EB575305B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 1e554b65c162e9a73b13300f9052b532bf3c372d963e491f6c406a7e4c8f995d
MD5 0122e936dbfdffcc5050ddd99e7091f1
SHA1 83a2a28c69529a58618c416699c353b19af05731
SHA512 8022dc675b88e7276c9f5df74b00fb9125849615efbb87569909dca913f715f0612c32ae1e03a3830ec2a710c5dbb5c643b9a378f523ae9ec3c9bf95ab260a00
TLSH
T14DE02063457EF4775078072BBA847D055975F13E414678F4CBA743BDB1550F35542013
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 7528814c35924faeb1e36b8362c67a65118aa0a90c9d5825f46d7b6d2859504c
MD5 feecdd72dd4963281b7c17b550471a36
SHA1 d392a6312a03dbf5871c0361886e292e4adbcfe9
SHA512 e11b727f88fd235da6eceb83e0278641c634f265687d70e684ba6cda3bd4bd0f3bb0710963fb341857e5cdaa64d799e2831f93418d7c99925d8ffa13e6d73a2e
SSDEEP 96:rx/dpBJjb9vk+Udo616Z08s7/x+6MhmuecJXt1ejeZK+gmlI8XM1C7K:rl3VOo68sV+FdXtQjDMg6K
TLSH
T141D1B6015E24B97B4CC6E108BA39BB17E2F9512275D52E58E7F8862C05DB6DD730780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 e6bf427802f582a65667a8221b36de28759b331576aac108899523632ef5b6d6
MD5 51642a08fe8604776f4bc2b97c486a3e
SHA1 a07d76f84c7da22f9fb6b5505da90f9a5101ef4d
SHA512 5679e8eaa3554734c629441cd784eb9a9b299683c8a9b765507a5b9bed0794383d2c2577b54de016b8bcf9b0b44b7d771cdf6c72ac6b13a2c7845e3065d379d3
SSDEEP 96:stx/dpBJWbDvk+Udo5h16Z0zs7/x+6MhmuecJflMkkjeZK+gef28XM1C7K:stl3mOonzsV+FdflwjDWG6K
TLSH
T181D1A5015E24B93B4CC7E109FA39BA17E2F9502234D51E98EBF88A2C05DB6DC730390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 c9b48f01561483eeb117dcd1fbff3d005550fec1555aa4668c2fd9989af89a87
MD5 5cb9054f94db632efa429c600c134db2
SHA1 316713bc60b3b317748268b6e738875badc3025d
SHA512 bc0a045027578f4f77599bffb78c942db9af53a96c9d459382596a60a109e2150c035cf9a9b68fb3725cc295027dfd19f1ae4cd9fc79865c5f835b659e8e3a91
SSDEEP 96:stx/dpBAGWbDvk+Udo5h16Z0zs7/x+6MhmuecJflMkkjeZK+gSI28XM1C7K:stl3wOonzsV+FdflwjD9G6K
TLSH
T1E6E194015A24793B4CC7E519FA79BB17E2F9602264D02E58EBF89A2C05DB6DC730390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c00a.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe59c00a.TMP
Size 5KB
SHA256 bac62a5270e2a34a874df6ffae4e3927ee837e154a7fc80c060034ecdf4cb42a
MD5 b93a2969a762ab3d4654d5a98c814ec9
SHA1 c5c43961d3865b16f794030ca381d71529e7d971
SHA512 08e73b863dc5e07a19d7ff832a3e9cda9ce462847574940a46e3bdf516ad4e82ec623a8dd64e665b2fb02a886334f0f9cda71616a4e389bc4d78d3d3b3c3d262
SSDEEP 96:rx/dpBJjb9vkEdo616Z08s7/x+6MhmuecJXt1ejeZK+gJ28XM1C7K:rl3Vjo68sV+FdXtQjDzG6K
TLSH
T188C1B5025E28797B4CC6F108BA39BA1BE2F9513265D52E98E7F8862C04DB5DD7307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 0af077a9c82ecd8543402f594bfffaf97f8b9e01bbc7ddd371c20417e3e207bd
MD5 0014506ad5c5d04c0c1fe425400dcbd6
SHA1 456b702a1070cba13e5108bec131b63bdb244d2a
SHA512 c321de0bd7870e8bc70c34d5c5b857391fd30e40fb747624f6ffa63677c7975be324ae2cba9b47aaf25a732d2e18b03e34ce5eeabd95aaed35c034f284ad3a6e
SSDEEP 96:v/iNPlf/ROo1pkF5d1MiB7VaTEv9V5h5pg5+e0dcbwu4x+qAkDXIm9IiW:ytvgn9lKi1AkD44E
TLSH
T100C1B7A3092D8575EF444BEBDC3C7ACF98AA01DF99C9481696E6C58C02C2EFC21DE495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 cae3d74e3c835de251a7195c17432a5b3b6f499c7f45edfb450e72c9ccc036c1
MD5 a95043c8e5824fb396cdd0e8eabc6965
SHA1 3b2747b696f1bb3d530ca335e3cedf4b4d8283c5
SHA512 e5d6ee9e072981d0186702f829b0773ea0b294906c6d1c3dbeedd528eddffd899868ab6fa196e3aa7889810b4b214fb49ec66d1ea51ed9128a0e86ce5ef06af1
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\LOG
Size 301B
SHA256 ab1e379b06ce3644e6f874071bcf9a4e7c528b3578e18ad052272aad7f1100f9
MD5 c4bd7ade8d2d57359ff883f1918750ea
SHA1 99be2fadf4648bb8897f8e5e7668b84cf5e2ae5f
SHA512 1d8bee0ab64d331d3d76493c92c75b6f81525327a5ffa29ea36db7bc917fe82eb2b403289201c57f12861ef0b0bac2766af30bed42acefb681c2613e8ab201b5
TLSH
T10EE0262019CA8E7F869548EF2932F30DCB61B008EDD911262E34F644250B848B002B40
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\LOG
Size 277B
SHA256 abdb31f083a06dcb68c8e515889c65d22c5aad8a4428818e2689f18dbe753606
MD5 25487458d3ab1dac34234b45876817a3
SHA1 5d6ddabb3a59b8b81e3ed7801f1dea80a84cf2cb
SHA512 509cf7e8b49ae64b130987c45b5a4fbc6d75b1d07affd2a38a3bd07bdbd271ac1d642aa10defcfaa109a9ce47cc41f936a259f4d16edc3af2a2cb1984078c927
TLSH
T13DD0C23158C98E7B8AC0C8DB9D72FB0EC3B4B808ABC5360E5F1CA944384750CF029B81
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Visited Links
Size 128KB
SHA256 bdadb8577b3441c33d0a79b66876c84a8534920758c4f8087aace98aa2cb37fc
MD5 c8ed14d11f9046c3a2b2abfea01c8c88
SHA1 88c938461b3c268e533722c4f7c435bfb511ddb8
SHA512 1ed7604e44b15159eec4468384495ad888a7437e6fca3d428a80517b5db380e62c159fbb4012199e07dfacc1b82f96a2e5e1a8ff295c673756ec6203bf3504b3
SSDEEP 3:ImtVuYyTwBctxZeX:IiVuYyTy7
TLSH
T1B1D304451501CD01D1C43C3445400FCD55F4C04D4057340DC33454C14CD0551C35F431
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 269c4a49278ed17a2a0b6db5a09765a97a043db9ff8852f3bac047bd3cd0d836
MD5 4ac875962d844e937efd760ceb08781b
SHA1 9c225c42c63e3f1f67f17a2e6b8c6f9a856f0f34
SHA512 53a4cc6defaf521ac1a9da5cb8c1c4357b08d15d83e116afa717e8181a7c00ca801e672243cce6b76807b7c110e578ec31184d1be5ae3ccd9d5b6d865f19a1e2
TLSH
T1687195326975AA374DF2D608788A3F1BAB754063E5D63FA8D6EC0F1C42DB2D91342817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 4bf0059db38ce1428a45c38d85d419065fa2095a7b58bebb4bf4df8e0a1046c5
MD5 e6bde242673b20a6a2f697d37b06b768
SHA1 cc27970f81e7c20adc1b0c056909b28d878e7cf9
SHA512 81f356525b454602933b71c6c705d60ba8c4e8024ab50d5d1e98225a6ed4f6e13807488e77b2a0cdd68a432bf47dc9ba84b44b94ea8480f5e94e941b130e0cb5
TLSH
T1158196226975A9374DF2D60978863B1BA7755023D5C63F98D6EC0F1C02D72D91382817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 72e6e8667e8eca6f9bb71470bc5690471ccecb4352b7b93363c1f24769e2ed5e
MD5 3a58351545ea57094114090ec62d04bb
SHA1 f2eaa37d3af926d627153c280bc9469cc8607d20
SHA512 26d50fbf4b09dc593aaa1593be2e07a2b479f0acd19cde2778b294bbddf696dce432e259367abc42b7764af3c4df026786ef44df425aeec71c04f0cf5a01141c
TLSH
T1A88195226875A9374DF3D60979863B1BA7B55023E5C63FA8D6EC0F1C02DB3D91382817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 6b12220fb7043da67458bd5ca6ad1f1ce7d62021be516479dc2b96c3ac9e8d16
MD5 5c732cb4ff5e175012dcfafb85332fdc
SHA1 637a2594b2272c79b98866ba66aa796a5598408a
SHA512 ea44620db960b393c409f068565b10526469cd93415aaa7fc487b09e101a2f961d82bcd207d37a7ec4c8e0591fc5b69e1fad63f2b412bb24ab6ef8163a856f9b
TLSH
T18751A7335825AB378DF29708784ABF6B8E3951919A931F60E6DD4F1C01DB29C2343837
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 aa595f3b0a168c5f25c4a7885166d42eac6c920e9db7a823584260d37d44eedb
MD5 92923b19c71c67ce29d86014dd46dd28
SHA1 870323bc3b9a2cda3556ca0a1987007363c61cc2
SHA512 522c2ff7e19ec5569b61c33ec3c8065ab516b94512d7eae4ec04f33062fadcff96e0664b657a88e78732ec8a02c9f16e94b02ccbff3c49546e4e837b33056033
TLSH
T1E06187325975A9374DF2DB04788A7B1AAB755123E5D63FA4D6EC0F1C01D73D82342817
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 51c39ff8315689b0257c5e47397f524f2295a7398c64b8d394ca303dc7d6977b
MD5 34de75606d0b5b1124ea01e5af57c374
SHA1 14ca8c4c5f2f0adf2ecc2d66dd033dcd0e23ca0f
SHA512 ef02e14c7c2c3f8c7c9e18e53f7e6e812c02001cfff4863145f16318cb026eeb1df1770b53988d176e6178b11ac1fd49e6275037f6b98bef6fd1f57377b104fc
SSDEEP 384:p+aQikB+z/xvxjg/qhEp3NBSg8dHF2h8K7O9z7:U/UxvxjgC+pkRFO7OF7
TLSH
T185729F2B58697E37A5F3E615795D1B9FCBFC946250C22EB88AE95F0D02C73E81342812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 945118efddb5ac6c0ad9633e05c196022583a4895c2d14007bcdfa82c1010a17
MD5 b985ff8622623fc2cffb894c51c1e9dd
SHA1 aa2e481c5f973463638d92c23f76f0d3faf12342
SHA512 bda38e827ac54b3bf6aa80a46d5bf0978bfc0abd2b31537d6d71bfac0ca4e5d133e6efce53a9c7b0aa69d0178dc4ba5040e36ec9c639629a0c4c4bf1908836ed
SSDEEP 384:M+aQikB+z/xvxjg/qhEp3NBSg8dHF2h8K7O9z7:r/UxvxjgC+pkRFO7OF7
TLSH
T145729E2A58697E37A5F3E615795D1B9FCBFC946250C22EB88AE95F0D02C73E81342812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe597aa5.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe597aa5.TMP
Size 1KB
SHA256 4e50cd1332415ffdeee63f2521413ac50f9213c64a027946528bcc111057d749
MD5 499df7ffc42b080d911f3fbcfb8dcd45
SHA1 cbdb12612849027cc4b89e28a501eef6dcc2f2cd
SHA512 295ac766303b1afd65d4b8e8dcea1afe3eda48cec74a5fe49e00ef6587d40744e385562fa6f414c30386c25aef439f9cf695037b7427d4928bf0ea360ad3b4fd
TLSH
T1C321723280255B336CA1770A3146FE9F4E3150A682920E44B2DD8B2C02E61DCA727833
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\index
Size 256KB
SHA256 d2e36fa445af6a3cdeaec24abaccc8c0015618128a414c5fa80fb054804e7257
MD5 57faa7548327bb4dcd611a680ee9b092
SHA1 4b2099b5f48530c7c24e5cbbfba9643b4a754ec7
SHA512 62d512803a1fa81d63f3cc1901a07794290f89a959356dd9c210da14c76ccd0f46ce048a57803af6fb9fd54813491de42c2b1db6f1c821689ff8e3cf83039561
SSDEEP 3:LsOllllklkXlGylll:LsUlPZll
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Variations
Size 85B
SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
MD5 bc6142469cd7dadf107be9ad87ea4753
SHA1 72a9aa05003fab742b0e4dc4c5d9eda6b9f7565c
SHA512 47d1a67a16f5dc6d50556c5296e65918f0a2fcad0e8cee5795b100fe8cd89eaf5e1fd67691e8a57af3677883a5d8f104723b1901d11845b286474c8ac56f6182
TLSH
T1F2A0120384738407E4144051C45C1341287C84570119C0012068931304240CB039643A
MD5 SHA1 SHA512 TLSH

Submit Download

Staging

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_1675003210\Mu\Staging
Size 36B
SHA256 411a706def2e70f96a507208bf80bceb93e950c4c2d671cd1ddb4134ce54b2a9
MD5 0163de1b14421d4eee3757ff76fd81e4
SHA1 96c75c4fe1e3f33a367f45293bd1bd8bff1c06f4
SHA512 80114d59db8f3654dd6821589e5ad03daa923a35610a372756a8865b3e769621e32ef2aed92c2494de2b9fc06d9796b12f1e3bb75873ed794e8c9ae8a0d5e965
MD5 SHA1 SHA512

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping6892_727182492\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/52-70-0x00007FFBDCC40000-0x00007FFBDCC41000-memory.dmp

Download

memory/1452-168-0x00000276162A0000-0x00000276162A1000-memory.dmp

Download

memory/1452-166-0x0000027616270000-0x0000027616271000-memory.dmp

Download

memory/1452-170-0x00000276162D0000-0x00000276162D1000-memory.dmp

Download

memory/1452-167-0x0000027616280000-0x0000027616281000-memory.dmp

Download

memory/1452-165-0x0000027616240000-0x0000027616241000-memory.dmp

Download

memory/1452-164-0x0000027616230000-0x0000027616231000-memory.dmp

Download

memory/1536-26-0x00007FFBDCC40000-0x00007FFBDCC41000-memory.dmp

Download

memory/2900-594-0x00007FFBDCE60000-0x00007FFBDCE61000-memory.dmp

Download

memory/2900-593-0x00007FFBDB610000-0x00007FFBDB611000-memory.dmp

Download

memory/5360-815-0x000001EFA2CF0000-0x000001EFA2CF1000-memory.dmp

Download

memory/5360-823-0x000001EFA2CF0000-0x000001EFA2CF1000-memory.dmp

Download

memory/5360-822-0x000001EFA2CF0000-0x000001EFA2CF1000-memory.dmp

Download

memory/5360-821-0x000001EFA2CF0000-0x000001EFA2CF1000-memory.dmp

Download

memory/5360-820-0x000001EFA2CF0000-0x000001EFA2CF1000-memory.dmp

Download

memory/5360-824-0x000001EFA2CF0000-0x000001EFA2CF1000-memory.dmp

Download

memory/5360-819-0x000001EFA2CF0000-0x000001EFA2CF1000-memory.dmp

Download

memory/5360-813-0x000001EFA2CF0000-0x000001EFA2CF1000-memory.dmp

Download