35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7

Analysis

user interaction
yes
max time kernel
273s
max time network
267s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 16.5MB
Sample260805-sw73jszelf
SHA256 35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7
MD5 411e27893f6e210f32cea7e28662adb2
SHA1 2c1f7771a8e24691bc39f7bf17609fa9cf628e2e
SHA512 1528111cc2a8313ccae7ec49c7b7ad911c0603ff4583a2fd19810dbf808142182628d0441baa0ffd42cb78f17a3f11e914b50f9595cf422d357771a4862622e6
SSDEEP 196608:GVXku+QMSrEM6IJZCsQdYXK7lDJl2zRwRLKAyWMsSt3K+zdY4HciDnzjW:MXkZXC/QdYXKoz0mAAsgrzCkXzj
TLSH
T12B07AD43F66280F8C16AC074935A6232FB31BC4907357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
131	3860	chrome.exe

Executes dropped EXE 7 IoCs

pid	Process
2392	Nexomia.exe
3376	luau-lsp.exe
1256	RobloxPlayerInstaller.exe
5920	RobloxPlayerBeta.exe
3736	RobloxPlayerBeta.exe
5804	RobloxPlayerBeta.exe
1672	RobloxPlayerBeta.exe

Loads dropped DLL 2 IoCs

pid	Process
3736	RobloxPlayerBeta.exe
1672	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1540	tasklist.exe
1532	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
3736	RobloxPlayerBeta.exe
3736	RobloxPlayerBeta.exe
3736	RobloxPlayerBeta.exe
1672	RobloxPlayerBeta.exe
1672	RobloxPlayerBeta.exe
1672	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\PlatformContent\pc\textures\water\normal_01.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\Controls\DesignSystem\Thumbstick2Vertical.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\9-slice\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\advCursor-default.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\collapsibleArrowRight.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\loading\loadingCircle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\audio.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Players\AddFriendIcon.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\ic-more-catalog.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaDiscussions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\MeatballMenu.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\New\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\StudioSharedUI\clear-hover.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\ShareGame\icons.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\New\Error.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_7.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\PermanentMarker-Regular.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\shadowblurmask.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Emotes\Large\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\ic-friends.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaDiscussions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\BuilderSans-Bold.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\families\SpecialElite.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\sky\cloudDetail.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\chatBubble_bot_notifyGray_dotDotDot.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\dpadLeft.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Moments\Reactions\laugh-joy-xsmall.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VR\Radial\SliceActive.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\PlatformContent\pc\textures\sky\sky512_up.tex	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\category\ic-top rated.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar mask-84x84.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\avatar\scripts\humanoidHealthRegenScript.rbxmx	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerLight\Connecting.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_1x_10.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\configs\DateTimeLocaleConfigs\en-150.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\configs\DateTimeLocaleConfigs\de-de.json	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\BuilderSans-Regular.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\fonts\RomanAntique.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarImporter\img_light_Rthro.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\newBkg_square.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\VoiceChat\Misc\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarEditorImages\Sliders\gr-slide-bar-fill.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\AvatarImporter\img_light_RthroNarrow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\particles\forcefield_glow_color.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Controls\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\graphic\gr-game-border-60x60.png	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\ExtraContent\textures\ui\LuaChat\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\content\textures\ui\Slider-Fill-Right-Cap.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3840	1256	WerFault.exe	149

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RobloxPlayerInstaller.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3860	chrome.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2208	timeout.exe
5036	timeout.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304174794747303"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe

Modifies registry class 32 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-145f189a6a974303"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files (x86)\\Roblox\\Versions\\version-145f189a6a974303\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-ff6341faef444107"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
720	Nexomia.exe
720	Nexomia.exe
720	Nexomia.exe
720	Nexomia.exe
720	Nexomia.exe
720	Nexomia.exe
720	Nexomia.exe
720	Nexomia.exe
720	Nexomia.exe
720	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe
2392	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1884	msedgewebview2.exe
3344	msedgewebview2.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of AdjustPrivilegeToken 48 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	tasklist.exe
Token: SeDebugPrivilege	1532	tasklist.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe
Token: SeShutdownPrivilege	2580	chrome.exe
Token: SeCreatePagefilePrivilege	2580	chrome.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
720	Nexomia.exe
2392	Nexomia.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe
2580	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 1884	720	Nexomia.exe	89
PID 1884 wrote to memory of 3008	1884	msedgewebview2.exe	90
PID 1884 wrote to memory of 1692	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 1692	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 1692	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 1692	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 5732	1884	msedgewebview2.exe	92
PID 1884 wrote to memory of 3564	1884	msedgewebview2.exe	93
PID 1884 wrote to memory of 3564	1884	msedgewebview2.exe	93
PID 1884 wrote to memory of 3564	1884	msedgewebview2.exe	93
PID 1884 wrote to memory of 1548	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 1548	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 1548	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 1548	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 1548	1884	msedgewebview2.exe	94
PID 720 wrote to memory of 4312	720	Nexomia.exe	95
PID 4312 wrote to memory of 1540	4312	cmd.exe	97
PID 4312 wrote to memory of 3940	4312	cmd.exe	98
PID 4312 wrote to memory of 5036	4312	cmd.exe	100
PID 4312 wrote to memory of 1532	4312	cmd.exe	101
PID 4312 wrote to memory of 5804	4312	cmd.exe	102
PID 4312 wrote to memory of 2392	4312	cmd.exe	103
PID 4312 wrote to memory of 2208	4312	cmd.exe	104
PID 2392 wrote to memory of 3344	2392	Nexomia.exe	105
PID 3344 wrote to memory of 5392	3344	msedgewebview2.exe	106
PID 3344 wrote to memory of 5740	3344	msedgewebview2.exe	107
PID 3344 wrote to memory of 5740	3344	msedgewebview2.exe	107
PID 3344 wrote to memory of 5740	3344	msedgewebview2.exe	107
PID 3344 wrote to memory of 5740	3344	msedgewebview2.exe	107
PID 3344 wrote to memory of 1432	3344	msedgewebview2.exe	108
PID 3344 wrote to memory of 2112	3344	msedgewebview2.exe	109
PID 3344 wrote to memory of 2112	3344	msedgewebview2.exe	109
PID 3344 wrote to memory of 2112	3344	msedgewebview2.exe	109
PID 3344 wrote to memory of 2196	3344	msedgewebview2.exe	110
PID 3344 wrote to memory of 2196	3344	msedgewebview2.exe	110
PID 3344 wrote to memory of 2196	3344	msedgewebview2.exe	110
PID 3344 wrote to memory of 2196	3344	msedgewebview2.exe	110
PID 3344 wrote to memory of 2196	3344	msedgewebview2.exe	110
PID 2392 wrote to memory of 3376	2392	Nexomia.exe	111
PID 2580 wrote to memory of 4908	2580	chrome.exe	118
PID 2580 wrote to memory of 4076	2580	chrome.exe	119
PID 2580 wrote to memory of 3860	2580	chrome.exe	120
PID 2580 wrote to memory of 4076	2580	chrome.exe	119
PID 2580 wrote to memory of 4300	2580	chrome.exe	122
PID 2580 wrote to memory of 4300	2580	chrome.exe	122
PID 2580 wrote to memory of 5284	2580	chrome.exe	123
PID 2580 wrote to memory of 5284	2580	chrome.exe	123
PID 2580 wrote to memory of 4200	2580	chrome.exe	124
PID 2580 wrote to memory of 4200	2580	chrome.exe	124
PID 2580 wrote to memory of 4540	2580	chrome.exe	125
PID 2580 wrote to memory of 4540	2580	chrome.exe	125
PID 2580 wrote to memory of 3864	2580	chrome.exe	126
PID 2580 wrote to memory of 3864	2580	chrome.exe	126
PID 2580 wrote to memory of 1548	2580	chrome.exe	127
PID 2580 wrote to memory of 672	2580	chrome.exe	128
PID 2580 wrote to memory of 672	2580	chrome.exe	128
PID 2580 wrote to memory of 3376	2580	chrome.exe	129
PID 2580 wrote to memory of 3376	2580	chrome.exe	129
PID 2580 wrote to memory of 5960	2580	chrome.exe	130
PID 2580 wrote to memory of 5960	2580	chrome.exe	130
PID 2580 wrote to memory of 828	2580	chrome.exe	131
PID 2580 wrote to memory of 828	2580	chrome.exe	131
PID 2580 wrote to memory of 5124	2580	chrome.exe	132
PID 2580 wrote to memory of 5124	2580	chrome.exe	132

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:720
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=720.4796.15679401056627242194 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd39155fd8,0x7ffd39155fe4,0x7ffd39155ff0
    3⤵
    PID:3008
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1784,i,4199614092571699590,15254956714674482795,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2172 --field-trial-handle=1784,i,4199614092571699590,15254956714674482795,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:5732
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2308 --field-trial-handle=1784,i,4199614092571699590,15254956714674482795,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3432 --field-trial-handle=1784,i,4199614092571699590,15254956714674482795,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:1548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1540
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:3940
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5036
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:5804
- - C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=2392.4876.9134344844479826795 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3344
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1a0,0x7ffd39155fd8,0x7ffd39155fe4,0x7ffd39155ff0
        5⤵
        
        PID:5392
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1792,i,14993052525917637575,2265278108603959420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:5740
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2032 --field-trial-handle=1792,i,14993052525917637575,2265278108603959420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:1432
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2324 --field-trial-handle=1792,i,14993052525917637575,2265278108603959420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:2112
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3564 --field-trial-handle=1792,i,14993052525917637575,2265278108603959420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
        5⤵
        
        PID:2196
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.8 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4584 --field-trial-handle=1792,i,14993052525917637575,2265278108603959420,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:7068
  - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp
      4⤵
      Executes dropped EXE
      PID:3376
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd36e1c728,0x7ffd36e1c734,0x7ffd36e1c740
  2⤵
  PID:4908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,7005422109540940537,13135010874172924108,262144 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,14898860061326929302,12321238698431564814,524288 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2284,i,11398375163022718350,4729356905561931841,524288 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3252,i,14644007871969680921,16563715267872966268,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3316,i,1500040649102178819,17264131255033694842,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4732,i,12348904222538555243,6595820608608405976,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4908,i,5148830552820193001,17987213810804945971,524288 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5104,i,6898805601223309594,8857924231982490628,524288 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:14
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5516,i,7218253815626019698,7590637021850538753,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5532,i,14065742204786155860,7712559914896483710,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5856,i,7238397114725354527,9718121345594873094,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5940,i,15110118996237283451,14507642898045515595,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,13794442098115580404,8084152944891401768,524288 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:5124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6384,i,2367658333576468366,9548445084284470354,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5836,i,16949475076580211791,5851905986388817994,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6072,i,7870610679255017747,10065119816746336989,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5956,i,15510992658857764968,17529529073257253000,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5760,i,14347779364675316709,12950843307037242414,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,16675393422232197202,14327513515250521117,524288 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,17834781274129921077,1285959016334791917,524288 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6212,i,6298208604413082128,15765696390729078042,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5540,i,299725265738427258,12326523875970044647,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:9
  2⤵
  PID:3340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6200,i,6857136541780306730,17256843672331835250,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6188,i,11658584047070320692,6617044183760065526,2097152 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6668,i,16032798561245887426,8313796593075420034,524288 --field-trial-handle=1868,i,9822261013750777339,14759469897919750381,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:4252
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1256
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1256
    3⤵
    - Executes dropped EXE
    PID:5920
- - C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
    "C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 1256
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:3736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1256 -s 1284
    3⤵
    - Program crash
    PID:3840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1912

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 680 -p 1256 -ip 1256
1⤵
PID:6128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7016

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
PID:5804

C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe
"C:\Program Files (x86)\Roblox\Versions\version-145f189a6a974303\RobloxPlayerBeta.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files (x86)\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.7MB
SHA256 a33eeac3fde1d1f99de2df08d63faa818ffdfcf2ace6a37e11bec1fe59409c5f
MD5 ad0dfa05fcbf007b1e2e535139317ae1
SHA1 8bff45114123dad46374913eac070a7255ca57df
SHA512 98e470bec6520eff7ff701d3448dff3682c39a1a9f95211595cb6fd5fde63ba26aeb79ccd32fe7adc1ab3e27d551474e41d4e56c1e2d8f01d4cfe9715c7c234b
SSDEEP 196608:ivgkZi/+KxW/hvjyysmsxP66IM5e5QIfqZzcz9P:iv3KpysmsxC6d5e5QI8G
TLSH
T17FA6AF22B900C032E8D100B296BD5FFA997D9E340B7954D3A7D41DB95A705D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ce73f2070ba614aa2a6a2b4e515862ae30f18e432d4c3a439552f46ea0db533f
MD5 7987e2cd378f5095df562f443fd68677
SHA1 a86977098b22a0223432b3347cd57261fde3651f
SHA512 c6acc97b305b8237e38b1d6379363724fbe82db5d975b1400c39b7dc96711bac434a38fb572a30be091e47cee239a3a9d3f8fe7699d7918111c4ace7b25130fc
TLSH
T1A8F028B5CD25AC3B19FD1B6820A40B8AE75013672B51585F3A3D820C8FB0A3B858681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 744B
SHA256 7b576945dfdc7ca2074557a77441a66c10afbd42d5a756fac0f672d95102a2e1
MD5 91117f9a1e5da68c33408d856c8f8596
SHA1 dd9f6ba633cb04a5c630542ebcceb30ee78328ec
SHA512 a26d623f876185331ecd49f45b23108d2517610664237db9c89aa1f257a5bc03a10f1716bd23dfab9e0a1250243cc18a1be0f7189183cbde92d6d00f7189616d
TLSH
T12C01241D21DEA020CFA72BB3A68ACD725161C584D0C21BAF0787487B577F6B4D78AF16
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 082199a625c3ec468cc4743013c634af92f0650f584c5b5f8868026bc0720540
MD5 089d0d2309eff1054af329fb9bf7a6c5
SHA1 a52d6bb3243c76d0eb15ccacea425fcbe668d88a
SHA512 af098b0b3d24f1dd2eb3e201a4910d40cd77fd7d97085d19b8ec74917b60e1532493a371e747442d2b70bfb63e2d7657b6a83afe580954ac4f39c60d3d046da6
SSDEEP 192:Dy3mMl/zFhqVhNLEBq9PbevyWNPGaPNfP8NHlh6HA:Dy3mMl/zFQVhNLEBq9PbevyWN+aVfUN5
TLSH
T1C7E17EF7C3D9C52DC91156F49B156F2ECE290A24432C3C66C8D8BE5BA3E2472D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 306e70386a0d6b24fbd68ace97565d23883edfbe56e85440bef6e07cf1e80430
MD5 772d592af9ec12c1106b7ea87670e0bf
SHA1 e21b0cbdc530106b9fc9b94bb29426cd52d563b0
SHA512 0d01ea85436247639ad796ee6a4ccb5b621800a67c8ae096a530c8c35edb81e909eeefbdf4b891fc1da5dc6fc93ec3fc18802f25d69491826fcd423f27e23441
TLSH
T1EA21CEEB97AFB417102C49BA5E40B80955B5A43141A0B8F4DE93D12DF0864F34B16477
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ffd6efc1b3fd2dbf1e8ace64b6a23d7f0c5dc61790ad30aafaed6a143a454a4c
MD5 46171783b9df42d0825c2592b73574ff
SHA1 f1b4cbb446b4a573cbd1d4067271c7672a2ecd27
SHA512 3e6c5f5f8656881d885b375938c29d5594b768373301820c0c1cc91df922516c0bcbfe1888c01cf7d49eb0668eb54992054dc30ccaa8020f6bfc24710b879538
SSDEEP 192:IRhcBz7qg7cv7xAPRp2Ht8+9SHsb+WNmXL2A4Au24s2LeJfVyIsnAUge:IRhmz7fIIXAEw2/K2h2ce
TLSH
T1A142952ABA20793B6DDBC21DF9257B66D7F6102225D42E90EBFC892C24D76CC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 0af814a0db93f07c3d4f3299c7f6a6c1986cd02ecb7889d37d6767f71e903fb7
MD5 e9dd21955732ca93153e926319712f54
SHA1 f10788977f576d19b1802dcdb7713e7ea2900a43
SHA512 55d398016272905f3b401da273213da7625ad55ddabd067a5e8a135c534e99b5029fdb34f9614f56f0ae547adb3f7ce77adbcde9162bb1fec8e5e48efbefa9e1
SSDEEP 384:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOXODt0+ErU3stHGx1XRBg:Dlts7KxkXqKf/pUZNCgVLH2Hfgs4UOpa
TLSH
T11A52E867648D9A3F0FD8C94DD8136F8FADB6025666784D2497FB9C0803A57CB120A1FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9729512b7b1d0bd61c8acc5e414b4314e9c5240b34c79d2a78b87430574677dd
MD5 76c75eb6462f5121dbdb17ada441db51
SHA1 1af7ab88d997b86df4554802b99e9541fdcb3a57
SHA512 907f0f305aa6c7ac2ce9d24564d803acbe9530b6b477a8fee0cb3538a1e852287539e380d632f53dc69cf78838da9f69fb397b6875055d0b16e22a68c60ca5f1
TLSH
T1E8A00220A1455970C01812F4185A01851259499042C40716A4A0614498945508261E05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 df8a7c72e7aca747a991d79b13d1f78807c674491bf1a0703d4de582db4be99f
MD5 57e23f6be595584b53f2a1b6bc58c349
SHA1 da180103a1dc669410213f9248327b4f920aab32
SHA512 7c4e3c218534a3f856699e2fc2cb139248747d522dd718fa9b5260b943185e30302900eb852907ebde9b3c52310bf862bd530ba18a9e43fbbb75b8762152bb50
TLSH
T104A002D451C41810DE2242BC646115411351885418904703459B14658A5F4C09F41F00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a881d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a881d.TMP
Size 48B
SHA256 c64a880103dbb9698bde12eabf333f33dd68db9e1f370ba838f1419e9991b08d
MD5 8fa2afe6f42bc6fc48867fc84a575626
SHA1 18cb85a4404d10b0384e6a05adf1e3beb80f526e
SHA512 f68a4bedefa82f3ae3291e22e99347f1ab1423e7732d494da3d30c726d6cf5b22eab79db54ee7e17aaa7cd1c35b86900d1af4bebd10e03947f4734fa382557f0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a88aa.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network\Network Persistent State~RFe5a88aa.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

fbeaeb84-4bc3-45b4-9716-44b607a89e47.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\fbeaeb84-4bc3-45b4-9716-44b607a89e47.tmp
Size 12KB
SHA256 b064a1ce9f641c2874ef9cdb7c7f298b8365a59dba409fa3208605432077e491
MD5 0897983a114ced4e57ce406874cc7ce4
SHA1 076d10114aae24acd2a15a85ffa8fe0212193133
SHA512 29686b6d342272394d1884a0701a842b50e472cae49034f0b1b482ce4497d3c105c4a1925d24ecc78c0d7265ddee12ea31b79b408539df370b52223c38c89e4c
SSDEEP 192:IRhcBzRqg7cv7xAPRp2Ht8+9SHsb+WNmXL2A4Au24s2LeJfVyIsnAUge:IRhmzRfIIXAEw2/K2h2ce
TLSH
T14542952AA910793B6DDBC21DF9257B66D7F6102225D42E90EBFC892C24D76CC7217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 d14fd793e85b70d04c15c08e45dca5c32a9d419c61232a428aff2244f22f9a48
MD5 41efd2b2405ea9d215e1192531fa1e75
SHA1 76bd216421a5e54a2e3743f24aeb27a6df82c790
SHA512 1dfdceab9de811b746abfe42724288d40ccd3a8ebfcac99867c541004a7551db4b30d6b50015e287aecb68da975a1adf64c2cbb58033e912a7d32cb10126f56c
SSDEEP 3072:HCQem4wzMq+iFUc3xl4sFjprk1IWWJ2K4dY:HCQtbzMq+iFUQ4sfrkCMM
TLSH
T1A8C302988B5A2E623165C590F11FD6074EBD42EFC9F07072BDA58F0E20E26CE9952A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 8f4a33f816e6dc16950860ccfb5775f64a7fc11fd41cb5bad5168af2d9d85783
MD5 6466a84da15e903f671044b3d90eabef
SHA1 9f4ded793686b3470632ecbad8f9e255be81147a
SHA512 08019015d177f9907bf3f91c63feb69e69208f5c29dea0fa8b2856cfee2741c15421a7738179246f6cef72f9563ac032cd9b1c417cdf70a5f259f40f7600ca81
SSDEEP 3072:SCQem4wzMq+iFUc3xl4sFjprk1IWWJ2K4dY:SCQtbzMq+iFUQ4sfrkCMM
TLSH
T1DEC302D88B5A2E623165C590F11FD6074EBD42EFC9F07072BDA58F0E20E26CE9952A17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 78f8dd07543c5a4057432c8b6568d5d42f320d140447f676e4ea6bfd77949558
MD5 edb1027fcafb086e2ed13b63d6e0bf62
SHA1 dbeb555a08899751c3d57d19d2d49b864ec8e5b9
SHA512 b7601b12dd19da041067b9c6d7f2fd1f6c19ef18a1573905a4b27cd65c1abb4f4169bd5c3072beb6711474c19f805ce771bd14588483512b1d061dab6d1c510c
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5t9D8NB6EGyvP/e+0VZPEOLv4a:MC08UR5rYv3eDUDv8Tgae+0VZsOP
TLSH
T1D1A10973A86A8D7BA976C58571062B43CFB5B17BA521AE94E9ED1F0C11EB0EC2301523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\Nexomia.exe
Size 16.5MB
SHA256 6978cc2b0e0beee5d68f7cb4438ebfd04403fa7166390771c6596ac953af4b59
MD5 1fd4cd395b2aa5a4fa3f839d021920c5
SHA1 7c1a54fcc437d7b423db7ada98bd3119f338242a
SHA512 edcfb00b72345608a9d9b979067e00824a147f71811f212a9f3f8b0b69ac7a0c9aa01228a264598589f425d18537a17db9ca7db0cd4d4bf74d3c1ab1038b2a26
SSDEEP 196608:hVCzDy/Ok1LwsdOJSkUgEqStKszfxKb+zdY4HciD1KK7lDJI/PoaYGMOwSWb:DCzO1YSkP1gvzfRzCklKK7aYGMOwS
TLSH
T1EB07AD43F66280F8C16AC074835A6232FB31BC4947357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat
Size 532B
SHA256 ed38812e0842092c5151a9a3f764a3d6a211aa667e20e69c0e51173b14fc2a32
MD5 179a1a9d55c426b7d0e6d3a01f72f514
SHA1 7de19f747badcdff65627c4dd6cac5a3341ccd59
SHA512 f6c584ae77a464408806528ff73b341f18766c7664c57df37acbbd50eaf295da4eaa51776ae49f945dcc4160f69ebe56736db16b4910ecf95e35f717be93f23c
TLSH
T123F05038891A06B500645A99CF5E3544D5FEDA4FA79D7AC014C0D68D366F18A1E873C2
MD5 SHA1 SHA512 TLSH

Submit Download

nexomia_manual_Injector.exe

Path C:\Users\Admin\AppData\Local\Temp\nexomia_manual_Injector.exe
Size 5.5MB
SHA256 c73578f94e0e0e958dc8c608bc6a070f652e30696870e59e3783f938f0a39721
MD5 3061aa94239747e98a57b7a9c689b8a1
SHA1 aebd9bf0747c0b42c98153e07f7fddc85a4d222b
SHA512 82f34fdc2ec53dc222273f1a0a1b37ade705b8d9ab5d371f03b7cd850750a73ccc6d68e638c09a5c5e4664d825bd14c97bded6b063af388e2a198b3cde4e8a7c
SSDEEP 49152:9gCG6nApbxAdv/jb8ZOlS3R6PSudvdgFNNcd/9nykItlIejZN7QagPyw+ayablus:JPpXtgS24TTZhum0PiTn658Jt
TLSH
T17246E137EE013069CDA5B1B4024D3BEFA2F6B2904F50EA7B206516D576706E42FA2F17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nexomia_manual_Nexomia.dll

Path C:\Users\Admin\AppData\Local\Temp\nexomia_manual_Nexomia.dll
Size 7.9MB
SHA256 795a8fe2f4602f2b531d7d52afec599967b8ba86ddd1794f6932e03e2d099745
MD5 92e1dae796fba37c3c40b0b5b1310964
SHA1 00bb755eafc54971e9357a722ecc6f4580e1dffe
SHA512 85d116ec383332ec265a717462f4f419763e2f9f533ccb61a3a80ca4c5843fcc4c1302480ab863f0b300617869d55c51a8402cd2e8b33e3e3b19394b3f180a93
SSDEEP 196608:XmuSobtfAjST3HRS/AjUrFg4o1DRWgwL38KAutVPfIKUD:X2obiCx/yAYgwL3rLtNfIKo
TLSH
T1AA861264CB661D3C18802792AFCACD96204412607E4CB71F6C5FADADDEDF0E548DBE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2580_977660026\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 373f60f39b579e522e05372e11360a5759b34880d3a03e97ade1a0686bc33192
MD5 4d88be5257d99034d67702f1918f3666
SHA1 c9e900d0d2c4bd6937ef73281c1e4e83e9ed381f
SHA512 d924d969b10d5ecd099ae93001b2fdc85d1473e1c9e974f658c6ac447ed0cf5e3eb55d68829a64f9805792c2980169078f87cb93acba191517552f854966f538
TLSH
T191D0122A32010138C81020730002620C1401C11F81C58145982CC51EAA080A54A07841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6c5b8db6bec963af042d6165ceda6f55d5275ba36ce046e3f4d1bfda25ea07dc
MD5 b07aa2881d56e93fe37702009af7a0c4
SHA1 15c7d520b280a759f43e124d0840102e329fd288
SHA512 4e70bd7f740cae768e4c7b215e2e58a8aa51d36df69dabaf7333f0f08a69a5e841bba03f20a001439d1c9c1d141bd314a975da33c6d6a79e7b7090337e8f3045
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8623dfb74176cf4ab14def959d6e75f45b8b03b06e6f3e731d7b0b0c4812721b
MD5 8d166e27cc0b212ce808eaf17453b449
SHA1 6313a656a0f20281184cd95d3f808250d318f966
SHA512 fe44152eca2c98dcb8adfb1d480e7e46e8dda3e5e6ebfce66c7633ae96d10446e7da6a3fe0648cda93c7ad4ab8c85ed3b0c4e3ba146b47aaee045203e6cab83a
TLSH
T1A9D0122A36010138C81021720001620C1501C01F82C58245982CC52EAE090A58A07841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 28b3e8e81df62d159c6b3e10900af66400914128ab97663cc804e87908a6a335
MD5 b6b2920388563ff2b1bb304be13d5325
SHA1 9dab11fd29b23660fc54dadd7540717ed3f11b27
SHA512 38fcc6991ef8325fdd70e898d09b7496ceedba50156649c2ca7166fdaae221f98a57dcdc9cc66a401eca1c71227e97dd560b2e7fdd2d1b1fd6d57d977120a644
SSDEEP 3:MsFlthltlluI+V5ZBCKkflFXBwOlllX1VAbPDKlkll1S5T8l0pol+C+flh+:/F8VV5/CKkNMOtgDW+08lQ4+C+
TLSH
T1E0134CECB5A19C2BD1C527F8779BA7B107B46D85925146A31170A8B3E05C361075D914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 eebf36874ffca61e233fa37d3a85e574abbd463b8a5e9d4bc859dbc701a1bf34
MD5 da15b40370b72db278b10317e350e82d
SHA1 978a387022ca3912a90e456d5891a808533a42f0
SHA512 6e9ae49f77db4b8111b658f384b5fccc4941b27e0883ec7edc759fe48f3aa8f22b09acc602a67995935f1c7e5d39efee7938f597522d8ffb19d6a05dff828b11
SSDEEP 6:/F855/c2NWvMzKl8qnWa9+F9zKl8K0e1:dC5/NoMzKlRnWa9+F9zKl+e
TLSH
T1F11301FEB4850C4AD0C9053ABA9A8B3842F18A18A9A6C76361A069A7E4AD3650328008
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ac44907a7f3fcf2970fa21d20c8b5ad39bdbd8517a3602afeabe9bce924419ca
MD5 3e30bf0d3a68aab7ffbaae27d127b025
SHA1 a48d5244691c24e1bb3d82969ac7fc6a799b3e68
SHA512 4a29294c28bf768d46a8eadb4fa047a0b300bde9a930f778e872b220b135ddddcda883e8c59e3b51ac1ce471ce5bd241b6fa0e455880f38e8fbed821ebede8dd
SSDEEP 12:U/9/I2HXkkS+Jxb7E9kTGLBDD1b79kTG68y8ShAbOC9kTGLApLbc4B9kLRLCo:Gy+J9GLBeG6FlGLApUd
TLSH
T12C445CCF4F06E406DB782BF67BB9E83D872641A054E4E742BDD058456D822AD3D5075C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b4bd43b67da65c8394863fdf65ef8cf98f76aca4ec6d7ebc7836fb4788058cdc
MD5 13d7f7c9f7e389a7b012cb21f3f26300
SHA1 18b11ac84bc660dc3ccd242fea7c9bca779c03d8
SHA512 205c46d0170dabc154edb5964d1a56ae1ac616c2b10b096c72d04d0f247d807e93dc047c7e7369a687662d7a5fa9f25697e27f308532280db271760c1ead209f
SSDEEP 12:U/9/I2HXkk+jt9kTGLBDDSLW9kTG68y8ShXO9e9kTGLApCjMT9kLRLCo:GDGLBOG6u9JGLApsMk
TLSH
T16F4425CF0F06E401DA746BF6AAB9E93D872610A014E8E656EDE058149DC23AD3D60B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 229d2c3fa3d2c88d536ec3bd78f5e6825f6b068b408f2d99c288f2dc0f048f0f
MD5 ee42b0580b88b3b8cbff3e6cbac6a81f
SHA1 2ee366b03e8b5db7263cd09e02dec00ec4d70507
SHA512 23bb53204e952292d0df1e7986d58724260cc679fdb4fb1110a9fb97c7ffe47515d565c81b5f536a64ce752624f95d9e1292dfc5bcfe1285049a0c6d6bb5ce98
SSDEEP 192:o6dfan9b+FqtozaLan9b+FqtM0ican9b+Fqt:ofn9b+F1xn9b+F1n9b+F
TLSH
T1E425F9D91F34A6A1DFE2EE30BAD1C4162EF41086AFD6F0535546C67610C3BC61E5928E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 655ab2eba24b12ce7e8e2fa3831be73d0491fafebd7252c991c595070f44ebc1
MD5 ef0aa99568f9268360621b165f99e9a5
SHA1 bd0d6b883c7a0bfc7d87b67ca5231b68dc111c4c
SHA512 59c1df93406a120ebbcd95c4ba6374dcde4e2d2557bdad2ec5a190ef425ee3beb025e7eea1825d35cfee16388b784e70f6372988567cb4985c9218da318eb624
SSDEEP 384:RINiz85OsENnTDUw3q7luI8OC4PygPH+2p1ZOrhlfVClTv:RIMwsNnTDNeEmZ+3fWT
TLSH
T16E16CFD7272E3821FFD70EF039A4F7269830BD68B1E583E58802261997853D18B6D76D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000001
Size 85KB
SHA256 2ba397a357b556335c6ddd6d5ec442f1e49c53687fe957fab4743490f2589430
MD5 16208805a5fe139b1209c570acfcfabe
SHA1 1d114557b8289ac4da11ee4e745e723d74282714
SHA512 8f638b42d32a31ce9f6aa26647d26a0f13b9db36ce09a3a420db791bc17a4afc2d8839c34b5ecaf06c21e48d826106e9abef1e77acacdefd267706e7c6210b01
SSDEEP 1536:qCyFzZmrEND1Pl+7gpMCKODBPm/FK+Jr5JCl5vJHZ6XTms8263OYZFXA5tdiP:bYmgND1t5pmOD10FKETo5vdSTmsxBY7t
TLSH
T1168302BB54FA567299E7F052D217CB0F85AE39C081980532CB67BABDC91B98D16708CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000002
Size 31KB
SHA256 28af44cd3766699962d197f103d31ba2e1bf48f4eb942ed1283755167dcd4c30
MD5 26e562fc6595c461cead42c79310e4cd
SHA1 f31f15822a1cbcb6d4d26d14a5a21d1334ce5f0d
SHA512 626f750f7876c741aec07b40035c3dc21584b2cb080ff398a610ba1176c42a1b02cdfcc9dd4d2d9143aaf3df8a5b4accb2ad4d261ed3ea2c20f7193f23b8a511
SSDEEP 768:0SHPcUru0CvXdkb3DYST0+YRQVcewqHa19iVy:0SHPcX0Cv4cST0+YRQ53Ha19z
TLSH
T129E2F1EA1390F5BB374EA2161226C4BC91C11F9E2DB7B72E8BB31B54B07140225395A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000003
Size 17KB
SHA256 aa62be4b0740c463cef75abbc29482e33ab9c91c75d8aedabe63264cadcc4d12
MD5 d332bb6ee1ab608975ee5f769b6fc4e5
SHA1 1dd7f35cf3da01f6409d011179b41c43925cae6b
SHA512 572a6a8886f97e848fde95285d81137cbd32fba1501566a5d2e95c34a2684cb17b21be75b91d6bac5da0313fba3406f7c835c0d45afab676c3e995f3011da79f
SSDEEP 384:6Y9YCcLTuYTNqgOpRdzVDEhf8yUK5lL7CuiIrXWNn2Ut:68YCaTNqgOTXDWLv5FfX+d
TLSH
T11382E19D68A599E0E0548716B217EBEE03770EC15F13940080E4EDB787475FDAB1F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 bb1b413d94790198c0d47da0ce270a8633bc026983659aa5e10faee52d107e90
MD5 6adf3e14f6d1e0978f6d0bbda7ec0494
SHA1 fe324720b712391f96f723ac992b2bfc33a6b901
SHA512 9b6362d297da3ded7a15b41710b99632edad9412ca767108e66a7f1b7b50f5c53186d7432347936244db1bb017031b1ba751dc4f19e511ed542be866fcf713cf
SSDEEP 3:LsYllNlNllkll/lmy4n/zllfEPlXl5NtlmNtlAl:Lse3lEt5TkN
TLSH
T19844016AC7D14C59C5D0117D940783642725C494C60BC38B1344556428C57A03E0D141
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03ae38ee19e172a6_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\03ae38ee19e172a6_0
Size 275B
SHA256 5d82dd09b92634ae397b9e1365dd59225801293e1383d0b2c72ec6c128bf0bf3
MD5 fc39f3c0f64d62b09b9c2ad49a784240
SHA1 f97104976639c71399bb93b26197823cc706f6fb
SHA512 c643231ada8fb439f82ef1082ca505f90c5943e4e0c061e2de4a0ddaf88a12064821d11e49765fa18191f5249c774da07de1e635f577a4f5cf393af59fd9857c
TLSH
T18CD0979F8F2CC300E28E8CF8EFE6928BE383E0F0046A910CA008C559D3A83687751325
MD5 SHA1 SHA512 TLSH

Submit Download

09f4703a13aac448_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\09f4703a13aac448_0
Size 258B
SHA256 d1ddd0964bc811e03fa750d8f461fff5c9ac6d0b41af54e069cb559d789bc6e8
MD5 ec52c6053dada4bdbf358f85bba0e702
SHA1 158fdd35ef2230a1ff1366d0aa061e63eaa0499d
SHA512 6ff0d938f00e3876e2a7ae51bb12414f28b2ee65c089bb636d3cc9e01b48dfe493780b10a1bbf4fb9eaf9556ce3e2d944c44afcaf37c32cd2c3463328b594952
TLSH
T1AAD0974FC1628288C75C80F1CBD98D0E971B80F0105A8841C012EC1162802BD7230340
MD5 SHA1 SHA512 TLSH

Submit Download

328cff54b1aaf628_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\328cff54b1aaf628_0
Size 270B
SHA256 73bb62bd7ae47133d30c34c7b2747394ba0bdce64e733a0d92d6c9624f0c5387
MD5 c44028d48a671fb7b10a26b553d2ffea
SHA1 c5521c4670f010021a9ef18163b9afd31dc8c197
SHA512 de7da099da98ccef95445eb134aa348cc155412025b9b8f47b6f53fa9b4059338a163a26fe2ba33f88c925996bbf85372c3fa6c3f2673622c5a62ffd8032cfdd
TLSH
T1A2D0978F4D118604D28B08FBEFBB8A0B43C300E010A968722910EC5200C6BE8B2B8F6C
MD5 SHA1 SHA512 TLSH

Submit Download

39a65d4ef01580b9_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\39a65d4ef01580b9_0
Size 275B
SHA256 2cd6f16ab4df4dd63fc7919db7d133e2c82a04291d5b98307c550fb5df4f8698
MD5 b5e7decb323da9e7348d6e047ed15d1a
SHA1 d99c2c5bc1eab194bbddd16d20b970fc6711f388
SHA512 9855abcfffc8e3ee530102be3b3e8f4b2c5780a8977663c57cc4ebf41caa192c1b2f7687e4d4bdad58ef4e1cc63d38de1e66d45828dc2cd39a1c60e40d509821
TLSH
T142D02E4F897CA444D6908AF0D7EF899AC72E91F0249C6022B001E8E13291B1C221D300
MD5 SHA1 SHA512 TLSH

Submit Download

4324b7eea189103f_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\4324b7eea189103f_0
Size 280B
SHA256 901f39b6a87003575f9ab05cf4b4ebf5a50abae3eac0507d81e29f4f3d3e44e3
MD5 15fcbf1e604d99ce6a1fd9eef4942b46
SHA1 27e65603197471b62520872c955c96157c3c57ce
SHA512 fb3e7908e39ab6315ee203b5078fb7a09e24d1039ae1593568b64fec2bda2c0836233d5e4e686ec2f64a547bd9d23c928daecc34d135c112f31a5fdcf3c188b7
TLSH
T1C0D02B8FC6205145C068A7F5979E4A2B430381F100299D11500BD49BD561375B665145
MD5 SHA1 SHA512 TLSH

Submit Download

49d3021795a13c13_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\49d3021795a13c13_0
Size 274B
SHA256 35499f5e4252c7806046964f5dce426238baa45fc9c80c59622c623ff61aec8f
MD5 7320d82f905fe2ade03eec00e2a78e21
SHA1 b7bc1e06ee2d7e62ac2b45b54c1321630451a8a0
SHA512 564a4e739008f5738ef21663f158f50bbe41ae39226a173131a2cad3bf1c9d2f50d782b138d6931e5a37b1d1139492e1f21c9f00e934461a8e94a3eccdd433f3
TLSH
T1FFD0975F89A2E80CC525CDF8DFFF8C2FC707EEF003A898921008D8612580AB6322D342
MD5 SHA1 SHA512 TLSH

Submit Download

505fc2e7014f0816_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\505fc2e7014f0816_0
Size 275B
SHA256 556d58d6ce21bbd80244f86740bfcd3b4d45fb22447905b0ca21adab69c918ce
MD5 c6812f5c975145cec734da0e66ae7649
SHA1 dd102ba76392034b457f3559411e27e860e26748
SHA512 1af8b80fe6d4df103bdf98344ccb78a1ba64405678742ec283a69fddeb376b36d34b99fc23e4100ad8b1e7eda024b4f813c07b285413996c7eccd4636b47505a
TLSH
T1FBD0958F8D15D940EF2DD8FCF5AF4897430790F0516CD015D214D4C33153118715D105
MD5 SHA1 SHA512 TLSH

Submit Download

5ac4446cd1f872df_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\5ac4446cd1f872df_0
Size 275B
SHA256 e25a636125f9a3f8a285bc3a4271686a751f135437a625920b68bb006d085244
MD5 efe7a9972eb137fb47d5d003b3da849c
SHA1 de58c90d4e8f5195dd3ea972d54739a1caafe042
SHA512 955b81fb29003e4f7562c85017d554a6d4dc8236e7f7ba990de6b62eb2934c32aef983ab7b22021f4875509cef68daf93cfc949fb018529e1f23af65bf66cc31
TLSH
T137D02E0F8217C408F096E9B06FAB00FBC20BD0F00069A0022209F8422881AA4A62820E
MD5 SHA1 SHA512 TLSH

Submit Download

5ded5da48ba86479_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\5ded5da48ba86479_0
Size 275B
SHA256 e12e19829931eba4f091caa6ae9f6266028608d884af7c044f652a5c90c148d3
MD5 d406a4dc67a08f8dcbec30506a43dcbd
SHA1 b33e1e77092d1c66a3b215237610ed953d3c872f
SHA512 41efd202d526fe47aca07d30a83823f5ec94ba59e1bfddc70232003c062a2e4d7f81702b77fdc9ae42a95ff8cd10e394402813cb4a20254bb30f1c62cc353bf1
TLSH
T177D095CF0919D11CD398CCF5BBAF05BE834744F5006DD0454015DC9CA0A6B18B274545
MD5 SHA1 SHA512 TLSH

Submit Download

7d584d23032e8f19_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\7d584d23032e8f19_0
Size 274B
SHA256 312ffe6dc93b69fc6b265f0918e9988eb3271656589a76c4cf702ebb170f73d0
MD5 1b60aa02442aa9025b0e58f459da81de
SHA1 14a3e5d08fcf3bb84bf4f008f904bf7213df2527
SHA512 65922192477fd135f4f4c2e110c1baa091d95adab38a6bd81c214587c167ba0b8e4341eadfb2b89584c1f20af2f0f951599f31098f5cd9102c322abb8f63efa5
TLSH
T195D095CFD9555514DE32CDF46FEE9617C32644B1022DC014750CDCB061AC5743204B05
MD5 SHA1 SHA512 TLSH

Submit Download

83594a70e03d6cea_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\83594a70e03d6cea_0
Size 279B
SHA256 7fd8bec5d4cb6118af61bcbce5acd29d31da016068c3970a791ccf7b6d96f7c5
MD5 e8e4f5adda694b737f6f58ee41c82fe1
SHA1 4bd9e664eadb866b6550b413cef613979a47d18b
SHA512 85354f49427a0672d664dadad72fecaf76669e7bb66a819534efe5535439edfce2684a938eb0cfbd62e0fdc87a6fcf4bc1d86676af4262ad62deba6e13998fae
TLSH
T1E2D0978F8621D109C01AA8FEC7EF4BBAC797DBF064AD04415900FC5A90922BCBA09110
MD5 SHA1 SHA512 TLSH

Submit Download

a38e3f529d975314_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\a38e3f529d975314_0
Size 282B
SHA256 c48b9e99758b81ad365fbd5b189c3945e8ad98088fd00d509aae1263dc05e451
MD5 3da08231226ea74a624d3374cbb2f53e
SHA1 1e96318034d4da26967c5157a55e0aae04658a61
SHA512 c02a642d51aebb112d379b199481c26939cc6900be55eb38dc1865b8bdf76199f3c28d1acf7b7717af63efceaf307bcc992ae983697a3ddafbc67cca2e8bee5a
TLSH
T1B8D0974F86B9E90AC22ACEF8DEAE6E27A283C5F002285454B018EC9330D1324B234312
MD5 SHA1 SHA512 TLSH

Submit Download

bae8d8339eed8dbe_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\bae8d8339eed8dbe_0
Size 275B
SHA256 54a37e9e2b2f2ba2d9ce519d17367fe256dfe7b60fcfbea7985339709417a287
MD5 e94fc8082a268c94fd6430bbf03e09bc
SHA1 38093bd2680a9a4ea2239fcc65d9211b865b90be
SHA512 69aee242c390bec205b327f87629ed9e9142cdb4f47e72634f9abb404168fca7a73a43ea0d1e4269a88ace2e5c035ae35796146da49317c09ed5d9554eb7ecd6
TLSH
T125D0979F8F8AD800C292C9F4A3AF8F13430AC4F0117EA8863600E4A2A0F070E72747A5
MD5 SHA1 SHA512 TLSH

Submit Download

ceabab55d1356180_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\ceabab55d1356180_0
Size 280B
SHA256 2d59890ccf2f98cc02927137a282a126edb88fd44e671133b6f6f353d6d97868
MD5 23dda4763de149660144689f3f9d8630
SHA1 6d6427fa8c35a3030b7f5962eae9863d2ac0fae3
SHA512 00b5e4ee262f33d5a34222cfe8fac6d99af29e6d05f84d0a44fffaa66431308fb84110e3d4c8de84efada231e25091172da2e01fc69ed5c06a51089d66788238
TLSH
T1E3D0979F95258999C861CFF0FBEAC9378322C0F040BF88B2711DE8D125D0B65732B651
MD5 SHA1 SHA512 TLSH

Submit Download

fa5d69ee8981ff81_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\fa5d69ee8981ff81_0
Size 275B
SHA256 f5e12a8fb59d6d42b0f685e788b35b2a07690ec4a6ec71cb048e5cb08c8a9e73
MD5 a7ef841ba4861fe38aee267045dd8075
SHA1 f8eec5c77b35679b163715ba010202eb172b929b
SHA512 1e9fb39e13d72cd2aa15145fb5a1ce790c450bf8865cb6a779a78dcd454453fdff3566f4043445a66c315ccbe1ef36d95384dc939f169e7d4b9ee362265d4b0c
TLSH
T1B1D097BFCB20B802C553ECF8AFEA1D8B8B5780F0805EC205A118FC432E00073B3A8220
MD5 SHA1 SHA512 TLSH

Submit Download

fe71ac62fc6f6a79_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\fe71ac62fc6f6a79_0
Size 280B
SHA256 e31264adddfeea3559a29a800a018d187c4d7e64efc8c6ff96c7fdacf060e6ce
MD5 7764c207a05f13dfa4db33fc579e9837
SHA1 93599d02036b8556a6919f54fc371e49b658f6ab
SHA512 9c621e83570a8cb3c84a7dc128434e249538b2c4c87f54bfe9ab594eb04f77043a807a8342db18dd6a3e779844ea945c14de0ebb45fe422b805278e7ca1a331b
TLSH
T1F2D02BCF46479904C1D46DFD9BAB65418A0694F0081C88092108D9A558C02296258604
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 78b95f9f98afd89143bf3d9daa70cf63491f566f40d1a741aa5ec860b12302bb
MD5 811584e8864b71b56d177d1bbe96c4ec
SHA1 ce740fcdf6394921bccd5023dc3bcb4b16fa53f1
SHA512 afe3e878b93228d2a9184279dbe8178ec8a85c408fdf679a6b0fb46728539a539c61892aa8d932885939f94e90af6428c08f9a15732f6d060e2104b5f8f9db37
TLSH
T113E08203088C7B85FF0C833868C40E29327071F02D8B0FC216AC83BA928E3D03B2AC42
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1008B
SHA256 6796f5b0c3829744a0f8b11779919acc34d2fa0b73d2b9e275bca2cc2c19fbd8
MD5 6789c811afe43b747bcd3c2576dfad93
SHA1 f049afd139c27bd68ac8a05927164420a6d4f50c
SHA512 ba75d8e607b421b06f55db8d3612704a16f89b2bc3390f935e1d7fbd13939502cb68da0e43f306ff7373e694f154a724f3c9862f05cb3ed25cc63a84610502bf
TLSH
T16811FCEB51C92A02EF1CABB9B2C20D22397636F92A8B0FC70598C676140F3D033448C9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597b31.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe597b31.TMP
Size 48B
SHA256 8c594e961a9e3a075b4e87f54c2ab64df641758e590543c50b165524f17e36c6
MD5 e89b6e79249ed231610a78182b22fd62
SHA1 7d5a61b0575a7767a5a6b0b4b6547e51a2b62bb5
SHA512 24a32fbf94c97808929c467641bf4ec14b55973761bbe1d2a1f2f33d9a67d1b0093fb107a799aafdb4159c339a392b638452154d7ff236cddbc47f3528acf2ae
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 aec7989e0f39b8fe36e9257bd9c8b5de849c6100b978a2e5dd7e69d47b2c42a4
MD5 18c055ca4fdeeb8d29933fb4a1526c69
SHA1 29ba35b29c0de1d02e4a0af80be3da755dbae485
SHA512 75a26c28ee42be641c141d012b6d3a83e53dab7f6b80c4c2d932dd2ea95307120efa7f3b2265a3b7a1b1ee8f3cfc481d3430c1ea070a3cd3bb21f7d003b38a8d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\History
Size 164KB
SHA256 d8d1d876bb4aeaaa93b1fa9eb5984bbcbad75b23ccf5de508de5b2474ba75e6b
MD5 0df47d1824aa678de518e773fb5e5b1c
SHA1 3c539849240db4ffef3772e6e0c373bef30a1322
SHA512 481cf41d095e1cef91e1255a3934d80942af39f30feb024aef828fcea0c45e4e06b533fcfb049e1d0551b58788aa03dfe404275dc56f9c3976adeda983c9f546
SSDEEP 96:8BFP5LqL/uejzH+bF+UIYysX0fxQp97zEHt/DfLVVVN6zRk/E0p0NAN4V:8Bp5qL/tH+bF+UI3iWGVzWNVVV63jm4V
TLSH
T151F3FA5E5F243312CDBD923668E649B3587DF03F87236AC56C6144B1CEE2796A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56f5ef9e-ee6f-4eea-9d02-d93cca210250.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\56f5ef9e-ee6f-4eea-9d02-d93cca210250.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 686B
SHA256 952d7f3002429365ced766ad489a325254be21d691f3b0f572dead36a16ece6c
MD5 26ee424bcdb115be11eacb10e793dbeb
SHA1 ff5f86b3ea327a5825923b53491f14be182141bd
SHA512 89422d06898e25d65af41727f85bcb5bd259f47f0e9543351ccd8c8a7aafdbab862c458b3c528f06cbad4951236ec5cea7dda35b9d28c9c3217b14bd0d66eb6d
TLSH
T1360194E687E0C57D4B5117E417347413CD3E051992287D26DDD9FBE59BD2072D11150B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 686B
SHA256 05b64455688a84cc49fd191918e9d96d369cf9492cc829b24d73d760bf2c80f5
MD5 aae9d5ec6b7932c8507a322a1009e6bc
SHA1 e1d5a92c99b42e9bcbc6fb0f317c4e1472e9a05c
SHA512 6a6fa9e564ca123a36e4a37e91c8bcae95b6c016176b21097066b4115e422fb3bf32a8dfb0b2af9c1393b7b7acd340581380072c94ae4f77497a8af61c1ac58e
TLSH
T1CE0194E687F0C57D4B5117E417347413CD3E051992287D26DDD9FBE59BD2072E11150B
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 e448c4468b20d0ec1215b0559bca31ffe5855881f3cce9a8abb7fd270be8b8c2
MD5 85cd5c3210f22b3d6534dd9b4d310d2f
SHA1 d0554850c86b96d9a8a32ce2ee7b7d047e460212
SHA512 ef22c94db8497c888087df46171f5c7b845a1f81e024135ae3b33904e1c59501e4ca8d39209a9077e5073d61cae471fc0ba3dd111002222cac8981da9bec7305
SSDEEP 48:T0IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBzZ3:YIEumQv8m1ccnvS61n6enEvenE9IjH
TLSH
T1E3F2EFEF0B68F309C5A46530E2A458C3BD6A001D9765DAE96EEA42F1BB420F2F539105
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 dc361ddd8c4d02bb489d61c30860d3ca3780b1cd883b04b1a8cc3b07ffe2682e
MD5 083a92526bba0f170c5d6482a959f909
SHA1 05d4c3241c81f1b8cfeab64d4030168d4922c000
SHA512 328c508b87949e830cce104b2780dd39c5b618b8dd196efa3a71b87eade13a6dd69bcebdb3420266abfa6d016933032fa4d0f7d82a00ba8e01f0753a4ec2cb16
TLSH
T109E026A74139B46750784A3A2D84799AAB76F034816678F4CAA2C03DB0A01F7E6174A2
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 823c5d2db56a40633fb78eb7e3964fd9966c8c2c331cd09b45341d2667d9573b
MD5 1007fcd512f7b118af93318399bff69f
SHA1 3ce3b1b27fe5afe39e28f5504d8a5dd26fb99340
SHA512 0a2d7bf83472525a2c1869ba4c2a88f765fa590d84eea67c7a4b6fdc80f33c5d6f365b8d7ec25ad040491f1eeac531e495ce4336b2c4557f9dc32d7e0cf822f2
SSDEEP 96:stE/dpnRGXbDIk+m/do5h16Z06s7/x+6MhmuecJETvAje/K+gj//T28XM1C7K:stI3LIon6sV+FdETYj55G6K
TLSH
T182E1C6016E64797B4CCBE51DBB25BB53E3F9506271912E58E7F8492C04DB6DC230390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 effba12376195bd7606f028c04a67e3c0fd23acf6cf8d8796507c20131547c85
MD5 5ebaa4650610d016cac3ee794f96c742
SHA1 b31166ff36b4d825d308c130ef4c27510a7b5c5f
SHA512 5d6474eb6f2830fe317789545a82df7a563cb154afbf41abf42463d3105cede5197de553f157231ee82fef6e6783ef6f3a1680df3c6b44a2f31cae6a5dd49803
SSDEEP 96:stE/dpnRGXbDIk+Pdo5h16Z06s7/x+6MhmuecJETvAje/K+gjP/kI8XM1C7K:stI3LJon6sV+FdETYj5Gg6K
TLSH
T1BBE1B5016E64B97B4CCBE51CBB25BB63E3F9506271912E58E7F8492C04DBACC230390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 e3c5209327c8e048b872d241412d05579b1f0d504c082c9c428a383b96b2989e
MD5 0b91dcccdaabdd24fa8ec11a2b9bb31f
SHA1 2ab6a14d8e3f5ef1ceb725f53e0d62ca3e65a0a6
SHA512 2f3a01d704f9622be37b2b63cb2d4defc352ccbd434002a1e2bb0be82eb33ecac7ade0b102b8d7771a2866e85ff212ef6944ce571288ea9c212240d4d26b106e
SSDEEP 96:stE/dpnKXbDIk+m/do5h16Z06s7/x+6MhmuecJAtSMkkje/K+gZfc/T28XM1C7K:stI35Ion6sV+FdAkwj5veG6K
TLSH
T1BED1A4016E64B97B4CCBE519BB25BB26E3F9616270C12E18E7F8852C04DB6DC630390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 0d2f345568a87a851d7135048f99e7337c5a00ab6c1f37376390a2880c6f3c9b
MD5 c1a45b4face0630ebc4b3c0e377f5696
SHA1 1772881983c402849c537750827baff0ea3e0703
SHA512 98be163e70ca860bda2ae4d68f9cdf2a512deb3b6eee8d53791210a4ed0f095266d2d2842278959521e16b855c4a709db814f6c0028d4a5218afa7c003cd2d60
SSDEEP 96:rE/dpnKPSb9Ik+m/do616Z0Hs7/x+6MhmuecJ7v41eje/K+g+fc/NI8XM1C7K:rI3CIo6HsV+Fd7gQj5kog6K
TLSH
T152D1B6016E64B97B4CCAE108BA35BB17E3F9506271D12E18E7F8892C04DB6DC730780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 25c04b373d7a2bf8056eee1d84d777d74ead944276ee154fdab16343fe28b27d
MD5 b27607ded4576517351b92d6d2956dcb
SHA1 525076993fa7da58ecade9e3ee003bcb39bdb97b
SHA512 ba5c2c74c8e77370365024f1b6738ef59a638fd07d8864bf3e965e0a45f161cd1bb84ed083396e574fcf4c912b6c805ddb0ba733f423849149cee7624acfcff6
SSDEEP 96:vvidPlf/ROo1pkF5d1Fii7VaTEv9V5h5pg5+e0J+vnDFq5eWXUYJuY5aNE:y9vZa9lpen5qdDt
TLSH
T14FC1C6A70568C135BF488FEBD8397ECA99A600DF98D5480AD6D2C44C07C2EFC21DE499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 478563d65d62f942da7778e83524769fd50509d01377f855599f19809c1243af
MD5 40e5e6d08f3f1343810f5afe46c6cb9a
SHA1 ede9c6e9845b5027c7258339892ab3bfdc028eb6
SHA512 97ad7b8a15be63dfb698dd5663bf01af43a5b05f8b2c243d05b905aee6464fdef592dc280df9c745913c68698f088ea458694b6c54bfff7ca9619099feb942b5
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\LOG
Size 301B
SHA256 1695ea6c9258f02bd830709b18882aea9f735f4a1c98b4e75b9b5f44085dd654
MD5 c1e78b99b9320f8f55a68084dfcd7ead
SHA1 6d72303c0800498782c1a4f834c52ff6845c9003
SHA512 62024a35f8c36761850ea1064a3d5c5673e2723f2b712c117227c0344dafde0ffedaef1d255d9c6781abbecfd0379629a87eadb3732c659ba188c39cf3ec5a73
TLSH
T1A9E0262156CBCE3B9A9598EF2B32F70CC3A1B005FDDA55121E24E644250B9487012B40
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\LOG
Size 273B
SHA256 23e28eb869abea147eed013a3d7e892fdf5ea9455292a886a183b6243b65a739
MD5 30e45471f9d60fbbe3ee199920994765
SHA1 8749315bd49b1df8a646abd99c01c5b01b81d7fb
SHA512 738bcfdb099a205ae6bca442ac39bb6b0d407bdaa4e0e247b601db8cec1b9e2e1d3b32ac4ace797e69c80d640b9d692990e48c25546a69cc0c046999c7c4e24e
TLSH
T1DCD0C23189CA8E7A8980C8DB5E727B0DC3F4B808AFC53A4A4F08A90828436087034A81
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Visited Links
Size 128KB
SHA256 b7438c454f4162ce5caad7e4bafa4bb6d82ad541edf150fa3c78deafb850fcab
MD5 e8f9e1660d6c26f741c29daddd7788bb
SHA1 4dc8426c92d9eaf504e1d16ccd46f7580a9ebe3f
SHA512 6ca80c7435904be822504648b7423fb02ab6fc93051cc0fc482a84aaecc0fd95acf67fa7881ff4016ac5e2b4124fca2c7dbd832768f7037aae82d54add068a37
SSDEEP 3:ImtVuHyvyll/i//l:IiVub/q
TLSH
T1F2D3045FC30F0C74C0540074C70307453137C3D115D53107C3351C035DC50511713405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 ab4c609a7b5cdb27ff2d69662f3d271c82f92ee243c0512db99abd4e21070516
MD5 5a673b211b85b8618799e2476c2df5fa
SHA1 d5241f058bae5740d3a920882ebc6d2dc351d4dc
SHA512 7d2814ec141850d0f350c208afe63c8beccd67c98050680ef92bcb50154c7e5e61942cf923c3c8215b02250b807411aa1bb4054a364dd9b8e27fd3d177bfa665
SSDEEP 384:4+aQikB+z/xvxjg/qhEw3NBSDggerih8R9za:3/UxvxjgC+wrRZFa
TLSH
T19372AE2A98787E37A5F7E505BA590B5BCBBC94B390C16E7449FA6F0906C73D81342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 a4663e86c122496b4c03836faa988abdb5fb2395c92cb62c2d5a6c452a36f95f
MD5 e46c8f6d8426e72e7510775c7dcf8216
SHA1 411769b66f225b0acd12f8d97e8d36d9bbaf2d2d
SHA512 722b2622e05eff28bc57615279951cf01faa5d6f9caf45e82bd8655a97595d28eb87612b09681c7188d735cd4d3c0fb25ccf435c9b74c9f123dfa3f88d3c54af
TLSH
T1E161D63BA974AA3B8EE29604B9862B27B7655133E5A13F65C6ED1F0D01C73881342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 b6fdb4811b9137c7e8de617f62d0e6d6485e2e4f286db90710c8666ce6a3fc18
MD5 61c35eb17a2c03f4ffd7afe1ba6c4d7c
SHA1 6adda8ab26a4950ed88161063db4bc260c6e6e83
SHA512 0a6fe36c7349c023df74b923760d6a2c4ebfb01d81bbf68855f986cacb9957234fb2456408e606145998626ae4183c5c61a511fbbfa9c087e749f0af7e301947
TLSH
T1D781B526A974B93B8DF2D605BA862F17A7756163D5A43FA1C6ED1F0D01CB3C81382C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 ad36f359d2791626c8a4312ebba88ee8713ab28325b9bdfca214602127ed4bd7
MD5 259b5c009472b005427d8491031021ed
SHA1 d49a5e30f0eb797c6ff42c7d99e95e3f69fe514e
SHA512 c5140512d190175da8eceb743b759e864c664e3b54becc5f8680a3b74fe070d1f465869b432f30c086452c0cf969a69eb678bef259a26a4ff9ab6ae8288f6a6a
TLSH
T19381C626A474B93B8DF2D505BA862B17A7B5A173D5943FA1C6ED1F0D01CB3C81382C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 17KB
SHA256 a8e580cfc859be2e52633cf863547b8817c711847b0642a41610e4d12d45363b
MD5 cea2e25ace314bb43efec63f71dbcc76
SHA1 751b19526c6be45307873d817cb0b544c755912a
SHA512 c8a2f9193b691f8ca2737fc0f75ba4f0b67dc8808903331f279733c8b928a81bb7d83ef63e9cc7ac008739a6ca1af142586e2eef3799bd6a7fa3c0897a1b113a
SSDEEP 384:R+aQikB+z/xvxjg/qhE5NlmqgeskmLh8R9za:c/UxvxjgC+ltmIFa
TLSH
T1CD828D3AD864BE27A8F792457A4A6B9BCBB8916351C55DF48DEA6F0D06C33DC0302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 72e2ad7e40b70d39eac4dd662ca64499df74e5c7c6c7293e0a7bfdc72fd920d2
MD5 34b816f88279c90a01380b3ba900513f
SHA1 be331dd636d6163c696593407a595cf6d240242f
SHA512 d7dc99d124dad3845032e352842e41e4d09a513449b8c4491eb661f10635db119ed22d4e7db7c3c77f8306cf42c03d64501e1f6fec96d83aa943f4876e7cdc6e
TLSH
T18551A733B9146B3789E656487A4A2F33DF3651A3D6612F2086EE1B1C01CB65C2346C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 17KB
SHA256 1875f65ab4305dbd4bb1acdfc0c70d130f6f809a0449bae3365521a97b65eb30
MD5 9f4886146a7294ac4afa4cc82776ec03
SHA1 e4626293c8b8fd2b2d5d68886cee323963665dec
SHA512 83af4756058d67653e468fe39c963fd8dc4b2f780f399b4904b840903207c569552ba79dad01ae06e7f8f7c5c48db3c0f671774b5a163904ff134b6b471c640e
SSDEEP 384:a+aQikB+z/xvxjg/qhEb3NBS3ggeskmih8R9za:l/UxvxjgC+bjtmZFa
TLSH
T11F728E3AD864BE27A8F7D2857A4A5B9BDBB8916351C55DF48DEA6F0D06C33DC0302C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 bea400d075917499fd6cc42cbf5100af18168655df012a6046b9373b58c5d8d1
MD5 de6b7d783a0e59ae63015a9c53daecfa
SHA1 e185411cd2d90a29606b272f3922582463a21a10
SHA512 13015b99deb8ad74c5609f5ee2f98f82e767528750e80053ffa7105bcf2ee68395f80c72d683524bcfcadff08b821dd0ecf84c7f8b23d9bda861ed366f8e4f87
SSDEEP 384:q+aQikB+z/xvxjg/qhEu3NBSDggerih8R9za:1/UxvxjgC+urRZFa
TLSH
T18C72AE2A98787E37A5F7E505BA590B5BCBBC94B390C16E7449FA6F0906C73D81342C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe595bd2.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe595bd2.TMP
Size 1KB
SHA256 7f1cf017875c70561e3ad3384c1817c5b0444a1f8a4ecbf658c657a82c2ddaea
MD5 33df458f87d2c1c1d45f9ba106f427cd
SHA1 f29319d5ddd74b1d5d5f05da3b2d2416e4e0b356
SHA512 8b4ba9002d0b857edb661c9142ea1ffc68b4a76eed9905dd6252a39fc723953a2e311841437889b4587c3c5389b0bccd1415ba3c06dd384852ae59224f770546
TLSH
T1D5216276E2242F37ADC5224633862E676F3161B7C2608E1091DF5B1E02DB18CA36BC32
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\index
Size 256KB
SHA256 a9a455641ea31a8a045791e74496b38e6ec53a69c62dd4a3b43623e734f2d0d5
MD5 0b29cf370810bacc4e8ee5dd42a40a12
SHA1 7d3e3dbf8afabdb4c9b9473db3b2659a8be8ecbd
SHA512 64cf23b018bb3fbb8014d351e756abadd4aa5d1b43e51ce363c66b49fc7d1f7ef55bec138ba0ade3e00e17adbf50f18ab49a9b74049d7e33c5c932b9ff099301
SSDEEP 3:LsOllllklkXlR:LsUlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hashes.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\hashes.json
Size 259B
SHA256 dfd13cd2cd405e866d03c2e9e16aae4fd44af9fc5b449d1e63c0883c351a731e
MD5 696ef99a284c701ab47496bfa2fc50c6
SHA1 331f07cbd1e2f379eb2a25937145210fe12640ea
SHA512 cd2e3171deeb38ed32836d772fdc11e448cc382c55b30ed0129de64ad267eff4c4a3f573058563bb2b6ff84d33820bc52113fbbee58ed41d9fd3a6887844bf4b
TLSH
T161D02EE8921180622FC8C07F020A90603983EAEF1B974920216E021031FBB36B031144
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 979584.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 979584.crdownload
Size 9.7MB
SHA256 6fe4e34d4140fd0dcf70dd5d489a56c3ca6b6de28fc19a6745a3d7eb030c6f90
MD5 b37da17b4c0f17be88c1a4d8ed38f779
SHA1 65f6b893ece9c5f0038ba2f3bfc08d8cd1133d38
SHA512 5659c01c11e750083d29b206ba1abc477e638920beef28f9180f7c8f148ff3c8f1d715b3e052e5afd43a776bbaaf99a69618a94a18aaf474150f3aa3ae6c8021
SSDEEP 196608:lm4L3+yKlLWA4MhfmsxfMgkjvJZ/L8Z4UrbW0:lzKhfmsx0gSvJZ/L5UfJ
TLSH
T130A6AE22F900C032E4D100B2AABD6FFA993D99341B7954D3A7D459BD59305D33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/720-135-0x000002108A6F0000-0x000002108A6F1000-memory.dmp

Download

memory/720-134-0x000002108A6E0000-0x000002108A6E1000-memory.dmp

Download

memory/720-137-0x000002108A710000-0x000002108A711000-memory.dmp

Download

memory/720-138-0x000002108A720000-0x000002108A721000-memory.dmp

Download

memory/720-136-0x000002108A700000-0x000002108A701000-memory.dmp

Download

memory/720-154-0x000002108A960000-0x000002108A961000-memory.dmp

Download

memory/1548-101-0x00007FFD5A5A0000-0x00007FFD5A5A1000-memory.dmp

Download

memory/1692-24-0x00007FFD5A5A0000-0x00007FFD5A5A1000-memory.dmp

Download

memory/7068-1379-0x000001439AB80000-0x000001439AB81000-memory.dmp

Download

memory/7068-1373-0x000001439AB80000-0x000001439AB81000-memory.dmp

Download

memory/7068-1371-0x000001439AB80000-0x000001439AB81000-memory.dmp

Download

memory/7068-1378-0x000001439AB80000-0x000001439AB81000-memory.dmp

Download

memory/7068-1380-0x000001439AB80000-0x000001439AB81000-memory.dmp

Download

memory/7068-1381-0x000001439AB80000-0x000001439AB81000-memory.dmp

Download

memory/7068-1382-0x000001439AB80000-0x000001439AB81000-memory.dmp

Download

memory/7068-1377-0x000001439AB80000-0x000001439AB81000-memory.dmp

Download