Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 15:53
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nexomia.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nexomia.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
General
- Target Nexomia.exe
- Size 16.5MB
- Sample260813-tb4eassxft
- SHA256 fb8a82d843199bbfa0367265ccf883c602101886d78b4bdb71b2668552aed831
- MD5 bbfc4f7b5328a3d188703d18dfee5407
- SHA1 e5cc4cc2fab108758443e85ece1f4a48ad7de98d
- SHA512 f1b4fabaa8a071133b255dc4080cc4dfca95e9cc9c8097bb683fc6566aa233439cb01b5fb31445ce308d14d920a79709a27e122e83464d7b8a1251645b78f5cf
- SSDEEP 393216:nq5WsCI4rAyKKeFOLIYfzA4/pW1zCkq1gQ3M:q5WsCI4l9sY7b/pW51GQ
- TLSH T13107AD43F66280F8C16AC175835A6232FB21BC4907357AEB5BE44B213E66FD06B3DB54
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Downloads MZ/PE file 1 IoCs
flow pid Process 229 2972 chrome.exe - Executes dropped EXE 3 IoCs
pid Process 1468 luau-lsp.exe 5980 RobloxPlayerInstaller.exe 5984 RobloxPlayerBeta.exe - Loads dropped DLL 1 IoCs
pid Process 5984 RobloxPlayerBeta.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Nexomia.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 5984 RobloxPlayerBeta.exe 5984 RobloxPlayerBeta.exe 5984 RobloxPlayerBeta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\Cursors\KeyboardMouse\IBeamCursor.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\DevConsole\Filter-stroke.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\DesignSystem\DpadLeft.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Moments\Reactions\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\PlatformContent\pc\textures\sky\indoor512_lf.tex RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\translations\CoreScriptLocalizationTrimmed.csv RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\btn_newWhite.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Menu\hoverPopupRight.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\PlayerList\ViewAvatar.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Settings\MenuBarAssets\MenuSelection.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\icons\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\icons\ic-remove.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ClassImages.PNG RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\StudioSharedUI\default_user.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\option.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\xboxLSDirectional.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\InspectMenu\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\MicDark\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\models\Thumbnails\Mannequins\R6.rbxmx RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\fonts\JosefinSans-Regular.ttf RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Motor.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\ExternalSite\twitter.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\icons\ic-more-groups.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\sounds\ouch.ogg RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\advClosed-hand.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\chatBubble_blue_notify_bkg.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\InspectMenu\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VR\notifier_glow.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\avatar\meshes\rightarm.mesh RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Emotes\Large\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Settings\Help\BButtonLight.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VR\recenterFrame.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\InspectMenu\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\ExternalSite\roblox.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\chrome_Unpacker_BeginUnzipping4128_693661683\protocols.json msedgewebview2.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\AvatarEditorImages\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\SpeakerLight\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaApp\graphic\Auth\DatePickerDivider.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\AvatarEditorImages\Stretch\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\dialog_blue.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\DefaultController\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Emotes\TenFoot\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Moments\Reactions\thumbs-up-medium.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\MicDark\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\DeviceEmulator\sim_virtual_controller.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\Controls\DesignSystem\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\Unmuted100.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\VoiceChat\SpeakerNew\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\ExtraContent\textures\ui\LuaChat\graphic\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\AvatarEditorImages\Sliders\[email protected] RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\ui\PlayerList\SelectOn.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\PlatformContent\pc\terrain\materials.json RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\avatar\scripts\humanoidHealthRegenScript.rbxmx RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\advClosed-hand-no-weld.png RobloxPlayerInstaller.exe File created C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\content\textures\AvatarEditorImages\Catalog.png RobloxPlayerInstaller.exe -
pid Process 5060 powershell.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2972 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 8 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer RobloxPlayerInstaller.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio RobloxPlayerInstaller.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player RobloxPlayerInstaller.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedgewebview2.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311100856595744" msedgewebview2.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 64 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" Nexomia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell RobloxPlayerInstaller.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff Nexomia.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" Nexomia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player RobloxPlayerInstaller.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000 Nexomia.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" Nexomia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open RobloxPlayerInstaller.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings Nexomia.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU Nexomia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff Nexomia.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 Nexomia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ Nexomia.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" Nexomia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe\" %1" RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" RobloxPlayerInstaller.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 Nexomia.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg Nexomia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox RobloxPlayerInstaller.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Nexomia.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} Nexomia.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff Nexomia.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents" Nexomia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command RobloxPlayerInstaller.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 Nexomia.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 Nexomia.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-ddf602d9cfe44005" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command RobloxPlayerInstaller.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" Nexomia.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" Nexomia.exe Set value (str) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" Nexomia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ddf602d9cfe44005\\RobloxPlayerBeta.exe" RobloxPlayerInstaller.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell Nexomia.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots Nexomia.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1" Nexomia.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 Nexomia.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" Nexomia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-d679641ad17741aa" RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol RobloxPlayerInstaller.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 Nexomia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-ddf602d9cfe44005" RobloxPlayerInstaller.exe Set value (int) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" Nexomia.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio RobloxPlayerInstaller.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open RobloxPlayerInstaller.exe Set value (data) \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff Nexomia.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell Nexomia.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags Nexomia.exe Key created \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 Nexomia.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" RobloxPlayerInstaller.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell RobloxPlayerInstaller.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe 1648 Nexomia.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4128 msedgewebview2.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5060 powershell.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe Token: SeCreatePagefilePrivilege 1448 chrome.exe Token: SeShutdownPrivilege 1448 chrome.exe - Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 1648 Nexomia.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe 1448 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1648 Nexomia.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 1648 wrote to memory of 4128 1648 Nexomia.exe 85 PID 4128 wrote to memory of 3532 4128 msedgewebview2.exe 86 PID 4128 wrote to memory of 4140 4128 msedgewebview2.exe 87 PID 4128 wrote to memory of 4140 4128 msedgewebview2.exe 87 PID 4128 wrote to memory of 4140 4128 msedgewebview2.exe 87 PID 4128 wrote to memory of 2204 4128 msedgewebview2.exe 88 PID 4128 wrote to memory of 2656 4128 msedgewebview2.exe 89 PID 4128 wrote to memory of 2656 4128 msedgewebview2.exe 89 PID 4128 wrote to memory of 652 4128 msedgewebview2.exe 90 PID 4128 wrote to memory of 652 4128 msedgewebview2.exe 90 PID 4128 wrote to memory of 652 4128 msedgewebview2.exe 90 PID 1648 wrote to memory of 1468 1648 Nexomia.exe 96 PID 1648 wrote to memory of 5060 1648 Nexomia.exe 111 PID 1448 wrote to memory of 2444 1448 chrome.exe 121 PID 1448 wrote to memory of 2260 1448 chrome.exe 122 PID 1448 wrote to memory of 2260 1448 chrome.exe 122 PID 1448 wrote to memory of 2972 1448 chrome.exe 123 PID 1448 wrote to memory of 5144 1448 chrome.exe 124 PID 1448 wrote to memory of 5144 1448 chrome.exe 124 PID 1448 wrote to memory of 5176 1448 chrome.exe 125 PID 1448 wrote to memory of 5188 1448 chrome.exe 126 PID 1448 wrote to memory of 5176 1448 chrome.exe 125 PID 1448 wrote to memory of 5188 1448 chrome.exe 126 PID 1448 wrote to memory of 5472 1448 chrome.exe 129 PID 1448 wrote to memory of 5472 1448 chrome.exe 129 PID 1448 wrote to memory of 5492 1448 chrome.exe 130 PID 1448 wrote to memory of 5492 1448 chrome.exe 130 PID 1448 wrote to memory of 5780 1448 chrome.exe 131 PID 1448 wrote to memory of 5780 1448 chrome.exe 131 PID 1448 wrote to memory of 5840 1448 chrome.exe 132 PID 1448 wrote to memory of 5840 1448 chrome.exe 132 PID 4128 wrote to memory of 5940 4128 msedgewebview2.exe 133 PID 4128 wrote to memory of 5940 4128 msedgewebview2.exe 133 PID 1448 wrote to memory of 5380 1448 chrome.exe 134 PID 1448 wrote to memory of 5636 1448 chrome.exe 135 PID 1448 wrote to memory of 5636 1448 chrome.exe 135 PID 1448 wrote to memory of 5772 1448 chrome.exe 137 PID 1448 wrote to memory of 5772 1448 chrome.exe 137 PID 1448 wrote to memory of 6068 1448 chrome.exe 138 PID 1448 wrote to memory of 6068 1448 chrome.exe 138 PID 1448 wrote to memory of 5984 1448 chrome.exe 140 PID 1448 wrote to memory of 5984 1448 chrome.exe 140 PID 1448 wrote to memory of 5600 1448 chrome.exe 139 PID 1448 wrote to memory of 5600 1448 chrome.exe 139 PID 1448 wrote to memory of 2528 1448 chrome.exe 144 PID 1448 wrote to memory of 2528 1448 chrome.exe 144 PID 1448 wrote to memory of 3184 1448 chrome.exe 145 PID 1448 wrote to memory of 1512 1448 chrome.exe 146 PID 1448 wrote to memory of 100 1448 chrome.exe 147 PID 1448 wrote to memory of 5420 1448 chrome.exe 148 PID 1448 wrote to memory of 5980 1448 chrome.exe 149 PID 4128 wrote to memory of 5752 4128 msedgewebview2.exe 151 PID 5980 wrote to memory of 5984 5980 RobloxPlayerInstaller.exe 158
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1648 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=1648.4668.68396792346197862302⤵
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:4128 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff8e97eb078,0x7ff8e97eb084,0x7ff8e97eb0903⤵PID:3532
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1704,i,13583329411304446431,12717156062699166769,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:23⤵PID:4140
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2008,i,13583329411304446431,12717156062699166769,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:33⤵PID:2204
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,13583329411304446431,12717156062699166769,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:83⤵PID:2656
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3576,i,13583329411304446431,12717156062699166769,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:13⤵PID:652
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4544,i,13583329411304446431,12717156062699166769,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:83⤵PID:5940
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4488,i,13583329411304446431,12717156062699166769,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:83⤵PID:5752
-
-
-
C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe"C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp2⤵
- Executes dropped EXE
PID:1468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | Where-Object { $_ -ne $null } | ForEach-Object { $_.ToString().TrimEnd('\') }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1448 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff8e57ec728,0x7ff8e57ec734,0x7ff8e57ec7402⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1804,i,15819413872978307034,14339926715046686554,262144 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2052 /prefetch:22⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,11508892213175374844,13425442864760636261,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2324 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2456,i,9100526169338693230,7611108242377497917,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2532 /prefetch:82⤵PID:5144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,10765153387649911926,15445564619918555306,2097152 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3224 /prefetch:12⤵PID:5176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,1985301317930561646,9098274467619239891,2097152 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵PID:5188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4608,i,6493072055865466107,5221058738860304219,2097152 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4616 /prefetch:12⤵PID:5472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4636,i,8641709090736339125,3905545723728675120,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4760 /prefetch:82⤵PID:5492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4828,i,10498936217270586022,16986709332161426301,2097152 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4812 /prefetch:12⤵PID:5780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4744,i,10445501609572255683,5428755947494320946,2097152 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,7483654386592771277,546179231945705971,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5608 /prefetch:82⤵PID:5380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5684,i,3854415912074510940,6617493668530957532,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5728 /prefetch:82⤵PID:5636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,9395724477971013884,8512452306386030838,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5600 /prefetch:82⤵PID:5772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5308,i,14161829901410115586,1425922567490560544,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5872 /prefetch:82⤵PID:6068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5864,i,1904851484071120785,1638507410954969481,2097152 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5940 /prefetch:12⤵PID:5600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6000,i,6691031661115674054,451358346204830726,2097152 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5908 /prefetch:22⤵PID:5984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6300,i,4555390203430918256,8554953087109332575,2097152 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5884 /prefetch:12⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,10150053045579961806,11563381297889274659,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6208 /prefetch:82⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=240,i,4000655190509839206,2077504800623837730,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6240 /prefetch:82⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6248,i,16079882939086117934,5055616339816710335,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:82⤵PID:100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5720,i,12511382361600143759,15724697516724620992,524288 --field-trial-handle=2056,i,12025265839673320676,2596190752727845,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:82⤵PID:5420
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5980 -
C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 59803⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5984
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5356
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5540
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
- Size 9.7MB
- SHA256 f2f9ad7aba372d43ca50ee83601d00d1701321edb932a6c31c5ba67d96c107f4
- MD5 a2b255c734df85929ce2d1e2e749fffd
- SHA1 af83105488e39ef51738fbdd7e5f2c5592c5cbff
- SHA512 07d841881202c07d6c2cc7e095955afbd3ca5a4f3184323d24a7a135432b7cb0de3caccff88b313c745d74aa3f13c833b1e35e3275242ecf0c300984c563637c
- SSDEEP 196608:6OooX5s0KmLj56WsdmsxZOdr3EV1MbU7H73Zv7Y4N:60KNdmsxZOJ3EV1CU7H7NN
- TLSH T1CBA6B022B900C032E4D100B296BDAFFA997D99341B3954D3A7D45DBD5A305D33B3AB2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Roblox\Versions\version-ddf602d9cfe44005\RobloxPlayerBeta.dll
- Size 20.3MB
- SHA256 7e411ae89687e566d366f56ecc5efe7836d0716b33aba66bd6aed27777374f91
- MD5 5128fd95566b86fdd27eeecc48a2143a
- SHA1 9f678f840e1d04e1f4d002f1b9f73b81696a4982
- SHA512 d56bdfd09d2ab46b27328c59973d8e9409c81bdd7d04df9a1471fd6e1758e828fcba7de386340b4d3ef2130520a6b8e0bc715d98a01a1316baef1d84d535eb13
- SSDEEP 196608:s0XjFT+k2vokETkwPZ+t5SulHmbuRwkMk6ZHQk+ZX:sgxTb2NE9PZ+6ImbUwjxZ+Z
- TLSH T18127CF4EB5D60AE4D5A24070E05F57D3E622304C0AA92EF787D902613A7378EA95CF7F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping4128_693661683\manifest.fingerprint
- Size 66B
- SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
- MD5 06d2b48de0edcb3e022ed639f0fb0085
- SHA1 32f93d5a76998c407087269794026d1ea028828f
- SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
- TLSH T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
- MD5 SHA1 SHA512 TLSH
- Path C:\Program Files\chrome_Unpacker_BeginUnzipping4128_693661683\manifest.json
- Size 135B
- SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
- MD5 616eb6b585f16811dc5db5063e088cd7
- SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
- SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
- TLSH T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 0ee83dc625de7b3d7a0a8cfe28432ecadeffbac1f866a43ae372ecb410e7dd11
- MD5 13980d25ca704d41399fcef7ce7ed810
- SHA1 72c735a101299d515f1b91605f4fac80bf5179f1
- SHA512 52b2a3d47e82383aeaf8dde5642b2917af4901eafa26ed78e7c56d2daa50b6cf468e2d707c3ff1a083a974804e760cb0bd2ea23fd9d943628112062b71085961
- TLSH T187E02BB9CC61FC2B2CFE1728A0514746F718135B2A80994B7A3D950C8FF1A3A565581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 5dceb7d47006209baf48b0ee432811405ae71654d86e3a9143cb307307c6d2c7
- MD5 14076b97bd6750d056b79da7ce703006
- SHA1 8949ea7b6354e3556f6f7453254566fefe6adf54
- SHA512 e859f46eb4bcb72de84f1cc6c1ec118a5b001be6a199f39142c96649703f64021cbf2753e7fdf36d78f25b7a7f6d24cad104e6605ff9525da96252e176dd843b
- TLSH T1D8813B04F6E05C01CF5D02F04FA36D246AA81667D2C6ABE773057C33B1932E81263ED8
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\_locales\en\messages.json
- Size 593B
- SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
- MD5 91f5bc87fd478a007ec68c4e8adf11ac
- SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
- SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
- TLSH T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_1\craw_background.js
- Size 531KB
- SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
- MD5 6eebed29e6a6301e92a9b8b347807f5f
- SHA1 65dfb69b650560551110b33dcba50b25e5b876de
- SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
- SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
- TLSH T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
- Size 23B
- SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
- MD5 3fd11ff447c1ee23538dc4d9724427a3
- SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
- SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 1eecceced3a212871740cd7ae6692f0d0278957528616daa291baa7f64f98470
- MD5 da494782f0cb7449b071967cce1ab3de
- SHA1 c8fcb6b307ab1ca41cfffbb2864aa897681e584b
- SHA512 931bf6ade812c21dbac07ddef90f01703febd755db1b37947d8e5bc7693e4be0ede1776818b48a522e106c313482016fbe441f72f7230d997696e87134d96d67
- SSDEEP 192:AR/YHvDv72vAPRp2qh9THsb+WNn/VtKY2T2jTaJIUyVyIsnAUge:AR/YP7C6X/FwdX2QTaqje
- TLSH T1CF42B51EA960297B9DDBD21AFA217B27F7F5107135D42E84EAFC852C04E76CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 4e6ab827e143b0d8ea243af0b57485b578e120ba76982139861915ad035ac569
- MD5 2353d88f156aeda12bf0cd13cf6f7447
- SHA1 8031301ac16429bf61c133ca33a3e83de94e7b53
- SHA512 7bcafb3f286473f630ba84fa8ac27016685bc9c0c443a17764e59a8e561c4e13e43341a8387b9d3a59da0cfeb89c1432f92e8888d10b40dc7d9d02d36beb80df
- SSDEEP 192:AR/YHdDv72vAPRp2q69THsb+WNn/VtrBEw2jTaJIUiVyIsnAUgE:AR/Y97C6XgFwdbEBTaq/E
- TLSH T10442B61EA910297BADDBD21AFA217B17F7F1107135D42E84EAFC892C15E76CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6af492ba9c3b487740b84eda418b29aa9e1b749194088cf389c5a47008b4f846
- MD5 46482a68ad6c95284748b1446d6ef716
- SHA1 3d6825a6f1bd95dc0ac9ce9f25ac26b06e8277d3
- SHA512 43520204cfbb4c3b48da3cd73a683ec497e26f2c76b328595b4970003eddab532a32bc613f00ca36313bb9146560a90bb03c771b45126900c6317811d2ae6d90
- SSDEEP 192:AR/sHdDv72vAPRp2q69THsb+WNn/VtrBEw2jTaJIUiVyIsnAUgE:AR/s97C6XgFwdbEBTaq/E
- TLSH T18442C62EA910297B9DDBD21AFA617B17F7F1107135D42E84EAFC892C15E75CC222701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 11KB
- SHA256 f58c36ae0fd8be9d3e122d4891302341e1a9e44d9070008b8e7a0bd26789526e
- MD5 03a2848188e3b48334b912e7800a6abd
- SHA1 7a7f8624b451c6e1287de2769d0e281486232e0d
- SHA512 5d393002b6c221d75b69d26b7faf51b6d979b92b8ebeca7b53141dc90854a24c61f27fb4329976d859e17597e9977b00fc2bb362f2b4809b92be2b9c8f5fcee9
- SSDEEP 192:ee14K6IW7KxkXqK4I40pUZNCgVLHrKHfFKslEK2cXzKD/Ty+ErUkKN9EIB3Wh/+2:/1jbW7KxkXqKf/pUZNCgVLH2Hfgslqcz
- TLSH T18A32C627988D9A3F4FECD55CDC566F4F6DB102A273780C2896FB9C0403A97CE115A1AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
- Size 96B
- SHA256 980b84255d4ee42995662446ff414758a5c1d65df95dceeee9020a22de84f1ab
- MD5 0812383def47118aea4913ffce6227c3
- SHA1 1850b3821a1f18d2abf7f2b9b1dca658899903da
- SHA512 5a503df7cf3af2941c38f81a81e659c863699d1ec6a9201af387a7d5cf085ee98b661dda924b56e3eb6b36db3fdab8164ddac6afd79effe26207037d38959314
- TLSH T1E2B0125590700422EA0082F210E0C0A13330180495A2030B319E08F3CD1E3B45902B44
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5a189a.TMP
- Size 72B
- SHA256 1d4f27f466dee9438f127b27975da21897bb47d035a6a4558a63e4391be23662
- MD5 eaef1c3c010cafc574c06121537f58b1
- SHA1 1fe3c352c2143f996f0bc39fd94bcced42d4ba84
- SHA512 0b27bb6b6c5d326116fb16b7098bc9ce55eacef77f02ba77c0edfe08c56a8275504cb7fafaa62346dfbb9477d012b4d9725a4d8f9fd8e64cdf31fdec7cccdde3
- TLSH T173A00261B6504021D602427160E1826733718C557953464B48920CF4DD5E2847501790
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 94d38f9cc276766f9f08c6f13314e8f4279a0b44b26cdb60ee2a9c0f52fc27e3
- MD5 2778df497d2017731dcdf8f60bbcbe25
- SHA1 8afcdbaff6095c819f7339502ffe095a5d9a38e5
- SHA512 1d2db1a147d9b7e030634342aea1ad7b5ccf159bc412996d99597fd54f2ce5974f30f196c4d24f4ccd73fbfc31640919312d1cb0a181354f2c6c980e09d4aba6
- SSDEEP 3072:RGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMm:Am7Rkm1tYpBeh2BAom
- TLSH T196C3123B5E70E9775979BB4EB08E0B1F1EF14AA2D930DA42C8D85A0437FA7CC1A45934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 238KB
- SHA256 778060ec387e8a6b2973cdf889e4e3b6721553d34c7d5a1c23e70bec8a005551
- MD5 f681efa1bc6e23acd070c772eb6ea0fd
- SHA1 c19fec0f41651c2e6f0b634c606c198708d7f41a
- SHA512 82eb30857206f7223c68e68b0623ac6449ec2ad40bd122377b7e78b1d9969d370757a1257480f236d105cf24e850d60037d13820505497b57537b69bd4eab6e4
- SSDEEP 6144:M513TeZk2Mw/oCeg2McKw65bd6m7Rkm1tYpBeh2BAoN:y3KZ5V5JwYj9oBGcAoN
- TLSH T10F3413162EBCAE765D7DBB0FF44F0E6F1DB00B92C510D90388D99F0462E5AA91126F78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 239KB
- SHA256 1cac8d013c994bdede90c6b791426b7acce762d5365267ba1c6bd90d439a1951
- MD5 a3349ec8ec1a6afbb8f9227b74b9774e
- SHA1 1f02df5f27781a646e206e0fa438a201f87dc5e0
- SHA512 5c6ba33e4df392f70c4944af2aa8cdf3c7592fba1d469dfa65fd5f0c29873a286ab8db7b87b12f3772001424a20a861ceac43c32bd8961166380ad08e9d60443
- SSDEEP 6144:bs13TeZk2Mw/oCeg2McKw65bd6m7Rkm1tYpBeh2BAoN:A3KZ5V5JwYj9oBGcAoN
- TLSH T1593412362EBDAD766C79B70FF44F0E2E1DB04BA3C510C90788D99F0462E59991226F38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 238KB
- SHA256 7898a7f7d773ebcff522a03c7f212ee8831d7e444f26be3563802c71135eece8
- MD5 1d7736d26988fe9a5ce608cf604aa8a9
- SHA1 5f8260f0c04609df30d42360cad95fb1e9d7cc8f
- SHA512 da08996e0a9f91776280e7e123ad776fcba9fa334bd24e1f8987fddd145541173edec0ef24f65e2d7976131470e52311078a0e47bfd44a16bef90c2f5959b974
- SSDEEP 6144:7513TeZk2Mw/oCeg2McKw65bd6m7Rkm1tYpBeh2BAoN:z3KZ5V5JwYj9oBGcAoN
- TLSH T1143413162EBCAE765D7DBB0FF44F0E6F1DB00B92C510D90388D99F0462E5AA91126F78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5drofrgr.s4c.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1673297433\92763f8b-bb0f-465a-8b15-599057ec8ff5.tmp
- Size 242KB
- SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
- MD5 541f52e24fe1ef9f8e12377a6ccae0c0
- SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
- SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
- SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
- TLSH T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1448_1673297433\CRX_INSTALL\_locales\en\messages.json
- Size 450B
- SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
- MD5 dbedf86fa9afb3a23dbb126674f166d2
- SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
- SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
- TLSH T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
- Size 3KB
- SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
- MD5 5e2067a92dcfcb05537479c384a89725
- SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
- SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
- TLSH T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 eefba6a828a898ce4108da5a40596bedd0cf5d9dfb0735925d0a053cb505a424
- MD5 85a298ab23b9d7500a0cc0dda8aa944e
- SHA1 76648f836db9846609deae708761b756d0e2359f
- SHA512 135c1ab41a930f7c032341f9ceb480a7db59af0c1c319e9090a808102417fc79d6ca12dae0b456575d6754ca393b91681cd3b02d0d8828a69246ef3569f2094f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 b8f4b8dd4a5ab3881b135ae43a45402fdc2c08ad3042db59df91050997f6a9c7
- MD5 e657e03ab30232a9bbe9045921d6a549
- SHA1 95ec87b81d72e7b4ad5c831cbc838862980ef755
- SHA512 49dd1d944df22edf7f342b0038d1c4d7c7db40ebaa5b83b52e9d5f4e0a708de4b4193f3982029103bdf217a5d81ebd0798ea8f88f0b14cecca96617c98dcb3e9
- TLSH T199D012563B014634C0213433026361081900C54F804940405429861D6B480900E42851
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 3b89d5c48bb8a4d3beb962c46f702f36f998b877101c471d657848ccd0121c67
- MD5 b5681988d72579d5413a9c0c1429d86e
- SHA1 b2d97af9f86726594acab44876cd88b4f30c545b
- SHA512 6e6c470fc3f854110389bfd8aa6b6c514355734873b664a08a371064219731a78bcd564ced0054344c4df8992bb63d5142f6d8fd67fff4b8219357a7e543c666
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 648B
- SHA256 c3235b3339549bc1035b8b07a61d189174cbbc174862239fcade86ff565f3c7a
- MD5 7c4580ff014d023eb9a33bba0a75def8
- SHA1 9631c155260f41316bd9b4b3d30287acfc3c4da2
- SHA512 1405117e95f9348cc45fcbb41aa77e49e4b13382edc241a9ecb1b0ce5f44ee44a82fcdb48458c166c5c9c4995abbdf2286c13ac1fa6980bff36372dc1c3b4c49
- TLSH T103F0EC0BEBC9C401CF0292BE38391F237A04282F290C378346920CB35B434D2B05C914
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnGraphiteCache\index
- Size 256KB
- SHA256 215567f44abf8ba3774f9f9ab4f12258c4493b918d28168e70bba53e21404063
- MD5 85c5dcc9911a64e89b4225a97ad3db2e
- SHA1 9e3b754d0e4e8ae0e3010871c3db6bc6f728ff88
- SHA512 706b2a79bfb7e82bf54ff929a00e243520c2a2a4d49a7bb573f4e6419d29ec26ff6c1b80af1f52877679c2907012d8934b1a088c6ed7b9cedc7b32e06de5c084
- SSDEEP 3:LstlNllkll/lX/:LsX3lEtv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
- Size 686B
- SHA256 3ec06fafcebbdcf224a7c9264ecfad215065477c27bc2b96c12bc852b538dfef
- MD5 dc767f3a4b2db6f154f58ee512ceed2d
- SHA1 6db07093cfb28e058ad940e7821240a47e502bfb
- SHA512 590f85ff20c0af6d1c81e380439c400e3cd736fc528811904132d9a32f2fdb7b2881783393f1dda883bdabce5786b64ff72f881d23f77057dd1415fea4b89be6
- TLSH T1220194E187E0C57D4E4117E427347817CD3E040992287D27DDDAFBE59BD20B6D11150B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe599745.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
- Size 7KB
- SHA256 9282ba4c02b86a6beea5d17a4587ab78466324b01d974cfd0a1ac857f3af2cf8
- MD5 ba639deb6efd6975d4560194f0203f86
- SHA1 7c5f8d1e4fda1564c5f1cfeba7c11787c6976b72
- SHA512 bbbcb59c4661644efcff686554fbfca1885b62a08b102e34968a92ce06638cd9f55620d04bfcd9b6ccf37e94fb0554644b33af2eb656765cc74d5bc852bdc9cf
- SSDEEP 192:stGo0xTB6fMOZ8pa78GR/S+WiT+LCdE4kJA6KC:stGxxTB60Jc3R/VgCKrKpC
- TLSH T1E8E1C802AE28697B4CC7F60D7936BF56E3F6106262D00E48AFFD861C05E66DC630790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
- Size 6KB
- SHA256 53769d6c2d812a90b6785f16fb9bd5be82d576028109ce0e58094accb751c8f2
- MD5 4fb3ac50fd58916585ee76bff1bba277
- SHA1 3ee48f7f424ccebe1bd657e7f5b3104a2dbd7c64
- SHA512 84cb6562d085448151a915203ae35c5e8e9395563a6171d93e32e9ddc57ed538eb4c582c99174d9c7f5d9fe48ee7478cfa12386cd162dc1d8c799a38227c9c43
- SSDEEP 192:stGo0xTB6fMOZ8pa78GR/S+WiTQQodE44wAbMC:stGxxTB60Jc3R/VHoKz3oC
- TLSH T152D1B802AE2869774CC7F60A7A35BF16E2F6106261D40E59EFFD861C05E66DC330790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe59016d.TMP
- Size 6KB
- SHA256 170f32340dc76dfa5dfe837a7c19a205dab2e6f2b9bfb86e55f85335d58dc9ad
- MD5 ac6bdb904c11349052a2ab521727d20d
- SHA1 714067ec317b9e142578321acf90761f849b2dce
- SHA512 f841a950fe80e473da9ff22480f8931378640c88e70fb7a55312cfd7e56387e4a0a6f27707b3cc17bd8379e8f527553256004af6c69bcb1dff50364dc2a611fc
- SSDEEP 192:stGo0xTB8fM2Z8pF78GR/S+WiTGmqmwdE4X2wAbM8:stGxxTB80BR3R/VC5mwKi23o8
- TLSH T1A4D1A6029F28697B4CC7F2097935BF06E3FA106165D40E59EBFD862C09D66DC620790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 17KB
- SHA256 816f4b63696bc6836b8bf6675991671187fb044d6afe572dff7c4eeb77574fda
- MD5 4c063aeaa703fa2b5a5f0a9e3ded202e
- SHA1 084885babd800a5fe268c2b19f05e7e6e0083914
- SHA512 e31f2155beb473c7a233d7b7ec5dc996b05d03607b12dd1d906e123f3ff0ddd2b37b0ac7eb5b6db0d636fc105f91b6faa5076034df8e1298f61ddb4381b45fa3
- SSDEEP 384:zKc+aQikB+z/xvxjg/qhEhNbpgc//V0zZYeuKVRtVVN2UBn9zL:W7/UxvxjgC+tgcF0zZYTGtVVN2UpFL
- TLSH T154828D3AE469AE33A8F3A541760A2B8FEBB445A241C11EE88DED1F0C07C73DC1706C06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 1KB
- SHA256 612381e252599ad0d9d57a420e6982f93aad39ce13fea0d591f2b85aecb7cdd5
- MD5 e4ad37456478303046769c5e80bd957d
- SHA1 1c52d94ab2de43bbcde1c14d9ae739addad29766
- SHA512 0cb04fbf1f5b346e246aa580e697d38bb7f40493106e2931ca6cff1a4c0ec235c8d67805c9715eb461fcd633f0488e447e855f47f8148ae0515815e902df13f0
- TLSH T183318573E9946F36AC817252B2453E5B7F21106AC2618E04A2EF4B0903F75DC9A3BD33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 2KB
- SHA256 66de10a67b53de38514a6f58dc02a559aaa93e52aae6e4fe25af5a2ab7419da0
- MD5 6826bc253cb236e79dfdd5a40482b088
- SHA1 90895efa0cfa85408d19255e936700c86229e34f
- SHA512 537001135b39d03eeac08764c832f90c473af3b1d953a173e2fc8edf9613e56b48eb7e5551b694e082a568d1920b672e30d73cee224f70480d2789eb87a3ed80
- TLSH T11951B733FC58AA368992654179493F12BE3650A5DA612F509ADE0F0C02EB59C1313C37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 3KB
- SHA256 79f6288ddbc79cb938b5cd8b2dc6cb3dd818f8d5f5c5625543d14d7acd5e7286
- MD5 ce41b2b5f700363f8755e99994324679
- SHA1 a481276f02dd4c0f98de415dcd80da035ad3784f
- SHA512 20ba35efd132cc7ee436267fd793b62e745333b4b98105b7e737ea3d30ebea4af637019dd79cb402835d26eafe2b5f7619d117de27e89061e842ec96f1d238c2
- TLSH T10D71D636AD68E93B4DE2A901B9853F06BBA61137D5D53F95CAED0F0C02DB2D81312C17
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 4KB
- SHA256 f43a921522bbc56e80f727fe02e50fa9b5face90e8c64fa87207411097bac91b
- MD5 30838f040a545d65bc54be016d377184
- SHA1 5dc27ea750468b8a6b9228ccd9b6a873200872f2
- SHA512 fbc21e8e8fa1c2d7599b9eb3725eddb28425b7c8931c99b8ae210de09cb170e41cf9ba4a2aaf22e4cada030ca1662f47d00be40a98256f676fc7f1e7837bc7e8
- SSDEEP 96:zutibNkCELf9t4BT2Z/JG8Frh/cInURoDoto+5GObcDGzvBYBZuW6hHZ7FKTVWlu:zKibNbutOTc/fooDUhGOKGzZYBZu1SVt
- TLSH T16391C522B964AA378CF2E905B9463F07BBA55067D5953F98DAED0F0C02EB2DC1302C17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 16KB
- SHA256 ea7add81a4494767e28ea6dc0428e6ebecd79c2080c059b072828463eb1159e7
- MD5 172770ddd411440e9fee902e30cc05c6
- SHA1 4852720ee1a6e6c938eb5470827077dd1ccf46df
- SHA512 e1e668fb290093688bfa482bc27034709008130bda4c8525def74511e7de201ec2f63c3d2febfd4f951c6a7940bd456a38d24a3e7db36331c387fec300ef0882
- SSDEEP 384:zK6+aQikB+z/xvxjg/qhEwNbpgc/lV0zZYeulVN2UBn9zL:WF/UxvxjgC+Wgc30zZYTlVN2UpFL
- TLSH T164729E2BA4686E33A8F3F90179591B4FEBB584B284C16E784EFE5F0903D72D81302C06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe5870b6.TMP
- Size 1KB
- SHA256 16554cc019f5716be7e930c446aa2e92efd325ee0a6687fedc9986b342480842
- MD5 eb1e278cd62e262fc385d43c690f465a
- SHA1 d55678673a95f86345cb10780b47b93aacbd4fcd
- SHA512 d14e598555e690c08e2b185d84b696ed226ea2a0792ac7daab21f328b5e5b6d92f078cc50eb4cde6ebced0aa2027b11751f43bb2204010d6fcec4ceae1230aec
- TLSH T19A213577DC987F35A9456552B2027F8A7E50516682659E08E2DF470903E74DC863BC33
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
- Size 16.3MB
- SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
- MD5 be087717213e34f06e6198159d9c73dc
- SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
- SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
- SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
- TLSH T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\win.nexomia\Scripts\Nexomia\Nexomia.luau
- Size 43B
- SHA256 5f2b7ea991bc4c8439dc52b21c560a4f46b0d15c5fdf095801b4861e3fa6ff5c
- MD5 81433d3776b7a6836de8364390c3bca2
- SHA1 cbcc35e73c8209f003b3ab16579a64462950ffb5
- SHA512 db92b41d40da22fa0bfac8c42e3547c8acbf7c1d51f7c526e2202657638016b33007f8ab3f70a388ea101deda5fbdbc8d729fd0f0a76cc0ac6e3feadce1a740a
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\win.nexomia\Tabs\f96a9714-8f98-4959-97c2-240fc52582e9__Untitled%20%231.luau
- Size 5B
- SHA256 ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a2
- MD5 f7531e2d0ea27233ce00b5f01c5bf335
- SHA1 6d0d5876e6710ebb4f309b5af01090cb97381d06
- SHA512 06460743cfd9c7f3c8ca1c85298f53645b50feb10d09bcd0ead7c494ec7d11c477c83ad8ab9d1c0345c0e3ff3637954f2cc139f34c8b4b9ccb49a92ca3ad77a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
- Size 13.0MB
- SHA256 2d9372b6f31b6d0c12b13b23fe0e28d556d86c97277d6a9d13cac2c8cf49f1e1
- MD5 5786766febdbf9e5564cc22bded311ef
- SHA1 b9eb8b6689d1d0baa720de82cc7273457a7d818c
- SHA512 a943a75b020485c9f26d2d916fa5ae4cdca834b7b4b7c288de8fe1e793c2c3fd076f4ff844b783af69de363776173811c2ca0127894b077376714cc3a56a15ea
- SSDEEP 196608:sQ5I1Y6lgMxsMh/vlKV4BmJsuCnuE5P5edeL:sa+YWgMV/vk6BmyuCv5yeL
- TLSH T1CED69D5AB2B800E8D4BBD178CA565613EBB1741603709BDF17A046BA1F63BE46F3E350
- MD5 SHA1 SHA512 SSDEEP TLSH