35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7

Analysis

user interaction
yes
max time kernel
70s
max time network
70s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 02:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia(1).exe
Size 16.5MB
Sample260815-dgep5axeld
SHA256 35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7
MD5 411e27893f6e210f32cea7e28662adb2
SHA1 2c1f7771a8e24691bc39f7bf17609fa9cf628e2e
SHA512 1528111cc2a8313ccae7ec49c7b7ad911c0603ff4583a2fd19810dbf808142182628d0441baa0ffd42cb78f17a3f11e914b50f9595cf422d357771a4862622e6
SSDEEP 196608:GVXku+QMSrEM6IJZCsQdYXK7lDJl2zRwRLKAyWMsSt3K+zdY4HciDnzjW:MXkZXC/QdYXKoz0mAAsgrzCkXzj
TLSH
T12B07AD43F66280F8C16AC074935A6232FB31BC4907357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5540	Nexomia(1).exe
5348	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia(1).exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia(1).exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4396	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4800	cmd.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
404	timeout.exe
1800	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe
4736	Nexomia(1).exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5884	msedgewebview2.exe
4972	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4396	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4736	Nexomia(1).exe
5540	Nexomia(1).exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 5884	4736	Nexomia(1).exe	89
PID 5884 wrote to memory of 5712	5884	msedgewebview2.exe	90
PID 5884 wrote to memory of 3284	5884	msedgewebview2.exe	91
PID 5884 wrote to memory of 3284	5884	msedgewebview2.exe	91
PID 5884 wrote to memory of 3284	5884	msedgewebview2.exe	91
PID 5884 wrote to memory of 3284	5884	msedgewebview2.exe	91
PID 5884 wrote to memory of 2752	5884	msedgewebview2.exe	92
PID 5884 wrote to memory of 3624	5884	msedgewebview2.exe	93
PID 5884 wrote to memory of 3624	5884	msedgewebview2.exe	93
PID 5884 wrote to memory of 3624	5884	msedgewebview2.exe	93
PID 5884 wrote to memory of 3392	5884	msedgewebview2.exe	94
PID 5884 wrote to memory of 3392	5884	msedgewebview2.exe	94
PID 5884 wrote to memory of 3392	5884	msedgewebview2.exe	94
PID 5884 wrote to memory of 3392	5884	msedgewebview2.exe	94
PID 5884 wrote to memory of 3392	5884	msedgewebview2.exe	94
PID 4736 wrote to memory of 4800	4736	Nexomia(1).exe	95
PID 4800 wrote to memory of 4396	4800	cmd.exe	97
PID 4800 wrote to memory of 4544	4800	cmd.exe	98
PID 4800 wrote to memory of 404	4800	cmd.exe	100
PID 4800 wrote to memory of 5540	4800	cmd.exe	101
PID 4800 wrote to memory of 1800	4800	cmd.exe	102
PID 5540 wrote to memory of 4972	5540	Nexomia(1).exe	103
PID 4972 wrote to memory of 1364	4972	msedgewebview2.exe	104
PID 4972 wrote to memory of 556	4972	msedgewebview2.exe	105
PID 4972 wrote to memory of 556	4972	msedgewebview2.exe	105
PID 4972 wrote to memory of 556	4972	msedgewebview2.exe	105
PID 4972 wrote to memory of 556	4972	msedgewebview2.exe	105
PID 4972 wrote to memory of 1456	4972	msedgewebview2.exe	106
PID 4972 wrote to memory of 4432	4972	msedgewebview2.exe	107
PID 4972 wrote to memory of 4432	4972	msedgewebview2.exe	107
PID 4972 wrote to memory of 4432	4972	msedgewebview2.exe	107
PID 4972 wrote to memory of 5248	4972	msedgewebview2.exe	108
PID 4972 wrote to memory of 5248	4972	msedgewebview2.exe	108
PID 4972 wrote to memory of 5248	4972	msedgewebview2.exe	108
PID 4972 wrote to memory of 5248	4972	msedgewebview2.exe	108
PID 4972 wrote to memory of 5248	4972	msedgewebview2.exe	108
PID 5540 wrote to memory of 5348	5540	Nexomia(1).exe	109

C:\Users\Admin\AppData\Local\Temp\Nexomia(1).exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia(1).exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4736.2960.16732023293595108804 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff24955fd8,0x7fff24955fe4,0x7fff24955ff0
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1756,i,12229516453355487739,13610230217044150280,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:3284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2036 --field-trial-handle=1756,i,12229516453355487739,13610230217044150280,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:2752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1756,i,12229516453355487739,13610230217044150280,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:3624
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3368 --field-trial-handle=1756,i,12229516453355487739,13610230217044150280,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4800
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4396
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:4544
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:404
- - C:\Users\Admin\AppData\Local\Temp\Nexomia(1).exe
    "C:\Users\Admin\AppData\Local\Temp\Nexomia(1).exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5540
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.2.5 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5540.4116.14700559826401054981 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7fff24955fd8,0x7fff24955fe4,0x7fff24955ff0
        5⤵
        
        PID:1364
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2076 --field-trial-handle=2080,i,16507143524895419418,17953416166811584254,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:556
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2504 --field-trial-handle=2080,i,16507143524895419418,17953416166811584254,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:1456
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2516 --field-trial-handle=2080,i,16507143524895419418,17953416166811584254,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:4432
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia(1).exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=2080,i,16507143524895419418,17953416166811584254,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
        5⤵
        
        PID:5248
  - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp
      4⤵
      Executes dropped EXE
      PID:5348
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\Nexomia.exe
Size 16.5MB
SHA256 fb8a82d843199bbfa0367265ccf883c602101886d78b4bdb71b2668552aed831
MD5 bbfc4f7b5328a3d188703d18dfee5407
SHA1 e5cc4cc2fab108758443e85ece1f4a48ad7de98d
SHA512 f1b4fabaa8a071133b255dc4080cc4dfca95e9cc9c8097bb683fc6566aa233439cb01b5fb31445ce308d14d920a79709a27e122e83464d7b8a1251645b78f5cf
SSDEEP 393216:nq5WsCI4rAyKKeFOLIYfzA4/pW1zCkq1gQ3M:q5WsCI4l9sY7b/pW51GQ
TLSH
T13107AD43F66280F8C16AC175835A6232FB21BC4907357AEB5BE44B213E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat
Size 535B
SHA256 c35722ec0a2b19525c1b9c1c513cda6207121586a3e6f5ae8c398a626b4f746b
MD5 fcb28569b3adac1b1991f601b019f7a5
SHA1 d8181b347cd3f3ecd8e453c049b9a337c50ff8c5
SHA512 18bc0609852ffe73eb50a7aa06dcab3b7d139cdb9d1290c33dbdfd8df99d22db0cf00cdb74fbc635d3466c52dacf5f3589d81eee21a2dec1ea2c1d48096fe8f9
TLSH
T1E6F0C038882A06B400245A99CF4E3044D5FED94FA79D7AC014C0C68D32AF14B1F873C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 003628ab38a4995f7aa7905970c7694f20e79976b6328a83744ccc34f79800c0
MD5 eaf67efb2a92200d89d513acd3eb6018
SHA1 57256029d1568cadfc2b2a39150cbdfe98b9df0b
SHA512 af6789158872652bc02110c00e046b0245efc0a0a616831da9d4eefe0692c4e3a898752e78230d9aebec2ba19296b8332bf1234340c122533665097c8fa90ed5
TLSH
T1E8D0122332510238C01020331402A1481480D51B82054005642C85ED1B040A40916451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 40771d19907e652f1eaadf8d81ec29afbfa4175f1f9ae9de61e2a7fdb72a7bb5
MD5 acdfeef57b6c9cd1f34d5f36a14f2b7d
SHA1 c106de211a20ef4687a3deb59d313a55be6cb98e
SHA512 020466fe82d3c691fab3ec8f3ea65a7a058cdf721232949f0934a79f7f4d485636ae686a38d0256117297266f1f9268c404eced408f117753010c12e13fec15b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ef5ece2ded1f0ed70964e148590c1015ba6c35112cbb53e87d8c91e144ac194c
MD5 958f06a5c738b7d15650ed0d432303f9
SHA1 103715cceb3adc1170538fe97ff82df416eabd3b
SHA512 a5a4814fc3ac01756adff1a86295a1fc62e78f491ca754924eb07107d3313535ffdf39601ae44856e1b5e56201a3752bc15ea8827ec25557c4289629495560e8
TLSH
T13CD0122336511238C01021321401A1481580D41B83054105642C85FD1F050A40916451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 037fd7bf0aff4767767530c769ac272b99bc12178b91d7cfdcd3df2c918062b0
MD5 97fefafb28d1fd34e731b02e06c805cd
SHA1 98823593ba33386df2266816d88cac13e7e6994d
SHA512 e0147bf014c6e12ab1acc09b035c64ad583bdec1a3e352b24347c932f9539c2a772cfb474bd240cb4b3079b05c98bd89b57d0ea5b72208d8a4501a846c4d35a1
SSDEEP 3:MsFlthltlluNtNW/+flNb2ZluamluU7nHE6g3esFsd5gWu/T5q1z+flael/l:/F8NtvN45SF7nk73esFC5e/Vq1z+4eX
TLSH
T164134CADA4A22FC1C698343DB2876EF5D3E158589016DBB7E1BC6DF571C2315DB0C104
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 6d98143066371f5b4986b61fb50b97ea623e721d33a1e4ebc684d85fe19dafbf
MD5 3b8c93c5639b81e9629363bb48614967
SHA1 e080b0cd0d4dd45b6221fd0be5e72bcc70a121f3
SHA512 d386a7438b9ba9f2cc2e6743b8e567386f88ebc64f5e79bbf23942cab3e0f9e6f1520d4d29fc4e3ac878ff02900ecb9a31881db2afbebd2ed60098d71b9bab6c
SSDEEP 12:U/9/I2HXkk6WZ9kTGLBDDSSB9kTG68y8ShA1cB9kTGLApr2tue9kLRLCo:GazGLBEG6wcyGLAprp1
TLSH
T19F448CCE4F05E801DFB85AB6A6B9E87D872650E014D8F712FDE04C1149D279D2D60B1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 6df8d9904696d95b7717fafd0b9b36c8c91376fcc2088277ba908fac8acf2b2a
MD5 bf32f939c8b31285007f05cf972aef95
SHA1 56c1c7776c3bf6b3390ed05386f93fdee6b1e6cd
SHA512 0a57a86cbf97a8a7af8d83e0f684c404dc57ae42beb4d7d401722d4fb4e3a2a6f77bf3c82437395f33da5ccace6d8822d952377b4a7a4f96e3808046b4459e1d
SSDEEP 192:omX9Oan9b+FqtYmv+an9b+FqtbmLDOFan9b+Fqt:omvn9b+Fn6n9b+FMm3n9b+F
TLSH
T11225F9D52F346AA2DFE3EE70BAD1C0162EF41085AE96B4535542C63500C3BC51E5568E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 a9b56a55c61db7874fe61124fbfb90a965af368cc519cd42b81848c670e0f7d8
MD5 5bd14dd7cdb7500230b2acfcd1615286
SHA1 20c6b5a68018aa47c9c02b08ca6020a48fcccc8a
SHA512 cc667bfc5c5f3d5de3f660c4d36fdca62667b0c97da7ec0d46388e0591b1b8757187cc727744ab9edf2b4155b436e623d8c3f4bb67b07a7fecfb750a2820596c
SSDEEP 384:O3q7luI8OC4PygPH+2p1ZOrhlfVClTvrMVB85OsENnTDi:OeEmZ+3fWTjMgsNnTD
TLSH
T12216BFDB372E3421FF970EF039E4F7265430BD68A19193E18802256997C13D28B6D66D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000001
Size 17KB
SHA256 aa62be4b0740c463cef75abbc29482e33ab9c91c75d8aedabe63264cadcc4d12
MD5 d332bb6ee1ab608975ee5f769b6fc4e5
SHA1 1dd7f35cf3da01f6409d011179b41c43925cae6b
SHA512 572a6a8886f97e848fde95285d81137cbd32fba1501566a5d2e95c34a2684cb17b21be75b91d6bac5da0313fba3406f7c835c0d45afab676c3e995f3011da79f
SSDEEP 384:6Y9YCcLTuYTNqgOpRdzVDEhf8yUK5lL7CuiIrXWNn2Ut:68YCaTNqgOTXDWLv5FfX+d
TLSH
T11382E19D68A599E0E0548716B217EBEE03770EC15F13940080E4EDB787475FDAB1F828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000002
Size 31KB
SHA256 28af44cd3766699962d197f103d31ba2e1bf48f4eb942ed1283755167dcd4c30
MD5 26e562fc6595c461cead42c79310e4cd
SHA1 f31f15822a1cbcb6d4d26d14a5a21d1334ce5f0d
SHA512 626f750f7876c741aec07b40035c3dc21584b2cb080ff398a610ba1176c42a1b02cdfcc9dd4d2d9143aaf3df8a5b4accb2ad4d261ed3ea2c20f7193f23b8a511
SSDEEP 768:0SHPcUru0CvXdkb3DYST0+YRQVcewqHa19iVy:0SHPcX0Cv4cST0+YRQ53Ha19z
TLSH
T129E2F1EA1390F5BB374EA2161226C4BC91C11F9E2DB7B72E8BB31B54B07140225395A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\f_000003
Size 85KB
SHA256 2ba397a357b556335c6ddd6d5ec442f1e49c53687fe957fab4743490f2589430
MD5 16208805a5fe139b1209c570acfcfabe
SHA1 1d114557b8289ac4da11ee4e745e723d74282714
SHA512 8f638b42d32a31ce9f6aa26647d26a0f13b9db36ce09a3a420db791bc17a4afc2d8839c34b5ecaf06c21e48d826106e9abef1e77acacdefd267706e7c6210b01
SSDEEP 1536:qCyFzZmrEND1Pl+7gpMCKODBPm/FK+Jr5JCl5vJHZ6XTms8263OYZFXA5tdiP:bYmgND1t5pmOD10FKETo5vdSTmsxBY7t
TLSH
T1168302BB54FA567299E7F052D217CB0F85AE39C081980532CB67BABDC91B98D16708CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 c29677fddc6595231e21a6b54f6bb814669cfa4a1c87a4b69e57c7a48caa5c8b
MD5 df4004964c24cb936eecc8a72392028c
SHA1 0b4fc6bf6c59f8eadc8c16daec0f5548115ba8e9
SHA512 7b47bda52c4fba44f7413e1bc4703907466b3efc287290452ee133dc9a8e214fdc47e0beacd9639972d9cb3e9c9f5d1d59db1ffda0d3f33627685e790d894072
SSDEEP 3:LsYllNlNllkll/lq50lzll8911PlXl5NtlmNtlAl:Lse3lEtknkN
TLSH
T17644016A83E14C4AC6D0527E844783A42724C484C60BC38703081A3028D2B941E4F140
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

03ae38ee19e172a6_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\03ae38ee19e172a6_0
Size 275B
SHA256 38eecc89e31bdc0430241614bb2425f9fb92d0df8ce95b78f792f0b10becd7a7
MD5 9d6083a5ce5740e8cec8ebca56f9fcc5
SHA1 c768e1d5a251319562a28a4e623ae5e659de4699
SHA512 13b981ffb22db612105d0d9696a97e49b3a43ae6b7fa6cab134ec39707b1d8227eba754495471747d12ac515b011a46cdf7c4616d1be55aac1695c24ed0ed805
TLSH
T107D0978FCE58C200F39A8CFCCFEAC28AE78390F4046A420D640CC84E83B022C7796319
MD5 SHA1 SHA512 TLSH

Submit Download

09f4703a13aac448_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\09f4703a13aac448_0
Size 258B
SHA256 5df2e6ccebcd8843bc31fd7ef487c17254c3c6d9067af1d5ea65fe79b960ae96
MD5 d52162aabc83844ff46515263f859913
SHA1 bcc0f7971bfb09daa458a7c73b3b2e45d903d63c
SHA512 b97025453f3495e2f9ade4d915d07ce85f0165af3abd6bf52b66afffec5093f48c44942b8ffe571f13feb468ddb73a00070547f0f4bcd7d6be693360d8894139
TLSH
T186D0974FC2638288C39C85F3CBD58D4E834780F4106A48428003EC2212C027C3230310
MD5 SHA1 SHA512 TLSH

Submit Download

0ac4c2e70312a0ee_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0ac4c2e70312a0ee_0
Size 279B
SHA256 6daf3a984503f80130b864db518138b6b4ece81f0bd1bd4a21216a5cbfba4808
MD5 2f985677ad830da2f919aacc538700af
SHA1 b2660c846791ac163e294c32780730c5cfa720af
SHA512 ced747d7c80a69557a99db401aca92f9e4b567247a65ab1e0aeafae90f9593b72993ab783388cab3ecbb56bd4757063c53fa95f5d75c4f89c7aa62cb18058ac6
TLSH
T146D02B8FC0809744C5AA9AF0D6D6CD0D031790E620BD84126018A86220A46787A24326
MD5 SHA1 SHA512 TLSH

Submit Download

0bb15a86094610e7_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0bb15a86094610e7_0
Size 266B
SHA256 0828680198f5ff30a59b8c6691532ac4f925fef8c783ca5beef5f3da2e7d3a9e
MD5 9bba3df5bdcb9d70d4c09651bd6ae14b
SHA1 b722684d406e927f4f9c4551b4bbfcbb2ab43d13
SHA512 2cb4fbf703bbea2d5eb70ace707d8c11c11f25eb9be7d74cf47b627a999efae6bab99b5e5bf16ac98602e048ef72185b27a42044fb3c9f48c1f174d36ec89dc7
TLSH
T1AFD0974F0C109638C31084F08BAF4D4983A252E1181C64202010AC9220C1E38B774202
MD5 SHA1 SHA512 TLSH

Submit Download

1a427df813dcfaae_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\1a427df813dcfaae_0
Size 267B
SHA256 467f702f77ba9a9086cf7502ea4a1b0bcfd24385b3e5585726809749cde0036d
MD5 6630920c36629479001c873a1d0f8d2a
SHA1 80b758ec98528adba14365a0f3471cceccf51de6
SHA512 e6986bef159863f7d6423b02950701cd80f27899559627fa4a2a33be11ed3fc94978d1345881e21a9e20e2f265467cf62d297b9d6bad3e676e8a09d194c9b055
TLSH
T191D02E8F0A691A88CBA9BBF2CFEF8A8A834254E024A9AD020054D952718066CA216211
MD5 SHA1 SHA512 TLSH

Submit Download

328cff54b1aaf628_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\328cff54b1aaf628_0
Size 270B
SHA256 144a72e015806e3c8554c2416b0b9b74fe14cddda2aa3ba6400b754b4bcc987d
MD5 23c68aece275ab1783db85ca248ce788
SHA1 838eaa19175ae07254dc3ee3666b5b454772d137
SHA512 17e6975ae210483b08b9075850f475c5620b0bd8199871ca8dcefec736691213fbe7ece94d8df78655d34f09b6391131d9f20989e574bb98b25c6280c8ca2bb1
TLSH
T198D02E8F89024604D29A0AFBEBBB8A4B4383149020BA14A31810EC620086AA8B2A476C
MD5 SHA1 SHA512 TLSH

Submit Download

39a65d4ef01580b9_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\39a65d4ef01580b9_0
Size 275B
SHA256 d8f389218012187854ca8fa9adb0d701e5e6cc3cfefc752893361bb980aa7c0e
MD5 fef2686904955c4fcdfd24cd5130d5b3
SHA1 bef7060319b1c1bc2c962206d467a7097419de0f
SHA512 9b61a15f61a6e494a5f7b91beac3195656ecf6cd8d8e15efdd15909fae393c21cb147702cc29e4816ff1b0f0f8abfdc3231ce06031ad6ba72ae0bacdd71e95b2
TLSH
T177D0954F86785440D6508DF0C7FF895FC71D55F0149D1013B005FCD5218072C15DE300
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0063714947ed83f230d110b0fa7ec2cc22b39928b6671deaaff647b976b7c5cb
MD5 659aefbf1abe999a78d780a7e5662c08
SHA1 c3955621eed975ef0da01389cba53f7c556cda5b
SHA512 a49971fb8302dc758a7d2e9ed6b6a807356af623efe999d8d2b0e322975a8d3545df8fa0a781f6e280d5f26921917737f01701d4edfb0636ea989141589ad3e5
TLSH
T15021CA0214C98756EF41AA38F5D50AD5773964E32E838F439BD14EB189C3BACCB9E419
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 58a2c1d1fbfddcfba908db67eb0b9a2cb21e583f96c3ac1a17db7c5533f391a6
MD5 14ea548d63ba31232152526505d502d1
SHA1 118c74ac0696d639778a23100d69172d9c356abd
SHA512 4cf29492f51b07facc96b4c35e94524fd250d7ba386313d7f80ebdfbf4fc8f3b65594d1bd0700be0611f0d8552bcf6cb2b218c0deab91d7dde9746657a5dc125
TLSH
T17AF0620224CD9380CFA17939F2C10BD93B3D28C22A468F03C7E08E365482FEC869C801
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 317d574e1d05f8b3f0db83a4b5e1621bd7297661a06b00c298abcc39c9e3e5a5
MD5 f011c217a93c964fc11ddf54a83a86ed
SHA1 502717479aa1eab64f3a26c16a837bd1ed618f05
SHA512 ef930e2522493da234f124b07fda686725fda2daafe73c458370caa0c4237d975cca7f5a8b5b77642f9bdf16f286cbea93d89329d16b6841247df430fae7dff1
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\History
Size 164KB
SHA256 6c438ef6f05fc02ddf0346d83820a2703b3b5852629561d7c57f3cb82eb865c4
MD5 15c65c932e6e7b8b2ecf991b6b7b00f0
SHA1 3defe9b65939eac935ce10707a841051d4e361f3
SHA512 71b54db6570728d8d2dc3874b254c8f993318b399a59f310ac53a9994b892df2eefe8a2f542061a71800c4de050295d0aa97b7421a3f39fa85201cbdfb347931
SSDEEP 96:8B1EwX5LqL/uejzH+bF+UIYysX0fxQp97TEHt/DfLVVVN6zRk/E0t+V:8BxX5qL/tH+bF+UI3iWGVTWNVVV637V
TLSH
T19FF30B5E5F243311CDBD923669E749A35D7EF03F47236A866C6104B1CEE2652B02C4EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 686B
SHA256 05513440a618b2a23eb48da304bd559906a2728032acb46ff4c3bda4192ae4fa
MD5 70d4870ac03c37d07a8c2bede422d3b6
SHA1 70600fee63b5db4fad134153e6e9c8c5f6d0d68b
SHA512 d676bfcfa2e3cfdbd2064d07dd8e8eaca774eb5c70dfd27de66da1bfd5e3c7e4a3a8b3332b95b483a88c0b93d90d9020c959ca6cf15b3eeb71b9523aa1179806
TLSH
T1EB0194A587E0C67D8A4127E45B347413CD3D040992287D26DDE9BBE59BE2471E12150B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 686B
SHA256 aba14efbbad0785e93d0cfe0517d29f75e2791335a832e029362dab1ee124d25
MD5 ca46b9a96d7cd392baa717da8f3dd5dc
SHA1 40e5758190fcd1b8599770ab1fdb8e3eb012a299
SHA512 6d38e08ec59a8a375c5fda43fc9fb739d76a2ec09f311641b5ac98daf829f991ba9fed5ba48c36d2618bfdf0972ffeb5b09b83e26d17d0dd08c4d081c490f5db
TLSH
T14D01D8E587E0C67D8B4127E457347413CD3D040992387D26DDE9FBE59BE2471D12150B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59c0c6.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe59c0c6.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 93e253a80184dbc03180ad1158f6d0c21f7fa5b39156de765460ad225c7e395e
MD5 3c4186d9a63b662d709eebe6759b9a94
SHA1 cab890fa67ddd9a8a395e4fd6384e1b57849b0ac
SHA512 2e90277d51a56396e089ecb89c431a7d87c2aed82207f76e67b1761b768d5cfafd8450165cc1c6b7169f5c244eca5ab9f7b5150be3ce7450da12f46da1868047
SSDEEP 48:T0IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBkvO:YIEumQv8m1ccnvS6kwe4a4KIjH
TLSH
T1BEF2F0EF0B69F209C5E05530E29428C7BD2A040D8761EEAA6EEA52F1FB421F2F535605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 1c0d6c3abae86537a4b9b38fcf1f13399c4f24d3829fc1141a784c6cb1d59a07
MD5 7d6f2b49c6b6d943f68126116c460900
SHA1 ac7ecd556913b06d995de0717321d51ce43455ca
SHA512 83d790af47d8bf54f053f70adc8f11fb18d9813d128729326278371424542848b1de23f2d37f804079a654f357b8b1ed4f85449e8c4c63d10586b2c97f5f44eb
TLSH
T1A9E026B7C179BD7790FD053A1948BE05EAB6F4388286A8F4CA67423CA0945E38247093
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 380baa704bd89fbf37d9bfb2e85314425c7a0934f4bab09cb13051195046411e
MD5 54a5edff957b8373517248566cb43d78
SHA1 6829622f3be8a929f1878b43244b659fa5201433
SHA512 da7e92c218a05b08f9cc542f93b248fd3e155f7219e85ff751275a6f6d6e06616c24093847751666311438a6abf60e0b172e893e70b4d334900fd095b7ebb487
TLSH
T1ECE0DFBB813EF87B90B915265D84BE05EA7AF439418AA4F4DB63843EA0944E79316052
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 fbb5c24b7b41cc13f19ec0c9b9ec4826ce065dd870508b287364d427dc286ba2
MD5 cd83c797f689ee64b5961e3c2dc4e0a9
SHA1 21bd7df80049bd5bba3dcdf3d0ef38107fc02e0b
SHA512 b35a09078722327d2fb539dc76fa283db7d4debd30d79df36d5f293ee51de4396dc02a6ae3d6ecd28e7545bce58110be3eec0ed7db047be9fb507f54f2a7e647
SSDEEP 96:sti/dpTcwtbDqk+/do5h16Z08s7/x+6MhmuecJS8MkkjegK+gUqGN28XM1C7K:st63o7xon8sV+FdS8wjg0NG6K
TLSH
T1AAD194055E64A93B8CCAF619BA35BA56E3F9506270D51E88EBF8462C04DB6DC3307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 c6b40370c18c03109ca21b10ebfc1d34923b5202cbf4db3b48e46f49cdda5df6
MD5 8ebbd4eb10071b0a2256e7c76ef8c218
SHA1 226e0765c2a2c1ca1e9c12fecd74c71c8beffa6f
SHA512 029f81c2f63babf66784bd019acf5d7093f699cbd955e056eda2763a956f5d6bc6c127d4f08d96180149c794742362286f990699b6d6223eb23b4bd0d49499e8
SSDEEP 96:ri/dpTcwlb9qk+/do5h16Z0Ps7/x+6MhmuecJOK1ejegK+gUylI8XM1C7K:r63opxonPsV+FdOKQjgHg6K
TLSH
T14BD184015E64A97B4CC6F619BA35BA56E3F9502270E52E48EBF8462C08DB6DC7307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 e3d571c32b42b0a254afcb7ac9f7255ae66d072ccdb0bb2ca33996a6f60c0f8b
MD5 357b428c3756ce039e464f646082082f
SHA1 de334d736a6c8e5e73a82d313e631983111deaaa
SHA512 e64e509a6bd5074208085755b26adc7b31831930bd76e6e24925d842d4803086b13b627f7f05d4e006976cdde40c6d39504c1459d8d02c77629a1f0a9e393380
SSDEEP 96:sti/dpTcwtbDqk+Rdo5h16Z08s7/x+6MhmuecJcCErjegK+gUE8VI8XM1C7K:st63o7fon8sV+FdcCqjgkVg6K
TLSH
T1FEE184055E64A93B4CCAE618FA35BB57E3F9506274911E48EBF84A2C04DB6DC330790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59c078.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe59c078.TMP
Size 5KB
SHA256 586060759c536dc42f0f6ac289e09baef9dbe06114c8444db2dd2ab5fbb3b30f
MD5 f25cec3db627e9dbb21bc54b21ba6082
SHA1 09d7aea6161f09f1e06b3206c0a400c7b55b2646
SHA512 a232d49d4a412384271b79e4642571b474384b73d7ace4a0f25594fbd5667852de55943df3c9dbadd88e6824bf37f879a55c4f83502ea7469f8ae5c0f513abbf
SSDEEP 96:ri/dpTcwlb9qkqdo616Z0Ps7/x+6MhmuecJOK1ejegK+gUB28XM1C7K:r63opVo6PsV+FdOKQjgOG6K
TLSH
T18BC1A5025E68797B4CC6F608BA357A56E3F9512271E52D58EBF8462C08DB5DC3307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 20629b0545ffea56d3dbc59567eabd0fdc6ccc309a470ceb34b58126c2d6d091
MD5 07e7b5b0c755b0e9ab52012b2d832a84
SHA1 d3bad510d9a2a7271064f7255d47483212b422ef
SHA512 64c061e339c7a5708514e61ed0ee62719374803b8e3614e90d69d2e575add9775e923e95ece9c438f6b573031390cbfa501aebbd87cfe564b66e620ddae8a6ac
SSDEEP 96:v3ixPlf/ROo1pkF5d13iE7VaTEv9V5h5pg5+e0fkuJkbIXg21deIXwk0:q5vPY9l/kiQ21deIW
TLSH
T138C1B6A7442DC1B4AF444BEBDD387FCA9AA601DF88D54C1697E2C54C07C2EFD21DA886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 879a0639ccdde7b40dc008dc9c6db5bbc53094d497b1907f6d56f25ab6a88365
MD5 c8c70b22fd5aa945c5979ed246b1a046
SHA1 67a81fdfd34166c49924912412ae348c7c312aad
SHA512 a397252862605652ed78c9820596e2fa8412ca474a143068c47630baeb76e35c3df352a788e10b605e75f488374fc8faeab068106a4130e4e55e1c6c700dbe0d
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 5035a074236f638d74013635803e4f540305f334c9457c11c17a544aeb53cab4
MD5 8342ffd3f9583d1fc9def7705afb2568
SHA1 48e0b1f65556ba22db36c7e9ca44faa89a22d5e6
SHA512 aa41315fb0b83e19c2203a7a5cd97f5fbd52c9cfa9cca8bd8136dfa02e4463e6f449bfa89b0e9fa9dc3a7acef4e9367f290596f763d6e975729c306ce433080b
TLSH
T1A2B012887F40EA2BC1D81F3F0688D7E06360E213674014038888CF210FA67E47E188D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\LOG
Size 303B
SHA256 423b6237406ac1a5aebb9a9d4de9fbf27d0e827ffe2b7451056ec9f24aa985f7
MD5 8a3608eadc660a9407485c6837f3e085
SHA1 63360574afb0add91fd1abc5446b280d99afdecf
SHA512 962f49f1d2598831bfd0d1f068a2bda0aa998b48bd1aae24b070e0c4860e13c5fab78229235afaa12b3f294edd40f46a728537ef247a74a5b9bb94ae643a403d
TLSH
T1B9E0203156CA8E7BD58545DF6A33B35EC261B405E5C921161E58F948110B4447003750
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\LOG
Size 279B
SHA256 1aae1af084f526e57f1a4562fb64d7e3818f686dffe7e22717df349b3778b415
MD5 0383954935f929fb52681602e67def6c
SHA1 1c74fa95ac48a8edba7ce3200f81fa03a64973ea
SHA512 de1cb324160d4e7d9afa672dae59826bd860ba44b7b8f6f6e248d9c581aa078c75598dcf472c805fb0bbb9999355108fcdff47672a6b729abbdf758aa2ffab07
TLSH
T13DD0C27689C989BADD85CDDB9D72676FC274BC45A7CA360E4F48A80C2943408F122781
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Visited Links
Size 128KB
SHA256 051b1028fd56ebc87a3efe576f20b63436d787a18ed7e3d0b2d7185c0b425c4b
MD5 c6c3e2d7dbe4424116f90a52e94ec24e
SHA1 ca9f66b88b448071a61c68e106b24c59eb778be1
SHA512 53a5a79a6ec2a6dfb337ae127a9476c55785ebb0e457c8d8bf3b5fc483fb81cd96ce97f4894c3a3d10f8b04d95200db6a2e148ab57039cb286f49f0b82cd8c5c
SSDEEP 3:ImtVuIVfSZtt:IiVuI4
TLSH
T135D3040511310C44C00400714D4107DD4017C330C115404303351D035440411C533F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 f2c783507afccbf79198890fdc68bb1002836d6ef39401542db8961cb9f470ae
MD5 4a7315b263fe941c17c7f55c177eb1f0
SHA1 42f1508a811880a34f44a5ba2bed111f3af2192e
SHA512 21442d5c75e2d94a9647b62b457511a29c3cdba9d14cd886a0413563ff48e09333b42c164eb4b3fabc3d3c57e0749b285c497cce183a7cb41ea78b25d560ec50
SSDEEP 96:dB3NkGSCWfVqcXAC8kh/cI9URoDotoN5HYBaQ06HXtZdZaTCJca:H3NBSJqcXpeoDUaMaQBiS
TLSH
T17E81962669B4A93B8DF3E605B9863B17EBA45063D5917F95CAFC0F1C01DB3892342C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 170deba3b9620185dee28a7ce20fe8db91e866659a2b2d00e1e39edb4e17bd62
MD5 5ff13a65691721ba194e36987ef539f7
SHA1 c6ed373e415c43b750f4a6834a038a1de799d25f
SHA512 3d6e17f76a6644f019869227331eac5375b1d0aa3e217f05fbc32dbbb26d3d0f37a6f34078418547d4f64eef8a997ae16ea465f648004553cc14c29748276b18
SSDEEP 96:dB3NkGSCWfVqcXAC8kh/cI9URLl8DotoN5HGBaQ06HXtZdZaiXJca:H3NBSJqcXpeiDUa2aQBTJ
TLSH
T11B81952668B0A93B8CF3E645B9863B17ABE45063D4947F95CAFC1F0C01DB3992342C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 4d58810cbffff539db7b2f6e3d4b454503d794d1e281e811bcb083ecf727c9ae
MD5 96aa794e8812b922c82033bbc6a97e63
SHA1 c9a3f6859d0c016d02e5a957bdd1ac521bca0c82
SHA512 835f7901988a5fd3dc32aa684f1500cb44d9e2989bec704adeb0ff82fd8c5550aa1f48b2e07c0b0848371c79fa286b74e65069fdb5c9cd4e452d8e38fe79dfe1
TLSH
T1AB5197736C64AA3789E2A744B98B7F23CFB550A599612F508AED1B1C00DB65C3301C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 afef78392cde3b10050a696af1d1babd7bfdcbac3bb7af56cbd5f1ef77623370
MD5 b35f5f919eecc991b17589ff9ac6b603
SHA1 d34020be7335f3a82589ce002059b9a5b0acaa78
SHA512 1f72accf0d3e4a4aa2d706cac0811590b60b2151cab72805d595acd844a5908486cd76a2dc8402c813a1ffb4cf087f8ff573456f74444146552c6eadc77864ed
TLSH
T17861943769B4A93B4DE2A704B9C63B16ABA05063E8913F91CAFC1F1C01DB3982341C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 1f649a5f9e3721a83c5718d109875cd198c2b63eac412da198a018541990f481
MD5 66e275105b34de8af4d2ed4cfe83077c
SHA1 8c9a9d70179dd076a0aa2ba0d39b1e1bf456315c
SHA512 d618777d59b510a5b48552f0a06754aed661e4a86e79141a3276fb53974955e8a70da46351efa39b0763e81bd19e2df8f7331cf2e308e2ecac46105292576091
TLSH
T1D27197276974A93B8DF2E645B9863F17ABA45063D8917FD5C9FC1F0C01EB2982342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 fca3dcd3454751c4cdbb08043f2ca656f29830b6321bea68084182c1bc1599de
MD5 66bd8efb11c7efc6ff29edf087e10402
SHA1 4fdc9a55614c4625eff3aa7f9b9aefd5d6f7cb3d
SHA512 824b2dcc6c0a5c4b635d6126d426e7d46a662bbf7e2005b39f15895d0e67e7f979b92c308e4ed4c6327463200cafc46b63fc364247cc9d37fe4055bf723ffa2b
SSDEEP 384:H+aQikB+z/xvxjg/qhEy3NBSpixJl2AVdpd9z3:W/UxvxjgC+ymgX2UdF3
TLSH
T10B729E2B58797D33A5F3F605B9595B8BCBF894F290C16EA44EBDAF0902873981302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 844301934845cc0affb6d0fe0acc61953b32bf18f2dde29cd161ab043dfca1d9
MD5 c347c2ba091496f8d6d2a5544b6cdf9f
SHA1 5728d29e7365ef56aecf43b3c33942c32ff63305
SHA512 3e6509fa58416a41dba60bbdefa314d5d0c1e7f8e7a05369eef60f8d05bca680fc6ea4fab0c0f5166071170c16e7f3d02ef920a2148c6094331eb945d7222cc6
SSDEEP 384:w+aQikB+z/xvxjg/qhErrNBSpi0Jl5AVdpd9z3:P/UxvxjgC+WLX5UdF3
TLSH
T1CB729F2B58697D3794F3F60579595B8BCBF894B294C16EA44EBD6F0902C73D81302C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59795c.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe59795c.TMP
Size 1KB
SHA256 2e3bb27706d531bd9d65f0f41fe7b79ee241e7d2e1c542bdf564a305f5f7cfb7
MD5 83345f7bb367d16b85e663cdeb9bf440
SHA1 7225b07846a7812b7519fdc3141f8f702f677479
SHA512 9b61f5bf3223d7476dc9b2aa5a23357a2bc7d25da7d60a1f5ed6acb32f4d7cf4a5281d1537917ae8883b065a533b000e123823d84adb0024147b40751df3faa1
TLSH
T1482165B3A8B06B366C92B3867187BB579FB020E681204E4095EE6B1C01EB65C7216837
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\index
Size 256KB
SHA256 540b7676ba5ace70e488f2ec0312f3a2396abcf900473adbaa09cdfbaefb9c97
MD5 c70eb0292cf6befba256bf790b38045d
SHA1 09859c2b16cc3947e0e4efb72911165c1ba6b9fd
SHA512 74bcd9abd6739f46b412b58eabe7bdfcccb31900610c4e3ba27014fd4a561495be4e65ba4c23186f60be23c7c9e7cb4f709e203e15592f4e0c81fe6dabcef8ca
SSDEEP 3:LsOllllklkXlKBSKXl:LsUlPKkKXl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-542-0x00000194124B0000-0x0000019412559000-memory.dmp

Download

memory/556-582-0x00000194124B0000-0x0000019412559000-memory.dmp

Download

memory/3284-381-0x0000028662D10000-0x0000028662DB9000-memory.dmp

Download

memory/3284-209-0x0000028662D10000-0x0000028662DB9000-memory.dmp

Download

memory/3284-24-0x00007FFF453C0000-0x00007FFF453C1000-memory.dmp

Download

memory/3392-212-0x00000207A4820000-0x00000207A48C9000-memory.dmp

Download

memory/3392-342-0x00000207A4820000-0x00000207A48C9000-memory.dmp

Download

memory/3392-101-0x00007FFF453C0000-0x00007FFF453C1000-memory.dmp

Download

memory/4736-140-0x000001D1042C0000-0x000001D1042C1000-memory.dmp

Download

memory/4736-168-0x000001D106A60000-0x000001D106A61000-memory.dmp

Download

memory/4736-139-0x000001D104250000-0x000001D104251000-memory.dmp

Download

memory/4736-138-0x000001D104230000-0x000001D104231000-memory.dmp

Download

memory/4736-142-0x000001D105030000-0x000001D105031000-memory.dmp

Download

memory/4736-141-0x000001D105020000-0x000001D105021000-memory.dmp

Download

memory/5248-556-0x000002A4ADA10000-0x000002A4ADAB9000-memory.dmp

Download