Analysis
- max time kernel
41s - max time network
40s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 22:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Nexomia.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
Nexomia.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target Nexomia.exe
- Size 18.1MB
- Sample260905-2p79eaar6v
- SHA256 35b72163d0da593ba3f613bea670b941910acfbfd86dec65dd0dde1cfcb4c3bc
- MD5 4aa8bceff4c4cc60764cc83cd35e7593
- SHA1 2857519505339e58de4684bd4d625bae978798db
- SHA512 2024e0f8811b397b842f8152bb9da1dc7228d9696a2bfe06111052b53c2e4d0a4d581f0f1890bbf919789cf5694a4ee27b34ee8842ecd9d33401cdfd8355cccb
- SSDEEP 196608:1V4wDOgw5iyQTxL1u0aVC1flcAFi7fv8yHkCnFa7cWLBTtQslVMN4C51W:oSfx1u0DwhfvvHkloWNTCAWB51
- TLSH T165178C42F66280E8C16AC175C35A6233FA71B84907347AEB5BE48B213F6AFD0673D754
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 4216 luau-lsp.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Nexomia.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe 5672 Nexomia.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 3480 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe Token: SeDebugPrivilege 5672 Nexomia.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5672 Nexomia.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 5672 wrote to memory of 3480 5672 Nexomia.exe 89 PID 3480 wrote to memory of 4552 3480 msedgewebview2.exe 90 PID 3480 wrote to memory of 1348 3480 msedgewebview2.exe 91 PID 3480 wrote to memory of 1348 3480 msedgewebview2.exe 91 PID 3480 wrote to memory of 1348 3480 msedgewebview2.exe 91 PID 3480 wrote to memory of 1348 3480 msedgewebview2.exe 91 PID 3480 wrote to memory of 4108 3480 msedgewebview2.exe 92 PID 3480 wrote to memory of 2732 3480 msedgewebview2.exe 93 PID 3480 wrote to memory of 2732 3480 msedgewebview2.exe 93 PID 3480 wrote to memory of 2732 3480 msedgewebview2.exe 93 PID 3480 wrote to memory of 3068 3480 msedgewebview2.exe 94 PID 3480 wrote to memory of 3068 3480 msedgewebview2.exe 94 PID 3480 wrote to memory of 3068 3480 msedgewebview2.exe 94 PID 3480 wrote to memory of 3068 3480 msedgewebview2.exe 94 PID 3480 wrote to memory of 3068 3480 msedgewebview2.exe 94 PID 5672 wrote to memory of 4216 5672 Nexomia.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5672 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5672.3380.7544618860512553208 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f17132⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffe8bbb5fd8,0x7ffe8bbb5fe4,0x7ffe8bbb5ff03⤵PID:4552
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1696 --field-trial-handle=1704,i,10091628114871628843,18208772788075929327,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f17133⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2200 --field-trial-handle=1704,i,10091628114871628843,18208772788075929327,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f17133⤵PID:4108
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2400 --field-trial-handle=1704,i,10091628114871628843,18208772788075929327,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f17133⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3380 --field-trial-handle=1704,i,10091628114871628843,18208772788075929327,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:13⤵PID:3068
-
-
-
C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe"C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp --definitions=@roblox=C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\globalTypes.d.lua2⤵
- Executes dropped EXE
PID:4216
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 7f9e3dfe2588128ba8807735787031cd160d2a3852e9b7275cb97119b7f8c1ac
- MD5 66cc455d8baf13cb4cc913f066caf619
- SHA1 48de8b19f4bd4dcbf84b24153044dd16351c5e30
- SHA512 56f2fc9db7ba6f59a331c51c6a253ada8aa7d2f2e26a46f8ee0dea932e981da1ef540c62fb871921d6b64055c5b202e1440dda64bc6045b42b261ec30df40d95
- TLSH T14ED0121276838174C0303433100267881401D90B40098200583ACA5E1E681901D03851
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 252326b23f507fa437a96f8ed05fd8096b100735fa1fac491fd5b8e5a1af64dc
- MD5 f27aebc8bf28a4cb9d7a9e239fa4e27a
- SHA1 6ae23a7fbf2bfd451bb922763e7179cce8bfceb0
- SHA512 4a3d6007b5def6a76822ff18d39f7a7642201b2b33b83e1d0c60cbacb20ced956f3d41727e9ac437bd188dc1c9ea080770b63d3f0b8354230aa83442f28329ff
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 528B
- SHA256 594e82d2290b624361e1acfdf5f1f82c33eb56a53f1531c17d18de128f6162fa
- MD5 05e9900f51b8bc80524e3831e922fc6c
- SHA1 2016d2f10f14ce2479b8efb2657069ad5773ff7c
- SHA512 1471b15cd8d0003f225e0ef9a1f70bd65cdbbe30eb8b5138db879636f6ff61bb34980a5ed1adc5d600669de3081247425a849fec0b38467d2061b19315058aae
- TLSH T1B4F039E84280FA91EF711FF594E6B803FDFA94D0D9335E174894C57942927B18D814B9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59e0e0.TMP
- Size 48B
- SHA256 77004e0b8c8013af20940b2a4bb626a0f0b4dc6ff33df033e2cb91dbbde4364e
- MD5 d132e2db523fd27168bc7848075eba6f
- SHA1 9c2c3d0876eadfeb78afc23a69214155a38585de
- SHA512 47246755dc1d38e9373b1d653e9e4fbd0fb90ee4bb1013d95edd6598c7388b0aec389d9a4ef733e16f8c3f93d497347a51c0f13b900f6cebd5e3778c225f7b88
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
- Size 6KB
- SHA256 b658a82d5bac3fb5f17469e36701fb79d89364059439b4ccf03e812af3f340b6
- MD5 014f1666197d42d8fee2ad7b5a6d4ddf
- SHA1 123aa3127f138199fde20b7609e1667eb70667ef
- SHA512 a0a85fb3582ecbada7897f1293c4fad7ab8e432567964f91ebb3194271082ef788b1aef21ab1540683998afa5657821c83395d18110948ef76ca8ecb166c54e1
- SSDEEP 96:stL/dpf1ub9ekDo5h16Z0qs7/x+6MhmuecJRx1ejegK+gq+28XM1C7K:stT3bSonqsV+FdRxQjUM+G6K
- TLSH T1EFD196025E28BD7B8CC7E509BA29BA57D2F9503160D51E58F7F84A2C08D76CD2317D0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe59c01a.TMP
- Size 5KB
- SHA256 c8d1047da569a556441ef80814c49a060b953dc00bcbfca157e2c22468537cce
- MD5 4d1822a8b35bddfea80903876177a656
- SHA1 badfdf9035b2859e6d12ae3e1ac5259e6372df2d
- SHA512 7317bd707b5c4443a08202ff0dc329125ebc974d2adc4b6c17948ca3e91a28a7a6bfe173737e63bb9c22904cc049c43bf5ef9d74bd54e7a2e898103c4d9eb724
- SSDEEP 96:rL/dpf1ub9ek3do616Z0qs7/x+6MhmuecJRx1ejegK+gq+28XM1C7K:rT3byo6qsV+FdRxQjUM+G6K
- TLSH T166C194025A28BD7F8CC6E509BA297A57D2F9503164D52E68F7F84A2C08DB6CD2217C0B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\shared_proto_db\metadata\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 3KB
- SHA256 8842cbdb94d24c47d0c29f3841b3047f55a9aad9167ad87bee171a10cd4b41d7
- MD5 36fd59c108602cd5c91d4a4e0e56b0d3
- SHA1 35d3b58cd108c98237d44b78a643e520766c214e
- SHA512 7faa78ce7aae5c3a6e25988a2bf634974b8ee81e28a3ab4836d5164c08690a3a7fd0dca53339bca1cd92123739e26a5ea250d8d692108d8b73acaae9bd98d63a
- TLSH T12C718322B574AD378EF2C60879863B16B6659073E4917F94D6EC0F0D02D738D1342C2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 2KB
- SHA256 238ea5a8cc0a79ecff83849a397108206e958a47d16cd8b716d8e02ed2f3266a
- MD5 7a727d7961abc0aa9807dc618ebdf295
- SHA1 5e9a2668b0ef273d09c7f69f7af810e972252d81
- SHA512 e1a3aadd41f18d02410a02f22671f7acc80512f03b2e2a7dd06264253fe0feca01c066d7e1def043d2eec874dc1cc50031068d3f1b194c4e7cebea8f6c581bbc
- TLSH T134517733B8246E77CEF2870879463B66993590B6DA612F50A6DC0F1841D725C2315C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 3KB
- SHA256 48cbe8c543c531a2085e46f7f4dafaf6d5ac95fba0dae9bf49afba6b638aa384
- MD5 39beffc7dfc34d6c7565bfdf3c8ac905
- SHA1 201fbe69fdaa5a49c0f168704057ab712e9c0d75
- SHA512 8a39ab3a328aad23368f52d8ad07acf4dd446b57ce06a60133f972e21b1061c236cd7b544be0fe0ba6b4dd23f0b59d68167c66b6ba5df1ce287d63dd9662dde3
- TLSH T136619537A974AD378EF2DB08B9863B16A6655037E5913FA4E6EC0F0D01D73881352C2B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
- Size 15KB
- SHA256 18214564f499cc997bbbd63da0e8ed41e34ed27d26c64641356a20bc5d810c38
- MD5 71bd76159ab356700918f99b10c41422
- SHA1 2f10e46d62e8aeab7d047fc24a6d7ecc1d8312db
- SHA512 4358fc9d27567d3372f4852e7d0fa31bdc239cf401da32224b6f311907b4687f90f967142ce5a7fc0e181458def5af0db72a26f08ec1efb5d55caccbda1b4b3e
- SSDEEP 384:D+aQikB+z/xvxjg/qhEwNBSVvDOpNIr9zm:i/UxvxjgC+hKpkFm
- TLSH T19E729E2B59696E239AF3E6047A49079FDBB998B390C16DB44EFC5F0E0AC32D41342C16
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe596ce9.TMP
- Size 1KB
- SHA256 6f9f1d5848fb1e4a7ac48bec2be8e78a72da244c0483a29f43d712869210317d
- MD5 c950c1d15679121291869698846f3697
- SHA1 32c3a8c19368c58b2e884b0361183b87d127c8c1
- SHA512 f39118e71237d76835b31f45b2f260d685581f09f77ad839ad957ef686bdbc107743b5c9e7810695fd416b389fa19418947c885c0f572118b16a4f88eb8cfbc0
- TLSH T169218473E5B81F33DDE2A30D32827A7B6D2160BBC1204E0076DD4F1952A324D663AC36
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
- Size 16.3MB
- SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
- MD5 be087717213e34f06e6198159d9c73dc
- SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
- SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
- SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
- TLSH T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
- MD5 SHA1 SHA512 SSDEEP TLSH