35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 16.5MB
Sample260905-ncdmdadd87
SHA256 35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7
MD5 411e27893f6e210f32cea7e28662adb2
SHA1 2c1f7771a8e24691bc39f7bf17609fa9cf628e2e
SHA512 1528111cc2a8313ccae7ec49c7b7ad911c0603ff4583a2fd19810dbf808142182628d0441baa0ffd42cb78f17a3f11e914b50f9595cf422d357771a4862622e6
SSDEEP 196608:GVXku+QMSrEM6IJZCsQdYXK7lDJl2zRwRLKAyWMsSt3K+zdY4HciDnzjW:MXkZXC/QdYXKoz0mAAsgrzCkXzj
TLSH
T12B07AD43F66280F8C16AC074935A6232FB31BC4907357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
226	2428	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	Nexomia.exe

Executes dropped EXE 4 IoCs

pid	Process
3428	Nexomia.exe
2272	luau-lsp.exe
5832	RobloxPlayerInstaller.exe
2380	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3932	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
2380	RobloxPlayerBeta.exe
2380	RobloxPlayerBeta.exe
2380	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\avatar\unification\humanoidClassicAnimateDefaultChildren.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\loading\robloxlogo.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\PlatformContent\pc\textures\sky\sky512_lf.tex	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\ButtonR2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\LegacyRbxGui\_preview water 03.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\BuilderExtended-Bold.otf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\smallTriangle.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\thumbs-up-small.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\TopBar\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\icons\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_15.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\avatar\scripts\R15MoodsV2.rbxm	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\PlayStationController\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Keyboard\close_button_selection.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\PlayerList\UnFriend.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Motor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\SpeakerNew\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\SpeakerNew\Unmuted20.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VR\notifier_glow.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\icons\ic-more-catalog.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\families\Arimo.json	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\UnlockCursor.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioSharedUI\search-v2.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\models\Thumbnails\Mannequins\R6.rbxmx	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\loading\cancelButton.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Settings\LeaveGame\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VR\closeButtonPadded.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\LuaPackages\Packages\_Index\BuilderIcons\BuilderIcons\Font\BuilderIcons-Filled.ttf	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\icon_following-16.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Emotes\Small\SelectedLine.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\SpeakerNew\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\avatar\morpherEditorR15.rbxmx	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\DeviceEmulator\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\PlatformContent\pc\textures\water\normal_22.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\SpeakerLight\Unmuted0.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\graphic\Auth\ic_aged_rating.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\icons\ic-remove.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\SpeakerDark\Unmuted80.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\icons\ic-blue-dot.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\icons\ic-pin.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\sky\cloudDetail.dds	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\advClosed-hand-anchored.png	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\PlayStationController\ButtonCircle.png	RobloxPlayerInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
312	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1684	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2428	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4468	timeout.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330805344075794"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 31 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-e7d81637d42c4b23"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-e7d81637d42c4b23"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-9fe94fb0e9d84c25"	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
2772	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe
3428	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4700	msedgewebview2.exe
1880	msedgewebview2.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3932	tasklist.exe
Token: SeDebugPrivilege	312	powershell.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe
Token: SeShutdownPrivilege	4064	chrome.exe
Token: SeCreatePagefilePrivilege	4064	chrome.exe

Suspicious use of FindShellTrayWindow 61 IoCs

pid	Process
2772	Nexomia.exe
3428	Nexomia.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe
4064	chrome.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 4700	2772	Nexomia.exe	85
PID 4700 wrote to memory of 1976	4700	msedgewebview2.exe	86
PID 4700 wrote to memory of 4744	4700	msedgewebview2.exe	87
PID 4700 wrote to memory of 4744	4700	msedgewebview2.exe	87
PID 4700 wrote to memory of 4744	4700	msedgewebview2.exe	87
PID 4700 wrote to memory of 3920	4700	msedgewebview2.exe	88
PID 4700 wrote to memory of 4652	4700	msedgewebview2.exe	89
PID 4700 wrote to memory of 4652	4700	msedgewebview2.exe	89
PID 4700 wrote to memory of 552	4700	msedgewebview2.exe	90
PID 4700 wrote to memory of 552	4700	msedgewebview2.exe	90
PID 4700 wrote to memory of 552	4700	msedgewebview2.exe	90
PID 2772 wrote to memory of 1684	2772	Nexomia.exe	92
PID 1684 wrote to memory of 3932	1684	cmd.exe	94
PID 1684 wrote to memory of 3520	1684	cmd.exe	95
PID 1684 wrote to memory of 3428	1684	cmd.exe	97
PID 1684 wrote to memory of 4468	1684	cmd.exe	98
PID 3428 wrote to memory of 1880	3428	Nexomia.exe	100
PID 1880 wrote to memory of 1120	1880	msedgewebview2.exe	101
PID 1880 wrote to memory of 4184	1880	msedgewebview2.exe	102
PID 1880 wrote to memory of 4184	1880	msedgewebview2.exe	102
PID 1880 wrote to memory of 4184	1880	msedgewebview2.exe	102
PID 1880 wrote to memory of 3420	1880	msedgewebview2.exe	103
PID 1880 wrote to memory of 1224	1880	msedgewebview2.exe	104
PID 1880 wrote to memory of 1224	1880	msedgewebview2.exe	104
PID 1880 wrote to memory of 4772	1880	msedgewebview2.exe	105
PID 1880 wrote to memory of 4772	1880	msedgewebview2.exe	105
PID 1880 wrote to memory of 4772	1880	msedgewebview2.exe	105
PID 3428 wrote to memory of 2272	3428	Nexomia.exe	106
PID 3428 wrote to memory of 312	3428	Nexomia.exe	109
PID 4064 wrote to memory of 2864	4064	chrome.exe	114
PID 4064 wrote to memory of 2428	4064	chrome.exe	115
PID 4064 wrote to memory of 1280	4064	chrome.exe	116
PID 4064 wrote to memory of 1280	4064	chrome.exe	116
PID 4064 wrote to memory of 2136	4064	chrome.exe	117
PID 4064 wrote to memory of 2136	4064	chrome.exe	117
PID 4064 wrote to memory of 2468	4064	chrome.exe	119
PID 4064 wrote to memory of 1168	4064	chrome.exe	120
PID 4064 wrote to memory of 2468	4064	chrome.exe	119
PID 4064 wrote to memory of 1168	4064	chrome.exe	120
PID 4064 wrote to memory of 3372	4064	chrome.exe	121
PID 4064 wrote to memory of 3372	4064	chrome.exe	121
PID 4064 wrote to memory of 5404	4064	chrome.exe	125
PID 4064 wrote to memory of 5564	4064	chrome.exe	127
PID 4064 wrote to memory of 5564	4064	chrome.exe	127
PID 4064 wrote to memory of 5852	4064	chrome.exe	129
PID 4064 wrote to memory of 5852	4064	chrome.exe	129
PID 4064 wrote to memory of 5184	4064	chrome.exe	130
PID 4064 wrote to memory of 5184	4064	chrome.exe	130
PID 4064 wrote to memory of 5244	4064	chrome.exe	133
PID 4064 wrote to memory of 5244	4064	chrome.exe	133
PID 4064 wrote to memory of 5924	4064	chrome.exe	134
PID 4064 wrote to memory of 5924	4064	chrome.exe	134
PID 4064 wrote to memory of 2712	4064	chrome.exe	135
PID 4064 wrote to memory of 5832	4064	chrome.exe	136
PID 4064 wrote to memory of 5440	4064	chrome.exe	137
PID 4064 wrote to memory of 5472	4064	chrome.exe	138
PID 4064 wrote to memory of 5368	4064	chrome.exe	139
PID 5832 wrote to memory of 2380	5832	RobloxPlayerInstaller.exe	148

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2772.3432.4897007288171805564
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff84b0db078,0x7ff84b0db084,0x7ff84b0db090
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1720,i,422507351657916828,11027855399085130000,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,422507351657916828,11027855399085130000,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,422507351657916828,11027855399085130000,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,422507351657916828,11027855399085130000,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3932
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:3520
- - C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=3428.1804.12731503296884426210
      4⤵
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1880
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff84b0db078,0x7ff84b0db084,0x7ff84b0db090
        5⤵
        
        PID:1120
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2040,i,14928246230974959800,17150018513850081231,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:2
        5⤵
        
        PID:4184
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1784,i,14928246230974959800,17150018513850081231,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
        5⤵
        
        PID:3420
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2368,i,14928246230974959800,17150018513850081231,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:8
        5⤵
        
        PID:1224
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3508,i,14928246230974959800,17150018513850081231,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
        5⤵
        
        PID:4772
  - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp --definitions=@roblox=C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\globalTypes.d.lua
      4⤵
      Executes dropped EXE
      PID:2272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | Where-Object { $_ -ne $null } | ForEach-Object { $_.ToString().TrimEnd('\') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:312
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff83c13c728,0x7ff83c13c734,0x7ff83c13c740
  2⤵
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,5052303080549249787,8729756017313540744,524288 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1696,i,7075970823184991671,9529471237520655652,262144 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2432,i,7787333825579883845,15549348113813358091,524288 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,4892951737744555217,999525741691860085,2097152 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,8876815371071689309,11850822132422196243,2097152 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4512,i,8438062757998965479,3364151500225243576,2097152 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5396,i,7667877146439517498,8599744457279893256,524288 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5644,i,3328066348208381270,18223240781195624780,2097152 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3264,i,1163967275614055600,12903260075234960676,524288 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3272,i,8652448633234971476,3654108790879187700,2097152 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6480,i,8515780001489173331,16118683506678040068,2097152 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6000,i,10705687333915466881,7993069452233818452,2097152 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6708,i,10990654398670811477,18275381900799215724,524288 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:2712
- C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5832
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,11669050638966002342,9773126541928552792,524288 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6428,i,8475900355637152465,7534068778165773564,524288 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6672,i,2789423381198411789,4902857750155436920,524288 --field-trial-handle=2260,i,6028318439792507539,6024667723269827946,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:5368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088
MD5 44b95492bd8693f310fc4b2c4fbabe53
SHA1 cda7cb64accacb9170ebdc6d7d876a6b46d29bbc
SHA512 47c612d2ec39fba90c732ff5160ec290499e59f7c578c1d45d5d205abc9c28514681a0bb98d0320334ce649a047e0ca99137dc3ac9a7eeebacde82797701ac42
SSDEEP 196608:fU9iHrHJbgONLiZ3V1ZbmsxvqfkIu0akVZzZC4qJv:fNHqOUbbmsxSfNu0akTI4qJv
TLSH
T149A6BF22BA00C032E8D200B2D6BD9FFA993D59350B3954D3A7D45DB95A305D33B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 54330d39582cc0a86607882c771bb85128fc91f7787134129677261aca270ebe
MD5 b0ec832a468c8862e2f8a8d6cb74af22
SHA1 409d2407ca8b5f6c67096d98d58d5fb54c910080
SHA512 d09d2619dfaec5b5643a2d17527c7eed0f410ef2759d814ddee6650e052721ffad7c65ec9d0d8f198108e68014c4a89571e4c109ebd3147eda38abc0c5b33c0a
TLSH
T152E0E5AAD931AC3B18F947A860544B46EA4013573A40C94B363CC00ACFB4A770185C1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 22ac7fe927a8d30c53647f03565ad20f95ac15872272c42d26404073ca66ee92
MD5 be822b5f9754cc2e2b6f9a605918be3e
SHA1 ee53384aa2b10abc8365edefb7f0d881f11ad495
SHA512 5f0f70bcb757d8db4163dc10cea9ec47ed5d5f4ca76c7a8bfaa6b8ebf3558b8c62c7c5b7c04f45d7e6491c4ebbbb203af9908106934e3aaf90bc7752ae1614fc
TLSH
T13B7193FDE4C44B32FFA0583348A25C095A2CE252C21A5FAB23E4DC74355BEFB54128AC
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 c55e0ad9425be518d354bc7ae5b04d79b01ac896fe264b212c168a14515912e1
MD5 771d31835901ead3d994822dba8ecfe8
SHA1 e48d1f15b131fd82b0fbf82b10a9494e762969d0
SHA512 9bb5d36f597085818ee503b84935d120bc630e2e8b9bb32b2bfca70dd57dfce63eb6bdea1cf43c0d344d82ea03322c8cef81e3d9ba4a2987f985457cb21815e4
SSDEEP 192:DrHb+fQ4+7I3tftiJraIsuX1ouZGMauAg89fcQ7aP3IHIpfPnIgI1QWNP+vy5NHZ:DrHb+fQ5E3tftiJraIsuX1ouZGMauAgw
TLSH
T1D522ACF7C7E4C66D891196F49B15AE1FCE2D0A24031C3836C8E8BE5793E2472E21179E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 912e9c4605587c8f5d17344b6334feb5e8c1b75f9d24d9c43fbe36b704181c99
MD5 0a21f57a938016928cefed3264f8fc24
SHA1 c6398880cf730f21dece0ee87ac32fa228f1abe6
SHA512 d47df79afa6419517f36e65443d64f6d66321e6c54e58d48f7712cff3b9ec80a8d1974cff0ca5ac4acbffaae7b50cc97547ef8998f83cdeba8144a311edf60c7
TLSH
T1EC4148B7C7D8897D890156E8A6156F2FCD690E14531C3C1A88D8BE0F93E6876E20059E
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 90d16264571ef702a28ab44459b6c51e3a3c05581491ee427ea8e8316f478cde
MD5 16714af2550b52fec0cacf40aa689512
SHA1 e825bf4713dd0389473885057ff1d20b48ac13a1
SHA512 ac86dac15afc8591dd589b16cccafa409b838d4817a3cb7f33b0114259f75b4edda7571b80164d25c0393a969e78dcb31b29749f310f4881597c0266e63e96a4
SSDEEP 192:6RscBhDxa7v78hmPRpkZ/x/rZ9DHsb+WNAnc9L5p45R2nuAa3HRVyIsnAUgraJ:6RsmhDMD4CXm5wg+H02NaHe
TLSH
T17A52D76AB920297B9CD7D319FD157B27D3F5202261D42E84EAFC892C18E79CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 11ac66b651048ad79422ac9f16adcebe43934030bb467834e79af178d9565396
MD5 c1215063359dad17a09625f99ec75380
SHA1 995736346432383721f2676a1ae42f09e0c64136
SHA512 e427eecf2f5b1cd2d9a5d6ef992032e8c96ed72ccc9194a99f39495f228f7366136f53c56ca426e0a254f2fbf0ae78daed6431e981ac7b1d2432e48bdf9cb3b0
SSDEEP 192:6RscBzVxa7v78hAPRp2ZEks9DHsb+WN5OL5p45R2WuAa3H5VyIsnAUgtaJ:6RsmzVMD48X/5wAH02MaP8
TLSH
T16D42C76AA920297B5CD7D31AFD567B67D3F6102161D42E80EAFC892C18E79CC321B01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fe05beea65849a0888129f3a224afee5fe076410c2cbc665e3d804fa3f929f40
MD5 bc0cb7c4f9b3c16d1340977a4d4ca640
SHA1 3286091afaba7af20d5912b928586ca77aef88b2
SHA512 845fc217a01ab180c5763c77ab51985c69f52da4f2e56d794f9798636b8d017b6416df80930425d3f9c2052877e549f81fe2e6b57db391f8f650d1d89bd7ce34
SSDEEP 192:6RscBhDxa7v78hAPRp2Z/x/rZ9DHsb+WNAnc9L5p45R2EuAa3H5VyIsnAUgtaJ:6RsmhDMD48X45wg+H02CaP8
TLSH
T13752D76AB920297B9CE7D31AFD557B67D3F6102161D42E80EAFC892C18E79CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 dc83087887c285582dc0daf33a18e8e1aeeace3b69928f0437476bd8932ba767
MD5 9d4fa049ebf002a272f7a6f545b51404
SHA1 c57d8ce4bce3fb4818a146adb3fa756b52fccb8a
SHA512 72531c49dda222231eae291b38d67fb17d09467d64ab239a8e4239804b4e09608d495fd5614df03c799f3993fa43d4bfcc1913c067dd6eb699b4006ea07287ad
SSDEEP 192:6RscBhDya4v78hmPRpkZ/x/rZ9DHsb+WNAnc9L5p45R2nuAa3HRVyIsnAUgraJ:6RsmhDxk4CXm5wg+H02NaHe
TLSH
T1DD52D76AB920297B9CE7D319FD157B27D3F5202261D42E80EAFC892C18E79CC321711B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
MD5 be6f9d6a2cbcb56c02708e735863c266
SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
TLSH
T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c82f1ac68ca4b256058a20e503a1335438a32b020846368bd23871255cc412d4
MD5 3146b6c142a2771b0eda379629f38155
SHA1 8c4a7bfe583781e924f6960127b97b1b335031f6
SHA512 8d3d5f3085a03e341d8aed4e7ac2a24f81277e2b88718d36047aa768c57562ed335bb5be6aad0bc03fcb1281d789abcbb75745631e18de5f92deea62f5392dc4
TLSH
T1C5A002E052941705C009D3F9F6C66AE13710BB2E13135A118094A2459D50243D151305
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 c4b8f444b5e0baade930e4de479c28afaed8b8abb40184e0201a06bb092bef0d
MD5 2a0e9c9cc9936ff0653e8fec02b06e11
SHA1 55b97554bb3fce5d677a1b665c7cfa43451d3df6
SHA512 4988f2029f0674acea447c315d5ccbf62c4ee3ebc8b3261ab4364c4cf52e0898d4e46ac17ca1f1f11d03c324d81b72704b32021780e4cba795140fd471d362a1
SSDEEP 6144:umKJnoL5tMcRbogx3kvXm7Rkm1tYpBeh2BAoD:uHy7d0gNz9oBGcAoD
TLSH
T1AD34233FDC24E436E4BDB61ED7470E0E0EF58796C222AD8ED9D09A056AD678C090D774
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 f18556909a6cd343822a0f29aa55e9f88058da8f6b75b45ae2a080870283fe89
MD5 81f1b466b2ed9898454486795ab3ba54
SHA1 ae6e7c3a2819432981fee40b474336d396b28f0e
SHA512 1728f159a5beb52692f7ac753f0490679b1e7d58ed912fa827f9e813bc1af085b09de0effc3690ae7d82defe30055ae4947dc66a2eff302fdd3d22de3bcb5bc9
SSDEEP 3072:yGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:Fm7Rkm1tYpBeh2BAoO
TLSH
T192C3123B5D75E9375D79A71EB48E0B1E1EF249A6C930DE42C8D86A0437FA7CC1A04A34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 241KB
SHA256 19cd8b4d131d305543d0c5a53f21b532c2586d4e6be65a5db11831aa8e03ee05
MD5 b02f8d163e1dabf15c66d19395d254bc
SHA1 e11ff4bb4079eccd22a50826d1b2eb40205b16e0
SHA512 b9eb0ca0b12c21243da0b7f9add9bfa52d75082d6bbc10013ed673189710a9266767336607ac684a72dd370ff5c13ba064421767217594aecf7f931c0548583d
SSDEEP 6144:E1JKJnoL5tMcRbogx3kvXm7Rkm1tYpBeh2BAoD:8cy7d0gNz9oBGcAoD
TLSH
T13D34133FDC24E836E5B9B60ED6071A0E0EF59797C215AD8DE8D06A047ADB78C0D0E674
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 856d47158c0f0bc7526b187a76795801e7e83e55488507982c97ba90499322de
MD5 f2cb84d69da2a5f8ab157830b83779cc
SHA1 b4e438e8e1e89421390580de88286addd51f6794
SHA512 7566d45e997147d9fd60dd0eec41b6c779c967b1ec8ebb8bff55c5e26e740c8ee1580f41132d517144d82a7412954a31b3bd691b2dbedf6817201d3eef5a78f8
SSDEEP 6144:hmKJnoL5tMcRbogx3kvXm7Rkm1tYpBeh2BAoD:hHy7d0gNz9oBGcAoD
TLSH
T19634233FDC24E436E4B9B61ED7470E0E0EF58796C222AD8ED9D09A056AD67CC090DB74
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\Nexomia.exe
Size 18.1MB
SHA256 35b72163d0da593ba3f613bea670b941910acfbfd86dec65dd0dde1cfcb4c3bc
MD5 4aa8bceff4c4cc60764cc83cd35e7593
SHA1 2857519505339e58de4684bd4d625bae978798db
SHA512 2024e0f8811b397b842f8152bb9da1dc7228d9696a2bfe06111052b53c2e4d0a4d581f0f1890bbf919789cf5694a4ee27b34ee8842ecd9d33401cdfd8355cccb
SSDEEP 196608:1V4wDOgw5iyQTxL1u0aVC1flcAFi7fv8yHkCnFa7cWLBTtQslVMN4C51W:oSfx1u0DwhfvvHkloWNTCAWB51
TLSH
T165178C42F66280E8C16AC175C35A6233FA71B84907347AEB5BE48B213F6AFD0673D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat
Size 532B
SHA256 ed38812e0842092c5151a9a3f764a3d6a211aa667e20e69c0e51173b14fc2a32
MD5 179a1a9d55c426b7d0e6d3a01f72f514
SHA1 7de19f747badcdff65627c4dd6cac5a3341ccd59
SHA512 f6c584ae77a464408806528ff73b341f18766c7664c57df37acbbd50eaf295da4eaa51776ae49f945dcc4160f69ebe56736db16b4910ecf95e35f717be93f23c
TLSH
T123F05038891A06B500645A99CF5E3544D5FEDA4FA79D7AC014C0D68D366F18A1E873C2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pnb12dyk.sp4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pnb12dyk.sp4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1c1edccf8128abd0c08456ff3b80dc3356f03ed94f6996e6ea438c50c91af468
MD5 6b48e16704827f9f0287ebae7af4fd65
SHA1 e706eb6ff451cb0096b1da1bb4d2c851cedb35de
SHA512 412db0da7459c75f674e65d4eca9695b501daff9478f5f9093d95b8fc65f76c3ec88c6c0cc51d65aad110b60902a32c55208179ca1111d8e4a4e14a89471116f
TLSH
T168D004147D014010C05050310C11D144410FD415D715710450D400170D7C40545414CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bd026fe5d9f01402015d67a0bdcdf5dabb289ac4ece933df16fb9a6e89f7ad17
MD5 f295c5078fd647e235fa893a2150c85b
SHA1 59c3a2e4b58c0b926f1ad23768f84bef93b6e0be
SHA512 8072e836b6336284e557a2c01683746e695c5e817aa610fe68b45ffe15b863d42e2581ebee9874e0d75eeb4101087bfeb01dcebf4ad404bc21d9b0853f97091c
TLSH
T1B5D012163E024134C02021320C02B14C0507D01FC3099104A46C853F1F2C4544E428C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ba96f777b45801b7d61c05caa55e3ce3a03ca8153f8d586460dcf605a625b74e
MD5 8b10882651b15f6926f3695eaacd8e2e
SHA1 cf8fe2dfba5ea8dd41527a05f86059aefdbd0bf7
SHA512 7adeabc6ae63cce3d7d4e30b275043e98a0acbeac91927819f71b8bcaf5f46fe20c48e26e4de319cfd0c1b05c1ceaaff78a832d837c22be2aaf11ab1bc6bb8a1
TLSH
T15CD012163A024134C02020330C03B14C0407D11FC2099004A46C852F1F2C4540E028C6
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5
MD5 d1f604157b0745a40453afb93a6caa42
SHA1 3d5d77429b03674ebb0ba34d925ba1b09310df5e
SHA512 0644ce93724a57dedd8aec208e5a038e323a1b9871d5046d58a87c60479626693e6c8f25b7c7f7b60fd35aac133d2e660ecbd8f8d579ad1fc6703ae117a485a0
SSDEEP 3:MsFl/ll+l:/FE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 e452c85cf0ba271349464e76a642c91b4c81d1f631fe9ea73044c3895df0565f
MD5 2280b0727534312236422a5b706c085c
SHA1 fadc4e65c91a9f6f767e7e9f94dcfcd0f256acee
SHA512 509427986af7893d0d7314be27079a5d17d11840d93730666cd21d0bd8bf170a614fc1af7910b2c36764da2ca00ebef70e835c22f822baf936df48d7f960ade9
SSDEEP 3:MsEllllkEthXllkl2zELxRSlt:/M/xT02z9
TLSH
T1DD4404047FF00417C404103C4013C31003F0D410051157473741F4375CC55410C40050
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 511ac06ad06b7a0be921b10f8bca88779841a402d8ff2ff7915bdb00c0a7a687
MD5 4d51bd4691037d3d1401a42a060e93bc
SHA1 2c9d1766dd77ad80c1bdde0353de42d85108823c
SHA512 e8ddda37ff83d41bf22fd3079ace55304431802490d9497462fa1e975295dbfff113d9f6237506c0bf15bfb33cdc0f7f868a92e2ea4fe83714d8b618a06a5ada
SSDEEP 3:LstlNllkll/lbh3:LsX3lEtd3
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 90cca3f794beb24ebcb903b3a5e3a5f2d9091dcee686a854d56f34679fa82243
MD5 b6a58092e75d91011dcd7b16b7fc2a8d
SHA1 38b76223677f5b36227264de888907e928f0f6e5
SHA512 81d57e8bff3876962d0d0666ed176a23408d24303d4e8f9d21d8235fb006bedf0acbb46c0ce33cebe289de20331dfccd81d5e6ab287713e4cabeba9ddb33e72c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 53e12ce6e8e0c310475e77c84e73272e3f46ebfa371956b4070cdc01a46b22ca
MD5 a2c697a8d8d8753f02889b9d21a2bab3
SHA1 871c757a4adcef0b60beedb49979c0c323e6a300
SHA512 817bc2d152f281f4a743fb3cadb9bc431da1b3e3bfe6b8209505ae123876637e89dc2b73a78e5ed310294def06183367f3532eabba97d675d30aecc76d408af4
TLSH
T154E08CF4C8E572A5FF14013324800D5A277369B7DBBA0BA306A5C2D14017AE03896887
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 912B
SHA256 441550452ede6bedf5ce60c2096403a7dd0f6645fce4c59a03c66e73768952be
MD5 d6ae16f1579974d33fe6e7443b5c1f0a
SHA1 4afd0d77e47961f3183a4ef1472cd757860abe34
SHA512 5c1ba68339399a47e08b786e342dc8780cb9411973df5de79f0040dd5c317979b503939db5e25298778c19291dad2add9c89a67263c4c936fc482d2f2617819a
TLSH
T15811B8F4C4D062D3FF10023646CF5C492267A576DF7A0FB30854CAA10217AE7768228B
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension State\LOG
Size 275B
SHA256 4775b07ed40b34207d4c4cec568147f7e1989e05b3d73e6241fa686694020a46
MD5 ecccd88e8580c150db201f83a6347448
SHA1 718fb068d51496543e3a22e640a3e186f6b7c2c3
SHA512 097effa09d540a72d15780e31cd1971432a9cb5110792504f79fd90f221f2d170977ba1416b16bc76fecb5683768d78c4b4b09fa467524aa5dfffeea865bdc2d
TLSH
T19FD0C21958CD8C3AC5A4CCEB9EB33709CBA47546B68976065F59EC0820428487101B84
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\History
Size 184KB
SHA256 02a92b00c08310fb6215bdda11236ff5e9a7917f439cfe439ca8227931401c1a
MD5 6ac3530f2db50ebd8485ea5a7b3f56d0
SHA1 a764aa4d3b8b05f32ec115721cbba808f419229a
SHA512 7cb9b130beb2fc888a4c137d1548a3925bed56618715d2a62e42c53dec9ca287f41ae31b087b0401f231168f54c735df6f91d4d98a06b3988288cdd028d7017e
SSDEEP 96:HB74gejzH+bF+UIYysX0fxQp97dEHt/DfLjLqL/i5bgI4VgNr2jWRk/E0kV:HB8PH+bF+UI3iWGVdWN3qL/BVgZQW3/V
TLSH
T190040D1E5F343212CDBD913A69E645B3597DF03F87236AC62C6104B1CEE2652B02C5BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 507B
SHA256 1032d6b7b872614398bc18b4619e5c7a1bff55d19cfc59fae1ef02cf0c60cbe5
MD5 9ce309d882de76c429f51be03dd2a6d9
SHA1 35250919ab00ccd4441c9d03742c3449c34d3b9f
SHA512 daf33e30ae715028e5c96af972441981d25e9223980c96eac085bec92794d2e8478b3d9675dcdc3b62cf517c068c193647ea8bf131d76e9ae2417294167c4bd9
TLSH
T18DF050B60370C9BE4700A7A476247C07CD7D0016531CDA76CEE67BB55B630B2E115547
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
MD5 fa739570350b78ef09e5d8ca61d0d71f
SHA1 d4e932ca96e76aeb84d3a151d847658df6a5555e
SHA512 8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:+IEumQv8m1ccnvS6
TLSH
T1BDF2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF866A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 692B
SHA256 3a209532f11a3cf569dab91edc901b8bdee29436226a0f1acd33fcb66063aa59
MD5 716d01e7cc3911cf057ec80c9b7c53d4
SHA1 7500fbe82f986ad72e74b3ca42a29297f0f992fc
SHA512 7697c7024db9941ad3973ea284cf56f5466e5215094129cbc9ac2ce9f7385b28b236d46da7dfbbd9091fafd086348b19aab3934f594a9cc4d48398e38b5429f7
TLSH
T1D2012B66907FB56B20F949EF6E04B8165E76B43A48817CF4CE5341BC73469E3461201A
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 9afe0dac10aa7984298515288965b84c3b8f24ad4952314a9bb317fdcc26dfb1
MD5 6c053e143470edf37f0d5f2515fb5909
SHA1 f658e2baf7c60cb7448d6a504ebb5802656334ed
SHA512 4a17914598883765d5582a8e6643bdf07bd71765e78ff0fb65132958653628557a0b6a3c3575a2cff21f27359cd7d8e68b57771fca1b006271df4911a9dba9fd
TLSH
T183C02261802EE1B2207C06A14980AD095F37FA300081A4ECA653027CE1004668303452
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 28cb39dde2bea43bedd462073b5a7d87dc576b670db835f9d47660017b8ce925
MD5 472630711d8bb37948142ed08916c756
SHA1 c4447f3da4152243320eefea475d9afeada2c51b
SHA512 4b4f500114447376e67547dbdbf0dd8dfb31b44b09480c417c9af615e4a9c45c496cde2a4fc4bf7ff73c48283ba22be769ae3cc3c86552caa134f371559d5e7c
TLSH
T124E0D892407FB56720B909661944B8255FB7B4B654517CF4C95342ACA2511E3C202017
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 8d48c8581825a608d452a1dbda7800ba41343ad837a7331353226fbb9abd2f5b
MD5 e7db75498ef44cbeb13e0f1fe633c82c
SHA1 d1ac55c13c1a16b69d169931fca6f93845cb3a4d
SHA512 0427b5cc2a4f023928cb1d9e98d79e3e8c9d5d76d794d667604c9248f42c9f661e0f0bfa3c84e45e83e2f703ad36007bf5aa4fac15b5b234e7922547d9804244
SSDEEP 96:st405bfk8b9DSffqIdZ8i0oEjktgm/7qx+WVHMSm+uecJ8nS1idQjf+gGy/tKEB:st40x5Sf9Z8pFeZ/S+WiT8SwdmB/tK8
TLSH
T121D1B8565E38A97B4CC7E6197A36BF23D3FA106261D41E48EBFD856C08D66CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 4e485c174e5b78cf6bd9dee90e41c5b7ac005ada7afa1416d4ca92570d93ccbe
MD5 64bb0aa20d189450497036221a583c50
SHA1 643114f16a9ce0e8760a60d53c7f4c3fbbc4c05b
SHA512 71bf09549ff15845d4f4eec2784bb7338437b6a2aa3d361726dc9319d0c9cd885ef37b01c4ad5ab716bd290af1dbef2ddebc22534c7bac3398b8b7d62ffb07b3
SSDEEP 96:st405bfkubDDSffqQdZ8i0vhEwktem/7qx+WVHMSm+uecJJIFMk8dQjf+gu9y/r7:st40xVSfzZ8pa7L/S+WiTGFQdmj/rFM8
TLSH
T12FE1B7429E38A97B4CC7E61D7A35BF52D3FA102261D51E48EBFD856C08D66CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 7KB
SHA256 a799c5d9029a09422da25d2d1969cb55de634dfcd99487802aac77b7897f8030
MD5 44e9cea69b768d114f8260b606633dac
SHA1 ded64471158a131803f1ba996b5b1f4dfa0bafbc
SHA512 a3cc49baa1976fb2e8ef119b8f928e4e690e31c40cbc2dde41fd76c1c101d78a15707eeea3ddb90a6402db6eb51e2ddbc11275e374710169626d02701589c2fd
SSDEEP 96:st405bfkubDOSffqQdZ8i0vhEwktem/7qx+WVHMSm+uecJSREZdQjf+gzmJ/rFMC:st40xISfzZ8pa7L/S+WiTSRWdmm/rFMC
TLSH
T1EAE1C9525E38A97B4CC7E61D7A35BF22E3F6101265D51E48EBFD851C08E66CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 7KB
SHA256 4ed3c016e50f855cd3131849d83dd65652e835fe2f29e05f1ad3ead7bc4d167e
MD5 34bd98f85de1f0dc2389e67dd34385c2
SHA1 d1f81020dfedd9a972c479be95b152906b76dc52
SHA512 dea18e6216e7b10ca656c6059b1c3da68ea13584529d3674c5efda3436669318e1ff429ce90a5c66a69c45fc2a85fddc0909b7b72d4f98a61c2813f9279d09f4
SSDEEP 96:st405bfkubDOSffqCdZ8i0vhEwktem/7qx+WVHMSm+uecJSREZdQjf+gmo6mk/rX:st40xISfzZ8pa7L/S+WiTSRWdmG/r5KC
TLSH
T147F1B8525E28697B4CC7E51DBA36BF22E3FA102265D41E48EBFC452C08E66CD220790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 742742bf4fffca25917e8f9a43fc5116fde4c087829ed3d1dd793597277a60c6
MD5 7791ef8d47c976511bcae4aef50de829
SHA1 cd1f196c7cd16d73fd1be44c9b3ace807625158e
SHA512 c099357c2b59dc28e3869fde9f2dd9cb26ec7b27b8f445ef3db40ebc353aa2b6c2a3b3832e827ee4f7e58cbe4ab1b3dd746c2a974fc8236c2beeb52a81c3a8de
SSDEEP 96:HlnihPlf/ROoKOpkF5d1ni07sMaTEv9V5h5pg5+eewDx2MbmEVl36YdQzz:HIpWGHY9lfMCQ6Ymzz
TLSH
T18ED1D6E7066DC478AF445BEBDD297ECB8DA5409F98D6480A92E2C44C07C2EFC20DE4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 e1a7773dfd423ed080dec77bb010012af5d3435afe5142e1333a679dbd3600ed
MD5 60b43fdd83e1616701b5155364d55aae
SHA1 8403d82ff44b644cb34a5aeb55a83efc3641c6e1
SHA512 64fb2d9543ea0e8c8d3e1a9a3e41607a5b3db2c0f742feab6ec64dc0059986980b1664f7f200dba2c4a166295e4db48fb538311e4242e7c0ed421c6c7b196a9b
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\SharedStorage
Size 4KB
SHA256 1fe8f6113488865c546d2faa55b21482662ce4be19d4f505eeefa09bc3131489
MD5 b9263bbf24428aaca95d04d04f3aeb6f
SHA1 5346015345f6df766df4bc9b42da076f6fdd440f
SHA512 5bc2978bc96e1347500db552e2a2dfd9e5df25c8e16d3ab57e5519de43cb9c08f5aeefd1a6f6947d7fa253505918763b932f622636fc2a7a429fa72a5b49c7cc
TLSH
T1EE810440534000F1D05407F755D1130C0F07D3D4D5410F0355010041CC51D445C70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\LOG
Size 301B
SHA256 4d2110bd16ac4b9995c11c7985b286cba89d0b2bab5b6d24d54e9cdad8680fee
MD5 e2deee7bb41d70cc0981c7dba60ddc12
SHA1 6dfa147e71513cf378c9a43ff1833f26dd3a56c1
SHA512 33568865fc19723e79142b9dc90d9d0d8bf92416250a30426c490db9bbe65824d5928042e755d750dede49d172c124753c8e0c0ebf523026d24523b6bbca14d5
TLSH
T196E0262055CF8E7B868598EF2972F30DC7A1B541E5D956162F25F9082107844B102B40
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\LOG
Size 277B
SHA256 35a76da32386f2ffbe46840045ba053c7c3d18a87cb312238f99abd6b0b18ad3
MD5 554900d9868cb9eda7646f1f45b0a127
SHA1 c0d40320c04db463da5f66b569391e94b6e36b9e
SHA512 24f144d0ba433127a5d293f97f437e0d44a919063ce25368577da422470522f2474b599dc3f538e14823f7e7d4ff204ece877e1abac3bbdb75f2e30a162cbe4f
TLSH
T1C6D0C23584CA8D3AC980D8EB5DF27B4ECBF4B945A7C9360A9F18A80828428087120A81
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Visited Links
Size 128KB
SHA256 fb3c7b5791c179dedf2f3a0a03c2308731632b57d21031370a945b12f7395988
MD5 a8151889e6466e6ea2e5ac3311e73db9
SHA1 dc3f2bb7b701b9835866fc98f0c4ac85b4c46571
SHA512 f7b4b3c60dbaa537be8123da9fa286eaf4c8f3b910b0d7763ee759e2f2e793eac0d666e80b52842ac6d1cf84071aad60bed8c13f852b443c5149f89eb1bea853
SSDEEP 3:ImtVu67tgVU96llt:IiVu67hK
TLSH
T1E9D3045D05050C51C04711715C0C4F5F0430D0154357541137751C5554C41173117D03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\shared_proto_db\LOG
Size 275B
SHA256 d966e7143f59ed768154b73c4617ec05a71eb8beb2d698e79bd06b470adae5d4
MD5 04843262c3d9fe7a67baf26e99bc8eef
SHA1 18c8f67cb7b7ed7745da6d2675a2209ec37bc142
SHA512 d5a2d9a7d2325e304c97b88430c8aeb5d8505b42ddd37f689bf01fb896857128f510757ac2910b14514116b0f099580be489998816057c02fb4b60207af9f06f
TLSH
T1F3D0C215E8CD887FD1A488DB2CB2778DD7587946FBD9260A5F01E90C24424087601A81
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\shared_proto_db\metadata\000003.log
Size 450B
SHA256 d29019d1a75a68a860d5e001059992b1994cacc3f6811f9b44b08b6c8fc21758
MD5 7e62cbb18879ad5f0597079f9370805c
SHA1 6b0f0ec05cb986dd7b2bc2a6cdd29bbbb6418f84
SHA512 67ec1f18e7eda8f6c42ef957c7bb2b5ea0b868460b9691b09f666c5d0e90a47d833d2ac53bb76b01c133dfe7166d1e292228bfeee0564797950b4ebd4a2329e9
TLSH
T129F08C1AF320C018D009C57B747B6B211338E8468FF8EE0F4C7AA0201F32A441E5B7D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\shared_proto_db\metadata\LOG
Size 293B
SHA256 15353034d800b6d6a03707a46ae94d7ca45873dc3424b80b23dda489ba9c9d66
MD5 18541180ab8efbc9f1713fafdc995d15
SHA1 26fe2f69448a3cc521382e4b74efcaf86c10466d
SHA512 d25db313053e62a7af6105aa4ee05db9b48f3f4730b115daacb8e78dbf094f0fcc59ec88adabc89cd11c3a4329119580d0712a1ea0db72d207f0babf58642577
TLSH
T1E9E0C214F8CD8CBFC19488EB2CF27789D768798AFB992F0A1F45DE0C18424487506B81
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 1KB
SHA256 340ecbc065eeee105e322771cb119568c1597fc1515b150c5ab1ae1f10069bf9
MD5 8443d4fd2e7f33fafdca2930536c5cbc
SHA1 dcfeb0259f4bca55771db8a193ee9ff89a901c1e
SHA512 80471a20810183d1a7855748eb56b1b42f0194badf43d61138950ef0a7ef74095a9219c1cb0519f9725f4649fb420ca1bb50c43e3ab55a1e2ff2fc7d08895281
TLSH
T15A3162F3A0A62FB25EA19945B246AE576F7010AAC2104F4866DE4F5903E35CDA536C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 b9b871223e75ce26698c9a4ca293b855b533657e3ca4ddb69c086ce8f54a0a3c
MD5 b22c3a8aa5e4df0e5a65f3e850a1f9d9
SHA1 0173e602aaadcf479b37b38a0dded0f9224118f4
SHA512 4e74775a40f148f8236bb99b1220dbb01b5247ca65b36fecb89da25ac40582163749d1f103d631c8207d99f879844948c2427a5460f7a91fa3dcff627096dc3c
TLSH
T1C851BAB378156BB74BF2D944BA4A3F239B7550A586612F545ADE0F1C02D758C2312C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 793500cb997cad485d99667b13df258dce5a67426ec7173632d6c9939c541a12
MD5 6c9eadb3151da8b47ab945c449a0774b
SHA1 47fcf3556ad5e809770cdef7d5569245bc61cd7c
SHA512 4d537fb9835dd878da2b237c686bd6d319689c3d1fdf99f884e6c821158d75c5c5e683aecdd70b68c1c3629b3d1bc805ec9ae591c5fecad40ff4fad453a2f23d
TLSH
T1477193B3A865AA774EF2D944B9863F13B7A45167D5913F98DAED0F0C02D72C82312C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 fa368729e51936aa326ac26300a490448a15b10f186b30af4f394f64438408e4
MD5 e47e48a3a689bc45a908a263650b4cd4
SHA1 e2edd6d96b263f9a6fb5aa6f558bf45abe6fd455
SHA512 025962593bdc7d9e422a2314ad1d827fe49f8a8de81f8cd0ecdbf84b5a5194db26ea12d4d58c1b7cb3bb76511d07bfee76252cc0fa40c037a4c0b3afdd789c04
SSDEEP 96:zuDKF3NkCEo29fMcDEtgnZ8Frh/cInURLl8DotoN5c+NDcBMZP6GXgZazi+SlEDa:zCA3NbrcDERoiDUajwMZTO+O
TLSH
T1F491A4726476AA778DF2D844B9463F13A7B4506795952F98DAED0F0D02D73C91302C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 0a3494187419b468652fec333aca03c88ba6d17acd4bd4d7a6ac008c13955337
MD5 92380c4bcc69d78906baaf5cc17b65e2
SHA1 a1d921465d96dac7ea371860b9c5b18ba919f82a
SHA512 a2f4a5c315cf5f968eb77524b3a117d05601b9e1e98e56189f58fb0caffb2e56fc7058c7eb39b0cd84468e3623f44a6e7e41eb16805d953daa818474069d6592
SSDEEP 384:zZ+aQikB+z/xvxjg/qhEh3Nb+DElgn/+h9zT:A/UxvxjgC+h+/+hFT
TLSH
T174729E2B65797E3395F3E544BA481B9BDBB484B280C16FA84AEE5F0E06C73D81303D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 e659c561a8c26fd272e2df8648c7edc523fac0f1e4dc0f3ef5253a4c11b7766e
MD5 0b88a6b73369c7afce740977f43cc67f
SHA1 193561a8c564d5d4cfd59337637a5effe9b034a1
SHA512 1f7522f06b2c02b358228103c4d6016102a48aa26f25d7538480e21437f7cff3475b1b93ba64a11f401cd64e2012b633243849b7b93e8e5d7ab37628deda8513
SSDEEP 96:zuDKF3NkCEo29fMcDEtgnZ8Frh/cInURoDotoN5c+jDcBMZP6GXgZazTPlEDa:zCA3NbrcDERooDUa1wMZTvP
TLSH
T1C891B372A876AA778EF2D844B9463F13A7A45027D5913F99D9ED0F0C02DB2C91302C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 0fc99bdc22cba314a9089698d75508b69e945e0021360040043e71f77a37cd22
MD5 c8e896be30e43bd837abeb672a162aaa
SHA1 dd8dcde65caa3f21756faf5ef32448e69e1679d1
SHA512 c91b74b48f1868adf449895c092867ca6f20fef4121458567f0a37d5a70d5d057abb424af264e8bfe996ab71769f4339262eb4a0bc27d80b5ae84d2db3947255
SSDEEP 384:z3+aQikB+z/xvxjg/qhEJ3NbnDEwgn/+h9zT:a/UxvxjgC+J0/+hFT
TLSH
T17A729D2B65797E3395F3E544B64C1B8BDBB884B280C16FA84AEE5F0E06C73D81302D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe590c0c.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe590c0c.TMP
Size 1KB
SHA256 1c9dc7e7dfd405bff0651fa26b559a533e011645caffdd960db58bf99cd489a1
MD5 aef6ecfe7bbb728414369b93dccfc7d9
SHA1 909a501b783332bedc01307f1be710a828e4352e
SHA512 5823a76547af35dd8c00df151901580d8187b38450d965ceeed74be8cc1521c2dee64f1f5b00bf60eff592baf0abadae8fe7be50223148fc2c5809b95a0a4254
TLSH
T10E2172B3D09A6EB25AA08854B242EE472EB050AE82105F0CA6DE4A5903D74CD5136C33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\index
Size 256KB
SHA256 35c753c783a25f68a213795a918b8047d0b44c91eb733dbcda7bd8995b046cc0
MD5 a9bfd85fe12daf1f791e197dbf4e902c
SHA1 ade13da910664c0164c91b795f1ab6a93cb380da
SHA512 e914e51fed6e96cc2d3e89012bd385bc5c1848086333ccc4ed272be7fc4e1c48ce68ef694695ccf4934beb45526c23a03b77e175ba40c0386aa98d55ba7bfa0e
SSDEEP 3:LsOllllklkXlP1h:LsUlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
Size 2KB
SHA256 fa6d4da434d6ce9e97b8fad5276d8be1b6e4e51bc70125a263ade2ca8ddf44cd
MD5 d092aec77aa518c29f3ce97177982c5b
SHA1 72100b96de812c367fa115697c9dad43b7abd677
SHA512 ef4e2fecf5235121f4c09d91dceb3364fe8c6897d19971f76f6a0a86b56faa9b755549cbae82139ea012a14afc39e0a47e273c4f61dab42fb8901cc11c85cc40
TLSH
T198416D7B2A8E12793A803815936048D03FB6E9A46FF2CF60B2C05BDD77F2401D6AB158
MD5 SHA1 SHA512 TLSH

Submit Download

RobloxPlayerInstaller.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller.exe
Size 13.0MB
SHA256 6819f279a5f123fb453c9b9192fe98802a896973b0652115fe3a1c06f1c2345f
MD5 be4ee7c43bebc9dbe029421e585419eb
SHA1 39906c7fa61061f19038a387e4ea1ef0151b0f8b
SHA512 9c01a4814685865f3939841163c528945fcb912f7ea0800173c2920953a139c2f07fb8988080263468533b6091f0f8eb9cf8b7992568386915a5ff1d07bf4555
SSDEEP 196608:Es6Sk0cVzmY5pSVlYL8dg7CwqOrNN5QCJ1IsvE:ErpVzTSVlYgdgOwqcYCz7E
TLSH
T186D69D6AA2B800E9D4BBD17CC6565603EBB1B41603709BDF16A046FA1F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/312-584-0x000001FD3F870000-0x000001FD3F892000-memory.dmp

Download

memory/552-141-0x00007FF858950000-0x00007FF858951000-memory.dmp

Download

memory/2772-187-0x000002A4817F0000-0x000002A4817F1000-memory.dmp

Download

memory/2772-183-0x000002A481590000-0x000002A481591000-memory.dmp

Download

memory/2772-197-0x000002A481A40000-0x000002A481A41000-memory.dmp

Download

memory/2772-186-0x000002A4815E0000-0x000002A4815E1000-memory.dmp

Download

memory/2772-185-0x000002A4815D0000-0x000002A4815D1000-memory.dmp

Download

memory/2772-184-0x000002A4815A0000-0x000002A4815A1000-memory.dmp

Download

memory/3428-477-0x00000177F7EA0000-0x00000177F7EA1000-memory.dmp

Download

memory/3428-482-0x00000177F7EF0000-0x00000177F7EF1000-memory.dmp

Download

memory/4184-568-0x000001FDB6F80000-0x000001FDB7121000-memory.dmp

Download

memory/4184-1326-0x000001FDB6F80000-0x000001FDB7121000-memory.dmp

Download

memory/4652-55-0x00007FF858B10000-0x00007FF858B11000-memory.dmp

Download

memory/4652-54-0x00007FF858B00000-0x00007FF858B01000-memory.dmp

Download

memory/4744-25-0x00007FF858950000-0x00007FF858951000-memory.dmp

Download

memory/4744-373-0x0000015A80ED0000-0x0000015A81071000-memory.dmp

Download