35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7

Analysis

user interaction
yes
max time kernel
417s
max time network
453s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 16.5MB
Sample260905-ncdmdadd87
SHA256 35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7
MD5 411e27893f6e210f32cea7e28662adb2
SHA1 2c1f7771a8e24691bc39f7bf17609fa9cf628e2e
SHA512 1528111cc2a8313ccae7ec49c7b7ad911c0603ff4583a2fd19810dbf808142182628d0441baa0ffd42cb78f17a3f11e914b50f9595cf422d357771a4862622e6
SSDEEP 196608:GVXku+QMSrEM6IJZCsQdYXK7lDJl2zRwRLKAyWMsSt3K+zdY4HciDnzjW:MXkZXC/QdYXKoz0mAAsgrzCkXzj
TLSH
T12B07AD43F66280F8C16AC074935A6232FB31BC4907357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
125	2684	chrome.exe

Executes dropped EXE 5 IoCs

pid	Process
1404	Nexomia.exe
5336	luau-lsp.exe
6348	RobloxPlayerInstaller-X3PY7FW3XY.exe
6948	RobloxPlayerBeta.exe
2432	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
2432	RobloxPlayerBeta.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RobloxPlayerInstaller-X3PY7FW3XY.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2684	tasklist.exe
988	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
1404	Nexomia.exe
1404	Nexomia.exe
1404	Nexomia.exe
1404	Nexomia.exe
1404	Nexomia.exe
2432	RobloxPlayerBeta.exe
2432	RobloxPlayerBeta.exe
2432	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\families\Creepster.json	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\common\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_10.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\models\Thumbnails\Mannequins\R6.rbxmx	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\AvatarImporter\img_dark_RthroNarrow.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\MenuBar\icon_chat.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\New\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\SelfView\SelfView_icon_mic_disabled.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\dialog_tail.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\RobloxNameIcon.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\wow-small.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VirtualCursor\cursorPressed.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-ingame-12x12.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio-14x14.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\blackBkg_square.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\SurfacesDefault.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\period.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\ErrorPrompt\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Settings\Players\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\TopBar\Round.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-tip.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\configs\DateTimeLocaleConfigs\pt-pt.json	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\RobotoMono-Regular.ttf	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\AvatarEditorImages\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\AvatarToolsShared\RoundedBorderRight.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\laugh-joy-medium.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaApp\icons\GameDetails\social\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\avatar\unification\R15.rbxm	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Chat\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\Animated\laugh-joy.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_10.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\icons\ic-leave.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\XboxController\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Input\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\families\Balthazar.json	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\families\Bangers.json	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\apostrophe.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DesignSystem\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\InspectMenu\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\PlayerList\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\PurchasePrompt\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Settings\Help\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\avatar\compositing\CompositShirtTemplate.mesh	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\MenuBar\icon_menu.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\MicDark\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\fonts\HWYGOTH.ttf	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\StudioSharedUI\KebabMenu.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\btn_newBlue.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Moments\Reactions\skull-small.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\MicLight\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VoiceChat\Misc\MuteAllSpeaker.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\VR\Radial\SliceDisabled.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble.png	RobloxPlayerInstaller-X3PY7FW3XY.exe
File created	C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\content\textures\ui\Controls\DefaultController\[email protected]	RobloxPlayerInstaller-X3PY7FW3XY.exe

Drops file in Windows directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_128549564\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2868_244719094\LICENSE	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6132	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5560	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2684	chrome.exe

Checks SCSI registry key(s) 3 TTPs 46 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
3012	timeout.exe
3324	timeout.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	RobloxPlayerInstaller-X3PY7FW3XY.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330806646497701"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe

Modifies registry class 51 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-9fe94fb0e9d84c25"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-e7d81637d42c4b23\\RobloxPlayerBeta.exe\" %1"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-e7d81637d42c4b23"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{81E27E66-EC02-459D-8452-093A307A3F89}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-e7d81637d42c4b23"	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{4C4DBED1-539E-4D5B-AFFE-E9B8DD0EECDA}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	RobloxPlayerInstaller-X3PY7FW3XY.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	RobloxPlayerInstaller-X3PY7FW3XY.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	RobloxPlayerInstaller-X3PY7FW3XY.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe
476	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
6124	msedgewebview2.exe
2868	msedgewebview2.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	988	tasklist.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe
Token: SeDebugPrivilege	1404	Nexomia.exe

Suspicious use of FindShellTrayWindow 62 IoCs

pid	Process
476	Nexomia.exe
1404	Nexomia.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
3788	sihost.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
5024	chrome.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe
4212	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3664	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 6124	476	Nexomia.exe	90
PID 6124 wrote to memory of 4496	6124	msedgewebview2.exe	91
PID 6124 wrote to memory of 2884	6124	msedgewebview2.exe	92
PID 6124 wrote to memory of 2884	6124	msedgewebview2.exe	92
PID 6124 wrote to memory of 2884	6124	msedgewebview2.exe	92
PID 6124 wrote to memory of 2884	6124	msedgewebview2.exe	92
PID 6124 wrote to memory of 4460	6124	msedgewebview2.exe	93
PID 6124 wrote to memory of 1456	6124	msedgewebview2.exe	94
PID 6124 wrote to memory of 1456	6124	msedgewebview2.exe	94
PID 6124 wrote to memory of 1456	6124	msedgewebview2.exe	94
PID 6124 wrote to memory of 2356	6124	msedgewebview2.exe	95
PID 6124 wrote to memory of 2356	6124	msedgewebview2.exe	95
PID 6124 wrote to memory of 2356	6124	msedgewebview2.exe	95
PID 6124 wrote to memory of 2356	6124	msedgewebview2.exe	95
PID 6124 wrote to memory of 2356	6124	msedgewebview2.exe	95
PID 476 wrote to memory of 5560	476	Nexomia.exe	96
PID 5560 wrote to memory of 2684	5560	cmd.exe	98
PID 5560 wrote to memory of 2264	5560	cmd.exe	99
PID 5560 wrote to memory of 3012	5560	cmd.exe	100
PID 5560 wrote to memory of 988	5560	cmd.exe	101
PID 5560 wrote to memory of 4428	5560	cmd.exe	102
PID 5560 wrote to memory of 1404	5560	cmd.exe	103
PID 5560 wrote to memory of 3324	5560	cmd.exe	104
PID 1404 wrote to memory of 2868	1404	Nexomia.exe	105
PID 2868 wrote to memory of 6008	2868	msedgewebview2.exe	106
PID 2868 wrote to memory of 4124	2868	msedgewebview2.exe	107
PID 2868 wrote to memory of 4124	2868	msedgewebview2.exe	107
PID 2868 wrote to memory of 4124	2868	msedgewebview2.exe	107
PID 2868 wrote to memory of 4124	2868	msedgewebview2.exe	107
PID 2868 wrote to memory of 2972	2868	msedgewebview2.exe	108
PID 2868 wrote to memory of 1396	2868	msedgewebview2.exe	109
PID 2868 wrote to memory of 1396	2868	msedgewebview2.exe	109
PID 2868 wrote to memory of 1396	2868	msedgewebview2.exe	109
PID 2868 wrote to memory of 720	2868	msedgewebview2.exe	110
PID 2868 wrote to memory of 720	2868	msedgewebview2.exe	110
PID 2868 wrote to memory of 720	2868	msedgewebview2.exe	110
PID 2868 wrote to memory of 720	2868	msedgewebview2.exe	110
PID 2868 wrote to memory of 720	2868	msedgewebview2.exe	110
PID 1404 wrote to memory of 5336	1404	Nexomia.exe	112
PID 1404 wrote to memory of 6132	1404	Nexomia.exe	116
PID 2868 wrote to memory of 3848	2868	msedgewebview2.exe	119
PID 2868 wrote to memory of 3848	2868	msedgewebview2.exe	119
PID 2868 wrote to memory of 3848	2868	msedgewebview2.exe	119
PID 5024 wrote to memory of 1420	5024	chrome.exe	121
PID 5024 wrote to memory of 2684	5024	chrome.exe	122
PID 5024 wrote to memory of 2012	5024	chrome.exe	123
PID 5024 wrote to memory of 2012	5024	chrome.exe	123
PID 5024 wrote to memory of 3448	5024	chrome.exe	125
PID 5024 wrote to memory of 3448	5024	chrome.exe	125
PID 5024 wrote to memory of 3736	5024	chrome.exe	126
PID 5024 wrote to memory of 3736	5024	chrome.exe	126
PID 5024 wrote to memory of 4180	5024	chrome.exe	127
PID 5024 wrote to memory of 4180	5024	chrome.exe	127
PID 5024 wrote to memory of 2284	5024	chrome.exe	128
PID 5024 wrote to memory of 2284	5024	chrome.exe	128
PID 5024 wrote to memory of 5404	5024	chrome.exe	129
PID 5024 wrote to memory of 5404	5024	chrome.exe	129
PID 5024 wrote to memory of 5444	5024	chrome.exe	130
PID 5024 wrote to memory of 5444	5024	chrome.exe	130
PID 5024 wrote to memory of 2744	5024	chrome.exe	131
PID 5024 wrote to memory of 2744	5024	chrome.exe	131
PID 5024 wrote to memory of 1740	5024	chrome.exe	132
PID 5024 wrote to memory of 1740	5024	chrome.exe	132
PID 2868 wrote to memory of 5588	2868	msedgewebview2.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:476
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=476.6072.3050944111906838331 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6124
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffef9705fd8,0x7ffef9705fe4,0x7ffef9705ff0
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,12850306138680205064,6140627684182753830,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:2884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1764,i,12850306138680205064,6140627684182753830,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1764,i,12850306138680205064,6140627684182753830,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:1456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3344 --field-trial-handle=1764,i,12850306138680205064,6140627684182753830,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:2356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:2684
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:2264
- - C:\Windows\system32\timeout.exe
    timeout /t 1 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3012
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:988
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1404.4816.6876258938097922826 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:2868
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffef9705fd8,0x7ffef9705fe4,0x7ffef9705ff0
        5⤵
        
        PID:6008
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,8649364530614229277,5932631290463293255,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:4124
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2064 --field-trial-handle=1780,i,8649364530614229277,5932631290463293255,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:2972
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2424 --field-trial-handle=1780,i,8649364530614229277,5932631290463293255,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:1396
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3440 --field-trial-handle=1780,i,8649364530614229277,5932631290463293255,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
        5⤵
        
        PID:720
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4392 --field-trial-handle=1780,i,8649364530614229277,5932631290463293255,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:3848
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4592 --field-trial-handle=1780,i,8649364530614229277,5932631290463293255,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:5588
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4496 --field-trial-handle=1780,i,8649364530614229277,5932631290463293255,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:6364
  - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp --definitions=@roblox=C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\globalTypes.d.lua
      4⤵
      Executes dropped EXE
      PID:5336
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | Where-Object { $_ -ne $null } | ForEach-Object { $_.ToString().TrimEnd('\') }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6132
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffef31fc728,0x7ffef31fc734,0x7ffef31fc740
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1824,i,14855955416584201710,4893644211792071731,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1628,i,2380558233773229631,926779708406694056,262144 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2320,i,4268298158376102229,3657877857275478856,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:13
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,3774962172074392794,18239981488236041669,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,344305105908803332,3141486995306825299,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4648,i,6969483019246544642,11064909060083225650,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4880,i,15122646057228552494,4950757899013043573,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:5404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4936,i,14777075273251976175,1217828971016741924,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,7786048383648331170,17966318946240221063,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:12
  2⤵
  PID:2744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3528,i,15970837977476042283,192311868949259936,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6484,i,4530714527829879136,3416410409424852033,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6568,i,8950155178052945766,5881283035195399910,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6584,i,6631189662780259772,797091814697444391,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6892,i,8103669586234027819,12773357350792101936,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=7008,i,13160865141023563096,7557309395458409255,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:6148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7196,i,9223063287111397785,11149367322586013383,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:14
  2⤵
  PID:6832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6868,i,18042614158107772804,4735592785150957576,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  PID:6840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6876,i,6381633317404403805,11079862855448884140,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:6844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6888,i,7646486740491543743,3718422262333293298,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6848,i,521357149576062560,7691315731584161095,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  PID:6768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6656,i,14350082061082352358,5569556423942124534,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6824,i,2887551976450908803,9548965490247204677,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7132,i,12616015010835063745,9441283641166279215,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=256 /prefetch:14
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6820,i,5868718741339385150,15321974965108583514,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:14
  2⤵
  PID:6792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6836,i,17877806227389662422,14114077547193251040,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:6808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=7136,i,3055048360503468439,13560119932728023969,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:14
  2⤵
  PID:5756
- C:\Users\Admin\Downloads\RobloxPlayerInstaller-X3PY7FW3XY.exe
  "C:\Users\Admin\Downloads\RobloxPlayerInstaller-X3PY7FW3XY.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:6348
- - C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe" -personalizedToken X3PY7FW3XY --deeplink https://www.roblox.com/ --webBtid 1788607053188003 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6348
    3⤵
    - Executes dropped EXE
    PID:6948
- - C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe
    "C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe" -personalizedToken X3PY7FW3XY --deeplink https://www.roblox.com/ --webBtid 1788607053188003 --downloadSource installer -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 6348
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:2432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7008,i,16309972569969580247,10345595837038769057,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:6776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6492,i,1843942504195975372,1335706508160309561,2097152 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:9
  2⤵
  PID:6832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6772,i,1763125138388968450,1412341550856014722,262144 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:10
  2⤵
  PID:6208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3864,i,15686634868645832956,17831075267655258215,524288 --field-trial-handle=1748,i,10420493812074389403,7050845810414378306,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:5344

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5744

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:7088

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
PID:3788
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4212

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3664

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
PID:6808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088
MD5 44b95492bd8693f310fc4b2c4fbabe53
SHA1 cda7cb64accacb9170ebdc6d7d876a6b46d29bbc
SHA512 47c612d2ec39fba90c732ff5160ec290499e59f7c578c1d45d5d205abc9c28514681a0bb98d0320334ce649a047e0ca99137dc3ac9a7eeebacde82797701ac42
SSDEEP 196608:fU9iHrHJbgONLiZ3V1ZbmsxvqfkIu0akVZzZC4qJv:fNHqOUbbmsxSfNu0akTI4qJv
TLSH
T149A6BF22BA00C032E8D200B2D6BD9FFA993D59350B3954D3A7D45DB95A305D33B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 cf6b41b312f088f6ec206e0d8e4887bf392042455dbdd09ba67eefcad63ff297
MD5 4879a31e3da94cdef88d8d80afd71766
SHA1 18643d24b22f4acbfc2b5195f31dad779b046366
SHA512 f57bfc9b97e275954ee3d62aa832d6d87e5415b9999e0086e5cb6c60372d8c9eaae5210968b7519511fe5cbab31a8e0560b2beabb335b1a134c60b121e4f29b7
TLSH
T166E068E6DE29EC3B19FD0B6820900B45EB6013972B814A4F363E800D8FB067F418685C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 203ad041d42fd57012d0a0f9bdba7ba0a3060a115d6e8d56428a5321eebc828f
MD5 c0f69a85035437149d566b103ada3cc0
SHA1 a5a4afeedb6a54a61a787eba204c997d266cf23c
SHA512 d07281b8410a5ae92698ad9c19b6700cd3c69f3c79b10875917b3315e0aae4ddec0d3beb23825eb48d6c892e1ded3b1c1449890cb777228f706e4e7ddb82ae82
TLSH
T13151DAF9E8E06728FF4020F034540C0A46F7257AC6A5BFFB2674D6A422433F41551930
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 268715de1fe05411bc10c989261d6e422255c9df8b68928221de7c107ddbdc64
MD5 0ba3543dbf45cd166edf935ce3d269ab
SHA1 f0c743b562f3c4af446b68482c162ac221601d78
SHA512 0ac02c5a82cb3179d3c6363fee2a9ff8248924e1afa6e3e2e0c90165136551b1b22f41fc23d0d8e09f1cebdd82b37ba70946b5043e4cc546da87158832aca899
TLSH
T183317AF7C7D8997D890156F8AB156F2BCE290D19531D3C26C8E8AE1FA7E2871D20058E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 b55c80f663a2a8e460eb75ebb9212a0d7d49de289a2ca25af456b91965e658bd
MD5 0e7a3bfc0c5f83450177bf7277791da7
SHA1 979cda5a7363460a82cfe44923bf4373b472df1d
SHA512 e20776697b2b6ca2436fb7ab32a9669740b2213aae25a957dbda56778d3e1f9a8f2c38eae866c70e3523f4c67b59ac9098ea2622d0f4541dd2ddf367e05a4b25
SSDEEP 192:DfXaYp2I+rILHjeiH0QKSIxmI6IfNP4aPVNGMQWzhfwHTlHxK:DfXaYp2JrILHjeiH0QKSIxmI6IfNgadX
TLSH
T102F18CF7C7E4C56E891156F49B156E2BCE2D0A24031C3C6AC9D8BE1B93E2871E21179F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7021137-79b7-48c3-a7ce-5e6f8156db88.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c7021137-79b7-48c3-a7ce-5e6f8156db88.tmp
Size 9KB
SHA256 a5298db91b5be458ecb7fe2e833bfa472d31fd4867114b958987f78750a90500
MD5 3c72008e4584f97c5a2f04f1c3cfac38
SHA1 d098068135e6523c07c00b86b7d9f7274f3b1b8e
SHA512 6d3f54d7898b8cf5195f76439567729d81ae7dfbece15671d946de734a4a05819aeccedaf40f5bb8115dfeaff1455308891244a9fd2a7373257e224779e1b8d4
SSDEEP 192:DfXaYp2I+3oSILHjeiH0QKSIxmI6IfNP4aPVNGMQWzhfwHhHxBwB5DuC:DfXaYp2J3oSILHjeiH0QKSIxmI6IfNgg
TLSH
T147128DF7C3E5C56D891156F49B256E2BCE2D0A24031C3C6AC9D4BE1B93E2872E21178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 7acd31599492300e4129beacc906256c6e333c89d53a70f6a6988ea4fc0f71b1
MD5 29db249475a2dc842cba8df3de0e35f6
SHA1 0bc4e62ab9111f06273476c67e939f33ef7be6a2
SHA512 270e0251a91814730fe863e2715edf0f43f4b9da3dd61f3bd88324b55fa28da8d15113ee62b48ec97ce764d8eddee4c9fce85357d19b105a1cdb5c494025860a
SSDEEP 192:NORlcBzDqgogcjfv7tAPRp2H5Ha9SHsb+WNIvCg4Ws2xYeAtvkwMmnVyIsnAUgR:NORlmzDUjUXdEwEy2KeAtvs2R
TLSH
T1E442C82AB915293B5CDBC629FA217B57E7F6102235A42EC4E7FC896C24E35CC2327417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 647df367c55a729651daac99436cec7bf77391b741dcb30e959145f58900a808
MD5 55d9eef598f08fd1b5a43e4a4b8f6e04
SHA1 7e10a7314a863e1d006ea222ec822aec04990005
SHA512 509fe2d3365e0df8b99c9c059e253528007fe7b9df4f620826296a12b30f9b2aeccff50cda4e41ead6e9b3fdefd555d05f871be2e65620621d50f6439f98f9c6
SSDEEP 192:NOROcBz5qgogcjfv7tHPRpfH5Ha9SHsb+WNIvCg4WsDg+8VYeAtvkwMmlVyIsnAI:NOROmz5UjFXEEwEyV8GeAtvsuE
TLSH
T1A952D82AB9142D3B5DDBC629FA11BB57E7F6102265A02E84E7FC896C25E36CC2317017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 f9f78cb701ee6d88b1225141b453da5e453f9ce2f5bbb9078a6b14b75563557d
MD5 5713a3cb4fdf13953a81614ae1a6c8ce
SHA1 53a1bc6c93fea481dd6d1fca159de2fd533ce256
SHA512 d567577a0687e63aadd7415ee63989a65161e4cf096c101b9547301fe05df7c0028a738b0b3528f081871f010dddc2eac7fd5a660141f59fa59f2fe40ae487fd
SSDEEP 192:NOROcBz5qgogcjfv7tAPRp2H5Ha9SHsb+WNIvCg4WsDg+8LYeAtvkwMmzVyIsnAI:NOROmz5UjUXdEwEyV80eAtvsyE
TLSH
T10652C72AB9142D3B5CDBC629FA217B57E7F6102265902E84E7FC896C25E36CC2327017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 3be91be7807e82cb451968cfda6389c8f3201bc64e82de7074ec6fcd337c4e9e
MD5 916bb544d6a4383b3c4eef682d44aa79
SHA1 1cab7670d3a83832452ef9036392649a92adf6cb
SHA512 30990dddbc5c6b6829864f5ce959faf7b877d200e57d2895ae446ac53d3592c3583ac7e5932fd7b6e61685f3f25a5b31cb9a0c61d888db542477643944454ae9
SSDEEP 192:NORlcBz5qgogcjfv7tAPRp2H5Ha9SHsb+WNIvCg4Ws2xYeAtvkwMmnVyIsnAUgR:NORlmz5UjUXdEwEy2KeAtvs2R
TLSH
T12942B72AB915293B5CDBC629FA217B57E7F6102225A02EC4E7FC896C24E35CC2327417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 11KB
SHA256 bb1fe948c2f1b0002c44817d0ce62d1baec45b0c3da3a52ebc36416b19370b74
MD5 f1a099f15ab2a0f0a1a630c8b0a50167
SHA1 93b5180c0083efb696889b149008d1c0f9390daf
SHA512 1a99b72e0df21ab925556473c6faf74b726e086430fed749e7dc4a378d074e1fe49c016d880c1a96c479145cb54fbf133c0c23fb1a2e38e5d4f100613a49a778
SSDEEP 192:eG14K6ms7KxkXqK4I40pUZNCgVLHrKHfFKslE88OXzKD/l0+ErUkKN9O6y/kZ6UL:D1jts7KxkXqKf/pUZNCgVLH2HfgsluOK
TLSH
T1E732E927A48D5A3F0FD8D41DD8136F8BADB5029263780D2497FF9D0803A97CA125A5FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 f775b668f35fa6a36b2c331806b92c5610b10c98d6521d9a6d3cb7adaae314d3
MD5 d26e742c584734c09783f75dfe81a9b3
SHA1 931f7d381e9980ff8a99c96b937d2be277752bbc
SHA512 2cdcc2d0af98eddef9b6d392267bb9acc4b17bf7253738ea74360789a904d906e91298dcb00ff52bcefb1283bf4343503b3d2318d42d034b47baf4c171023cd6
TLSH
T19EB011C282008002EAA203FA33C20AC0F2203C0203038B0A0CE288288032228EB2328C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 b881db9e5b891c584aecd15383a983cb669954edcb6098b58763fc7070578cde
MD5 253b591ea47200919c08915936057daa
SHA1 f7e8f0a7209964cb6212fc60829d6697012e82bc
SHA512 5454eb01415c88d6c6f35b6be5e7ebc5684c09f5feafda08f1cdd5c3b8ee3cdbfbda368e276002e03e98f7211800be6e99ff62ab1e7aa8db64e618e8a2018630
TLSH
T117A00270D1C00D12EE5043B1A27547472E51492769556B53F5959585CCDB1E48241106
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c6866.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index~RFe5c6866.TMP
Size 48B
SHA256 b32fdc585745dbd059acc3cf88f5c66b07ddd35441aeb5d4967118728808a9b4
MD5 277bd87d6974a8dcc17f1d4f282f5888
SHA1 ed791bcfc77de79e4435d4075e55a2cac69750d9
SHA512 d50398a61a2d7ea208809063dd3f8b959b285ff0d72a7c360f41182cd542b7b6c1c4b2275f6f2e978250caeaec481d41ed6173a8c0e77d5ab6e14a16fa150091
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 5047788c98f7a9fca4bc096b66b52bb509f18d0fa98754f2392e036bb2a12e14
MD5 bc07e4351ed8f5d1ef22ad220488a9b8
SHA1 2c1dba354a7312dc3317fd8e871e8477b57045fa
SHA512 8c52567b57300a2046cf6a835aef2b94677b527d37f239c942e4e4df7db0f93f899d75371429cc418408e1ccc71b834f4cda5fe47408232af8a55021332bdc03
SSDEEP 96:nMC0d+VUJ7oKfVHrSJEYvJVHQRDotok5a9DLB6EGyvP/e+09ZPEOLv4a:MC08UR5rYv3eDUDg1gae+09ZsOP
TLSH
T189A10973A56E8D7BA976C48572022B43CFB5B07BA521AE90E9DC1F0C01E70EC1301523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 d06a0057c6135788dec87d6e50f8dbac400cd8c67bc56e80f866677deb30918f
MD5 2e263376e469ea42521b3d6436e3136d
SHA1 647eee8662bf07d7bb21109efc94a6b4ead3e818
SHA512 c6076beb36d7707163545360abbb57726fbc81f9d0361b820ef0acea493136bf987dd94db9013d6a4bb94877a30241272d71025262cd6ef4cf649daf33eea7a6
SSDEEP 3072:bfgnX0nRa7GgRT+jwPlwMwaSlq+nZTKb5zEMWIhHYA3hv4AL/i:bgX0nRa7Gq4O9wHlja5otIpYehPi
TLSH
T1FED31220EFED05E75DF6E1DE71E7DA0F8929E9CFC94C1E08411FBE8A602DA600752166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 e92787310ce717f810e47d62de809af55e7f1241625726a9b82406966ca2d2b7
MD5 5ddc00d6a5b09a09902c3657b0771091
SHA1 5c0d8474dc6d12cc7f422ce2d1ee791817a38118
SHA512 49c1ba6fc528fa99d3eb26ff2a6ad94991fea096349383a65b75132e4edbf141738b1dc72d925621e0cb1bd420de80772235f7f7d6403b1bbc728fde70d175e9
SSDEEP 3072:IfgnX0nRa7GgRT+jwPlwMwaSlq+nZTKb5zEMWIhHYA3hv4AL/i:mgX0nRa7Gq4O9wHlja5otIpYehPi
TLSH
T139D30220EFED05E75DF6E1DE71E7DA0F8969E9CF894C1F08411FBE8A602DA600352162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 129KB
SHA256 2dae792ba184d268c55989ca8f21401f0b5c30918d43e63465a83fe903c07ded
MD5 889710d3bf5e021ddf148ec4c7ee9ee5
SHA1 7465c47e05ba875f9899e1a4b1407242df8d1f74
SHA512 f2fbf22fafb9163faefbd72270007b4a9ac19e9a7b5554d9dd91aaea2264f0756f5a88ab0b6b2c3acf86996b9aa0eaf36f77bd1802b5f3ed1773dc2fc960ffed
SSDEEP 3072:VfgnX0nRa7GgRT+jwPlwMwaSlq+nZTKb5zEMWIhHYA3hv4AL/i:BgX0nRa7Gq4O9wHlja5otIpYehPi
TLSH
T125D31200EFFD19E759E6E29E75E7D60FC229EDCE858C0E04421FAD9FA02DA600352167
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 5KB
SHA256 762a5759ea7a1f988fab572e29a291f30dd10ee8461c6e6a31932027e5d9a52a
MD5 d2b7ca30cc72e8972d5addd2c5cd01f8
SHA1 7049166c33617a7a2293afbc2acd5abe449f8029
SHA512 4eede1f3e004def7cb3465e4afdde6577763f9742b57bc37c4ef66243aa7beee20c5bb34f37f35cb88652a3705a54da9f1b5e604d8883ce5f12054b108753a94
SSDEEP 96:gSC62d+VUJ7oKfVHrSJEYvrvVH6Sl8h4otop5a7DLB6NGyvP/e4ilp1GiNT5HV9B:dCZ8UR5rYvx2iU2q1Jae4ilCcT5HV964
TLSH
T1FEC118B6B8BEAD7399B69485B1032B47CFA1617BA5409DA4EAED0F0D01D30EC0302127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 feb7138afea81c386df36980bd07c3b854b850081630603b075a4621c3e6fc28
MD5 6a2cd3f2cc77b978cc8b6944eb9b66b9
SHA1 84e6cf68be8a1ec828784c14c0d9f66c18756320
SHA512 50648ff0ffdf464aea9544b2bf76efc1daaf6316135a1161278dfa7b72779022faea0a47ee2727af9dfa95f286e3ab853124df0642a18039d01723019ccc5426
SSDEEP 3072:3fgnX0nRa7GgRT+jwPlwMwaSlq+nZTKb5zEMWIhHYA3hv4AL/i:vgX0nRa7Gq4O9wHlja5otIpYehPi
TLSH
T10DD31220EFED05E75DF6E1DE71E7DA0F8969E9CF894C1E08411FBE8A602DA600752162
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 595B
SHA256 d4e60617c2afab8263febabe7f14f18595715078d71307a8cefe0707dae76dee
MD5 4454c8e578515db43fadd90604ae7675
SHA1 3912ffa00c3a5c86fae6500a0074284d9f668976
SHA512 b17559d466cb6954554c4f879b396ff8431c730f837205547ab46329c6517cd35a719378efa55d78c01b739414dd320157f120feb12e28e1ae90ce7c53a0c75c
TLSH
T117F0DC47E7B15216C926123CC89724E1B730F5917DD1162341056F5D2C373101F17CB8
MD5 SHA1 SHA512 TLSH

Submit Download

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\Nexomia.exe
Size 18.1MB
SHA256 35b72163d0da593ba3f613bea670b941910acfbfd86dec65dd0dde1cfcb4c3bc
MD5 4aa8bceff4c4cc60764cc83cd35e7593
SHA1 2857519505339e58de4684bd4d625bae978798db
SHA512 2024e0f8811b397b842f8152bb9da1dc7228d9696a2bfe06111052b53c2e4d0a4d581f0f1890bbf919789cf5694a4ee27b34ee8842ecd9d33401cdfd8355cccb
SSDEEP 196608:1V4wDOgw5iyQTxL1u0aVC1flcAFi7fv8yHkCnFa7cWLBTtQslVMN4C51W:oSfx1u0DwhfvvHkloWNTCAWB51
TLSH
T165178C42F66280E8C16AC175C35A6233FA71B84907347AEB5BE48B213F6AFD0673D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat
Size 532B
SHA256 ed38812e0842092c5151a9a3f764a3d6a211aa667e20e69c0e51173b14fc2a32
MD5 179a1a9d55c426b7d0e6d3a01f72f514
SHA1 7de19f747badcdff65627c4dd6cac5a3341ccd59
SHA512 f6c584ae77a464408806528ff73b341f18766c7664c57df37acbbd50eaf295da4eaa51776ae49f945dcc4160f69ebe56736db16b4910ecf95e35f717be93f23c
TLSH
T123F05038891A06B500645A99CF5E3544D5FEDA4FA79D7AC014C0D68D366F18A1E873C2
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5024_1639281679\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 90e3e86c325ead0ab947f186982cd0e64e645733937e1f771e5c246ad95ecdcd
MD5 c31e00788dd648447e5fc07a6a76c301
SHA1 9943934ad2dcff907d2293a9e88a8fbf43f54875
SHA512 aea06e0e305fde667d302f82c4a15e21dd805855a96c7d05e7757129ce35e046d5e06fcefaa8ad59649887463fbc05f04d2988aa8e3ab94a7d191e3bb5afceef
TLSH
T19ED0243733510535C01034731C43754C0C00D31FC0D55000D47CC51D1F450541D13C51
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f4f9198742c2b02682da5eaa2305f8262cccb85436a9e5d46f22afc2fe293ca4
MD5 15455984bd7b71efb45e4b7a3bfc4693
SHA1 9ee143cd0eb0b35900da71009dfd7cc54eeabcc1
SHA512 37db187dab4096b66e06616dad527c45509c28e26ff7054bf3079194f9ba6ff3ea93828bf6a1679b305efa350196d08aa8e79a4e2ff8c6b5894c8cff8c6ab231
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f5e9c5ca6088747cc323f144c385bc2f96da49efdb25c318b876424bba4e9eb8
MD5 4dc760832718fddffe1ab3c0fbd32081
SHA1 a88fbcc724e191eb5d559b1556308fe3387baa4c
SHA512 c3559726c6b75fa66410eed5b12a6a52c860267791a89965be4d4445b953f5526cef4cad0c2ff097500aadb1c0c9225499f0ce332ec9c5b877a20607e565cd67
TLSH
T1D7D0243737510135C01035731C01754C0D00D31FC1D55100D47CC53D1F470545D53C51
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 84807fef6728ccaacba1133e2115ed1ecc3fe58f54e2687547e4e788335f2b8e
MD5 bd4c14bf24f469249868a4282fafc6f5
SHA1 54a7797c89364be55c7180e6795820827d269f13
SHA512 df737b1b8a4be85413861bf248e9715ad3b4c42ce61eba8f4a532f95de481d794314e128735a53d6b4bf82a9e2e45ef4d678e80ee317a64100af8833ea7cfb6a
SSDEEP 3:LstlNllkll/lU:LsX3lEtU
MD5 SHA1 SHA512 SSDEEP

Submit Download

03ae38ee19e172a6_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\03ae38ee19e172a6_0
Size 275B
SHA256 ef088b1bb459928831688c99d3668a11d3873c24f108b4afeeb0bf34f9312ee5
MD5 b551a5a58c2888624af4268c25149882
SHA1 5ccf36194f006f42b5b6e639e0ab9ba34fad5c8e
SHA512 de24a98aa34cbdcd2b9c64f4c408dbd2ffc493380d8864aff458fc6b96e746fe514c6a32dd721135569ad9c1d36caed5cf9b3c41a5d376355bd51b86a7c3ae70
TLSH
T15FD095CF4F58C500F25A8DF8CFD5559BD743C0F00459910C600CC45683912687291311
MD5 SHA1 SHA512 TLSH

Submit Download

09f4703a13aac448_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\09f4703a13aac448_0
Size 258B
SHA256 140adc603449d182e32597d20b6dc7f64f82000df1842d7422da6a588ab36050
MD5 abe053ea38a9006ca137e31bf2f24500
SHA1 54823c5fa8c4fccf2adfff834db2901fbb0b55b8
SHA512 3ef49f3f0ab4f6e789453184b3d6e507097d094f95d1578fa286ab97298cd3d07a667f8271f6186953dd7b98bdecc517eaf486faf6a01797f5bbe51cc925e2d7
TLSH
T1CCD0A74FC5B2818CC79D95F1CBD58D0E975790F5149A48428012ED1163812BD7534781
MD5 SHA1 SHA512 TLSH

Submit Download

0ac4c2e70312a0ee_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0ac4c2e70312a0ee_0
Size 279B
SHA256 b0ec8f49d6b0971341dbf1928f6417ce9d14596b5bd086663fb86ae1a085b6c6
MD5 5545ba17f94f362e3704cd3019003a7a
SHA1 ff0ef5344f68dd30b33d963ed51c7cb0207072df
SHA512 8e5369f1a08b5d80bc96477875606b5a9021b93fbd8b61aee48f757f86ee69a5e3f2ef06cbd66844cfdc0776da1f0236dcba46dab618a3750af97edd32673190
TLSH
T108D02B9F91415748C9BE95F086D6CE0D021B90D220BD98126014E86325547387924316
MD5 SHA1 SHA512 TLSH

Submit Download

0bb15a86094610e7_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0bb15a86094610e7_0
Size 266B
SHA256 8a4f099072b0327dd631dc0e039799222831760f9f880d37f6a5738a60d5e681
MD5 4b5d504397c76e2dd125851c723657ae
SHA1 e2143e1ed732c86cdcb0d96b10b57cb77a236049
SHA512 f96fb3cad8535be913b6c5079a07388371789a9f7ec92e59b5a7dffa615bb690be89f4326886d52c4fdf458b37792275981f315a50c1bc65b0ddb2590bb9655f
TLSH
T17FD0974F0C20852DC35684F48BEE4D0EC3A252E1281858100412EA8111C1978BB24206
MD5 SHA1 SHA512 TLSH

Submit Download

1a427df813dcfaae_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\1a427df813dcfaae_0
Size 267B
SHA256 46b20a8d3d1311e67827e456494eb17efd0122852a8fd909619cfb84bb869b89
MD5 2f7a39cf8eea6913ccce16fe24e38cb3
SHA1 cb5df87aed534b6f3a773133a22c9e54ab7eb9a4
SHA512 64ce2ae0cb5880badcb03aa4e84d3fdf8932e092c9808949361a822dbcdbab6723364087ecac12fe5fcffc47b9f9a9c93c525fa3a151974154c9f58cf0aba42d
TLSH
T10DD02BCF2A681698CB6AB7F6CBEBC99E028240D015595C010414D902204066C2110311
MD5 SHA1 SHA512 TLSH

Submit Download

328cff54b1aaf628_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\328cff54b1aaf628_0
Size 270B
SHA256 c3e2188e80e2530bdf8b35df9270e6bea67546747a3014b9d2eb795ddae27574
MD5 2702bdf455284f7a447cea937028c9f4
SHA1 448f227ef30e31ab003abf17fafbfc6f0223d07d
SHA512 d18c18dccaee10f75355735429e79cf4b5b08d33f536c87ef947230fd2f890b0db2e913e9bbacf2378c56bb0ea9a7146949e4419475a0523989bd2c576d24ad1
TLSH
T1E2D0958F4902458CD64748F7DFF78E17439300D014D518511910DC5300D26B4B66475C
MD5 SHA1 SHA512 TLSH

Submit Download

39a65d4ef01580b9_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\39a65d4ef01580b9_0
Size 275B
SHA256 14f990bb519fc4b81beb2f6d53e650e16f73204afe9966dbffac738ca2663b26
MD5 7138bbae5941e2b12fa79d1623a25c23
SHA1 6653cf2247b569f42c1a79d57e38f1b3f3a6ba1f
SHA512 aa0dc02d0fdb4ecddd2751336b428b3b9ed5d4658489b7fe506cc79dfcde6c8a3ac463b6d77ab9a74040140db7dc400791a2d03a2d2f105046eb3c9c15a1d22f
TLSH
T1C5D0974FC9BCA444D6208DF0C7FF995ACB2E49F005AC6416B001F8E12290B1C321E300
MD5 SHA1 SHA512 TLSH

Submit Download

4324b7eea189103f_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\4324b7eea189103f_0
Size 280B
SHA256 cfcbd4ea9a4f363888057d1e93a9c5cf349038bf2bcc4a47d17f83d78eb62f99
MD5 24f24ad222584f601d1c1958fbe4aaeb
SHA1 b83b2f09e041881fdfcf66f7564ab7063be78238
SHA512 39bf97dbe9dc6624f1e6022ce4933b969a50aacf80cefcdabcd96b3b13d9494723074e846c41b5e959df036e1e6f0a4b642f0b37ec0c8197d2789a42ae999835
TLSH
T147D095CFC6351209C13CE6F947DE4B2B431380F1006EA901500BD4EF4551239B695146
MD5 SHA1 SHA512 TLSH

Submit Download

49d3021795a13c13_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\49d3021795a13c13_0
Size 274B
SHA256 5d9a7faf2765f77b7c3b20b2dc0360143ea9df79fa43a7bf7da21ed07848e1e6
MD5 abe4e322e08cbe8f81f0ea860fbe6c7d
SHA1 6ac1aea4b9666b804a519ed22029cf6c9009e0b1
SHA512 f01c0a7ea71c05d37ba7bf7c386e3153c808f97c7f0456608a9ca528eab3f36441808972d69aff352194e3f3d9aa89071912ecc087c5e23876d617a90b526dbb
TLSH
T142D0954F8961690CC525C9F4CFEE8879C202DAB10354A4411004C8511590571311D303
MD5 SHA1 SHA512 TLSH

Submit Download

505fc2e7014f0816_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\505fc2e7014f0816_0
Size 275B
SHA256 0c9a9bb3e8961e3113b59094bc9fb299ec04ced5e1528267309417ddd396876b
MD5 19ccad20a5faa0b57ef7c2970099974a
SHA1 5b8a3acfd2e80c8377391d9ce979581a9dbb3f63
SHA512 8a989405bc6c851777252965430d4bcbf8b2c312ec48b312fd08b58b1ae5b41c2e6c652c00c95a80e1dddcbc63d68f19e42e7423dd93712a751904cc6ab3b21f
TLSH
T191D0978FCD155E40FF3AE8FCE2EF548B830780F102A8E042C220D4C3229322C755E205
MD5 SHA1 SHA512 TLSH

Submit Download

59311ec7d38026ea_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\59311ec7d38026ea_0
Size 280B
SHA256 c5eb406847a91bcee2810840e51e015154c267f5088f02b6fa88aa5aa72f6d06
MD5 ea0d3530eea6d0514750f1bbafc1de2a
SHA1 bdf3784a9628b9a0b18c53c04ac2c9291bb02ebf
SHA512 512b38e7bca5ba3e99b1e52758b5af7e885d3d19c4375ca4a10abf23bb5ddf6fc0c4b33354d731c6d8a4a805e3c2208a8abae07e33927399d2ab6881c1fa3b6f
TLSH
T199D02B4F41240288C6D625F197EFCE555613A4D4108D5D213034F90012D02383966308
MD5 SHA1 SHA512 TLSH

Submit Download

5ac4446cd1f872df_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\5ac4446cd1f872df_0
Size 275B
SHA256 4621543040faa237a5656aef961b23c9f21d018bfee9bae5cd34f709fd8d7cfe
MD5 56ad57ce920a212cbcdc5841caa7a7ec
SHA1 b37c68edf6323fe0445e4376486f64db6ce0c261
SHA512 7152aa25e615696a3201aa5636bca546ecdeb158f13372849bf1e42d91cf4808d046a1a2588cbf87338e444a82430f388fe5bbe96ff142bc4a2271d3ea6bb2e6
TLSH
T12CD02E4FC22A840CE0A5EDF48BEB21EBC24B90F000A8A0062209F8421881AA4A61860E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 b06693885756ef78223cffa7faf425cab955aa053139f37a4399e6d84af6b790
MD5 09e2fcccc12d4ca797705977cca2b155
SHA1 dc731dd439bfa8ed690b825d58caa12283ac3308
SHA512 b1198ea9b652f4abe125cdc72a17d1c22a053859d3edbdeea56cd63661b326ff598f538a569fa14e6312de6bff99d75b9b14e35ed946c79b285c37b2cdc75cab
TLSH
T1E5F062B0D48519C2FF19023360830D2B362B2A72FBA72F1A0661C1E10027BE0381E603
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f75c7ec648212b0160f0073c433db4fa9e50a042aa1d06698b7ba81dceaa7cd5
MD5 7c26e26910f95a6448d039017a32bd52
SHA1 24161a60352669bea34397161f00eb84c973683c
SHA512 8638cd50678bf3df41f3993e7f1af9e472d54969ed760c3deb25fa5ba8a88fa831934ff7ecb937cbed6f1cee0393e054e89a8a255acdbaf0ea7a52b99ab97b5a
TLSH
T19F2197B0C1855AC1FB89093650D2A8273577623AF6732F2E05A1C6B101277E0745A543
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dc6c.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59dc6c.TMP
Size 48B
SHA256 192914dd54d928de261a9e5758e9f94f8b2e08bf3dde6691b02fd9415ec64b19
MD5 d0a0624b76bc5bd9afdbb0de2231ed00
SHA1 1c1d867e896d0830ef26d4417e4d829379cb30a7
SHA512 e75cdfb692d7ca8569dd4c6eb20c7a59cfdc3010fdb00a29d8b0d9b1ec2eee118ba6d890fd82faf7fbec6e248152841cc448152f08ac24215480f1a7a82b8be2
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Favicons
Size 20KB
SHA256 2db221a44885c046a4b116717721b688f9a026c4cae3a17cf61ba9bef3ad97f4
MD5 b40e1be3d7543b6678720c3aeaf3dec3
SHA1 7758593d371b07423ba7cb84f99ebe3416624f56
SHA512 fb0664c1c83043f7c41fd0f1cc0714d81ecd71a07041233fb16fefeb25a3e182a77ac8af9910eff81716b1cceee8a7ee84158a564143b0e0d99e00923106cc16
SSDEEP 24:LLiXxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:iBmw6fU1zBmI
TLSH
T1AA92EE075E383407DBA10E7D266B187A8E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\History
Size 164KB
SHA256 6b6bd668adba9a939ac5384a2add4dc1eedb12863e7eee9f0665a70b43df9de3
MD5 a1e533ad297b7933f162a0055a6f7886
SHA1 4fd7e3db73f46dbd9c82b734ce8e60b2005dddfc
SHA512 4f1c2a66eba84688e22b8eb855d216c23e701f06996cfd09f1771b0035bfff52c3d91b3c4a5fa35359d947b2cc68ba301a2aa7b0b03be1b433f3be1aabb1ed54
SSDEEP 96:8B0ZOHcrc5LqL/uejzH+bF+UIYysX0fxQp97sEHt/DfLVVVN6zRk/E0GV:8Bl5qL/tH+bF+UI3iWGVsWNVVV63pV
TLSH
T139F31C5E6F343311CDBD913669E745A3697DF03F87232AC66C6104B1CEE2656A02C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 252B
SHA256 6aaeb9dd9d33686e0fb9d1a0d3903a0ff453dc652121d8685b01b716b4d2a44c
MD5 9f5254e5daa5468b27414dbf126ee949
SHA1 780d35e362e5410fed4ae06b81a52ae8898bcff2
SHA512 c96933c04d970ab1f2aea55d82bf9847b95379bb92595b318d562b22c94c11bcf304a616ca0a51e8e90c4c6f304be26f7d9923f979d7a67c3475d653ef3a4fad
TLSH
T14CD09571437098FE074093A076247807CA7D0002531CDDB6DA74777947630B9D014487
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59dcd9.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe59dcd9.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 0d14a418d6c376db5711780305a028dcd25d036d7556d381412f71f91dabcd7c
MD5 dc6936cbbb8e127725cd4818765c860c
SHA1 4d9c6f6bec9feca4b0064155223daa98265149c7
SHA512 cc728c2ce5627eea3df3bbf4ddcbf082b18b09e08127c324335b21561a08b8362d8fb4e440d3803b4efb9938ce5f97ec34f8f569029335cd1a672caa1f6e8a0f
TLSH
T199C02275886EB177107806390880AD056F36F030008158F8E543026C60000A6811341B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 7d83d748a7020919b30db1e2c224f9c448897df4fd7a84ee235183afd8b62624
MD5 e753b97bd58f72ac365e9e4bc6d00678
SHA1 53f8559125287bcbd66cd5f6910d19b13b0f3164
SHA512 1e89583b5f4a5b2c004362caa05882a264580d0318b8b891cba5cd7703d4e7ac3ca4b341f93d99648e480795f16f471f7a00073892f5b9ebd009430d784195c8
TLSH
T1A0E026E3507FB52A20B94AB21D84BC069B7AF8324852A8F5CA53427DA3425F39302026
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 e18fda8b56737a6294acb88794ac87a35c41b3113977adc4ee84b6b64aa8bff7
MD5 49e393c3770fcbc7ae20cc67c78456ec
SHA1 43212508a15218e78eadaf7a76698842776058b6
SHA512 2970c0d09119e6754768359775793404a447058b5f670c0786e5b8d2e91145342e29a27c5c287c3754f99e7d9def57e1d91dcd2fbcaa36e8a0e2592625f33998
SSDEEP 96:st+/dp6rGwbDqk+sdo5h16Z0Zs7/x+6MhmuecJpGxjMjeuK+g+JRe5a28XM1C7K:stG3LGonZsV+FdpGxIjWoJG6K
TLSH
T101E194055A34697B8CC7E51DBA25BE23E3F9502266902E48E7FC496C08DBACC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 d993acaf82488bf474ed441e6fef8a9570117404649de3f3e4ba5453bc92be4e
MD5 d9ff2e1a878dd7481efca7fc1d318e6e
SHA1 22d6badfddbc671799a3f0fa90a49d43e348ffce
SHA512 85a77147dd18e1ff5c7016e443026582350a7e4af07778392183748d6c5a413604b6752ee031f3d3029d52987b5b51692746a37f6c8f8d7746a808cda88ad5aa
SSDEEP 96:st+/dp6rGwbDqk+odo5h16Z0Zs7/x+6MhmuecJpGxjMjeuK+g+JRe5HI8XM1C7K:stG3L6onZsV+FdpGxIjWoqg6K
TLSH
T10AE184055E24A97F4CC7E51DBA25BE23E3F9502266902E48E7FC496C18DB6CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 ac23d96028be89c267af2329897125cfed4d7406a997ab0f05a2b0fa97a33cfd
MD5 bef48edb962e290f4da2648f03dcc993
SHA1 696c3e2fc45522fe5a1ce1d6907216d91caf2040
SHA512 0d24f0193da4116ceca5d31ea1ff135935c740b87232076b581d84858abb0d79e050b37a3eb8e55d5260b1b871ab2ebd13ec186474637725e0a5545d190ad180
SSDEEP 96:r+/dp6Ei/b9qk+8do5h16Z0Qs7/x+6MhmuecJ5a1ejeuK+gN4I8XM1C7K:rG3G8OonQsV+Fd5aQjWcg6K
TLSH
T11FD1A5116E34A97B4C87E119BA35BA23E3F9502271D52E48EBFC496C08D76CC630791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 c920259e26451c0043ce482eb38b78597bd89f3ca2ca73d20d3ddf33e09ff278
MD5 c88cbada11fd42dc06cca4690c5d172b
SHA1 566657be126a0a5f30adc1684463bd59b4d946c3
SHA512 a99f64b5bce3bd350c525ba296ef9f9652927e19f40ff54b8d4b43c58aeec521ac457cecd33f067a9a41434cadf3b068501e027a369cf45088b3bc197c24dfd6
SSDEEP 96:st+/dp6EwbDqk+sdo5h16Z0Zs7/x+6MhmuecJXsMkkjeuK+gTB28XM1C7K:stG3pGonZsV+FdXswjWPG6K
TLSH
T182D192015E34A97B4C87E519BA35BB23E3F9502274D52E48EBFC496C18DB6CC620791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 85f1bb47423955bd6ae97fd43f490f02332fa364e13cc8b08708e3927fe5b8ce
MD5 91682baf83795e6fd94511fec9cd8f86
SHA1 4d685ac9f4754756e82ebe14d49194beb102c4b9
SHA512 9525fa7156fcdf2751d1631754c5cb27d22d01904f59c968bbb1abb82821f6e82d198cf3de955da229762ddd635ba035a6d63b4f3a8a74b6e1551d645b39e33d
SSDEEP 96:r+/dp6EwbDqk+sdo5h16Z0Zs7/x+6MhmuecJXsMkkjeuK+gTB28XM1C7K:rG3pGonZsV+FdXswjWPG6K
TLSH
T135D193015E34A97B4C87E519BA35BB23E3F9502274D52E48EBF8496C18DB6CC630791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59dcaa.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe59dcaa.TMP
Size 5KB
SHA256 75777bc965ef63dcec4b0198c47b72d59b4c2dab486a09a61752c78fcaa14285
MD5 0460db5e4418c0207b6b8b260ac70670
SHA1 b1dbd7dbdb647ce44d323a2e7e04b341d0e6f48f
SHA512 da7e681672b72fa4c439ddd097d64a89c8eedbb862bbdf3c67165ae2bb2fadc9091e86b1104ba8f8e7872c770b63992c52d59346839359b918d8981b31983ffc
SSDEEP 96:r+/dp6Ei/b9qksdo616Z0Qs7/x+6MhmuecJ5a1ejeuK+ge28XM1C7K:rG3G8Lo6QsV+Fd5aQjWoG6K
TLSH
T125C1A5115E2869BB4CC7E108BA397A17E3F9502165D52D58E7FC4A6C08EAACC6307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 08f1228712e693facf82b1a22d0296719fe60946c59283d62f444c38ecd14497
MD5 e3451b1c1e7b570191fb3eeecd82ae77
SHA1 cfbd1ef2deabd3456f9d705b6bf54ff321ad7e53
SHA512 ea62ff72fa83c6607e17e0e73cbc4428512ae5bc9004a2630d5920bfab2aeafe452671fbe37c217bd866b9a42503ab8a27627386d96d8b3c60b601c536b982e6
SSDEEP 96:vMiwPlf/ROo1pkF5d1GiT7VaTEv9V5h5pg5+e0J+vnDnQgWXUYJuY5auR:FUvWV9lpenLQlD/R
TLSH
T14CC1A3E70528C575AF448BEBD8397ECBD9BA40DF98C9480696D2C4480BC2EFC21DE499
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 b8a25951b432ce52917652585da7e666dc26532bcb5953ca6ea628e491981de2
MD5 3c2ed2b064604d80729f31e67ceaa819
SHA1 eae29f37c8fd51c3b3b620c8ac70bb818a515e2e
SHA512 14027bd7291acdce0c0e7a97e37c0081253d2047fc1c51983f18a5575f2036d254836f290543649d6d4fe2bd4120793b3fb5e0b1041495bec0e72077a3ee19d7
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\LOG
Size 301B
SHA256 3f60d90373cfc63b8f6f4381141fe3184be99cbab9a869eba878973565f7fc10
MD5 6493ecd46aa736dcae457c924ac346f3
SHA1 a918fe312b96b1f5fc6f5d142897268d12f6c4c4
SHA512 d11d91ab72f991b2f7e126cd8ce01675da7faaa28018a501d9ec81f7a4e2c6cfa292e4e483b28dd6123019daf43b9eb330859f5e0b07047b504de1abbe6318d1
TLSH
T1F5E0262455CA8E3B829588EF2A72B70DCB61B506E9D916122F25F54821578487142780
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\LOG
Size 277B
SHA256 9113b9b15cf2d6c3331f3f7459af772cbe2543ce9bb8631da1fab3fcfef52720
MD5 b8fde2201e4a284b31ef1844cf24a74f
SHA1 2d2d39716d77ebf441614d4b569adf57ff6165d9
SHA512 171eee7152b35ddb6bfdaa131c31873d0bb794ba36cae658425b6586860b8770977a48c7912b3ee59547011e136b34b92fc7257c45ce8798d9ed4bc0f936f448
TLSH
T111D0CD7494C98936C590C8DB5DB1B74DC7B4F94557C936065F08A80825834447110681
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Visited Links
Size 128KB
SHA256 dfbc6e377d890622c67d6c67dbe31b4878fbba6a281a135a3af420f90ebf8a0d
MD5 6a29f3646a31ad575b472a4bcfbae5bf
SHA1 a16d68bb33b73ed8950169fa9b528b419d416da4
SHA512 2b244ba652bbc5ea81bf272b13418f96b0a8b1ac75b27e1cc34882b4a70b264b583b38dafe60c05fcefb80caa8967f9663edbdcadfaefe6bdbf3eb388cb3ae2c
SSDEEP 3:ImtVuSpmADlwG+/t:IiVuSD
TLSH
T1EFD30404D10105D5D145103054D14555141DC005445100CF473DCC5D44F000753135D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Web Data
Size 210KB
SHA256 db93cc6874e6ae80c9a151c1dd6a326ffee07b127e5899438873c19399c79b85
MD5 de64b3487ba692a60d246d8fecc05bbb
SHA1 e2c1d6c0c2ef943be79fee667d2895d5579f279f
SHA512 13e75703aa5562b559896e564a264385fddfcde4ca29de673c1ba7582425776f51c6aeda5a324d89207b0d69b0c915284a1290577774220302a45d3b0fae8f1a
SSDEEP 384:FihpPI2DnEDsKc1IysvHEBMehIv0QKIqJOw:wzPDDnEAKc1Iys/LIIvfKIqJOw
TLSH
T1A724554A7B746100DDE2D9B21CB080771A3CB16D8F22E6925DB264694DF7853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 17KB
SHA256 90e9353e68b8c90156f096043cb5cd921a444863a7fea543457e2dec779c8ab1
MD5 081e7a918071f80ad98a4b8b99ca3ed3
SHA1 e71ab11e71233c91104fef11b5fed2868f01b4b9
SHA512 e58cf53982c6bb9c99b1876d10eac34eeb61f687cad1111325017be08c6b52f3e08d10d89809c91f518185e102fdc204a65d462b436521fef2b61b720b888bfa
SSDEEP 384:p+aQikB+z/xvxjg/qhEN3NlZJteyqRmANIa9zf:U/UxvxjgC+NJZATFf
TLSH
T192829E3AD465AE3399F3A245764A6B8BCBF4546351C52EE48EEC1F0D0AC32DC1302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 17KB
SHA256 7324938fbdec526eec31793614ee1f01a73794b9f62dbea28b7269d8010b14f0
MD5 894681a6267446cc7d680541749dc0a2
SHA1 5149e7604caffab270367d0f6fb3779a239e2b9b
SHA512 c525dd71ae5b33c2a14f5cab219c8bb21e1a9f237c3461e343d76769b81247145f072195ab3fd6e4441ad7ddb8040358e4f48d97a3a9c531d0a7c127b82ba689
SSDEEP 384:U+aQikB+z/xvxjg/qhEKNlZJKByq4mFNIa9zf:z/UxvxjgC+WUFTFf
TLSH
T191829E36D865AE33A9F3A6457B4A6B8BCBF5546351C51EE48EEC1F0D0AC32DC1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 2aaf543e02808eca194a10484583837c3d3c36fa6f19f254763cdb70893b886e
MD5 924396d15a4fb4009c0ccf9a69ced992
SHA1 8c670ca98e5e8bc5e0d708403e6a36f04feaeb3a
SHA512 032184c80475997b8fe855151c33fe2c9ee790e2203f91b456e2112ffeaf9f91a6f29e78ea4a783bb2c6e39a9186fc5cf58394bfb46f0731ddc22d1ff668d31d
TLSH
T123718432A975AA774EF3D549BA863F13A7A55063A5913F98C9EC0F0D42D72CC1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 28f6410e3a44bb6f0908629d17076df53f8247033ddf559845a2355385bae0be
MD5 bd721c00f2611fdd32c7c0e0912c84f1
SHA1 f1eaa54b15f45cee591b443cbe7c74f889170629
SHA512 53ba5cd633ea4fd6e16e78e3a6544aef545dd9e82a793e6418894baf5ea3fc7a59f552726fef8e11be53ad72df59099dccc311228eaa891ce520c68e75d8294e
TLSH
T1D3817322A975AA774EF3C509BA462F23A7A5506395813F94C6EC0F1D02D72CD1342C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 f1fb1a8bc8131fb65ef0cb8aaeccd29995d6c3010a55cfa5a914214f1cb1e6fc
MD5 e8e641e3ef2a883a8ff9193edde97e32
SHA1 2881e3cc48c3cd83a5673a049d40cae662ddc21e
SHA512 7d31ed4251121819df2ac149533960731546cd78e240b0eddbc7664d400c9257e252ee9000f6d25e2fa72efa6bfb74216cb6b8ed9ca453ea98b20c1660e6a3ec
TLSH
T143818422A975BA774EF3C549BA463F13A7A4906395853F94DAEC0F0D02D72CD1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 b9699384240db4f7bba4dfdf4f3fde2a193ae0b422ace54a626cecc1771f520a
MD5 2129b04eddb1dc0598fb0850af6c488f
SHA1 e01df8d3c9b9a87f4c9b84d4822a1808b86d9b83
SHA512 4bee05ee71896422fcf6d6b773b95f7055fe99aa5e88e4f24353d7ce99eac32b758606a411bf67adc72efc8901f27bbb553f03a64534af9c3aedbd1f6a66270d
TLSH
T11D817262A975AA774EF3C6097A463F13A7A4906395852F94CAEC0F0D02D72CD1342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 ec947ac03cfcfe934ddb2f3c762695d7d314ba4c662225bf11e19263ffcb2f70
MD5 8bc58feee661b96f3de049fb8a09622c
SHA1 83a29cd472697afad01626134af51d793c778ce7
SHA512 f391831094cb63fd8f8d6db9f51f00274957d5c2236c7b8703468e993ec5153592a5543e0a32da6bff5b6be28d3eab7eb4d764db9f300897f4a2824c06ef13df
SSDEEP 384:Q+aQikB+z/xvxjg/qhEh3NBSZJt/qTANIa9zf:v/UxvxjgC+hCaATFf
TLSH
T1EA729E3765797E3396F3E5057A490B4BCBB9A4B394C22EB44EAC5F0E0AC32D41342D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 ca2511c50fe95b3b6791a9bf91f02e6c026c7b531c3b156e86683ae9d2ea6de2
MD5 8191dfb7b1f5fe2081f5c6111750dc8a
SHA1 3b8a8893c4c475521267eaf3f68667558c108e37
SHA512 8bc533a1d90bc3181ec4d7f3c13ceae5d2a848f26449ee96d379ae1e73638f731cfb94b524b5463bf6fe3d2d6d77204f52b5c1cb79007bd02482753a3d9a2784
TLSH
T17C51A773B925AB778BE346497A4B3F338F7590B69A521F509ADC071801D758C2742C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 2b7ce820066d19a7406736eeca003a6c1540e08a6ae7b689e711983f515133be
MD5 350cf0a060397e2b6e145aac923a15b5
SHA1 60dbc38dc224dc098a9d09fcdfd6f5ae4f14692c
SHA512 9580243e128674e853b1c336abd83785008bb5bf620a2e0f5e2e00c5eb0ff19012f033325009b740aa12dbeb4f9a39afbd1ce46d279185c1902a4c262bb76d48
TLSH
T141617372AA75AA7B4EE39A057A863F13A7A55077E5913F94C6EC0F0D01D72C81342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 17KB
SHA256 de345c92deebe0f76fa438c04b778418c4c483c0b0e048edadccb76939dd4972
MD5 7f4e04c8cdf9899798b0d274cf13e9fe
SHA1 9683b852bc4c3b2506b1b864e2c0857a5a677151
SHA512 4f77b1091c3f982f12bab1880afd77e0b098e9756f3008ed68b288c7e5454171c2f38a88db9fa850090586f3f413f1f2cc0b61826a4d045a94ad8d358ecdd0be
SSDEEP 384:C+aQikB+z/xvxjg/qhET3NlZJneyq4mANIa9zf:t/UxvxjgC+TnUATFf
TLSH
T154829E36D865AE3399F3A6457B4A6B8BCBF5546351C52EE48EEC1F0D0AC32DC1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5995ae.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe5995ae.TMP
Size 1KB
SHA256 602ccdbbe52563c618c1e35b60c599530e14d4b1c6764bb3e3a5f5f0c0d4503b
MD5 3084cad8b43782debc82bde76a6824e3
SHA1 271d75d2af29a4f0ac6e066c2ca3bbfa1c77e3c8
SHA512 85dcffdb839ed1005e33b1b790da53b87356cc72ab96f1b0a0b6da64038f878ab92fd6c1dbd27c9c8d8bf0f747c3ab6aad7706a40ab540920386c48cfa493994
TLSH
T1222165B2E6795F73AF8262463387BE634E3250BB81610F0095DD071906E748C9956C32
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\index
Size 256KB
SHA256 e8c96586dbac45c3414015fb066dd15c50972e6d36357eede2a35f23a0ead8f4
MD5 dee5a0828d8db478cafa3cccbbf690d2
SHA1 ea2135f400353e5170ab588206dfc477c033951e
SHA512 33ac43770efb4d31e04b6305920499f9bd932bf50950a0ac70a18cb23a897f10560bcfa1eb60bfea27aba459f2f672c7765c8abb1451dee2fc21b3a4598ab26b
SSDEEP 3:LsOllllklkXlt:LsUlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ba6dcb19-9c69-47fd-b8ca-9888efbe77ce.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ba6dcb19-9c69-47fd-b8ca-9888efbe77ce.tmp
Size 17KB
SHA256 f46410938f2216828014ed3471e4352b369512d2e80492f285c00d5e91cdc762
MD5 412e3942b20a77c9c5bd95340d5c5591
SHA1 5d4f8d20ca4b9076dee1fb482084554c1ef00392
SHA512 008102f709a34a98f36a33bd766b4c6972f57a6844b1f92bf4282ca67bb8feb7baac480bb298e15807fcd8ed515e78638d6af30b14437eb80a491fdb0ae8b992
SSDEEP 384:7+aQikB+z/xvxjg/qhEp3NlZJ7eyqRmANIa9zf:a/UxvxjgC+prZATFf
TLSH
T14D829E3AD465AE3399F3A2457A4A6B8BCBF554A351C52EE48EED1F0D0BC32DD1302C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerInstaller-X3PY7FW3XY.exe

Path C:\Users\Admin\Downloads\RobloxPlayerInstaller-X3PY7FW3XY.exe
Size 13.0MB
SHA256 6819f279a5f123fb453c9b9192fe98802a896973b0652115fe3a1c06f1c2345f
MD5 be4ee7c43bebc9dbe029421e585419eb
SHA1 39906c7fa61061f19038a387e4ea1ef0151b0f8b
SHA512 9c01a4814685865f3939841163c528945fcb912f7ea0800173c2920953a139c2f07fb8988080263468533b6091f0f8eb9cf8b7992568386915a5ff1d07bf4555
SSDEEP 196608:Es6Sk0cVzmY5pSVlYL8dg7CwqOrNN5QCJ1IsvE:ErpVzTSVlYgdgOwqcYCz7E
TLSH
T186D69D6AA2B800E9D4BBD17CC6565603EBB1B41603709BDF16A046FA1F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/476-165-0x000002AD8D0A0000-0x000002AD8D0A1000-memory.dmp

Download

memory/476-164-0x000002AD8D090000-0x000002AD8D091000-memory.dmp

Download

memory/476-166-0x000002AD8D0B0000-0x000002AD8D0B1000-memory.dmp

Download

memory/476-180-0x000002AD8D300000-0x000002AD8D301000-memory.dmp

Download

memory/476-167-0x000002AD8D0C0000-0x000002AD8D0C1000-memory.dmp

Download

memory/476-168-0x000002AD8D0D0000-0x000002AD8D0D1000-memory.dmp

Download

memory/1404-464-0x0000026394C00000-0x0000026394C01000-memory.dmp

Download

memory/1404-463-0x0000026394BF0000-0x0000026394BF1000-memory.dmp

Download

memory/2356-79-0x00007FFF17BE0000-0x00007FFF17BE1000-memory.dmp

Download

memory/2884-214-0x0000021D12650000-0x0000021D12723000-memory.dmp

Download

memory/2884-26-0x00007FFF17BE0000-0x00007FFF17BE1000-memory.dmp

Download

memory/3848-633-0x00007FFF18350000-0x00007FFF18351000-memory.dmp

Download

memory/3848-632-0x00007FFF176C0000-0x00007FFF176C1000-memory.dmp

Download

memory/4124-513-0x0000020C02570000-0x0000020C02643000-memory.dmp

Download

memory/4212-2195-0x000000000F2C0000-0x000000000FB3B000-memory.dmp

Download

memory/5588-1107-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/5588-1095-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/5588-1094-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/5588-1103-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/5588-1104-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/5588-1106-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/5588-1105-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/5588-1096-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/5588-1102-0x000001731CB40000-0x000001731CB41000-memory.dmp

Download

memory/6132-624-0x000001AE34B90000-0x000001AE34BAE000-memory.dmp

Download

memory/6132-626-0x000001AE34E80000-0x000001AE34E8A000-memory.dmp

Download

memory/6132-620-0x000001AE34B20000-0x000001AE34B42000-memory.dmp

Download

memory/6132-625-0x000001AE34BB0000-0x000001AE34C62000-memory.dmp

Download

memory/6808-2030-0x0000024880100000-0x0000024880200000-memory.dmp

Download

memory/6808-2031-0x0000024880100000-0x0000024880200000-memory.dmp

Download

memory/6808-2077-0x00000248951A0000-0x00000248951C0000-memory.dmp

Download

memory/6808-2046-0x0000024882E20000-0x0000024882F20000-memory.dmp

Download

memory/6808-2058-0x0000024882D00000-0x0000024882D20000-memory.dmp

Download

memory/6808-2044-0x0000024882BC0000-0x0000024882BE0000-memory.dmp

Download