955cc24df2229776e872312122702008981d83471b5e389315aa10304b808cf3

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 22:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Instalador.exe
Size 175KB
Sample260906-142vhade45
SHA256 955cc24df2229776e872312122702008981d83471b5e389315aa10304b808cf3
MD5 1d6c00381a5d4df4b825c0816cf3a6c5
SHA1 d6e0a8bac803ee1c92ee7dbdf8dbd9d5ed53ac8b
SHA512 ceab51f216388a47204e83def47ce2c3543ec18be767ddb44ca1f873ca090c4cceda7abe2970b4c18c9206160f3bbf87d75d69c8f59b78974294409c50640a2a
SSDEEP 3072:SOqXtuKuajptxtSBzQWJWl0W0kdYqr1lcFYM5wQK7chFRlbmtuKuajptxtSBzQWk:S9XtEQvtS1QVTDFr1lgbbmtEQvtS1QVp
TLSH
T10004C0346196954FE43A37F51630E3908654BEC1346BDADE3ED0248FBD06391AA36EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	4256	Instalador.exe

Executes dropped EXE 1 IoCs

pid	Process
3240	NexusAtlas.exe

Loads dropped DLL 1 IoCs

pid	Process
3240	NexusAtlas.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	NexusAtlas.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_1541845572\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_1541845572\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_1541845572\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_549631890\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_549631890\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_1743544871\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_1541845572\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_1541845572\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_549631890\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_549631890\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_1743544871\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4892_1743544871\protocols.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4256	Instalador.exe
4884	msedgewebview2.exe
4884	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4892	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4256	Instalador.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3240	NexusAtlas.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3240	NexusAtlas.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 3240	4256	Instalador.exe	89
PID 3240 wrote to memory of 4892	3240	NexusAtlas.exe	91
PID 4892 wrote to memory of 2908	4892	msedgewebview2.exe	92
PID 4892 wrote to memory of 5732	4892	msedgewebview2.exe	93
PID 4892 wrote to memory of 5732	4892	msedgewebview2.exe	93
PID 4892 wrote to memory of 5732	4892	msedgewebview2.exe	93
PID 4892 wrote to memory of 5732	4892	msedgewebview2.exe	93
PID 4892 wrote to memory of 2856	4892	msedgewebview2.exe	94
PID 4892 wrote to memory of 2812	4892	msedgewebview2.exe	95
PID 4892 wrote to memory of 2812	4892	msedgewebview2.exe	95
PID 4892 wrote to memory of 2812	4892	msedgewebview2.exe	95
PID 4892 wrote to memory of 5152	4892	msedgewebview2.exe	96
PID 4892 wrote to memory of 5152	4892	msedgewebview2.exe	96
PID 4892 wrote to memory of 5152	4892	msedgewebview2.exe	96
PID 4892 wrote to memory of 5152	4892	msedgewebview2.exe	96
PID 4892 wrote to memory of 5152	4892	msedgewebview2.exe	96
PID 4892 wrote to memory of 4784	4892	msedgewebview2.exe	100
PID 4892 wrote to memory of 4784	4892	msedgewebview2.exe	100
PID 4892 wrote to memory of 4784	4892	msedgewebview2.exe	100
PID 4892 wrote to memory of 4588	4892	msedgewebview2.exe	101
PID 4892 wrote to memory of 4588	4892	msedgewebview2.exe	101
PID 4892 wrote to memory of 4588	4892	msedgewebview2.exe	101
PID 4892 wrote to memory of 5412	4892	msedgewebview2.exe	102
PID 4892 wrote to memory of 5412	4892	msedgewebview2.exe	102
PID 4892 wrote to memory of 5412	4892	msedgewebview2.exe	102
PID 4892 wrote to memory of 4884	4892	msedgewebview2.exe	103

C:\Users\Admin\AppData\Local\Temp\Instalador.exe
"C:\Users\Admin\AppData\Local\Temp\Instalador.exe"
1⤵
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\NexusAtlas\NexusAtlas.exe
  "C:\Users\Admin\AppData\Local\NexusAtlas\NexusAtlas.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-backgrounding-occluded-windows --disable-renderer-backgrounding --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3240.2604.1829103276470803146 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView /prefetch:4 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffd2f3f5fd8,0x7ffd2f3f5fe4,0x7ffd2f3f5ff0
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1784,i,14241177891163779022,7993091642153856174,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
      4⤵
      PID:5732
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1784,i,14241177891163779022,7993091642153856174,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
      4⤵
      PID:2856
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2316 --field-trial-handle=1784,i,14241177891163779022,7993091642153856174,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3408 --field-trial-handle=1784,i,14241177891163779022,7993091642153856174,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19 /prefetch:1
      4⤵
      PID:5152
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4564 --field-trial-handle=1784,i,14241177891163779022,7993091642153856174,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4576 --field-trial-handle=1784,i,14241177891163779022,7993091642153856174,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
      4⤵
      PID:4588
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4552 --field-trial-handle=1784,i,14241177891163779022,7993091642153856174,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
      4⤵
      PID:5412
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView" --webview-exe-name=NexusAtlas.exe --webview-exe-version=2.8.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4792 --field-trial-handle=1784,i,14241177891163779022,7993091642153856174,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d408bb8886ce9d787a1496b562e9a5fb30c2db19
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NexusAtlas.exe

Path C:\Users\Admin\AppData\Local\NexusAtlas\NexusAtlas.exe
Size 1.1MB
SHA256 57e7d0f4fe7c57e58e6d3b9181ff4a850da1b6f6a0bb56c0f6f046a8c5c7666b
MD5 27a6975b0c3b4b9f8bad1329be5e7103
SHA1 5882d5f882bdc35cba762b7ddcaadb1579ea059e
SHA512 1cff53ad06980f695125baa04b03af9106788a9d2f2ce68ee07955193deed55749536a2ffc081858ded526f7467de7cc7832054a681ea4e98480614320dffed0
SSDEEP 12288:7/J4dCXzRKX4EcJupbSRi461R1VDrP3224c+iKmDRkRFNBMUFeA+imQ269pRFZNZ:rJ4dCXzRKX4EcJAD1RvQJsnSdS
TLSH
T12435C61123FD821AF5F27FB9997512609BB6BC967E79C38E0694642D0D72B809DB0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WebView2Loader.dll

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2Loader.dll
Size 160KB
SHA256 239a9d6614a6cfade62b47cdb0be36e3069eedc438c3e0647a9e7b7c84ef6ea0
MD5 cce1332e0af440bc54fdf04eb543d4a0
SHA1 c7f6c049ff3eee4ed337a98d3163fbb5c4686ff7
SHA512 3484febcb142beac708faa1775699450ff22f5ce13b7e90da4d6d27ac9bbedd1c2477dc33125cbcce00fc7d59d416588300fa7b3c1c607bda0d1e874cb0425a9
SSDEEP 3072:qjAuqhU/3A5evuBdyoioiVO7kKlU9tKTTnhTEtJI8w6lKIc:36642lioiVOAqnpEtJs6W
TLSH
T1ADF35C57B3E500BBE1B7C27885A74A46EB7678111B609AEF0364433A1F237D0AE3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dc8b073cab4ce2117b2bc24586a983943c5058233dacd35b1866f8054b560328
MD5 3a66cdd1b93a7d61d1e4c6938f5408c0
SHA1 5a3751ca1620ca16a4fffcc6d70422bee886e701
SHA512 9d98ecb219443f8cc7c81790a93a3f36a05594bae9bd8f0ff775a611a20530c4f777df0790fe57f19c2438e6d6ae56abee76809ce0c30034d75d2c6b8c704af4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 39a9fa064a442e2e8f698df3b90167267c03069faa61b92096574eede51fa325
MD5 6ae340afceb56e9a6ebf3b7d1bbc3f8f
SHA1 12710eb5aeecee10b03e7b2389493c27274ec9a0
SHA512 f442d1b938636b2980e9a3ebfecbe6788eb5ff2ffda05e29cd0d88990478c3779029372ea449b8c7914f46e0b905de282b5d99d3e18f09eafaf4d872c710a555
TLSH
T1DCD024337331453CC05030331113710C1400C10FC0054000D43DCD3F3F444D40D07451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 fa3b7c5b2d0dc0dddd8eb429b23f5813975e0037de5e189e1403fcd45bc1c21c
MD5 263798fdcc97a45a4b8fd089f15f54a1
SHA1 29839d3487f1e1fa0a03eb263164c7bbfa36eed0
SHA512 00dccabbd61cec446983cd081315119b3dd3d45cf12d81252b9707b40c3022a34ca6ba14a27867a6114183f013c08c8957423cd6b16db98b1c045f302958b3bd
TLSH
T1F6210E338AE140E5F3D8147A40CAB9973278AB1D20EBECCA53F7D9F89861735491C725
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fa35.TMP

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59fa35.TMP
Size 48B
SHA256 b80e8850baeeee1fd91209fed078982c2fc512d4ed55bd19de8aaa2e836da8fc
MD5 d66b06e97510f15b3aa657b4b3505220
SHA1 821af748c87a1f73f46f16a3352f4e9abc98efa7
SHA512 e6b9711f47335103d14a821b3ccc18985dfc645e0b3d7590dc76a72b10feffdb03ad80476eb3c3ec00015f25e5f0e59ceb507188f2a4b659b5c5e768cbea88ed
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 2e7edf971484a80b81fc626d5c42517fc1d921fbba9c90ba04807ae5d552742f
MD5 0bffd849f63fef490286bfff6185480b
SHA1 9f952323a4ecf3d63a8b3f7a054d59a112c1a8d9
SHA512 7da55e494e154d3a9bb0078c7008bfc77ca1fbaabe280b0a84f176a34f4dc91ee0d4a21bc4b33976f2e75df95352a4026412f860cabc22f7983b80ca0721e9b8
TLSH
T16D515BB3C7F4476C996256F426353D27DE5E04A483287D69C5D8D78BA3F0820F36160E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa78c.TMP

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Network\Network Persistent State~RFe5aa78c.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 dd9a812310986bd2c4707d026c3e3ad070bfd5fc67706c8cd856a6161ba93137
MD5 7a96ffb99a4d701f0c0c4405ce674333
SHA1 2bac850fa711e47789563ede8ce4f7a0b8039735
SHA512 8fb47ddc0a18390d06d82481a38917a3333db3705152ae2764a58cb5d9f84a8c179883e0488244c7b2237b3ba71ac50c1283f460acb535b2b9a9a84e18fc4e29
SSDEEP 96:stY/d1Mqlb9ikkM1o5h16Z+is7/x+6MhmuecEoTS1eHJeSK+gR28XM1C7K:st8fGkD1orisV+FwoWQHJiPG6K
TLSH
T180D1B8125E647D7B8CCAE619BA29BA13E2F9507274D11E58E7FC462C04E76DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Preferences
Size 6KB
SHA256 25a8488ac1db4808bf75c9ab1aa92e7afab3c19be240ac709e9057e3d3415526
MD5 e226300efad8416f27327a2d40c8fd56
SHA1 258bfa035bee2b7196971186e3746c2b0b9a4d6e
SHA512 b293dfab385d42fea1bea77779b07c28b0d9035171135fdc54abb1c1bfdb66ce3006822a22b610bae955e6eb80ac966fa9eb554bdb0b76b0f0acad77d63da770
SSDEEP 96:stY/d1MxGlb9ikkM1o5h16Z+is7/x+6MhmuecEoTS1eHJeSK+gW28XM1C7K:st8fIkD1orisV+FwoWQHJiwG6K
TLSH
T1B2D1B8025A647D7BCCCAE619BA29BB13E2F9507265D11E58E7FC462C04E7BDC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59e15d.TMP

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Default\Preferences~RFe59e15d.TMP
Size 6KB
SHA256 8c507f99edab7a868beb7c2b49e5fbe6bd329aeb321fdef1d121cd6fb701743a
MD5 dc47f07f777e8888a07b769ffd1d9feb
SHA1 0f51a4ea344c691af8668d11f60ef798455a9de8
SHA512 37ea7f60d21643bd05cfefd416062e95dd2fafccd5838e3c6e944845b913a84d71085513b4dcb5d9cef8e9adffe0fc6ad327b52a2038f11b03d56b1b31d9dfb3
SSDEEP 96:rY/d1Mqlb9ikkMpdo5h16Z+is7/x+6MhmuecEoTS1eHJeSK+gR28XM1C7K:r8fGkDTorisV+FwoWQHJiPG6K
TLSH
T110D1C8025A647D3B8CCAF618BA39BA13E2F9507274D11E58E7F8462C04E76DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State
Size 3KB
SHA256 b98f969236fc4853fa4e8112871b7034800f285ddde6b690628d7990d7f067f5
MD5 6c66cace3edad4175990c52406ea54d9
SHA1 628f9e394dbe7eb0b606c4d2533bbcbb4e833665
SHA512 bbc974a88907e1fc92705e92c752ffce7681d7ac25d023d2d88225430f2a07477e9d6b0233c0fe1f82375b28f356e9380acec5f4670ba8626e16d84cd2e330eb
TLSH
T11671B62365B1AA378EF6D604B88A3B13AB785033D9913FA8DAEC0F1C41D73991342C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State
Size 15KB
SHA256 0b27efefc237002e455084949d2daf66b337d67d09ad14514583a9b2b8901f4b
MD5 b01ea4cfebbc4e54dd3f119318656fd4
SHA1 2ed1c82c34ff0563386ddc22e425b978517217aa
SHA512 d3fcb1596dca19b116454d1c13935ea5ed89feee03f59d1a0f1bac52f1a68713aa1ac4183cb933b85566ee396930895834795975b96fcc7a7c67b07f46e8076d
SSDEEP 384:j+aQikB+z/xvxjg/qhEwNBSaAHr6h8t779zB:C/UxvxjgC+5LN77FB
TLSH
T13C729E2B55B97E27EAF6E654794D0B4BCFBC947350C26EB84AED5F0D06C73A80342802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State
Size 2KB
SHA256 faa5b6ddd34d9dc608314e18164c1cff95cb9fd8aac7b695660bb59ff6388d9a
MD5 1ec8bbf1a0e5963c828221df0689d208
SHA1 4fe3b8eda635d8d8725ef58926856e71bb4bdd8d
SHA512 21373c187d5f03a4098be5924bb59bc1769cd56db94d3acf85310aaaac4c279ffad63f38d7d5ed8c4de9adff5f69327e659a97c65a8d342936962e1cf8ab045a
TLSH
T1985174336860AB37CAF65744794A7F23DE3961B2DA612F549AEC0B2C41D762C1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State
Size 3KB
SHA256 b9ef38bc35067c554ec6db34743704987e1f64e0d53facec3f9d4f04e65f64b4
MD5 e3be0104bd9de25dc2583cd5e9a663f0
SHA1 64857eff0edc0b5e0bbc4a167a14cf2d6c38843f
SHA512 6835c61cb32289e2f0af5e5c65f39a70babdd7f1be537f93ac86422f602e40e3cc17647ebc547dae7fd5e7a1d42bcfa93f83d4f5aa7f2c0ee0a254e8d8d10567
TLSH
T1DB61843769B0AA378EF69A01B9863B17ABA95133E9913F55DAEC0F1C01D73581341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5991d6.TMP

Path C:\Users\Admin\AppData\Local\NexusAtlas\WebView2\EBWebView\Local State~RFe5991d6.TMP
Size 1KB
SHA256 f20525b8951e95cc50e2475a4b25ef10c13ebae88608cd71f9a3c01ed03c4a26
MD5 f77bf3c294e2f82993b499fe4fe1e26a
SHA1 e78712c80f016cb7f9e8c868486073aa4bff30a6
SHA512 fc53af00dc6674edf484d4886992bab8f189db120964cc2209cbe3e4d138c6518c11aa84d14aa3451198d27baeef3b850e6a70b013fac4c1639edbcdcbf9e018
TLSH
T1392184B3A4A06F33EDE52342224ABB675E352077C6200E046AED4B3C42E722C8756D33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3240-37-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3240-40-0x00000000026F0000-0x00000000026FE000-memory.dmp

Download

memory/3240-41-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3240-43-0x000000001B740000-0x000000001B7EE000-memory.dmp

Download

memory/3240-38-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3240-46-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3240-32-0x00000000005A0000-0x00000000006B4000-memory.dmp

Download

memory/3240-45-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3240-377-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/3240-44-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-11-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-5-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-36-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-15-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-14-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-13-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-12-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-1-0x00000000004A0000-0x00000000004D2000-memory.dmp

Download

memory/4256-0-0x00007FFD3432F000-0x00007FFD34330000-memory.dmp

Download

memory/4256-10-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-2-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-3-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-9-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-8-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-7-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4256-4-0x00007FFD341A0000-0x00007FFD34B44000-memory.dmp

Download

memory/4784-464-0x00007FFD564A0000-0x00007FFD564A1000-memory.dmp

Download

memory/4784-463-0x00007FFD57230000-0x00007FFD57231000-memory.dmp

Download

memory/4884-564-0x0000026763A70000-0x0000026763A71000-memory.dmp

Download

memory/4884-553-0x0000026763A70000-0x0000026763A71000-memory.dmp

Download

memory/4884-555-0x0000026763A70000-0x0000026763A71000-memory.dmp

Download

memory/4884-559-0x0000026763A70000-0x0000026763A71000-memory.dmp

Download

memory/4884-560-0x0000026763A70000-0x0000026763A71000-memory.dmp

Download

memory/4884-563-0x0000026763A70000-0x0000026763A71000-memory.dmp

Download

memory/4884-562-0x0000026763A70000-0x0000026763A71000-memory.dmp

Download

memory/4884-561-0x0000026763A70000-0x0000026763A71000-memory.dmp

Download

memory/5152-401-0x00000234AC130000-0x00000234AC206000-memory.dmp

Download

memory/5152-151-0x00007FFD55A50000-0x00007FFD55A51000-memory.dmp

Download

memory/5732-380-0x000001A346430000-0x000001A346506000-memory.dmp

Download

memory/5732-75-0x00007FFD55A50000-0x00007FFD55A51000-memory.dmp

Download