35b72163d0da593ba3f613bea670b941910acfbfd86dec65dd0dde1cfcb4c3bc

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 18.1MB
Sample260910-g4mwsszbpc
SHA256 35b72163d0da593ba3f613bea670b941910acfbfd86dec65dd0dde1cfcb4c3bc
MD5 4aa8bceff4c4cc60764cc83cd35e7593
SHA1 2857519505339e58de4684bd4d625bae978798db
SHA512 2024e0f8811b397b842f8152bb9da1dc7228d9696a2bfe06111052b53c2e4d0a4d581f0f1890bbf919789cf5694a4ee27b34ee8842ecd9d33401cdfd8355cccb
SSDEEP 196608:1V4wDOgw5iyQTxL1u0aVC1flcAFi7fv8yHkCnFa7cWLBTtQslVMN4C51W:oSfx1u0DwhfvvHkloWNTCAWB51
TLSH
T165178C42F66280E8C16AC175C35A6233FA71B84907347AEB5BE48B213F6AFD0673D754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4264	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1075519364\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1075519364\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Part-ES	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1075519364\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1265835362\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1075519364\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5976_1075519364\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe
4620	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5976	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe
Token: SeDebugPrivilege	4620	Nexomia.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4620	Nexomia.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 5976	4620	Nexomia.exe	89
PID 5976 wrote to memory of 3236	5976	msedgewebview2.exe	90
PID 5976 wrote to memory of 5284	5976	msedgewebview2.exe	91
PID 5976 wrote to memory of 5284	5976	msedgewebview2.exe	91
PID 5976 wrote to memory of 5284	5976	msedgewebview2.exe	91
PID 5976 wrote to memory of 5284	5976	msedgewebview2.exe	91
PID 5976 wrote to memory of 5400	5976	msedgewebview2.exe	92
PID 5976 wrote to memory of 3180	5976	msedgewebview2.exe	93
PID 5976 wrote to memory of 3180	5976	msedgewebview2.exe	93
PID 5976 wrote to memory of 3180	5976	msedgewebview2.exe	93
PID 5976 wrote to memory of 1376	5976	msedgewebview2.exe	94
PID 5976 wrote to memory of 1376	5976	msedgewebview2.exe	94
PID 5976 wrote to memory of 1376	5976	msedgewebview2.exe	94
PID 5976 wrote to memory of 1376	5976	msedgewebview2.exe	94
PID 5976 wrote to memory of 1376	5976	msedgewebview2.exe	94
PID 4620 wrote to memory of 4264	4620	Nexomia.exe	95
PID 5976 wrote to memory of 5864	5976	msedgewebview2.exe	100
PID 5976 wrote to memory of 5864	5976	msedgewebview2.exe	100
PID 5976 wrote to memory of 5864	5976	msedgewebview2.exe	100
PID 5976 wrote to memory of 3424	5976	msedgewebview2.exe	101
PID 5976 wrote to memory of 3424	5976	msedgewebview2.exe	101
PID 5976 wrote to memory of 3424	5976	msedgewebview2.exe	101
PID 5976 wrote to memory of 4476	5976	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4620.2868.16398376180738988357 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x160,0x188,0x18c,0x16c,0x194,0x7ffcb0895fd8,0x7ffcb0895fe4,0x7ffcb0895ff0
    3⤵
    PID:3236
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,15496578672084640141,17082917990639431411,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:5284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1956 --field-trial-handle=1768,i,15496578672084640141,17082917990639431411,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:5400
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2344 --field-trial-handle=1768,i,15496578672084640141,17082917990639431411,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3432 --field-trial-handle=1768,i,15496578672084640141,17082917990639431411,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2108 --field-trial-handle=1768,i,15496578672084640141,17082917990639431411,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:5864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=1768,i,15496578672084640141,17082917990639431411,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.7 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4548 --field-trial-handle=1768,i,15496578672084640141,17082917990639431411,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:4476
- C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
  "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp --definitions=@roblox=C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\globalTypes.d.lua
  2⤵
  - Executes dropped EXE
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4dd51605c0ea383cf0227908ba2bedb28010efa0d8b04f679591abbcc9e6114e
MD5 a52b2e092c3f2e612f2c6fbc3a6b46eb
SHA1 ff5ae3851d26b9f19789ea375472c402c17b4c08
SHA512 252ea055f89f95ece74469b20bf158a24570c9fc24c414dd8dfc933be742d5a13989e2924ebec0d5d622869cc7cf8bc03ac756ff3823cb0c661d118dca1b1a48
TLSH
T1C9D012223251527CC0102133950275081500C11BC00541015428861D2E480901A02843
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e9b94e72ae771d06c2b0748c82510a9be61323a83e3b7061965e37d623c2133b
MD5 afb3c30763d40ae536e61bee5820e125
SHA1 6d3b94e177734a8ef959e4ac7220d4cf6c7b1f99
SHA512 b7844dcc226639df93379b03ce29298b4df37730de861b62d5ea937450380e1114e2d0de89f4bd14cade0ab43e11a9176084be0c75c3eb04b1bb7a5621bbc9dc
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 8bf6125aee20abf832c836c575f2d3a714168cb42e1a8497e9bd23cdc293c5fd
MD5 a2558b588861605c865de85913863b3a
SHA1 550c5def34bc97c1feb21c370adb256ea3d917bd
SHA512 0248cca16708d5236cd7a25a9355c9b874d2ecc2855cf78a5db4a9c953be302c827fd6f154036496d923e19a3243c15301362b2b3b65af60083ea194d0049a81
TLSH
T180F09AD832847963EB710A3895C76C0338B2A0B111230F861B50F8BC0E423F481DE4B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bced.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59bced.TMP
Size 48B
SHA256 e41ea9b3cd175891b4acbe15645f8d7e547d890afe6e4215643cf7bab130bff9
MD5 998845dbced950b6938eaed37912e743
SHA1 3a600d807c09a76acb45aa80b164f212b71068fa
SHA512 cf8234494733843a0a34444ccae525fc860f56a36e6aa33d500592352347a2052b5846a52fa372ed0926c15962884a999990a3bdd1ab7e9923e9c3ad6902bc28
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2a2d0e33-ec16-4e0f-9305-5c8e15a648f1.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\2a2d0e33-ec16-4e0f-9305-5c8e15a648f1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 252B
SHA256 6aaeb9dd9d33686e0fb9d1a0d3903a0ff453dc652121d8685b01b716b4d2a44c
MD5 9f5254e5daa5468b27414dbf126ee949
SHA1 780d35e362e5410fed4ae06b81a52ae8898bcff2
SHA512 c96933c04d970ab1f2aea55d82bf9847b95379bb92595b318d562b22c94c11bcf304a616ca0a51e8e90c4c6f304be26f7d9923f979d7a67c3475d653ef3a4fad
TLSH
T14CD09571437098FE074093A076247807CA7D0002531CDDB6DA74777947630B9D014487
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a60de.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe5a60de.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 d6ca3f479a794ee437175b163b4ac53a3f23388ca2dd4404a5ee15822c31d2d8
MD5 5f4c35d897974fe1822ae93309af0b05
SHA1 ccec28fc7f72ca4081252902e7f5219c05e45101
SHA512 0c119db40aa0847d0658a26073c31737412841237505c47af21114103b38273f9e93fd845e4b4f3d59a811bd6a7c58db922c9285c0986afcc25c35431b754d96
SSDEEP 96:stn/dpdVKPGgZb9rkwo5h16Z0uxs7/x+6MhmuecJuzyo41ejeYhK+gUYq28XM1CO:st/3dsdonuxsV+Fduzy7QjbMC1G6K
TLSH
T16FD1A6025E64797B4CC7E219FB29BA53E2F9643265E01E58EBFC462C04DB6DC2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 e66e02668c89075f4c5d99ae104a618d68bd070af32a8277c73d6a7354ffb4f3
MD5 5e75e6c6a07e759871566c779a05c4c5
SHA1 3151935165c7a33436d1e0dfc4639169b936c64e
SHA512 a95f544a55b79351a219d187c9f585ae089d04999a2f109e368d8176666489b657bb0c496daa20df22b2fa7dc04e034eeafe465c450f9e9234249a7e8229cc5d
SSDEEP 96:stn/dpdVK4gZb9rkwo5h16Z0uxs7/x+6MhmuecJuzyo41ejeYhK+gUA28XM1C7K:st/3dWdonuxsV+Fduzy7QjbMCAG6K
TLSH
T1C4D1B5015E64797B4CC6E219FB29BA17E2F9613265E51D58EBFC462C08DB6DC2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe599fe0.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe599fe0.TMP
Size 5KB
SHA256 73c4f28881f8807877bf9b063ecccfad41bdd412300454723a2ac21825200dea
MD5 efc4020c131809a7ba56b19058181796
SHA1 c9e900eccef4486b2aaca1c05649335571568602
SHA512 44a7941436372d2ebb863e0b57cc10cf830c5d42ac58de3715b131ea25e42b2213ae8b3ba8597955809bdc3876008908d35706a78e6d212aed23c16c15ce1e9e
SSDEEP 96:rn/dpdVK4gZb9rkKdo616Z0uxs7/x+6MhmuecJuzyo41ejeYhK+gUA28XM1C7K:r/3dW7o6uxsV+Fduzy7QjbMCAG6K
TLSH
T1A7C1B5025E64797B4CC6E218FB39BA17E2F9553265E52D58EBFC462C08DB6DC2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 1a5944e04b142574ca2127ee58657a9490e18d2ea2dfd5fe43289feeb18dd02b
MD5 b3606767eeb62f6654734e1ed0fb17d5
SHA1 e89ed11caf118ac400986911479da41c30ee7b4a
SHA512 8dd57d1f9a3a1f8ef0c194dd90293a63c5b29f0094c9efbf6834022e05f9033b80a28fc13e64eae6411705da5571de729f496c9fae6e9586fa4dc2f1f8900186
TLSH
T17A717422A975AA3B4DF3E644B98A3F13A6A45023DA927F99D9EC0F0D01D73CC1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 9dbde24327747bce06280ff569590a7ba85fe4fe08084552b04ac1d995cc8232
MD5 8a23a295bf3ca1bf03b498c2a0d08e46
SHA1 280def9804ba2e3ae20558b84ba007a21bfe1b8d
SHA512 0b08fc70a7bcc0953554e628823beeb79a40f687bb67b1318e24ba3a5bfa9d137282f4540cc27bfb445d01de5b79c6c0069886037daed9b8ec808e63cb5b4ff3
TLSH
T12B517533A815AB3795A2D754F94A3F23CAB541629F622F519ADC0B1D01C728C2706C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 f62cc512be423d9459f96cb2244b5bd674ee03e48fecd5a6c4cbe054c08aa292
MD5 859cb41200d7af53014b689e28c56509
SHA1 71032404b5867a7199793559bbc6da0b94fd0156
SHA512 8833f7e522c21e9bc76e85c0f64fadcc58dbb897e7c6e9b34a21cedd0f036ac68fc30a97941371f610e083ba23ef814bb527a441307bc49e262839e527db1fd8
TLSH
T1066177376975AA2B4DF3D604F98A3B16A6A54133D9913F95D9EC0F0D01D738C2342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 15KB
SHA256 328c9a97137f71a0246e81b9764e0c37c619b9b1e72c3aaf371fc22514eb1159
MD5 768fde872f0fb74f46e50d9d067c0f48
SHA1 bd854e40dd24c4c11b24986be2fdc035d7ccbdfe
SHA512 190a778fed10b657524e68dc5c5dee1e5aa83323587cc89891a99f49c185463560d30a23c312a136503b2b7d9412b02cba08a92c01b168634183da1fcda10635
SSDEEP 384:u+aQikB+z/xvxjg/qhEwNBSafKs/SF9zi:5/UxvxjgC+J4WFi
TLSH
T106729E2BA5797E2795F3E610B94D1B4BCAF894B395C26EB44DEC5F0E06873C81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594925.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe594925.TMP
Size 1KB
SHA256 ef4131c87c685b4c9f9e76d48d19180c003bf1d9c1aec90b2ff08991ee9b9d30
MD5 baeb399d2e60653c4cf8cbe9a3ad84f9
SHA1 afcbff4cdef47b008b95e5d7e650ed03743a560a
SHA512 93468990502ecb546481b3da5966097e7c39918d90bb9ab770e99df653b1c37efa5416ceb5d60d6dee90c3a0c425e2e47f319eba1484999763c1ad79737f613d
TLSH
T1BF216573E5716F37BC92A351B25A3B579DA00067CA514E84A5DC071E019A18C6A2FC37
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
Size 16.3MB
SHA256 0da4f09d474e41074f4ec52bfef01eb90c014928358eda88f6a5afad5319b537
MD5 be087717213e34f06e6198159d9c73dc
SHA1 60e2ca8a33531199a644061238b1605f78b8ae66
SHA512 fdc7b914eb7425bc17c23a7e52c7256f0263448ef4e0469302386a17b6ed3d5241bdc4cc2c43092c521368b9c09540ade980deffa16c201455b5a9a8650104b6
SSDEEP 393216:XdTfwgggjgzggsgTguwttbgNlggigggXsgJgUQLCgggggCNc/gggga4ggggcgggg:NRggjgzggsgTgugtbgNlggigggXsgJgB
TLSH
T132075B3A21AC01DCF1BBD0BD8BDB9E47D6B2340903319ADF0591569A1E1BDED4A7E720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1376-87-0x00007FFCCFC50000-0x00007FFCCFC51000-memory.dmp

Download

memory/4476-407-0x0000026F92AC0000-0x0000026F92AC1000-memory.dmp

Download

memory/4476-409-0x0000026F92AC0000-0x0000026F92AC1000-memory.dmp

Download

memory/4476-413-0x0000026F92AC0000-0x0000026F92AC1000-memory.dmp

Download

memory/4476-414-0x0000026F92AC0000-0x0000026F92AC1000-memory.dmp

Download

memory/4476-417-0x0000026F92AC0000-0x0000026F92AC1000-memory.dmp

Download

memory/4476-416-0x0000026F92AC0000-0x0000026F92AC1000-memory.dmp

Download

memory/4476-418-0x0000026F92AC0000-0x0000026F92AC1000-memory.dmp

Download

memory/4476-415-0x0000026F92AC0000-0x0000026F92AC1000-memory.dmp

Download

memory/4620-148-0x0000018B09C00000-0x0000018B09C01000-memory.dmp

Download

memory/4620-154-0x0000018B0A9B0000-0x0000018B0A9B1000-memory.dmp

Download

memory/4620-152-0x0000018B0A990000-0x0000018B0A991000-memory.dmp

Download

memory/4620-175-0x0000018B0ABF0000-0x0000018B0ABF1000-memory.dmp

Download

memory/4620-151-0x0000018B0A980000-0x0000018B0A981000-memory.dmp

Download

memory/4620-153-0x0000018B0A9A0000-0x0000018B0A9A1000-memory.dmp

Download

memory/4620-150-0x0000018B0A970000-0x0000018B0A971000-memory.dmp

Download

memory/4620-149-0x0000018B0A960000-0x0000018B0A961000-memory.dmp

Download

memory/5284-240-0x0000015E65DF0000-0x0000015E65EC3000-memory.dmp

Download

memory/5284-26-0x00007FFCCFC50000-0x00007FFCCFC51000-memory.dmp

Download

memory/5864-326-0x00007FFCCFDF0000-0x00007FFCCFDF1000-memory.dmp

Download

memory/5864-325-0x00007FFCCFA50000-0x00007FFCCFA51000-memory.dmp

Download