35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7

Analysis

user interaction
yes
max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/09/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 16.5MB
Sample260916-2naazsfb88
SHA256 35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7
MD5 411e27893f6e210f32cea7e28662adb2
SHA1 2c1f7771a8e24691bc39f7bf17609fa9cf628e2e
SHA512 1528111cc2a8313ccae7ec49c7b7ad911c0603ff4583a2fd19810dbf808142182628d0441baa0ffd42cb78f17a3f11e914b50f9595cf422d357771a4862622e6
SSDEEP 196608:GVXku+QMSrEM6IJZCsQdYXK7lDJl2zRwRLKAyWMsSt3K+zdY4HciDnzjW:MXkZXC/QdYXKoz0mAAsgrzCkXzj
TLSH
T12B07AD43F66280F8C16AC074935A6232FB31BC4907357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery execution spyware trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3164	Nexomia.exe
5328	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1532	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_1285072135\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_1285072135\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3324_1285072135\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
624	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
3468	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3844	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3620	msedgewebview2.exe
3324	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1532	tasklist.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe
Token: SeDebugPrivilege	3164	Nexomia.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3844	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe
3164	Nexomia.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe
4184	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 3620	3844	Nexomia.exe	87
PID 3620 wrote to memory of 4340	3620	msedgewebview2.exe	88
PID 3620 wrote to memory of 5136	3620	msedgewebview2.exe	89
PID 3620 wrote to memory of 5136	3620	msedgewebview2.exe	89
PID 3620 wrote to memory of 5136	3620	msedgewebview2.exe	89
PID 3620 wrote to memory of 5136	3620	msedgewebview2.exe	89
PID 3620 wrote to memory of 5720	3620	msedgewebview2.exe	90
PID 3620 wrote to memory of 2604	3620	msedgewebview2.exe	91
PID 3620 wrote to memory of 2604	3620	msedgewebview2.exe	91
PID 3620 wrote to memory of 2604	3620	msedgewebview2.exe	91
PID 3620 wrote to memory of 1840	3620	msedgewebview2.exe	92
PID 3620 wrote to memory of 1840	3620	msedgewebview2.exe	92
PID 3620 wrote to memory of 1840	3620	msedgewebview2.exe	92
PID 3620 wrote to memory of 1840	3620	msedgewebview2.exe	92
PID 3620 wrote to memory of 1840	3620	msedgewebview2.exe	92
PID 3844 wrote to memory of 624	3844	Nexomia.exe	93
PID 624 wrote to memory of 1532	624	cmd.exe	95
PID 624 wrote to memory of 5852	624	cmd.exe	96
PID 624 wrote to memory of 3164	624	cmd.exe	98
PID 624 wrote to memory of 3468	624	cmd.exe	99
PID 3164 wrote to memory of 3324	3164	Nexomia.exe	100
PID 3324 wrote to memory of 360	3324	msedgewebview2.exe	101
PID 3324 wrote to memory of 2932	3324	msedgewebview2.exe	102
PID 3324 wrote to memory of 2932	3324	msedgewebview2.exe	102
PID 3324 wrote to memory of 2932	3324	msedgewebview2.exe	102
PID 3324 wrote to memory of 2932	3324	msedgewebview2.exe	102
PID 3324 wrote to memory of 5396	3324	msedgewebview2.exe	103
PID 3324 wrote to memory of 2796	3324	msedgewebview2.exe	104
PID 3324 wrote to memory of 2796	3324	msedgewebview2.exe	104
PID 3324 wrote to memory of 2796	3324	msedgewebview2.exe	104
PID 3324 wrote to memory of 2876	3324	msedgewebview2.exe	105
PID 3324 wrote to memory of 2876	3324	msedgewebview2.exe	105
PID 3324 wrote to memory of 2876	3324	msedgewebview2.exe	105
PID 3324 wrote to memory of 2876	3324	msedgewebview2.exe	105
PID 3324 wrote to memory of 2876	3324	msedgewebview2.exe	105
PID 3164 wrote to memory of 5328	3164	Nexomia.exe	106
PID 3164 wrote to memory of 5488	3164	Nexomia.exe	108
PID 3164 wrote to memory of 4908	3164	Nexomia.exe	110
PID 3164 wrote to memory of 2276	3164	Nexomia.exe	112
PID 3164 wrote to memory of 2460	3164	Nexomia.exe	114
PID 3164 wrote to memory of 5132	3164	Nexomia.exe	117
PID 3164 wrote to memory of 3588	3164	Nexomia.exe	119
PID 3164 wrote to memory of 4596	3164	Nexomia.exe	121
PID 3164 wrote to memory of 2368	3164	Nexomia.exe	123
PID 3164 wrote to memory of 5964	3164	Nexomia.exe	125
PID 3164 wrote to memory of 4548	3164	Nexomia.exe	127
PID 3164 wrote to memory of 972	3164	Nexomia.exe	129
PID 3164 wrote to memory of 3372	3164	Nexomia.exe	131
PID 3164 wrote to memory of 4980	3164	Nexomia.exe	133
PID 3164 wrote to memory of 1916	3164	Nexomia.exe	135
PID 3164 wrote to memory of 4488	3164	Nexomia.exe	137
PID 3164 wrote to memory of 200	3164	Nexomia.exe	139
PID 3164 wrote to memory of 1532	3164	Nexomia.exe	141
PID 3164 wrote to memory of 3744	3164	Nexomia.exe	143
PID 3164 wrote to memory of 4048	3164	Nexomia.exe	145
PID 3164 wrote to memory of 4372	3164	Nexomia.exe	147
PID 3164 wrote to memory of 5560	3164	Nexomia.exe	149
PID 3164 wrote to memory of 1104	3164	Nexomia.exe	151
PID 3164 wrote to memory of 4880	3164	Nexomia.exe	153
PID 3164 wrote to memory of 4892	3164	Nexomia.exe	155
PID 3164 wrote to memory of 1404	3164	Nexomia.exe	157
PID 3164 wrote to memory of 5816	3164	Nexomia.exe	159
PID 3164 wrote to memory of 5344	3164	Nexomia.exe	163
PID 3164 wrote to memory of 3280	3164	Nexomia.exe	165

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3844.2132.16072796568908484752 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x140,0x194,0x7ffbf3d15fd8,0x7ffbf3d15fe4,0x7ffbf3d15ff0
    3⤵
    PID:4340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1776,i,6563948279700848208,10726107379349712600,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:5136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2160 --field-trial-handle=1776,i,6563948279700848208,10726107379349712600,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:5720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1776,i,6563948279700848208,10726107379349712600,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3140 --field-trial-handle=1776,i,6563948279700848208,10726107379349712600,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\tasklist.exe
    tasklist /FI "IMAGENAME eq Nexomia.exe"
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1532
- - C:\Windows\system32\find.exe
    find /I "Nexomia.exe"
    3⤵
    PID:5852
- - C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
    "C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
    3⤵
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3164
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=3164.6020.4144815068032318243 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:3324
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0xa4,0x1cc,0x7ffbf3d15fd8,0x7ffbf3d15fe4,0x7ffbf3d15ff0
        5⤵
        
        PID:360
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1748 --field-trial-handle=1752,i,141463779638116260,8152147377777031172,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:2932
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1988 --field-trial-handle=1752,i,141463779638116260,8152147377777031172,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:5396
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1604 --field-trial-handle=1752,i,141463779638116260,8152147377777031172,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:2796
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1752,i,141463779638116260,8152147377777031172,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
        5⤵
        
        PID:2876
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.3.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4416 --field-trial-handle=1752,i,141463779638116260,8152147377777031172,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
        5⤵
        
        PID:1592
  - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
      "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp --definitions=@roblox=C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\globalTypes.d.lua
      4⤵
      Executes dropped EXE
      PID:5328
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5488
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4908
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:2276
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:2460
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5132
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:3588
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4596
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:2368
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5964
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4548
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:972
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:3372
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4980
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:1916
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4488
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:200
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:1532
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:3744
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4048
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4372
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5560
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:1104
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4880
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4892
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:1404
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5816
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5344
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:3280
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4584
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4480
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4204
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:52
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:1484
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5560
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4388
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5964
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5664
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4420
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5200
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:2304
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4428
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:4800
  - - C:\Windows\System32\Wbem\wmic.exe
      "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
      4⤵
      PID:5876
- - C:\Windows\system32\timeout.exe
    timeout /t 2 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5044

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4184
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2804
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F9F50068495E03E3B927314C3F408C32 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5568
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FCF03A69C0B4D9E065E09220ED2190B4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FCF03A69C0B4D9E065E09220ED2190B4 --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:992
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B32E9AFAB9BCDCE44312D8F8A28443D0 --mojo-platform-channel-handle=2384 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3120
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=641DA4221316FED48A9D8F08CCA89352 --mojo-platform-channel-handle=2548 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4868
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BE25B25A89EA932497F8CC9FC569DFC9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BE25B25A89EA932497F8CC9FC569DFC9 --renderer-client-id=6 --mojo-platform-channel-handle=2588 --allow-no-sandbox-job /prefetch:1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4976
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E19F89FB0B24C2484CB2A46E30F98852 --mojo-platform-channel-handle=2768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\Nexomia.exe
Size 18.1MB
SHA256 f89002c16eeca46e8c05692db3e588f316c4fd0bad605b82a0cc7bc95cf7d21e
MD5 c776c47c9d36aeec94ccf539df80118d
SHA1 427b2f7182c41ca3fb3ade41c647cb6661672798
SHA512 6834d88e7e574ebcf35d26e6af2363c596054a99ba80715415172ea31323ce18953f02e2a948d2637d22eaee54a3f8381dea1174d290d59fd6c2bc6b2e310915
SSDEEP 196608:qN9w0wJu7GZNB9Vmta/qt0gVJM2JmkhowquSzwkp7TYEBVRWGO:qtwsuNYtiqt0YM2PhoH3p7LBVRPO
TLSH
T1D1179D42F66280F8C16AC175835A6233FA71B84907347AEB5BE48B253F6AFD0673D714
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat
Size 532B
SHA256 ed38812e0842092c5151a9a3f764a3d6a211aa667e20e69c0e51173b14fc2a32
MD5 179a1a9d55c426b7d0e6d3a01f72f514
SHA1 7de19f747badcdff65627c4dd6cac5a3341ccd59
SHA512 f6c584ae77a464408806528ff73b341f18766c7664c57df37acbbd50eaf295da4eaa51776ae49f945dcc4160f69ebe56736db16b4910ecf95e35f717be93f23c
TLSH
T123F05038891A06B500645A99CF5E3544D5FEDA4FA79D7AC014C0D68D366F18A1E873C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 31a5f02627e1318eba54c5fef93656f350a22fe6e3daedb318ba8750c069902a
MD5 14850073027c4841b5b0d982fda97d3c
SHA1 dc37f8d79a6cb60aca698dc48efe7390c83e3d6b
SHA512 d34275af7b81fbec06c3711e03d0e583de55ed3e719d6ee1cc07335008ba1e4e8d1a60e5efc47913a78b60585c51c654b45a102fc0c9e7b0b27dca11697861f7
TLSH
T148D012167E8109B4C0103273040266480400E60B40058040992CC65E1B0C8600A12491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b12dd2f9173a1eae45ea5c6a4078e602eb6a528b81020aa333a43157f6511736
MD5 c58399107ed5212c627ba80db34becb3
SHA1 a594ec6cb119dc0c3c7b82e5747744a5b3fddea2
SHA512 408ee36f2b66a1d43317dde2bc964a6ba89d015d108718c06632048ba8855141985ce05bbfa1154abd75964619a3c595f96c16eeb0921c102dc3b9a6c95843dd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1643602dfc462c30281d69c113808117ed4c135cb71bc41f8641b953a945eec5
MD5 077c2d3b7cdf69c992b6efec6c052e6c
SHA1 0bdd92eede592e32eab04db09b132c7492e7d336
SHA512 41756c2f7aed8b25455e176e60fc5321c0d0bef0d23e6e4b438080c6010a20d9b7abb6cb55b7e38bd7178c0a0ae159b756f3c4b86f849dfc7a40b27dd4c7df24
TLSH
T1B2D012167E8105B4C0103372040166480500E50A41058140992CC66E1F0C8600A52491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5
MD5 d1f604157b0745a40453afb93a6caa42
SHA1 3d5d77429b03674ebb0ba34d925ba1b09310df5e
SHA512 0644ce93724a57dedd8aec208e5a038e323a1b9871d5046d58a87c60479626693e6c8f25b7c7f7b60fd35aac133d2e660ecbd8f8d579ad1fc6703ae117a485a0
SSDEEP 3:MsFl/ll+l:/FE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 0ff81bfe8be0518d8f0d6ac60e1782d0c04745701c9ec549404fddf3e0604f8f
MD5 42f45fe60d4fc7b74fca481a35dfb6dc
SHA1 cc94dbd2fc84990d3ca849deedbe78d37331c735
SHA512 c8855091db9b73ca924a8d3c8c84edba9bc5cc4766816872561d7f2b0d09874636247db6f82815f3d8dfd7a2202e8d664f7b8668925af166cb3e4b01163a2bf9
SSDEEP 3:MsEllllkEthXllkl2zEklslMlZll:/M/xT02znEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 4a8ada3b31e08caf2b3233c038db79d076ece883cf8d02318d198cc19e82c5fe
MD5 a28974fdacad67ff0e5853512067833a
SHA1 0ae7792e869b14b1eb46ce0581e4837e5c23d0eb
SHA512 c7a0566bcc4f077427114c171426526cb2d4ff7a6b9ab328f52df8432600cbd9df3c520a87804c265ee91042cc1a8472da57a0b083e0b967915384dc03769ce8
SSDEEP 3:LstlNllkll/lRxll:LsX3lEtHl
MD5 SHA1 SHA512 SSDEEP

Submit Download

03ae38ee19e172a6_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\03ae38ee19e172a6_0
Size 275B
SHA256 f6c925f2ae965ba704393a6ed5e50c49d6a1369ff4baafa62b4ec9265f2c4998
MD5 282abb957301018d21d9113676624123
SHA1 fa18a41b7f25ef78848832d385ebbe43a389fe17
SHA512 bf987457886af1215574f96420f657c58bb565c45656d75d7ad6751c158c182d0dc1a89ea97f506becda1382ed57eb1cd5d9dcb9044e23d5c6d151778530b6ff
TLSH
T167D097DF8E18C204E28A8CFCCBEB928AE783C0F10499860C7009C98983A06A87341311
MD5 SHA1 SHA512 TLSH

Submit Download

09f4703a13aac448_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\09f4703a13aac448_0
Size 258B
SHA256 cd51fbd229d5a95547e01b9a221e2ab9b46262834c9f274415e31474d3b94589
MD5 1407db3495de65e603a8ee4eaae291d6
SHA1 3440e61c4764b65c49cb2f4352308d064c87363a
SHA512 5cb655c0238ac56932dfd948e457e21353fec4ec3f9ad9f3c1fe89fb54daf03ae8c7641118aa262aa6a97db027218a2e48de2d215eac305a5ec84ead316e706d
TLSH
T108D0A78FC96381C8C75D95F1CBE98D4E975790F5155A48419012ED2552D16793638341
MD5 SHA1 SHA512 TLSH

Submit Download

0ac4c2e70312a0ee_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0ac4c2e70312a0ee_0
Size 279B
SHA256 b8c34872db32f7f793fad260a75e4788c1871f5a845cc16d3e090bacf0cae2f3
MD5 ed4025314698727c367c600957e08109
SHA1 e069da77c19a6c5373af08fe35e7c65e6a73b200
SHA512 13fb635ab19af302b5624a038107d111beeaca81e9a829aceab826c0d8afd20bf09ce6faf328a8dc0fa57c8feba60dbbaebd501a87cfd8cae69ccf013ad8f13f
TLSH
T10BD0958F80416744C5AED6F187D6CD0D0717D0D335FD44527014EC563490B3C7D14326
MD5 SHA1 SHA512 TLSH

Submit Download

0bb15a86094610e7_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\0bb15a86094610e7_0
Size 266B
SHA256 bb6b523ca0b786017f1b4fc985428c6e6fe46030d4e6c3cfbddb1b0a225cec78
MD5 74fe023d5361888c56fd16bdd5c88d61
SHA1 ad328b5715567f0b275c454ae7e9e1c5ed54e378
SHA512 b0a6906317c6063e6d92800a163e4b8aba13a76a32012089d032124b7e2b3a880207eb34763ac3300678068475944f649d67b9aeaa414aae588909edccd2a6f1
TLSH
T1B4D0234F0C10D52CC32088F08BFF4D0D83E353D6281C64108250BC8610C1F3CB378102
MD5 SHA1 SHA512 TLSH

Submit Download

1a427df813dcfaae_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\1a427df813dcfaae_0
Size 267B
SHA256 e9a56c8719165c2b3cf627edb7cbd6a528b772406d8132eb0415128155693dba
MD5 56683badfbbc25f2de6c3531a8823a8f
SHA1 45302b60d80d80480240a4494d497198d841eeb6
SHA512 20f4615ae8845161f716a69f268292bad88fb1e162040327aba0b56a2e3c2e4feade70d047176b419b9c4d3743930e78d54e0668f051d2ae9aefd4cd59cec112
TLSH
T131D097CF4B681698CFBABBF3CFFF9E9F438240E026696C220028DD127080B6C3111224
MD5 SHA1 SHA512 TLSH

Submit Download

328cff54b1aaf628_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\328cff54b1aaf628_0
Size 270B
SHA256 c7a312b9cb69dfaa9d3b8160513d226bee3e38ad60a1b146368c5737a45211e8
MD5 f96b0ec264c2e99146a589dc3bb9c44e
SHA1 a470e2b606f3e71c90722e8c2086373ace5ab2e6
SHA512 16358ebe2a3d8292366dddda39173f65aa1f224f3abc8e5f2fb325c2c04728596344e468f04533e4fe211c6b1b93211361e5b7434abeb874fa8ae3e042a9869b
TLSH
T1BFD0954F49018504D2474CF7DFBFCF0743D310D010D614912910ED5204D27B4B26475C
MD5 SHA1 SHA512 TLSH

Submit Download

39a65d4ef01580b9_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\39a65d4ef01580b9_0
Size 275B
SHA256 5aa7c030896577bbd7eabba03a4c802d871708e68c83aeed6150deb834192081
MD5 2ac31017451ebb57b952cd91c8baf535
SHA1 33bc320b7362aac07ca6b73b95bb424040e25e62
SHA512 6998adbe39539191a8265e7d0437e7ab28fb5e3313022f986fbfb963157d050e85df09e3ef2b41a01d698c210d74dbbc74001b9d8c38f1503b9face5bf29dfa7
TLSH
T1A9D02E8F8978A840EA5089F8C7EF996ACB2E80F1049CA9127005F8E52290A1C215D300
MD5 SHA1 SHA512 TLSH

Submit Download

4324b7eea189103f_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\4324b7eea189103f_0
Size 280B
SHA256 cc3cbd54a9beacec9fefcb5eeb41f9555fefbed3b7cfc1c5943f61e3cbb06f2d
MD5 64494087bad13dc803de6f2811a502c8
SHA1 257933b1f156be7f0eacbe5aad15e15a1d93c65f
SHA512 27f84bf9c8791eff48246bb4bf7b07e82f8cc194c683718713932b822379c692b0fbee9837a524e4b6cc137d58617a77b39f3f052dcbe22b3ad202b5319403f8
TLSH
T11FD095CFC6315105C439E6F887EE4F1F430340F1002D9D01500BD4EB8651239B658145
MD5 SHA1 SHA512 TLSH

Submit Download

49d3021795a13c13_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\49d3021795a13c13_0
Size 274B
SHA256 65fa685cbbe76bd21f9d9483772e671dbadad1c727bb8606937000be9cb124ea
MD5 e0e2201f1a6406b4c92c5ba033fb2bb3
SHA1 f09f5eb5c9bf187405f561bfb56f70857f374163
SHA512 ba589f4bc02dd3cf1f021e0f7388933ddbb36450616d8eca678ffed7c7a8d34fc53be21e82f90125102c9c1c13e690aaadd92e23ffe32076b8dcfda16c5b0ff4
TLSH
T1B0D02B4FC655A808C51989F8CFEEC82EC6428AB0035998421004C85116C0971312D302
MD5 SHA1 SHA512 TLSH

Submit Download

505fc2e7014f0816_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\505fc2e7014f0816_0
Size 275B
SHA256 e0b99504b669c509f9f2c4271be2e5c398cc0297820718f6da426d79b2bec19e
MD5 f94583e33f4726e08edff21cafefdeee
SHA1 a1b7a3cebc2e9bda9284b62baa9bc501c841f396
SHA512 27f013cf57dd48a3832156ca988d3bb31cf2c310651ec9d26def37b8165f1bde490e26f135f82b2601baa34649fa71a41ddf9d930ba4def197d77bdc9f3a403e
TLSH
T182D095CF89155740EF2AE8FCD5BF548F474750E30178D445C210D4D32153958615D205
MD5 SHA1 SHA512 TLSH

Submit Download

59311ec7d38026ea_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\59311ec7d38026ea_0
Size 280B
SHA256 caeecdde006f322fc12c4ca7654e6d6249fe41e56050cf99d008faa3327d4e40
MD5 e9e7cad399984995a482d81aa959540e
SHA1 3c4e004a84d7e1c351b4860042d4296ac0897d6e
SHA512 b101595e9cd5460388661db865b8ce54f1ec44238bd639d3faac13b4c1f409e4a85b061fdc3e9933e8b2a8b3437bea43046f9c890d5bf8bca4436a777ba9c3a6
TLSH
T103D0974F82300244C7EA2AF2DBFFCE5A5B13A0D8208C0C223224FA4103E163C35A6309
MD5 SHA1 SHA512 TLSH

Submit Download

5ac4446cd1f872df_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\5ac4446cd1f872df_0
Size 275B
SHA256 ed2a38185cf82b8ce755ebd0625f4584f51817590c81f9c2aef88471a44fec95
MD5 d9119e238e2b88d5d7da9d32e1adc0ea
SHA1 a398d8e6b39b19093fb0030f5ef10f00f9a48d1b
SHA512 df35612ecfb8080df7b1d6706e346dbd27434489334069bb417d76441a2f458bf7525cb4f42d0e75b3254e940fc5fbdacca76077937b4554f3cbdcdf10f4eb0f
TLSH
T138D02E8FC25AC408F0AA9DF44BAB61EB824B80F00068980A6209F8421881E24AA1C20D
MD5 SHA1 SHA512 TLSH

Submit Download

5ded5da48ba86479_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\5ded5da48ba86479_0
Size 275B
SHA256 8ac1603ea4d8164fbe0c4cc74242b95aaeb84570dd977740d5b3e3ee2e114e31
MD5 2c94fb29fba95517b9374f522a95d7a8
SHA1 77eff6d53d353b82e9c7d051739beb05b1cb427f
SHA512 8b3a45731aad53ddd0f4d3f1eff1fc95b0395b0301f768a6483d59f907140eda9af89690a4707b7620135dabfe7d17009c14a68f70696588848a20ac59d61e3d
TLSH
T190D0978F0E29C50CE2AACCF9ABBF4A7E838B00FD046DD4445021DCD8A0B6F18F134A01
MD5 SHA1 SHA512 TLSH

Submit Download

6c25a9b6a22f910f_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\6c25a9b6a22f910f_0
Size 287B
SHA256 b6fe5467385da298066fb99b3be05fabb4c89cc52173f34fa3ce659e86051401
MD5 0565ec8ecf92f4bdde72ea0c7814cc1c
SHA1 a8b74f560834e3b6c9194fb7f8ccc2ba136fb009
SHA512 c083fbb7f983a413a8d6a3cdf0f8636283165402dcefd02e6331e14840aa16a2839b307a312a65bb0aff4eeb1ae787597a2d9633560ec5d246893c57406ebc9f
TLSH
T13CD02B4F8705520FD785E8F293EEDE569665C0D9506E6C522150BD1A44C12A4F5A270A
MD5 SHA1 SHA512 TLSH

Submit Download

6f9a63ff9eef039b_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\6f9a63ff9eef039b_0
Size 280B
SHA256 84a8047b710503e57e80b381ae25cd8085b28c52adb59c109ebd230a62af4fa4
MD5 0a2c409fb0c40c58e3500b9259ce25e7
SHA1 49bfd052e36e310efc11d6ab1742c90f76c1880d
SHA512 989cc2512da2966b95cdbbc6107dac1c5bc27dfa11227f084849a5ed4d71d146e39698e962c5368af18e5d69a08b37ee18a5d16cc50fbca92fc16660cd4d496c
TLSH
T1AAD02B4F41540708C7C5D8F483EA8E19934240C025C84D12702BBD61A0C16753A2672D
MD5 SHA1 SHA512 TLSH

Submit Download

760604906b472815_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\760604906b472815_0
Size 280B
SHA256 564011904b2470e53b54c195337daa0b8a0c78f302a3ac05181ad22ae6df5b38
MD5 5d121a2c2c109ba991c57ba3baaed697
SHA1 0700dfaa09bc46d5d653cefffc8c989cb86f4e3f
SHA512 f508c16d62075dd64b67218e04353f688efa3fde4e44894a4d593fbabd5ccb1a0dc0a92725bf17ae9a5861b6a7290f00dcc38b63ae6492140eec73949d98d9b5
TLSH
T115D095CF81050108C79269F0C6BFDD265F06D0E4215F38435110BDD307C1F647221F10
MD5 SHA1 SHA512 TLSH

Submit Download

7d584d23032e8f19_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\7d584d23032e8f19_0
Size 274B
SHA256 b5c84843ac3a7f543f4dac196c7b9a0dd7ccda814cebc087835d12f2be56a7f3
MD5 9e2f95c960048d2a9c21331458a4ff4d
SHA1 50a5220775dcc858bfda0f280c54bae2d1c26edc
SHA512 ebcef65344e81848c0848719a3e9326e7291544341c5b74e6c36066cba8b56bfef653c0ba3525203aeab7b69f543dd2b161415a22523d86d1a1be33ceaa4c47a
TLSH
T198D02BCFC5555404DE2289F85EDE5567875644B2021AC804210CD87111A8D343544305
MD5 SHA1 SHA512 TLSH

Submit Download

83594a70e03d6cea_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\83594a70e03d6cea_0
Size 279B
SHA256 c8d0f63fea1d5171c57996343beadd599a54d72dae3c4326deda47895a732549
MD5 9e348f31f33611f9d9a897e8c462dfec
SHA1 af4ed794210270f9dcc8e4d4a65112acd9660d20
SHA512 271434a57145305fbc8499fe85b6c6505469c57714456b72f512fdc8f191c6b62f5af42f7b978a5fd786afde5833dd05d1d05f6d983b26475dd480520b517d3b
TLSH
T1DDD0954F5160F105C06A98FDC7DF473DCB5799F4506D0C405500EC5A414152C750D211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 aacf1d48dae9fcbbac38af19de8c0d952056b194cc5150064bfba8272ec95015
MD5 f805d7c82e0587cac624469dc44c76af
SHA1 2f65ead1d2ee4c26e0713a9b1b2081d758672f96
SHA512 0ab47efb39e3a6690d35e9de5910062f1b9be8deea98a2081188cdba5eabef3645df0826a0e6c1dafd99ae14e5f7eea82088b022934707d4382842b939ab34a4
TLSH
T112F062282AA12844DF18303070B21D193DBE188C2F820FD737A33271079FBD32951FA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 c2524632a833a8a8946adb6e8e8ad31bcfdd8465931fc482f95a5e0f34e7cdcc
MD5 c06d6d0a396f444b8509f39adc565bd9
SHA1 fdab40525ecc7d3f38ca5a858d9bfc4fead87912
SHA512 d5eb60a28b69c65cb6bc4ab8795f16d46bb03a3cd309d0e9e75bfedbeaf6f3de7ee44acba37b3752a7fe0fe875e9105faa1b19b26698ab2cab5e257a5f55db9b
TLSH
T16D21A93815A05484DF2D3131B4F21C1A3D7A385E1E530F9337A3623512DF7EA7A58E61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5982c3.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5982c3.TMP
Size 48B
SHA256 0417469da5ed49865d9f55d81fcff85359dc5104d39c1a112eb62598bcdb180f
MD5 e4ba950fdaad9d465a15bc80e45203c7
SHA1 2ef8119f3401735c5d75ceeea75007142b65f99c
SHA512 0d4f5d87775b2e7229747a0d3396e7775c035ee24038c1a0bfc7b2aae7083e5e9260d4b44f72467aebdea0fcdf417a37bb451a6624683dba8ff40d49c3486ad6
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

History

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\History
Size 164KB
SHA256 d3c828500016305a94a8da2c85ddfeccb974b2e9fa45d2ffff402f20c3b8aadd
MD5 db06fc698b4b1415edd9b7706625ba32
SHA1 c0fc29609098116f15436d0575c5e1ccdc4510d8
SHA512 ec503aadb4fbf748381db90b0b7319760baec552ee7491c56d6d2c4da43d9c35127b11d6fabf454e46c1ad2809b9010b0ac1dde80b1301b3a85bcf18ebf044e4
SSDEEP 96:8BZXYY5LqL/uejzH+bF+UIYysX0fxQp97OEHt/DfLVVVN6zRk/E02V:8B/5qL/tH+bF+UI3iWGVOWNVVV635V
TLSH
T1FCF31B5E5F743211CDBE913768E749A3587DF03F87236AC66C6204B5CEE2652B02C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 766B
SHA256 fe0ed145969fac9ef4043b7d8b708a2235f6ca0a80ce6f256317f31f0a076152
MD5 a5da51defc353e647105578ef7679013
SHA1 789163befc0264f9cc34a9c319a45847b7d97ab6
SHA512 79bd58a0ba8a31f37fa0848170890192c095db68c9aeaf472653a5345d351d91de16602706186c499a0e7b5be8763c1e6750926caf131470385dd98f8cc53f62
TLSH
T1360161B343B0C5BE8710A6A477346D17CD7D0416A31C6E778EE6AB6657F20B1D11064B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59834f.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe59834f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 10ce46995378459151b5a072d6ef1e54867ce57edcc1520ec6a0965b5ff432ff
MD5 5f080b35a2352f916d574e049ffa88c5
SHA1 bb4cdb42ea2c454bcb92fac028696d65b4b91697
SHA512 b9862a5ba6723d3859bb1baecc04df0bf14a3d6c06278fd7cfbbba2412fd0dc5dceca969a9e1fe967a8f29764cb800f475b3270f3d1c2868f56a2d1586125bea
SSDEEP 48:TkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:IIEumQv8m1ccnvS6
TLSH
T169F2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF862A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 0353f0f1efe4aec24e0c9ffe4204aad64f6abf412d5f4945dea8a6ac1569de8b
MD5 7744b801fdcd20d02713acf9a5261149
SHA1 c1baebe1e449019d9dccc55a53fb11dd9eb4188a
SHA512 6aa1e954fbfba941c9e955759d3f6e5e5096f7a39b61ece6262190b19702ff3de4b88ee11ac5624502555340a4ff4c6e375dbff97f32e8acfa06f083590db853
TLSH
T174E026E6507FB87A30A90D663D847C06DB7AF8360043A9F4CAA2527EF1811F69607022
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 186B
SHA256 9907f89046485b261744a3c159f87cfab24245605b5d733880ced1b54ae97982
MD5 88710ae9fd6ae0e0685768965f7be598
SHA1 503cabc755fe4f8196663dc77ca43a0462139f84
SHA512 cb8cbde019cf9fd0068d02445fee76550f5d03f7a82cf6ae6748491bc205aa530113dc29032a1349b1bfe16d231a93d6e65d8901a8e71d72e436c120f3da3655
TLSH
T12AC0C0B1107FE0722038092168C0FD005F76F970005394FC8952467CA04017A4113453
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 4e90d519b68506867a3836eb9d32928c55fddcc655fba0bb4e2d502515b536fe
MD5 6e0e91a18f4446b95701aa941fe34595
SHA1 48b311fd722f33783ee1c86a8bca06495c9d60b8
SHA512 685683f5e4e687e7622472883e828684c4021af5115a5f96ecc91e365fc38796f9953e03c6e343b30f88425d94b6e9a2735576959fa1fbd75334d1668abeddc7
SSDEEP 96:st/J/dZavQTbDPk+6do5h16Z0s1s7/x+6MhmuecJspoMkkjeWK+gWs28XM1C7K:st/tygwonssV+Fdiowj69G6K
TLSH
T145D184056E28B97B4CC6E509FA35BE17E3FA502234D52E88E7F84A2C04D76DC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 01730bec91803128cfa6133c425200d0da0e9bff70900cf7679b5f1c46688cc2
MD5 4e519a04d4181f53ff31d2877865f4c3
SHA1 003dafb9e0948135dd0b83ea66b3121685f861ad
SHA512 3a6feff0d653ebdaaa5ce1de4e0a9d65ab825719d887a336e2db24da7c43f232d434a08df138e59362ce334421c8bedc0333039e218ee5f8937d9d39ad0b74b5
SSDEEP 96:r/J/dpvQgb9Pk+0do616Z0iAs7/x+6MhmuecJimmZ1ejeWK+g33uI8XM1C7K:r/t3J2o6iAsV+FdimmZQj69eg6K
TLSH
T17DD19506AE24A97F4CC6E509BA357E17E3FA503135D52E58E7F8462C04D76DC6217C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 411a0405e3df8734f6ca2347cbd7cccdd248d28d039d330e3ddb5ca769324608
MD5 f3d9c3e1529f2a3d712e3dbfb4f8e931
SHA1 4ffc0036c26c709660efd6e9f0eee722410e9b44
SHA512 6f71476b34a1140ca8c0643b9f1fe7a53eeb98eadccdc1ff1571334fd943f6a78c6ea3b286174429a8314b7fd1597fd4dc86cd42aeaabdb60cd4da6da002dcc3
SSDEEP 96:st/J/dZavQTbDPk+vdo5h16Z0s1s7/x+6MhmuecJx2ErjeWK+gB5I8XM1C7K:st/tygxonssV+Fdx2qj6Jg6K
TLSH
T1ECE185066E24B97B4CC6E509FA35BF13E3FA502274D12E48E7F84A2C04D76DC621790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5982d2.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe5982d2.TMP
Size 5KB
SHA256 e3114bbc1e74bd05575d15fb2ec0a41d8edc5389ccdd4d7eaae4732a9a5d1f87
MD5 0c6e406175531bdb4a58f387d17c7ebe
SHA1 2384b442c5c6e10e2a4a0d14627f3a64f575bf96
SHA512 1f9cc3fe26a3256b6abf6ac377f61616dd07108ecbb8b764df200f0a0fbc1d887f53667f0c4fb495e000280f3bfc1dea2d152a27b9a7d5728bf08b5bf35930ab
SSDEEP 96:r/J/dpvQgb9Pkxdo616Z0iAs7/x+6MhmuecJimmZ1ejeWK+g3e28XM1C7K:r/t3Jeo6iAsV+FdimmZQj69eG6K
TLSH
T1D0C195066E2479BB4CC6E108BA297E17E3F6507165D52D58E7F8462C04DA6DC621BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 07eea1ff9fb794167e018c919174ccf84d5882c966467fa90869a9ad1d201ebb
MD5 5370504022e17cbd4b31a0802dce8751
SHA1 8151dbaa02ff726fcb1c34a783de11797f75d261
SHA512 40fa18d6d4530d28e292cee6af973c00dc2c8fe00610e424cc89d4e1688792a67be40053041901d577dbd7b9d57b1d8c0d4c052ff3dbba1a7292c8551cdc6456
SSDEEP 96:vuiyPlf/ROo1pkF5d1AiF7VaTEv9V5h5pg5+e0ECqOe9znfwds3hqJmixL:TevUz9lpqOKfwdj
TLSH
T161C1B7A7092DC574AF444BEADD387DCAD9A6019F9CD64C1A97E2C04C06C1FFC21EA4C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 e8437f1763e301e24d127e5b647e61d99baac9d989303f4c2a0705060eff5ecf
MD5 a7d78355596c5dee0c56d6d040997c8f
SHA1 2a6a80e0a25d2b2d5031069c8ae8686214486b4f
SHA512 86040830d27bedfbf9f33bba3358535469cc8ea5f659236c2e517df83b8c77af14b6394a820321155e4f46c27fd5d28ed38112065154ce5b70dfa58eb0cf87eb
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\LOG
Size 303B
SHA256 21d9ec3e355746e488d5692ec12bb3e81656bb6cc48bf057cdd535a68bc085b7
MD5 630199031fa986c09bdd9ff26be86b54
SHA1 6a15791a2efe907ddef5548aa1a6f2cf78481f93
SHA512 bbf71970515d8dda54d805b132a422327ca870b6e2269111a37e8f17640758458668809297c75567ae9bd351a9a3936264fafa16eb153f341b957063dff2f932
TLSH
T12AE0263119CFCF7B968998EF3A73B78CC22AB200F9CD16226E24E504310B84CB302740
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\LOG
Size 277B
SHA256 a923dea1306fc5d11e41bba137a3bb67fd7201f27a4d488b864faf7e9936236f
MD5 4f43801ebca67394878b1c0fb8c1158e
SHA1 a0bca2e7a3c83913e38f1157986193a590964f99
SHA512 29c2dd724715beaa41270ed604e5d82934dbf1352abb8e54f0769992f34843b4511424156175613cd4913dc08c64b060aa7a05aec550e711e1abc5e2783f70e6
TLSH
T156D0CD3549C9CA7595C0D8DB5EB1778DC2B8F60577CE36495F189804344650C7330281
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Visited Links
Size 128KB
SHA256 0d5fc853388173d204cc6c10f900ab7897da6bc7cb4ca0ca4d6c9a50767e7ed3
MD5 514b6c2f1f6769e6fc109ea19f40adf8
SHA1 e9e784e5d7bc8307501dd82c3bbe2f5791762eff
SHA512 ba44e56ccd0b4d86049929e57174ebabe74cad08e0918a442047cd880a8d0630506fda1e2c7d54ff1f28e80725a021eed4f3fccc6f78eed7d1b9123ddd487cd9
SSDEEP 3:ImtVuHdmiT+l/l72/lt:IiVu9mw+l/V2t
TLSH
T119D304D543071404CC540734D44047170315C0114077504143F5DD0345C0355011341C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 117691524883ba3800febd14452d8eacc07050a8298ab3fcbd7cfb31e34a0129
MD5 01ee7a99b038f5a06f730e417e8b879a
SHA1 56225be0bd71ffd02682705d4346feeb10b3f6fb
SHA512 39e4208246dfd7cf0b989d7f650081869cce036d802ae7051ade6d65264ead046611452c51b3e044a2fb003e74dddb64035dac4927556b6941cc1af4417264cd
TLSH
T14C518637B950BA7799A3470479466F23DF7680A56A523F90E5EC0B0841DB62C3367C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 180bb0bbb06afbfb8c55a504d8d937e6279e47303cba741b5c59ef7c682a0954
MD5 800b8b1a38dd179e95e90d76614dbdd9
SHA1 f5a75a58713c89fb13a24d322bd0342f51694395
SHA512 a44c1ba838101b63f1f33432bfcd776e3239440b0a720a3e89331b47ecad466020f68f4b1f9ee26bf325d7dbbacc11104ced57dc1bd37254983b8b83e5f90d98
TLSH
T17071753AA9A0B9774DA38A04B9856F16FBA54076A9C13F94D5EC0F0C01D735C2367C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 307bae6f4b2b37276150c104a830942f1d50a3e99688f11570a032a288a145f5
MD5 35e7ff7a88f9b77bf930ace2336894fc
SHA1 b3f3cdbfa912d2157b9297b99eeede1f93ef7b31
SHA512 ace80c80dcda3d42a320951abf14034ecb5f8200b2e9fb63edcb3b511c354cba544668eb27edb55c27876a10846445743104709bcf5a3d3cd43feb567fe916a4
TLSH
T1D081953AA9B0B9774DB38604B9852F02FBA54066A9917FD8D9FC0F0C41D729C1356C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 5a7e86efb3ed2ad1690537c2b87749f4f13f4b51352d8407e90b63471f11fb70
MD5 379770296d30f24ed0f860b6c2a90aa8
SHA1 6438278df7d2f0e2135b536175a5aee75e88ea76
SHA512 e4b3a86a181beee98dedd52ee9e10088a4b574277c63074cebd768ab4fa57788feb10a9192989ab8284f981db9428eb0c49e374d70483e0169678504db4e4b76
SSDEEP 96:2B3NkGSCsIfwBF7zH8kh/cI9URoDotoN5i0dYBUZ/6qiZ5QTPJTa:a3NBSh9D9eoDUa7dsUZmoQ
TLSH
T1D491843AA9B0B8379DB3C605B9416F16EBA54066A9857F94D9FC0F0C02DB39C2356C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 eddc62042d852d61c104e2b6428acc7d78ad7fe49f8f2533bd585f9dba588b67
MD5 e26e5e96f4ef1fc235fb2b0326a0a811
SHA1 7e5f300d09f515c7851aed8979ece296d0813d30
SHA512 5a51e6c53e1a5e2df703a2cc42179a0a893ae6a0915ae37034826024a77f2b1be9fc742077926a83001b52860b39b7696ca9a4500d61e6ff5eb7ec198753186e
SSDEEP 96:2B3NkGSCsIfwBF7zH8kh/cI9URLl8DotoN5i0dhBUZ/6qiZ5QiQJTa:a3NBSh9D9eiDUa7dXUZmZl
TLSH
T1BB91743AA9B0B8375DB3C605B9416F16EBA5806795C57F94D9FC0F0C41DB39C1356823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 17KB
SHA256 8bcba5891e06857520f8b22332a8b3d2b1b9fb28c42a47841b0077676be326d6
MD5 c3d2474af4ff572d18ca583503e3d934
SHA1 b6a694767ca465a6ddef87028335b0c40528284c
SHA512 5ccf7bc8f1b5fb9a02d0355a64849f580234e607a49007598f22ac3d8743b1d63fa85fa175cd7ee26182127f4c977b0028826aabb60a6808754480714ac37395
SSDEEP 384:1+aQikB+z/xvxjg/qhEINl3XrdWvAgeQmryqF0R9zV:A/UxvxjgC+Ybs3etryqFkFV
TLSH
T13F829D3AD864BE23A8F3A24176066F8BDBF4846255C66EE48DF85F0E06C379C1357C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 a23d335fbc9f98fb2ecd0fc9e0de42ef41c615af62389f3fcd12ec0db9b0307b
MD5 70d0081e8907d2c29255552ce605d25c
SHA1 1d529880967605cdb2a3c403af701fcfa8afef42
SHA512 e06df4ff89c5b3c1474b37e3da68dfa4f5de2a295acf16e3e683cda77c9c2ee3aa228811d776a1c1753871b9c259795fa7ac0fe17fdde1787bc79ef9b7e3e4cd
SSDEEP 384:s+aQikB+z/xvxjg/qhEe3NBS3XAdmvh+0R9zV:L/UxvxjgC+emQsJ+kFV
TLSH
T19C729E3F65A87D32A4F3A60479550F8BDBB884B295C27EB48EB85F0A06C73981357817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe594982.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe594982.TMP
Size 1KB
SHA256 8838c13159b69530d823b4778602463997a850a2303e7913b5a9283aa9300d0c
MD5 d3ba755587be4a842bf6d943ed2b3cd3
SHA1 1cc40dccce421095c94fd041b96645040e98c6e4
SHA512 b499524538cec2a43cd4f197db08f6f37d10497845e867b8a84a4e93b841d00cd042a0b718c8eda2cd99baeae3cdf412cf99fca1010e150144ba81c7f78f6fe8
TLSH
T16B3172BAE9E07A32AD5312463242EF53AF6140B956815E40F0DC4B0802EB51CB67FC32
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\index
Size 256KB
SHA256 55c8b4b52c0a52f1b2f3bf3104c0ff79c07e2bebddb592ec7f6a04002ad64f65
MD5 e8f4e263a5e7dd4973023e294fef5537
SHA1 935b346ad7d48d8fb6677b7ac060134d6ff5ec1b
SHA512 34cb7751f50fccc51dd5e942e918dfa2b9bb5edcc846c5a4c95c3d51ec86add8f0dfc086871d8054df28af860d032d41f23fedcd95578a26b791dc8dce737c42
SSDEEP 3:LsOllllklkXlEll:LsUlP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
Size 2KB
SHA256 d2f0941e7e1f2d115e2a3d45a290215485cb9183522cb0f457b90ec6aabc1d76
MD5 49531c68d4fcb36b29cf44ba4560326f
SHA1 ccb360924e8f25dbe8accd756b4f3ad7879b3c5a
SHA512 c09f848cfe489089f12bbc2c475ad9ed75308f864ee30a12b8a9f0ff9d82247f292b8969565f938eaddcc50f4bb47418275fc117899d7da6232476041a4be796
TLSH
T135517C386187C7584F444E3E4473ED421185F80A1F5CE2A8257BA2B9085B8B694B0C0F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1592-594-0x00007FFC164F0000-0x00007FFC164F1000-memory.dmp

Download

memory/1592-595-0x00007FFC15A10000-0x00007FFC15A11000-memory.dmp

Download

memory/1840-82-0x00007FFC14D10000-0x00007FFC14D11000-memory.dmp

Download

memory/3164-460-0x0000020321930000-0x0000020321931000-memory.dmp

Download

memory/3164-459-0x0000020321920000-0x0000020321921000-memory.dmp

Download

memory/3844-167-0x000002219C0D0000-0x000002219C0D1000-memory.dmp

Download

memory/3844-166-0x000002219C0C0000-0x000002219C0C1000-memory.dmp

Download

memory/3844-168-0x000002219C0E0000-0x000002219C0E1000-memory.dmp

Download

memory/3844-165-0x000002219C0A0000-0x000002219C0A1000-memory.dmp

Download

memory/3844-164-0x000002219BF60000-0x000002219BF61000-memory.dmp

Download

memory/3844-170-0x000002219C110000-0x000002219C111000-memory.dmp

Download

memory/5136-26-0x00007FFC14D10000-0x00007FFC14D11000-memory.dmp

Download