hxxp://gofile[.]io/d/Qo2fLqx2

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/09/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gofile.io/d/Qo2fLqx2
Sample260920-2gpgbsde73

Score

8^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
141	6028	Process not Found
148	6028	Process not Found
150	6028	Process not Found
155	6028	Process not Found
162	6028	Process not Found

Downloads MZ/PE file 1 IoCs

flow	pid	Process
90	1348	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000\Control Panel\International\Geo\Nation	Nexomia.exe

Executes dropped EXE 3 IoCs

pid	Process
4964	Nexomia.exe
2496	Nexomia.exe
4480	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	api.gofile.io
31	api.gofile.io
34	api.gofile.io
36	api.gofile.io

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5104	tasklist.exe
5952	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe

Drops file in Program Files directory 14 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1720_192611043\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1720_192611043\nav_config.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1720_200580212\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_1671831791\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_1671831791\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1720_503075113\protocols.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_2056209994\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_2056209994\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_2056209994\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_2056209994\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_1671831791\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1720_503075113\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_2056209994\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping412_2056209994\manifest.fingerprint	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3212	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4972	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1348	msedge.exe
5500	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 2 IoCs

defense_evasion

pid	Process
2268	timeout.exe
3796	timeout.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134344172240888693"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{14E3D45D-90A0-4FDA-B4E8-98F4C3F520C7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{263BB180-2CE0-446B-A76A-615E92189EE4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
4964	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe
2496	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4264	msedgewebview2.exe
412	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	tasklist.exe
Token: SeDebugPrivilege	5952	tasklist.exe
Token: SeIncreaseQuotaPrivilege	6112	wmic.exe
Token: SeSecurityPrivilege	6112	wmic.exe
Token: SeTakeOwnershipPrivilege	6112	wmic.exe
Token: SeLoadDriverPrivilege	6112	wmic.exe
Token: SeSystemProfilePrivilege	6112	wmic.exe
Token: SeSystemtimePrivilege	6112	wmic.exe
Token: SeProfSingleProcessPrivilege	6112	wmic.exe
Token: SeIncBasePriorityPrivilege	6112	wmic.exe
Token: SeCreatePagefilePrivilege	6112	wmic.exe
Token: SeBackupPrivilege	6112	wmic.exe
Token: SeRestorePrivilege	6112	wmic.exe
Token: SeShutdownPrivilege	6112	wmic.exe
Token: SeDebugPrivilege	6112	wmic.exe
Token: SeSystemEnvironmentPrivilege	6112	wmic.exe
Token: SeRemoteShutdownPrivilege	6112	wmic.exe
Token: SeUndockPrivilege	6112	wmic.exe
Token: SeManageVolumePrivilege	6112	wmic.exe
Token: 33	6112	wmic.exe
Token: 34	6112	wmic.exe
Token: 35	6112	wmic.exe
Token: 36	6112	wmic.exe
Token: SeIncreaseQuotaPrivilege	6112	wmic.exe
Token: SeSecurityPrivilege	6112	wmic.exe
Token: SeTakeOwnershipPrivilege	6112	wmic.exe
Token: SeLoadDriverPrivilege	6112	wmic.exe
Token: SeSystemProfilePrivilege	6112	wmic.exe
Token: SeSystemtimePrivilege	6112	wmic.exe
Token: SeProfSingleProcessPrivilege	6112	wmic.exe
Token: SeIncBasePriorityPrivilege	6112	wmic.exe
Token: SeCreatePagefilePrivilege	6112	wmic.exe
Token: SeBackupPrivilege	6112	wmic.exe
Token: SeRestorePrivilege	6112	wmic.exe
Token: SeShutdownPrivilege	6112	wmic.exe
Token: SeDebugPrivilege	6112	wmic.exe
Token: SeSystemEnvironmentPrivilege	6112	wmic.exe
Token: SeRemoteShutdownPrivilege	6112	wmic.exe
Token: SeUndockPrivilege	6112	wmic.exe
Token: SeManageVolumePrivilege	6112	wmic.exe
Token: 33	6112	wmic.exe
Token: 34	6112	wmic.exe
Token: 35	6112	wmic.exe
Token: 36	6112	wmic.exe
Token: SeIncreaseQuotaPrivilege	5892	wmic.exe
Token: SeSecurityPrivilege	5892	wmic.exe
Token: SeTakeOwnershipPrivilege	5892	wmic.exe
Token: SeLoadDriverPrivilege	5892	wmic.exe
Token: SeSystemProfilePrivilege	5892	wmic.exe
Token: SeSystemtimePrivilege	5892	wmic.exe
Token: SeProfSingleProcessPrivilege	5892	wmic.exe
Token: SeIncBasePriorityPrivilege	5892	wmic.exe
Token: SeCreatePagefilePrivilege	5892	wmic.exe
Token: SeBackupPrivilege	5892	wmic.exe
Token: SeRestorePrivilege	5892	wmic.exe
Token: SeShutdownPrivilege	5892	wmic.exe
Token: SeDebugPrivilege	5892	wmic.exe
Token: SeSystemEnvironmentPrivilege	5892	wmic.exe
Token: SeRemoteShutdownPrivilege	5892	wmic.exe
Token: SeUndockPrivilege	5892	wmic.exe
Token: SeManageVolumePrivilege	5892	wmic.exe
Token: 33	5892	wmic.exe
Token: 34	5892	wmic.exe
Token: 35	5892	wmic.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4964	Nexomia.exe
4156	msedge.exe
2496	Nexomia.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 1680	4156	msedge.exe	88
PID 4156 wrote to memory of 1348	4156	msedge.exe	89
PID 4156 wrote to memory of 1452	4156	msedge.exe	90
PID 4156 wrote to memory of 1452	4156	msedge.exe	90
PID 4156 wrote to memory of 1452	4156	msedge.exe	90
PID 4156 wrote to memory of 636	4156	msedge.exe	91
PID 4156 wrote to memory of 636	4156	msedge.exe	91
PID 4156 wrote to memory of 2524	4156	msedge.exe	92
PID 4156 wrote to memory of 2524	4156	msedge.exe	92
PID 4156 wrote to memory of 2524	4156	msedge.exe	92
PID 4156 wrote to memory of 4264	4156	msedge.exe	93
PID 4156 wrote to memory of 4264	4156	msedge.exe	93
PID 4156 wrote to memory of 4264	4156	msedge.exe	93
PID 4156 wrote to memory of 3212	4156	msedge.exe	95
PID 4156 wrote to memory of 3948	4156	msedge.exe	96
PID 4156 wrote to memory of 3212	4156	msedge.exe	95
PID 4156 wrote to memory of 3212	4156	msedge.exe	95
PID 4156 wrote to memory of 3948	4156	msedge.exe	96
PID 4156 wrote to memory of 3948	4156	msedge.exe	96
PID 4156 wrote to memory of 5012	4156	msedge.exe	99
PID 4156 wrote to memory of 5012	4156	msedge.exe	99
PID 4156 wrote to memory of 5012	4156	msedge.exe	99
PID 4156 wrote to memory of 2132	4156	msedge.exe	101
PID 4156 wrote to memory of 2132	4156	msedge.exe	101
PID 4156 wrote to memory of 2136	4156	msedge.exe	102
PID 4156 wrote to memory of 2136	4156	msedge.exe	102
PID 4156 wrote to memory of 3220	4156	msedge.exe	103
PID 4156 wrote to memory of 3220	4156	msedge.exe	103
PID 4156 wrote to memory of 3220	4156	msedge.exe	103
PID 4156 wrote to memory of 4352	4156	msedge.exe	105
PID 4156 wrote to memory of 4972	4156	msedge.exe	135
PID 4156 wrote to memory of 4972	4156	msedge.exe	135
PID 4156 wrote to memory of 4348	4156	msedge.exe	112
PID 4156 wrote to memory of 4348	4156	msedge.exe	112
PID 4156 wrote to memory of 4348	4156	msedge.exe	112
PID 4156 wrote to memory of 4668	4156	msedge.exe	113
PID 4156 wrote to memory of 4964	4156	msedge.exe	114
PID 4964 wrote to memory of 4264	4964	Nexomia.exe	118
PID 4264 wrote to memory of 3520	4264	msedgewebview2.exe	119
PID 4264 wrote to memory of 5504	4264	msedgewebview2.exe	122
PID 4264 wrote to memory of 5504	4264	msedgewebview2.exe	122
PID 4264 wrote to memory of 5504	4264	msedgewebview2.exe	122
PID 4264 wrote to memory of 5552	4264	msedgewebview2.exe	123
PID 4264 wrote to memory of 5596	4264	msedgewebview2.exe	124
PID 4264 wrote to memory of 5596	4264	msedgewebview2.exe	124
PID 4264 wrote to memory of 6104	4264	msedgewebview2.exe	125
PID 4264 wrote to memory of 6104	4264	msedgewebview2.exe	125
PID 4264 wrote to memory of 6104	4264	msedgewebview2.exe	125
PID 4156 wrote to memory of 1720	4156	msedge.exe	127
PID 1720 wrote to memory of 5304	1720	msedge.exe	128
PID 1720 wrote to memory of 5500	1720	msedge.exe	129
PID 1720 wrote to memory of 2168	1720	msedge.exe	130
PID 1720 wrote to memory of 2168	1720	msedge.exe	130
PID 1720 wrote to memory of 2168	1720	msedge.exe	130
PID 1720 wrote to memory of 436	1720	msedge.exe	131
PID 1720 wrote to memory of 436	1720	msedge.exe	131
PID 1720 wrote to memory of 1404	1720	msedge.exe	134
PID 1720 wrote to memory of 1404	1720	msedge.exe	134
PID 4964 wrote to memory of 4972	4964	Nexomia.exe	135
PID 1720 wrote to memory of 732	1720	msedge.exe	138
PID 4972 wrote to memory of 5104	4972	cmd.exe	139
PID 4972 wrote to memory of 2316	4972	cmd.exe	140
PID 4972 wrote to memory of 3796	4972	cmd.exe	142
PID 1720 wrote to memory of 6064	1720	msedge.exe	143

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gofile.io/d/Qo2fLqx2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff8f606c188,0x7ff8f606c194,0x7ff8f606c1a0
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,12776836736060649696,1587384070378817125,524288 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,16092152725280021688,9010735007752136314,262144 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,9016510228104506237,4870027078604031343,524288 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,7273153557566950246,15517344019567454691,2097152 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,16737567858194459992,9132370117316927465,2097152 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,13806119259387718154,13888286992423089818,2097152 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,17952753927474410995,11357818774755649211,2097152 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4848,i,1450552120300846181,13750569151458764889,2097152 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,6175073718164591831,10395758047588131682,524288 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,12868470772765641063,17050520727415467171,524288 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5728,i,15461558698711597241,4501462245123615306,2097152 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,6928091216638675813,712989311109285143,524288 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,6928091216638675813,712989311109285143,524288 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14612940821172773172,15620949729616171845,524288 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6520,i,15038258186725582372,1705173821897617196,2097152 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,1872275371166938548,4990981812093962843,524288 --field-trial-handle=2276,i,10601607375329190457,9307356496545164980,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:4668
- C:\Users\Admin\Downloads\Nexomia.exe
  "C:\Users\Admin\Downloads\Nexomia.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4964.4612.11847342936777423540
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ff8f20db078,0x7ff8f20db084,0x7ff8f20db090
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1768,i,7389828816048131531,14778904798203333224,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1764 /prefetch:2
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2080,i,7389828816048131531,14778904798203333224,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
      4⤵
      PID:5552
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2468,i,7389828816048131531,14778904798203333224,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
      4⤵
      PID:5596
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.1.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3732,i,7389828816048131531,14778904798203333224,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
      4⤵
      PID:6104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Nexomia.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5104
  - - C:\Windows\system32\find.exe
      find /I "Nexomia.exe"
      4⤵
      PID:2316
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3796
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Nexomia.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:5952
  - - C:\Windows\system32\find.exe
      find /I "Nexomia.exe"
      4⤵
      PID:5984
  - - C:\Users\Admin\Downloads\Nexomia.exe
      "C:\Users\Admin\Downloads\Nexomia.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:2496
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2496.5752.12468083087522656506
        5⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:412
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x17c,0x180,0x184,0x158,0x1b8,0x7ff8f20db078,0x7ff8f20db084,0x7ff8f20db090
        6⤵
        
        PID:5784
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1812,i,15152505257909086560,4501518142673278252,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1808 /prefetch:2
        6⤵
        
        PID:1540
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2072,i,15152505257909086560,4501518142673278252,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:3
        6⤵
        
        PID:2132
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2064,i,15152505257909086560,4501518142673278252,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:8
        6⤵
        
        PID:4692
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3484,i,15152505257909086560,4501518142673278252,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        6⤵
        
        PID:5836
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3656,i,15152505257909086560,4501518142673278252,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
        6⤵
        
        PID:5532
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4648,i,15152505257909086560,4501518142673278252,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
        6⤵
        
        PID:4176
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:6112
    - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
        
        "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp --definitions=@roblox=C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\globalTypes.d.lua
        5⤵
        Executes dropped EXE
        
        PID:4480
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5892
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:6028
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:1212
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:2520
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5092
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5496
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:2368
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5940
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:216
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4840
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:512
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -NoProfile -ExecutionPolicy Bypass -Command "(Get-MpPreference).ExclusionPath | Where-Object { $_ -ne $null } | ForEach-Object { $_.ToString().TrimEnd('\') }"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:3212
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4952
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4576
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5144
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5908
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4400
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:3768
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5488
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5904
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4624
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:1116
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5224
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:2436
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5956
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5324
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:3196
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:556
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5660
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:6132
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5264
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5592
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:3196
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5700
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4748
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4996
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:3556
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:884
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:2296
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:6132
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4952
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4652
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4812
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:3220
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4740
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:6080
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:1764
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:5284
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:2212
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4660
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff8f606c188,0x7ff8f606c194,0x7ff8f606c1a0
    3⤵
    PID:5304
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,16796315081267951386,15663609983567850915,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,12488852036417038099,14784588290554742408,262144 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,3946959092375712778,16122297226423085129,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,15789066084675150435,13601553440991690569,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
    3⤵
    PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,14911634645940681040,974534659597578352,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,14911634645940681040,974534659597578352,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,13400656456693353511,4294764077749798970,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
    3⤵
    PID:6064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,9679716710515486085,10689338608762752908,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2151687298047438176,14659963424571718597,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,4585942412605927296,5964533061867201991,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,14965020453585517459,12136237528014963772,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
    3⤵
    PID:6112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,2404818008416861776,10498911946155933174,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:4720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,2584256481551881842,6090135645142047605,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
    3⤵
    PID:5100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,13969962080432947393,7722205474768530443,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,15767522027876819636,1982651780373321200,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,9918044855734492238,2478776891546564591,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
    3⤵
    PID:884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,15256498036270623357,4217809990038766835,524288 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4904,i,9656824045430939059,13187713679086639013,262144 --field-trial-handle=2224,i,17594400286779054944,13173907511250043570,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
    3⤵
    PID:1904

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4920

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1720_192611043\manifest.json
Size 160B
SHA256 31952875f8bb2e71f49231c95349945ffc0c1dd975f06309a0d138f002cfd23d
MD5 c3911ceb35539db42e5654bdd60ac956
SHA1 71be0751e5fc583b119730dbceb2c723f2389f6c
SHA512 d8b2c7c5b7105a6f0c4bc9c79c05b1202bc8deb90e60a037fec59429c04fc688a745ee1a0d06a8311466b4d14e2921dfb4476104432178c01df1e99deb48b331
TLSH
T1F1C08C73CC08AE7911B14B371B214642E3B8030B600039093A32084C0BA47B00262328
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1720_200580212\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_1671831791\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_1671831791\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping412_2056209994\manifest.json
Size 1002B
SHA256 dca3cd7a673d0776a085c0b8958a85bdd8392923db21a0b55f4d37210f752322
MD5 9be87722ce3608a2d38a79079feaa394
SHA1 34ed541044567272d5402b30fa99eff29d70e9b9
SHA512 d4d22a3c277a9cc3325f4f6f15f18c56efc6945ce8abccae32d66158b9f35039b347e93d0f1002b66336fbef2d750f78184e6a4b72644cb71a2ef944af52388d
TLSH
T10B119B00CC388DD322D4BAA21CC6580A93621DAF4CC23E84339E161D8F1C8AB927366C
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 452a5479b9a2e03612576c30d30e6f51f51274cd30ef576ea1e71d20c657376f
MD5 cfab81b800edabacbf6cb61aa78d5258
SHA1 2730d4da1be7238d701dc84eb708a064b8d1cf27
SHA512 ec188b0ee4d3daabc26799b34ee471bee988bdd7ceb011ed7df3d4cf26f98932bbbb4b70dc2b7fd4df9a3981b3ce22f4b5be4a0db97514d526e521575efb2ec6
SSDEEP 12:biUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:bFRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T14F724986B34494EFC883597189BD17903374F6EE5F02839B6A267A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb29521835d0887aef733d211fa43d2903333bb5e86e2580dbfe7db3b16bb1ca
MD5 ae441104cfb514988d8468c296b33f4c
SHA1 1de1bdd3ad0b87ba57d165cd0d5b72d99a1a48f2
SHA512 4178d6169908ca49fae4773c8986a0c9d71a515b2fb4d7ce8fb9bcc8b10c415ac00698c7add7cc45f427547535401a518211221bcfe6dfc2bdc0f71f62b0105f
TLSH
T150D0C028AD78EFF4F021113C0330400031CF88138642210A58610D174C302C30380DF0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0bfdaf7a7f3c16d92825ecd7dfcef7bd91f70955e72c84c3be57a7459d93da7
MD5 e04ab80590d65d0cc0c2cd522ad21ccc
SHA1 875cf2aeb7cb258a064fcdfbcb1e5525860ef3e4
SHA512 257aa2cafbd7ff3ee2e448d0dc1d71771af456cadc96a7098617311c0c18bd0c0e5e92e6cb0c803e7ce880bcdf17cc2271cbfa673e8ec4ed5b19602231c911da
TLSH
T1E9D0C058F754CFB0F40240740330891C32EBC903880224292CAB168A08006C30344860
MD5 SHA1 SHA512 TLSH

Submit Download

26192bd9-61aa-41f3-a5d7-63afbe921dfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26192bd9-61aa-41f3-a5d7-63afbe921dfd.tmp
Size 414B
SHA256 8d1f2e5de6a19e78b8921a39a36990d183847077d7b018caf267a625ad931d89
MD5 4b79b90d959cfe03babce4377f9427db
SHA1 4a901c4545eb9163ac0cc339613f15b121c42977
SHA512 9326bc3d5a9a8d026483a6b372234d5d68244f4189e90b2b86e934b8d28f2a10efae9ca67e5f1f1cb87bcd4ca9349361bf9002223e6a84991900988493892a84
TLSH
T123E02BAEC862AC270CF9175864544E0AFB54131B2651545F3A7D91098FB063F419686C
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 9a41b84af7fa8d37e36e8178cb52a2659a8c084b0afce6a41ae885f510bb97b6
MD5 6b83e45b74607860921482aff8be6241
SHA1 715980dda59c59ecb040da9068c3cbd78c8dd10f
SHA512 e25857a9248b4a5f24a4929b80bdf2531bcf294cb3a6bb13306ce7da5e8730efca8641bfbf4a917d8a2402bb7f6c243e8f66e4a0fc0c12d9d8999b73adad3bea
SSDEEP 384:bKG+J/wMDKJ4cbm64EJL0WzX3PVZ9R5fF:EteJLbZLLPVnr
TLSH
T19C133CBEB3346D16F6C64A7D825F9F7A2332D82CC4C4556727B9F09A4B4A34B48CE114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 ea59dd9e6b8d56d8cda70720371294a585dea65387d79fdef0c98f0dfd453a89
MD5 86217767fd7d5ef7827814f27c5a6ea2
SHA1 8c2b24a7d1a5248ddb3fffabf6088751bb09d538
SHA512 497dbd75a5fbfa6b0cadb3528c91fcd5c07b2bd493a673e6a215a04d0f08ddd74f83f8d39b56747defb4a2834648cf056814ad47eca044038ee58af179e3a4de
SSDEEP 1536:TazVL/iNL/tku3ejtJv+e09ArtsOHOL/ZL/WL/3N3QT3B4D0G/QuDPvYa:TUVL/mL/gdHOL/ZL/WL/JQyD0G4uDP
TLSH
T16B4450F30941A01BDBA852F5D2033A7DE27B405D7CE1FD99D1788CD6182AF316ABDA84
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 89b86c5103ebf88a94329acdaaaa2fbda9a3a642125d0e74d3f20427942923d1
MD5 044963a2a9bb60b65f71dd0e69af048d
SHA1 211b5284429154eec13a9facd86ffc3d08ee0a6e
SHA512 5d524bec40827f468f3cabfb7b793e802631aae3f65b454dbb0f7dfa024208c5a833235d93cc2a48ce7080ed9c54a92bc7b4221837798676e5d245800fc11ea3
SSDEEP 6144:ewxsbopxOM1vBOx8qlsIqWtom1QTsOM9kYCo:VLpxL1vBM8qiZYOWDCo
TLSH
T18E254CDECB242C53DF678B75B0D0D8163EB421C2B999E0C38445C6E9A7C2B847AD52BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f1d4845ebc351e2f0437cf4728dace52c5656478322e27469e1c80143b49f87e
MD5 95a95f7062cd27fcad2702cb2bed9d09
SHA1 e438ae4cedf98516464c2f2ba205660a2135b7fa
SHA512 e684ba06cd675b4aecfe79ea38d6991d82a6f35b18660b8e3892085bb7e7ffabc7bb5de6f83862cfe37004880b1f1eab6823def2bb618bca058890e25594df3d
SSDEEP 24576:Dvb3/tTWFsBAdEjKW4WoyvJ1G4HmNglZpMoD7/Zv+aKmOs4wsgfA:P31TBA2jyWoMvmNKu3aHTdsg
TLSH
T1BD166CEDCA7858C3DD63AA30B4F0E9477C7413C3F955C1D68898C184026BBC5BBAE669
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 23503b806554124ce232714efa8bd6ceaef0086305f0ff9ce9e5639208544646
MD5 dbdb0d22f6701ae5989a0ab1c70d61d9
SHA1 125bd1ca5b7a294f2df475960dc047a7c02603cc
SHA512 29447a7500dcf6d20dfe0ea2c677844b867afce97cbea2f1f530278d7f57284dae2d41970fd8d3b188ef9c344a67edbc9d559322c0c060cee326547e3fc17ad4
SSDEEP 48:YWll0lBrlC3k6lGlZVXljlolUlBzl8l3lLlEfu1+liloo+lOljhZwlRlIllV+lTs:tuY3kdXS6uDI8Dvln4mHMLnuOWlp
TLSH
T1C0A16E47D5720223FB94B3F097D21187BE377A89CD431C5F00AEEA79802A7B708969D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59353f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59353f.TMP
Size 3KB
SHA256 18487741549a8242eba31a5fc034b276e207af3079f7dd83309f99046399ac64
MD5 23d23e9fb03271063a5c16d91bf1a770
SHA1 2ae56f0646dc9bd26d7ce4254149769e5078cf28
SHA512 08a09e773954e2db59cd785e8f4358c3492218ca22835a6191742776d502bdf55202597360e378a06d552ca7e205165205075f38d3413e63f63e74c8d7aea78e
TLSH
T173613D4BC6B34263FB9897F1D5E42187BA3B7E821A935D1E11A8E475440F7374C151E4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log
Size 456B
SHA256 c5ce9aaf8ffdcb8a00463a7bf24001885e0a792f110c8db74a1e2f4392cb0e31
MD5 f23d2df21a39aa8d814cade6c37856c8
SHA1 233e65707015a53f83a0d53db03a4af8fab21ea6
SHA512 a7b50b8cafba80f6baca44b260f8379852c4176f3dd57168812f3b4b811d2ff340f09f8ce625cc2adecab2851cc33725cb729548a3da98b041387c7952077918
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG
Size 322B
SHA256 830b4d070f10b031ec86d288a66d578cbc5d528dea9ccf3af0b31d9d8f7fa2f7
MD5 08ce463ae5fb2006afff958e29e27116
SHA1 4ad3ae5101e08a517acb5121e003cd02fa0d2384
SHA512 fca34edb52bb0ef311a5892b7b588224b1a1226a3e2005df94a76f645bebfaa67423a3e12256fb57b551d356f907912557a5a39547a00fb9fa59f7b95d8904a3
TLSH
T131E0208809C8C21DF4156E9742E95B08C2F03E52A68C3A011709CD546382589A35D1A1
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons
Size 20KB
SHA256 b84b10dc6ce227b1086a695865a0cbbf3887affbb9ac09d0655c1eae124c604e
MD5 a11deba7f75d84b12bc00d703db69e5d
SHA1 60948927108f2c514f8eec53ffaf3687ce481b85
SHA512 85ce9046db4d0465224c9f1750c72a12f2171ccb418c7fb9a362444d0165ab22808decf4128763f19face730f8e9eee668867946590199c0cd16097e0682934d
SSDEEP 48:uzBmw6QU1PzI0txMyXPTOrc2JFiZwUSXtNHpIyW5RfWo7:6BCxI0tyyXPTOrcKiZwUSX9It55B
TLSH
T1BD92B44B5E383813C7656DBA2A6B4870DE3AD25C5FA68CD4782080528DF849688768FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History
Size 204KB
SHA256 d112b772ef982210af93561519be1ee1ad53f78300c3bc3fc0462d18c962745a
MD5 ea19d5bf5cd8a482fa87b972ed827c44
SHA1 0004531a510197ef8ed6c8b7f3f414f1da859800
SHA512 98206b6713143215e5106b09e03db376bb68de60f6eb14a54dcf517009d50db3732ba20a7bfa16fe5d00cd6ef94d7943614baf6ef1e73d2ba9c06804e2a23a0d
SSDEEP 96:LC2IU+bGz83uy3+u4tgp4DLjGQLBze9z3L7jBHMsDEuspU0wbtqrOQpPfR4J+MC5:LVf+G83uy3Ct7XBBKhH7DXspU3iD
TLSH
T1ED14335E1F242722CDBD917629E644F36C7CF03FCB52668A6C6104B4CEE2652A02C4AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log
Size 735B
SHA256 8ea7554818d52f2179f1d93a9796b02d1ca8fe456b84d349aa3c9fcf2d813d1e
MD5 a385cd19624edca5913f14c582697433
SHA1 610476b110513725dd92d9e52d4f24daccc860e8
SHA512 2a931127e0abdd350a963d6fef4e7a54621933414fef687dfb0c859cd9e411aa18ea334d835061b6f5d7d9e05fa6dd0584eb6374aacc8af86da9ccf11f758143
TLSH
T15001904B1A6175EF7B4CF7E7450A9DDAF50904159DB5A78C6293410C402F8680A988F3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG
Size 331B
SHA256 4b8dba452c338b52d0c25398d3a3d7101eeceb0b2da6bde1407d93c1e628f570
MD5 ed44d6fd171b0d23967de8bd892f28b4
SHA1 991d9a9f8b4b5bd53b91f90264b51ce061357e3a
SHA512 768a958c34b94d4368521740b5abefcd05d1972b4a780ae64246fe74ced913c42831f4e85eb04933b34ae9629578b3bf6bd459dd7f80d3a965fa730121aca987
TLSH
T141E0D8655ADDC22DE115384B52E57F0CD7A13D17D68C6F015B049851B242448A3911E6
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Size 20KB
SHA256 20971eb62b54af5406e27bc3f36ca2910ed0fea6aa8e277b67f3c7887eb8752e
MD5 16525cf8ae4d77a8a49963cb7a231b8f
SHA1 786b0949bd11b50124f5e150dc1237992e455936
SHA512 3b2291439f08da956fa13e2f1af163a6dc20bdb0a2d9bafd730fe57cadbfe353d6a1d64f1746e52315406c36de6ae4de376ad8480237c3ab02543725c1ad9d05
SSDEEP 48:TtLopFMatSaw/auUOt8BMofw4VDFA57f5AwH:9eMatUaAKZtEz5AA
TLSH
T17792410E2F346221D1F45B72DEE588AB2E7C201DD3A732999E1820F3CD9265BF1160A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fd015b9cb5ef459e179b7c42bfe8ad57d2c88c52b1645ddb32cfbf47218211da
MD5 813b371394d0e34e6f932ecf2959e508
SHA1 7f510dce5aed282d5e179ddf7fe404630d2ca4aa
SHA512 42311f4f8b8eecd70a10e707ad48d819c55aeb68c11bc6a8c1954aaf318deebffa894105450797d41fa74a60e5313ca6a24c3c417bc987819ee7fb8961927d37
TLSH
T11A41ADF3C3EC916D8D2256F4AA24AE1BCE5C1515832C7D3A8AD49E07E3E3831D20564F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 96404c8eefac52c51e530aecd301a9418a87fb1f2325bdec81b3c2207379072a
MD5 d5b5b1cf1d80af2ffd0db25cca0fc841
SHA1 fa9a76f5dd506464d04f128e3dd56895da0c5618
SHA512 d0c3c13b34f008e5d61857fe673d06eefd1a03b58911119ad61673f40ba300cca33a0c73cfc323c74bb6f7bc2263ff4c169c1ae7426aa2df69530d8076e5062c
TLSH
T1FF61C0F3C3EC916D8D2156F4AB246E1BCE1D0515832C3D6AC9E89E1BA3E3831D24564F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 857B
SHA256 7372a76c34368b86b507df6c70ba04ca9f627e1fa00ea9ee6ee58b25bc814447
MD5 ef5734fd2736dfb03642d998c56e62a6
SHA1 c109fffde6bba856e747e41320ec2306a3fdb860
SHA512 7b066fa7fea4d0911aa9447576daa2202a25fa87d59a391488a4911a2e1ae4c78d8dd022fdd37d8ab0fc8719f723fd347b171ad1c0eb95e8e1a0bfd4e25ab1ae
TLSH
T131118C9281BEB537206E2DBB5F997C03297EBC31016378F4ED96C2AC60811F71B19463
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 7c88d56e79999f4403923b9e3ac06b79a2a2e90071350ffcfc465f9877943720
MD5 662f0b60a00c0014728758a6d99fa719
SHA1 0ca9ce2fa25435c9e62511332ae40fa71331c436
SHA512 4a08dad1e93bf66e333f6983c15b9ff711bf3800a6a9f4beb1741f499d3fc9a285e5fc4f1cf7f4e353ab007440c60d45dca3e8fce8ed5ef605d8c25363326642
SSDEEP 192:sxZFR0ne/fwsACW/tIdpjl0HW6+WNekY/Y3dRtTIgrJ:sxZFYe/fwsACgOCHb+/89
TLSH
T15622B7166E28B97B8CC7E21DBB25BF53E6F9403291D51E58A6FC861C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9e7d2210fc52359553d0072634b723fdb0a5eb13d8072045ec2bb8af1ede7a6b
MD5 e337f5121e32f55cda213dd6d5e93587
SHA1 6b369bcfe08e899f62e3db12ba2f352ed8d99fe5
SHA512 33aaf1bd465c310729b078adcaa829b632a86930edec83235b5ed333b6f36431a582c1580598e3a00f1071fc410cf0a5d555d381282bf48818421d68226944a0
SSDEEP 192:sxZFRwne/fwss8WpVL/6Idpjl0HW6+WNcckY/Y3iRvNIgbnJ:sxZFYe/fwss8Wv7TCHbz/bl
TLSH
T16632C615AD28B97B8CDBD21DBB25BF23E6F9503291D11E44AAFC8A1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 b55c4baf20b0639426910d73e7ad410d7afb6be27d3354c47204b948357f0287
MD5 c57c0e48b6946dc6114a55d305b282d9
SHA1 38ca34725afa8a8d8331d00b09190982dd6cb491
SHA512 7ae64900ecdba8ff6a646ba3e5f712fa6d3c8bbf448bccafc8cc1516a307bf1da597244679bc4a1b07a95e298ecd0a90bda4d65a540535502f62e6472c3f357b
SSDEEP 192:sxZFRw9e/fwsqWpV59tQCdIdpjl0HW6+WNcckY/Y3dRoTIgbiJ:sxZFMe/fwsqWvreCeCHbz/3C
TLSH
T17142D715AD28A97B8CCBE21DBB15BF13E6F9503291D11E54AAFC8B1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0dafac6e048cc8a13f7524ae40b75d1848c568b417f0de80355eb1547fc03891
MD5 b6ee27c936351919254dbeec02fb937f
SHA1 a14474b15db0e1bf305a4f30203c930a9a82cc3a
SHA512 051cd1a2d345b5ea3210c6a3476122bc82d81bde49776cb83a609f36ed55939d88808a17b09bcf88de25557a73a9b339e8d00f82df2376bb02712802d9c5c25b
SSDEEP 192:sxZFRw9e/fwsqWpV56tQCdIdpjl0HW6+WNcckY/Y3iRoTIgbMJ:sxZFMe/fwsqWvUeCeCHbz/s0
TLSH
T1C242E816AD28B93B8CCBD21DBB25BF53E6F9503291D11E54AAFC8A1C05E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4e8f10f8d0736428e934341cdcb7383fc58cc7cb4de04efb17f64cf9795fbdcb
MD5 30696a66dd59cc255b90ef0a9ccb886a
SHA1 b3fb8226f0d4d6bd96a79139f650bbe351da0a03
SHA512 b481051ae0fefce2c879f5775c54250a9bfb5f2f939657314a637be05b0009b56230c3d3c911d472dfcb5e878deb1398745d30873ae55667e52800c78a018102
SSDEEP 192:sxZFRw9e/fwsqWpV566Idpjl0HW6+WNcckY/Y3iRoTIgbMJ:sxZFMe/fwsqWvUTCHbz/s0
TLSH
T1F832C616AD38A97B8CCBD21DBB15BF13E6F95032A1D11E44A6FC8A1C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b11f00aec478ddcb3a75bdd672c563a07f4655445ff3de392ab12381373385b1
MD5 23146b4e7275ba6c4a465dfd669f754c
SHA1 616e66c43adb73c5f041de6421917a1418a01357
SHA512 287f150f153de1f47c7242bd30d47cc976452c68ab886bbdced623ac9e8dac6a7663d15fe6eb08126cbd56b3710eda17bcdb8f08ecbcdb95d7270a7abfbf24d9
SSDEEP 768:mu30AbSWvS2l98F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72FrolZM6:mu30AbSWvS2l9u1jaLmLZ12+Z
TLSH
T1D8C2DA3B640CCB7E4FC01A9DDD6AAF9B6E9C02C796548D4047FA944C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG
Size 338B
SHA256 8f6b91ef473c1e1a4a54da6ced3bc219a72e731998ccd3bfc786b676df35c55e
MD5 0104c7e0f878b63f639bf516e38a3b1a
SHA1 88dd1f196c78e4b11d482d05c7cc67bfef8bb3be
SHA512 2de2d2df5654e904120d3a7ae561668b23f0d464281da6659d72bddb28d28825533147b05adf3db37353caf594101f8396baab5a8fcf10316710e5e5276246c5
TLSH
T130E0206806C8C27DF11B254741F9E70CC3D9BD77D2CC3E411F04C840E2829487263161
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 c555c5f7e18a7df47fc7e2bd7edc9ec12d8801bd1eff87b779e3532c912b82bf
MD5 b479633203fda4e579ff307ed970cc4e
SHA1 de48b6b1e271d0d5005cad740f95f358193e308d
SHA512 6a4f1b55350a2f04fe9adb98d817e2f2eff75bb39fa73682d0ad64cd7f30b3867ed3ad3c91663b51afba0ff8ad2551e088e1ab82e73275906151ede0bb6cd6d4
TLSH
T117B0124CBF005211C6CDCA3503805F445310F05235004923E846DF700C1D5D97F368C4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG
Size 350B
SHA256 d82d57a21d6f1b23d9edcae058ec9cfb3ee315b77ed51963a3a159d93cdd6cb8
MD5 659737fe6c9b82be5b59e9a35325edd6
SHA1 1bd05d1da67902cc662d68440a99fd4147442451
SHA512 9000da661c3aa18cf99df6839acf68472cbce030e31ba59aba80b86c4271f8e8b8269e8b25af43d286116a66f1f9987c5a28ecffb05568fb5157799573a7e991
TLSH
T11CE0D83426CDC33EF246248B52A6F74CC1A3FD53D6DCAAF13B089454634658473D3162
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log
Size 175B
SHA256 80d1388b9a7150eb0291175fe693dd7b6bce910c3e4fff51e94841d31d771dbe
MD5 cb63c64828a27af7253afb7c7d986654
SHA1 8a54aeb86f79cc69e6f11278d874cebd328ae466
SHA512 e0dbdd6931c9272e0b52bb2ef7895121f6324379f584899343342a057737a9837cc476842ea781a1de5c17a20c06e0a7d24c0ed6ea41fdd95bb99296e8810f9a
TLSH
T135C09BD55F903023FDCA5D3D0DAB53041720C4752F74CF57D28430901C0A285FF61145
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG
Size 326B
SHA256 9e06f27f21de19bdfeab83de651c52b59f0f5b9422a4b500c10b2ad03fcc3061
MD5 26a741138878dff46c8870434e3fdeaa
SHA1 0054a80ccd75c07273886af52bc26591609de2b6
SHA512 6bd01fd22e4c87322d25212face1b5c10bb09db557897049ec61ff2155fb5a1952752aedd1a64391bbec94250474792c54351c25c26eab0962da0b9d1e576e78
TLSH
T197E026B84AC8C33DE406658B42E5AF0CC2F1BE579BCC7B9267084850B2815C8B3B65A1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 332759c29f6d4d0ce6c200105075d25f821062c9068feb2953b88f103d449ca1
MD5 102d6e7419c48031df9654a6e9527b5c
SHA1 35d301de72f16c817c9c95ea2330e737195cbcb2
SHA512 b417ec10276d0aada29b961ff4209f3dc79a86d651374fbaedbce79a20f9a5faf4c17d5255d6b6e8dcdd3b5339db0fd51bddac0cacd39b67be1b60c9b131d1ea
SSDEEP 24:Kc+5u8MIdKihU1eS70pyXNmq4L7roU5dkt5o3PIG3kKDHhr9k1xP0SPaJrZWmj1F:KgHIdK0UInyxQIfK9+8l7IFKIEoHyZ
TLSH
T17391FD0132FB0260397E2A0D94B69A2E464231B33118EA6F7BFD40E64F67E581DFC5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Web Data
Size 224KB
SHA256 2e12ab050bed4369b941f31ecbadc07970945b9b6e85d53d55b56054dcf95ea0
MD5 dc3a989a2b8bbcdc82fbf6c27834b230
SHA1 baec09b52541e9e999a50c0f668bd916e638e66c
SHA512 8728387d4c105a4b5dc56fc9958144e8b478610e29773a121a1d866f00466183d0387bb6a56c8e0dcd10f385c89a7fd79b557f33663a448eae999ea4d0cfdd64
SSDEEP 192:P+xWFe9fT8w0QQnG2IMW1hPJubRd6vPtcdCewdbsc7V1VJ:mx9fQ9QQn7IMW1hPJuVd6vPkxW
TLSH
T19324740A7B747001EDE6D9721CB080771E3CB16ECF22A6915DB654698DB2853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log
Size 14KB
SHA256 0e3c505a2c032fb6a35891ad4ad7d7003b1411e198e69e3d96675e01974329e0
MD5 780a1465204703520614ede00f9e02ce
SHA1 ead65c52fb01a385f1e3de1da0fc79f5ef04d808
SHA512 27b8a2d3695e5f9678fe35d74f39da68d53b3805ec36962a21dec2ebe4a2fe934e7bd213038611fa86900d41ed6ca3c1926dc3f920d07644a8c2f2b5e0977e0f
SSDEEP 192:I7VQhtrIIICbyMIM8HNYcYk9OpsAsSNlrNTssET18o8K:I7VQTIIICbyMIMiBGpVsomss5
TLSH
T11162946E23541773C29EAF7643658B8815D9AC410862522CB5933C0F8EF3BAB86D53F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG
Size 319B
SHA256 071f61851fc6bfddbaf856b985db0b6755f1ef34e17537cc35f302f26176f83a
MD5 eaeae05a64cac6541bae8de5f059ec5f
SHA1 d1c6736768c9f991144b64a0e73bb3e5e12bc511
SHA512 e74dd6d572cf68c13635cb2ef3a1207e3e2761755e44a830e145870c7e37d895fb6383269dfd5b1981735b9600473d6563996b660345fd53bfd5fead7fada778
TLSH
T131E020547DC4C27EF115298B12FA574C82953D93EACCEA452F04C4446181544F355562
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log
Size 1KB
SHA256 f283005fb001251e49c6527c3cdde62bae79ac6b1208932abb6d5bd52f1e4709
MD5 dee8e19c3010ed8ab0f53e321e6d84df
SHA1 d24988341bb06b3cdfcebffd4abd7708e3f5ead2
SHA512 0b65bf1ab1ea12e0eba64a02d789b0840eb840efda92ca0a8ffb5bf9183b1206ed39e2e7b469585b1534cf709c8dfe6f18cb030a562ba82e1e3ae37bab8c7c4b
TLSH
T17D2128A2F334C204D149823A547FA7151334E816AFFCDC0F46BA24A87FB3A051D4B6D9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG
Size 337B
SHA256 838296df3e5de737827c3bd99864f1031bc500ea6670f5fa208554d733d59e42
MD5 d93e14c3744e4ca9ab8cc6cc2c2aeae3
SHA1 89d0c91095929c1de61d6cea62f404964aea0020
SHA512 95a09ac1201f99eb7797db30bb2969bd0fda8c852b2f122ee7a7ccc55513dcce4e05c0a6913ad1ebc8fff8864e533f3fa4c493ff5a9a6de355e0a96368dfc994
TLSH
T158E020547DC4C27FE111298702FA978C82A63DD3EACCEF412F04CC445281585F356562
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a28b7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a28b7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Size 14B
SHA256 ee1367d356a136a11664001cd90e05ba08dbaa85f496584158f5e42be8e836fd
MD5 8297da058a737611abcc3a0ede9ffc24
SHA1 e532552672ecffbe3509fb4c334833a67f16d05b
SHA512 fefc70ebe486693310a00beb5ae125abb1569c4455538124d897566f2e44f2b3854ad4451196607137301a811ac7f96f1d488a36eb6d6cd566f2f7cdc7c7568f
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 2f1a269a100412839b7fb378da5d5c03c2fbcf2790a339def73602cffbc6b2f2
MD5 8e15889c2d39cbb1f6301b2a16b4b555
SHA1 21572247d7d98a0d2d759d558882380de9ff7347
SHA512 307ecba57b83338f20e1358359de8518e58a7c5669630e47e31afc2b4ad9d1bddcbe0c3b894e1690f29f669b25d4e23435e893ce8867ca606dcc30458e07db50
SSDEEP 384:n6ZcIqsNfm9dpugMe9iX5FC/8TiV3zAO9GOa+VYf0gL/7IzboE:4qndgKauplEO9GvgoKD
TLSH
T1EDA26D75A8246DEB45F2E5C6A7466B032FF8027BC6C86D5CC5F86B2D208E5BC1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 54d97a2d4e541ddbd5db1b0ff3698f33a7ba4a3e32ceda7fe60e892151f9d4da
MD5 93775e15959d37f73d1645d14ea45598
SHA1 62d6580c6959c5e63c92973f917dfe7cfe78cd30
SHA512 9914d8c7e100592d7bf010b21d100497770143d2a5ad1a74c4dfe27b6c01770aa8baae365674144ea673dc6dbacac97b5337840ede51c296c04cdabd7bb9160e
SSDEEP 768:2Fyq6wg8dgghnEBvmdebVE07SRc8Fvg/sM3PlEO9G2goKD:PqNdWmE57X8hsPib2goKD
TLSH
T139138D75D854DEEBA9F7DBC6B706B607AEF4017785C8A888C6EC6D19108B1FD0343825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7afa3724c3fe427389f2ef15e4d84e187890d3b026a49cb9e2cd5df5418e1fcf
MD5 1d60cc3675689545feba140a69cb9c09
SHA1 ab661fbd37485637de2beb1823f86fa95c195e6f
SHA512 f651bbcef7a1e4c9a03bce86fa7b45931544cf6c48638987e850f56d73b6175e8a8788870432a865635b0089380d9d98bd3b4b4407b11fb5ea469c6fa339269c
SSDEEP 192:LONv6AmwprQmiUyNf6siX5FC3jzor9mylJiMMU6:LONv6ipde6siX5FC/8TiZU6
TLSH
T1A202FB35EC786C7F8AF2AE45B14B37175FA9116BEB946F84CAE8172D01D729C1306832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 2f76262abc13a270db0652f8660ed7a0754e29696d4930e889931dce4263107d
MD5 e3488c9b6b1b07fac1f260bde25837c5
SHA1 3e1c59667e5b454c28feea7669d46916b6dd62f2
SHA512 2f7e4fa345634af72035a6ce07efdae7592b18ecb5d8c2d751baa9ca5c5cea7420102952c6c78527dce7ef7a6d086310bf8faada7eeeb8875a900f7b8cf9b488
SSDEEP 384:LZcIqsNID9dpuu+e9iX5FC/8TXX1i+207sa+VYfvo+:Tq5dwKauMcl07hgov1
TLSH
T1DF828C3268786D7B59F3E292B54736135FB88157D7C82F94C6EC6B1C01DA298130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4902922dc312821908b2cd22a6b3598433f5fb9ea03ccd909193990612fd8d25
MD5 dd53bc8e254a372dae7d9e5adcfe2520
SHA1 3d90c95a4e33081f241b9df1eaf3d51255c1d6ab
SHA512 6c94aba36813254abcfedb2b94600663df55b49dd201c6badba2274ece9b2b1cf893e4d0a368c16bb20534debb97640889ae05a760cd3618e51bacae6058437d
SSDEEP 384:3ZcIqsNIX9dpugGe9iX5FC/8TXX1i+2Dr5vKASwZdookLCsa+VYfvo+:/q9dyKauMclDVtSJokLChgov1
TLSH
T16AA24B75D8646DEB84B2E9C2A546F6076FB81177C2881A5CD6F8BB3D309F5F80312826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1894b29b824a9effa3b40a2b0a7407f226cd52cf2b8dfe0cb62507ca0b075066
MD5 f44424961dc068946010e8d5fcd45174
SHA1 fa9ffc0877a28cce6751bd057870d6ece3813784
SHA512 3ac65fc7021ce0b7fdfcbdc7c9c117fd30abd72b0a3d1ae0c7dc0450233c3b3b289630892985056b1cf4daa0e8f20f78ff311f99b2f593495d5e025acf4e612f
SSDEEP 384:3ZcIqsNIX9dpugTe9iX5FC/8TXX1i+2Dr5vKASwZdookLCsa+VYfvo+:/q9dPKauMclDVtSJokLChgov1
TLSH
T1EEA24B75D8642DEB84B2E9C2A546F6076FB81177C2881A5CD6F8BB3D309F5B80312826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0b7f4829b65416959a37310fe6851563acda261b627335b5eec07118bcbb3c5d
MD5 24522ac534bf93628366a3a343f8f105
SHA1 bfc8c5de45640de3e40757cb5707aa42f055a450
SHA512 516125a76faa62d80fd1558569c14b2cf1064c8c2dd68247ce7292e815904669a25b9875b821bcceac21c2841820f46f1a12bb7752ff79bd61cb9ea9d5eaf620
SSDEEP 384:nLZcIqsNKX9dpugMe9iX5FC/8TXX1i+21Nsa+VYf0gL/7IzboE:Tq/dgKauMcl1NhgoKD
TLSH
T170928D756878AC7B54E7E285B75B3B036FF81163DAC81F94D6FC9B1D00852892707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8f8ccafd3a708dc5f639ea9a1ab355e8b35ba128df01ec383c0f25228e95a550
MD5 e3ed8594d9c1d540bb6d650a70ec9950
SHA1 4c881b3569663cf913104810527738c5fd01f11f
SHA512 3a2d97618ed52b42d985251c6e3ec0cd15ce00b6b66c000785d570080db4cf4976f435ef1a4fe6eec4a737be8f0418265a3cfdc027add0f768fbd00977db8638
SSDEEP 384:LZcI/sNID9dpug+e9iX5FC/8TXX1i+207sa+VYfvo+:T/5d+KauMcl07hgov1
TLSH
T143828C3268786D3B59F3E292B54736135FB88167D7C86F94C6EC5B1C01DA298130782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ba6de53888f362b2e6ef09f49b1918eadc90fa518259129954b2ef69c97fdfb5
MD5 8a3432fe246f3c11196b96d99b7bd9b5
SHA1 d849fcfc4aa0dff23a3fe341538fce4def831ce5
SHA512 5d560cb3742fe13fa84782cc4b898bce6665a1725a6e4607612969ae017c9bf526376e0b1ce0831e2af97b79ec860a45f3b23464880a7711b2483b803e88e008
SSDEEP 384:nqZcIqsNKm9dpugMe9iX5FC/8TXX1i+21Nsa+VYf0gL/7IzboE:IqwdgKauMcl1NhgoKD
TLSH
T1B8928C756878AC7B54E7E285B7573B036FF81163DAC81F94D6F89B1E00C52892707827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 40e623fceadf848d2ac3d12bc296c2e7f427b0290079e8ce7abb2d70c958712f
MD5 11a848407eda80cd953d60d5646037fb
SHA1 2f905f6ca979ee7e77f796703bbba6cdc2580e97
SHA512 3a6240fe7a69f075dc1c153f5fae59d42d1886b8e84f7e456583778b5a5aab2db8ced766a0cc3d740dd40079d86727aeb46673cbab6c0c1341a621feea856c19
SSDEEP 192:LONZ6AmwphQmiUy1fasiX5FC3jzor9myXXXFi+2dlRl/xU6:LONZ6ip/UasiX5FC/8TXX1i+2l7U6
TLSH
T1B3121C36B8786C3F5DE2B595B04735139FB94217EB887F94C9EC172C01DB69C530A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

nav_config.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\WorkspacesNavigationComponent\1.0.0.5\nav_config.json
Size 2KB
SHA256 98252dc9f9e81167e893f2c32f08ee60e9a6c43fadb454400ed3bff3a68fbf0d
MD5 499d9e568b96e759959dc69635470211
SHA1 2462a315342e0c09fd6c5fbd7f1e7ff6914c17e6
SHA512 3a5922697b5356fd29ccf8dcc2e5e0e8c1fd955046a5bacf11b8ac5b7c147625d31ade6ff17be86e79c2c613104b2d2aebb11557399084d422e304f287d8b905
TLSH
T16B51DB73D5988C4B9BF4A29CE919A309F11107CF75D48C0B76BE010C1F7757AB5C6588
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4bd31368cc3ed7730b72b6ed438b963e82b7d90268c93539d50a81c92e3af0a2
MD5 1b3d60487d930fad7bf9250c12522b2f
SHA1 1b8c61cbcacf847479077f5c7cf29e90bc8192ac
SHA512 34df194b2407c3d5ce3117e54fc6ee38329f1f26343be9d7ccce3a167b5a106c220c70ca74dea99a84d9e3eb23ff45966b8c14818bd71fb7457e5e015e6b98a5
TLSH
T1C7413458B6E91148B3B77E1AAFF6A96E443B79372E4AC45E00110D4E0627B01C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 30cf3ba618afed6708087dc88c96d01cab91592ee8e1478ba4108677c98fb586
MD5 0cb115f729de6f203b281cc36fd6984f
SHA1 75c8f2803204f6b0cc7d4787ad942f38c15e0c4f
SHA512 e12eade7779d731f02c5648891a40fcf46c08df555e4f965ccc09d3db27dfb69baa9ae82afd06b780518408f4247d1d171f079bd09b1c146c44a06851fd797cb
TLSH
T125514E68AAEA110CB3736F5A9BF6786F457B7D372E46A45D10510F0F4623A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

575cde4b-b2e4-4e56-b99a-ef4f7c2406dd.tmp

Path C:\Users\Admin\AppData\Local\Temp\575cde4b-b2e4-4e56-b99a-ef4f7c2406dd.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

713bc546-a93b-427d-ac96-9de3cc8ef202.tmp

Path C:\Users\Admin\AppData\Local\Temp\713bc546-a93b-427d-ac96-9de3cc8ef202.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_442imqew.ku5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_442imqew.ku5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c94a9187-fa2b-4ca5-ab4e-f603b8fa46a3.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1720_1360585044\c94a9187-fa2b-4ca5-ab4e-f603b8fa46a3.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1720_791492611\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e945584fea0fbb4a2113dd861f093b1cdaaaa124b1c8dc070cb5afedb0765390
MD5 51a9decc7642181521c3b3b4d692da0b
SHA1 3762abd3e2810866634fc196fff5c96f6b2c710e
SHA512 99b009935215f3afc5e357a054eda9941625ee47cc3cd8b99274f96da2edbd687e727b3236701c796c980cd51dbbe9a6aa73f2e9f40b7ed11f46abbc8f255b45
TLSH
T15FD012273A111274C0103136100369484D02C40F82094241993DC52D2F8E4644D02441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d694663ae5175e5ee567cd765dc888a41df73255466c3351cc00d5e54be98c4f
MD5 9ecb9ca411ac954b89b503a1cd0c97ab
SHA1 a6cf94be5fdf875993174e4d497bb6bcc5a0e44c
SHA512 5c2281df0b1313f98f8dd83c1591ef3104f9e78498e2992a31c97012c23d9a7b4bbbb038f597ffadcf82a6305ad497f2ff03b76baf0676332a4348e9316daa19
TLSH
T1CFD0043555101140D040703D10574D50CD034C05411503414735400C17CF4144401004
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 18837dcd6ce2f5abeb386f009846521c367275d96d4d7ccfefac96f7725e3aea
MD5 b76e8e924443c6911ff12d9e99a6cfb8
SHA1 bfe0430b3c3091a7cda30b5f60334ea5c840ccce
SHA512 451c0cc99af3ff469ee3298af0eb92c414fc4f6b0f96954d201cf6643953f0f3bef1d944a58cfa9752e3015dc1cad2a7c7ba063d1dc8ca732ac121310f891408
TLSH
T1FED0122736110274C0103037104369484C02C50F81094141993DC51D2B8D4640D02441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 809e971faa7e204c8595c8c1fb3721e28a13d51cb25dd64e03abf191cd4b5803
MD5 385db921148d03091c926c98450b633e
SHA1 d728d2a0b4102f07bb900db74e1ca531da18776e
SHA512 91212525c17936dd54db94dda324d6494a5ee80bfdc9c0268cbc25d15715b42650054923314779775b654875eaedcf1ca4c31b190eeccdc2a3365057a8559c36
TLSH
T1EA216604C7FBA785CF21313027650E096C2FF22E3DE64787BA621233844BAE06A30D46
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 648B
SHA256 74e4eb35955d0f0e86684bb78295ba52d6436ecaadf085e8e606aeadeb200999
MD5 03eb637461343eede70523921a804678
SHA1 fb8fd3e77b62051307f715df1b1d6f2ce2a0521c
SHA512 b63c52ceedb44c8c9213185d81c6e8a5eb2f9fabc85caa3926c5198b1c9a03b09c7ef056b7cd77c8d06749925e10bb0f3c92f8174c3b3e84a36d6ded218ae6ff
TLSH
T172F08C04EAD96285DF25713027B11E167D2FEA9E3DCA0B07B6A242324413AE07B71E85
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59672c.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59672c.TMP
Size 48B
SHA256 7ddcbc3e177b561267199dd4bf9b38f8a9d66e7fd838a5766f02e9b0c7a0629b
MD5 e1252ac28a60cf94f43bb72cb64eacf4
SHA1 b013225f3a612a88062eb040c278fd10521a3397
SHA512 58c24c5c3a98893cd545478aec40999bee1114bd7230d164b82a174f7e05a62756575b2412c655ba48535dbe8fb6bed3990683e5dc0a4762a162946d40f78997
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 766B
SHA256 0137848138000b086700f6ae12341fd4022893881be0d71a8addbf624c17bcbb
MD5 4cd64c39be123ec09107e409e34f6ed2
SHA1 6957bdf077ccfe1063fe9afec781b1b2d9b9392a
SHA512 9fff0703a612c82858a38c1deab65ccae3388311085605227393f77188e02c937cec004b148c34b02a3fab68633343d6b0e9ff0c20b9e31d85ae5ea69fecd70b
TLSH
T1FF01B1B343F0C9BE4700A6A477342D07CD3D0016631C6E77CDE9AB6657A20B1D11064B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5967d8.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State~RFe5967d8.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 36122a3568bcc2a4e0518c15dba0a41db4e645bd16324ca6885ea6956a5c3205
MD5 9ee924e3120f7d11b176be750715349b
SHA1 21dfa802e756dd2c96542533fda4a32e3452f939
SHA512 2e5b1c9a6faa92a94710e899ec29c3a543ad612cf44d3aa3f2778d463c047af516e4dbc79f77247f67465485ecdc838723754e673d7e85bb2049b96f87a87108
TLSH
T11FF0C093403FB12B106D0D362D493C210F75BC74126058F0C952C56CA0811E3461A027
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 524B
SHA256 b041901a12ae2e6f9c52586401d63910993d1db4d71c7df8c6781ae33acdacda
MD5 4351fe5fc9b75501fc34b084ff98b1fd
SHA1 f624271870c0eb250a820c49b74cbc616ff404f1
SHA512 3990180827ce7a9dce674c66c3811499ec1e12b0e8200516e06437d5724889d3e8729695fb7d305ac7e4753ce9c345b1f9d98cd5b8dfa0ee88d8e1ba40a4e9c6
TLSH
T12AF05993407FB62B206E1D762D497C260F76BCB1626168F5C9A2C16DA0812E69619067
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 6aacb9bb372785d572eb1b6edf5a090a11a27e16965402b635c08dca8f4250a6
MD5 55129f447e7e5aacc70b3d0c642679f4
SHA1 9b55680e1a563fba73b61b0aea0814af40fc27f1
SHA512 08a3310d8b401be387088d6eea2095b8e1bc908489cd10727356c1c736367236e20a37c0b71e2340daab44aa17deca7a91ab7d0117e43c18c0eadeda357dc4a2
SSDEEP 96:stl05bTvCrbDcYlffqidZ8i0vhE/ktSm/7qx+WVHMSm+uecJcVSMk8dQjlP+gNOV:stl0xOgUfBZ8paiP/S+WiTcMQd2PSTM8
TLSH
T1BFE1B7065E28B97B4CC7E619BF35FF46D2FA106221D50E59EBF98A1C08D66CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 7KB
SHA256 19d6b6700d09e579f0229fbe55a2107735033732dda8fe5e3e919c6e7e548abd
MD5 63ccd17f5bf29e1c66f5b2168af725da
SHA1 cff0dc08f1ce59ade32250349ff4da6bace74dbe
SHA512 c2555989d442631229d5e9ebe971660c9eba2269890e6523daa3fa357d8b4eb73d3a41cdb3da8d3a12309ca2dfdd78585b1d259f3646a32400908d06bde052a7
SSDEEP 96:stl05bTvCrbDcYtffqidZ8i0vhE/ktSm/7qx+WVHMSm+uecJG/SEZdQjlP+gNATL:stl0xOgEfBZ8paiP/S+WiTGqWd2PUTMC
TLSH
T1BBE1B7065E28B97B4CC7E61DBB35BF57E2FA206221D50E58EBF9861C04D66CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 1fe5b7d4a6b99ac6aedbfbf8df71cfad90e7f4374f4929642a36cc1850c493ed
MD5 7929c70cb46ed17570e06a2d24ed94af
SHA1 ba67d3820f4593a082ea49d74547f66a2da14736
SHA512 cea25e3ac0915f08943c4ac3c47c0be12c811d2c58c5c8d31a5b3c844dcc7a33194ac856766a5aeca385636e76357b581724be6f9883f10b0e1bbd0a47eac4a5
SSDEEP 96:stl05bTvab9cYlffqadZ8i0vhEaktkm/7qx+WVHMSm+uecJhX1idQjlP+goOqKEB:stl0xDUfrZ8pa5t/S+WiThXwd2PrqK8
TLSH
T19FE1C8065F28B9774CC7E219BB35BF16E2FA206261D41E59EBFD861C08D66CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59672c.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe59672c.TMP
Size 6KB
SHA256 4f64d805e2a9759cf3ddde2304ef8c74dcd73274260b00b1d9ee6f5886f39750
MD5 bdf3f669e46a3a2cc9497925ff7d3019
SHA1 65b3c7d7370bf865167d8bf5c9066ed806b5d6eb
SHA512 b310ea5a8e286cc853709c13a9b5a9735200642bd4deb987c1af6ea5e205e1cc11898d8608d42aeb912a66b5178dabafe0b682962dde533acc9de3608f9e06d9
SSDEEP 96:stl05bTvab9cYlffKdZ8i0oEaktkm/7qx+WVHMSm+uecJhX1idQjlP+gWOMEB:stl0xDUfEZ8pF5t/S+WiThXwd2P0OM8
TLSH
T174D1B7065F6879774CC7E2097B35BF46D2FA206265D51E58FBFD861C08DA6CC221B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 1KB
SHA256 764d13633e8559943ef26d2b7e3fbe64cee36b88af5dfb768023d935002e7b54
MD5 8a1acb6889dce9183983669b96317e33
SHA1 28e00cd5831ef2246af6b5418e1d24d0c1b09121
SHA512 9824ea594e34f1ff32d74b2f35f1d30ece5026aeea462688259208d584896ee0781aa7527ad830c94e5da564745195defd9ee9f195d1c785b66000d22ddf16fd
TLSH
T1F8316575D0983B326E825642B3476A8B6D6071B581619F48E1DE4B2D02E7ECC6537D33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 55cde680fc6788e62b8f30e7f92819096ad8a397c584c96698b9334a2dcd5f4b
MD5 8cb248092fcd9f31d9605920962048d9
SHA1 1cbb46df54d0095004d7bcd584fa88e36ee0dae0
SHA512 14ff5025d64d6a8bbf568370f080a4cdc12cbff1e9bfff4c45b65dbaa58d6287f4f781837d8a7bbb683fb274f469aff2b65d99d5450b71be229ae787c684b7cb
TLSH
T1FE519872E8187B374A934901BB463F17ED7571A195612F9499DD0B1C01D7A5C2313C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 b1a6359791ea522f1619d4930597b59282667df8b11089ac7edff1dc51ca1602
MD5 428a6a22a43c23e084b114db131e253e
SHA1 6a003af6ee4e9547825c9ab1971f05bfb0534064
SHA512 6d0eb3db44882c8b85290e47c54fc5a87a70175e6b8eda2d39c0d3d9bef1de321f07687944cccc0f5447a0674f9f39eb419741edef59e73802504114f70d4152
TLSH
T10271B735A568B9374EE39901BA862B07BAA17173D5913FA8D9ED0F1C01D77882353C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 6879bcfe195142cf8816ba4ff2c555cf9324d289b7e21c1d1b50810182ff8ad9
MD5 0e00aa99e325f70bac6ffe10db4ebcb1
SHA1 f79d33d5192e668004ce9e0d8c0c6459c2139ab1
SHA512 9502add286f839cbf837282fe3e75f3a69fe8c1b130c9f925547b99f9bf5240ab92ad169ee2cc4b751e0c8ac24bee2fd4056d0e0329d5881489273dc296ca37e
SSDEEP 96:zun0NkCEifuo/WZQ8Frh/cInURoDoto+5uGDhBzZ36eCZwGT6l/a:zK0NbqR1ooDUhtXzZDO1
TLSH
T1A391A335A578BA374EB38905BA863F07BAA1B163D0917FA9D9ED0F0D02D728C1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 3892339b53660cd978774dc16e570926c17187999579c37bc3f2f59c10b0fa67
MD5 1621df6d987d2f2f3ea5144fa2000153
SHA1 9195f3ee95c8e7a28dbdf1315d5dd4d41f23528e
SHA512 5040eb6b7560d1160d86164ac04c0cf9d8997a5c899d4114e7ea38c02d692ecc100b2844d204763689dae46844e02f29038ace20951ba844b69a05383b8db38d
SSDEEP 96:zunn3NkCEifuo/WZQ8Frh/cInURLl8DotoN5uTDtBzZ36eCZwGiZl/a:zKn3NbqR1oiDUaSzzZDvy
TLSH
T1F1919425A964BA374DB3C945BA463F07AAA0A163D4906F99D9ED0F0C02D77CD1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 4KB
SHA256 5807722f0aae45f109a2e9e896ee92b83ef087a31273471b02e47614f4388bb1
MD5 f3327e82007f7fe4ed32be0870c9ec13
SHA1 df82557071e8f6dc963a2374c2921298f7a82ec0
SHA512 e0efe2f12f0ebe06c701db974036cd5562813bcfe0cff7520ee8f96962c4e3da379a4734781a89ee2046968973be75810ff51fed229d9cad3f729f8fa52a3b26
SSDEEP 96:zunn3NkCEifuo/WZQ8Frh/cInURoDotoN5uGDtBzZ36eCZwGTvl/a:zKn3NbqR1ooDUatzzZDOQ
TLSH
T1BB91A325A964BA374DB3C905BA463F07BAA06163D0907F99D9ED0F0C02DB7CD1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 16KB
SHA256 7deecf619d94897a22df12535674bbee6615803a13444227ba8757ccc527b3f9
MD5 f1249c8e223a0b240eb2cb40b678fae3
SHA1 bb83bc351d879aac887628f4884b1d1de6ffde1a
SHA512 b0a23a8c951dcdb1bb073c4c47ef3e0bb9642bc69726d8894c1e8fd74d18972439231cede66a2b7f775147ef1b7c55a22a582bf19601d9c648c8eca07682d843
SSDEEP 384:zf+aQikB+z/xvxjg/qhE13Nbg1Uumbl9zb:K/UxvxjgC+1+BmZFb
TLSH
T19B729D2B55683E3395F3E541BA590B4FDAF494B290C16EA88DEE5F0D06C77D81303D02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe592f24.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe592f24.TMP
Size 1KB
SHA256 10bca6e48ccebbfc565165c93d30e7e6b7d62623ab46286d44374ad8694e8693
MD5 c560101e1d4a85b2f9507fd75eed7872
SHA1 eac85de1bc257661f157c754a579e03b29c6c619
SHA512 8a2eab45a1fab8ade924db64e00537b281733cb375ba1647fd0c3c17d23eff4821c1b7272f132a43a3791ee90a8de114f8881baefd6d15fbebdcfd7e2f9f8c82
TLSH
T191216275C0983A32AA420902F3437A8B6D60B1B591209F0CE0DE472D02E7DDC5677C33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
Size 2KB
SHA256 e214ff17ce36f3e087038d57c7fac89d66a90ff4c3281619c1e9ab42015e0f72
MD5 fdfc01c765559b3227ffd35fc2e296ce
SHA1 5ed0969ca824b1d31f7729c828e9652aaa044aa9
SHA512 6bc8f1da3ad734177cc2c5dfc7757198303480f211ec8bb97d7128aadebff6c5965a1a3c07694a1ea25daa7476e9fd7e36b26a9422e65cd71f2f99ea6b2afcba
TLSH
T141513CB6BB17B14364E1B3523F78C5EE2A9169AD14C534C4B90B28B5C08DA9B6FE0847
MD5 SHA1 SHA512 TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
Size 2KB
SHA256 c46b341099d985db59c539d43371e76429a3fe73753cd2935519f1d7c3a60972
MD5 82f345984799b965460715ab715bad6c
SHA1 1c23ebaf466817169cd4147b4919d47200acde37
SHA512 8d67b6f2e225323a30a82a3ffb042b0a55a90a399d65da9bde805c41b0bf02fc8b893c089675b644cab2b93cf9c0905e4886007615b7d09c2c016a75e8468064
TLSH
T187514CD84DBFACED2AACB6B2D30F294692F123D8D524DF7153D48B89C3382556A0D532
MD5 SHA1 SHA512 TLSH

Submit Download

Nexomia.exe

Path C:\Users\Admin\Downloads\Nexomia.exe
Size 19.4MB
SHA256 c23a06fa1fddbed8b6d96464044bff63e651e2927faeac5c054c16c34b117b46
MD5 e5e63841966c32e38bd62127c99b5ec8
SHA1 dfa3cb6ab1a500bd474079ca2ea27fd70953db59
SHA512 7a2405e639ff0c721a935686f2d92537e12e6b0d32c44326dd433fdc15ce33610d031a2cd628f0f74daca16af371baad200c926026fafbdf8515a355fc1ba851
SSDEEP 196608:Erec1mTOAbK3nR2O2uz3bK0V85IO5S5uS3W6QP5J1wP5993CiMs7UfCI2CWl:E3maAE7z3bKdFEuuWlJM99yiMQUP2C+
TLSH
T1EC279D43F26290E8D56AC175830A6232FA71BC4D47347AEB5BE48B213F66FA0673D744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nexomia.exe

Path C:\Users\Admin\Downloads\Nexomia.exe
Size 16.5MB
SHA256 35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7
MD5 411e27893f6e210f32cea7e28662adb2
SHA1 2c1f7771a8e24691bc39f7bf17609fa9cf628e2e
SHA512 1528111cc2a8313ccae7ec49c7b7ad911c0603ff4583a2fd19810dbf808142182628d0441baa0ffd42cb78f17a3f11e914b50f9595cf422d357771a4862622e6
SSDEEP 196608:GVXku+QMSrEM6IJZCsQdYXK7lDJl2zRwRLKAyWMsSt3K+zdY4HciDnzjW:MXkZXC/QdYXKoz0mAAsgrzCkXzj
TLSH
T12B07AD43F66280F8C16AC074935A6232FB31BC4907357AEB5BE44A253E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1540-1426-0x000001A832860000-0x000001A832D18000-memory.dmp

Download

memory/1540-1407-0x000001A832860000-0x000001A832D18000-memory.dmp

Download

memory/1540-1366-0x000001A832860000-0x000001A832D18000-memory.dmp

Download

memory/2496-1290-0x000001D6ABD90000-0x000001D6ABD91000-memory.dmp

Download

memory/2496-1285-0x000001D6ABD20000-0x000001D6ABD21000-memory.dmp

Download

memory/3212-1450-0x000001A1C4430000-0x000001A1C4452000-memory.dmp

Download

memory/4964-574-0x000002128D220000-0x000002128D221000-memory.dmp

Download

memory/4964-562-0x000002128CFB0000-0x000002128CFB1000-memory.dmp

Download

memory/4964-565-0x000002128CFE0000-0x000002128CFE1000-memory.dmp

Download

memory/4964-561-0x000002128CFA0000-0x000002128CFA1000-memory.dmp

Download

memory/4964-563-0x000002128CFC0000-0x000002128CFC1000-memory.dmp

Download

memory/4964-564-0x000002128CFD0000-0x000002128CFD1000-memory.dmp

Download

memory/5504-296-0x00007FF910F20000-0x00007FF910F21000-memory.dmp

Download

memory/5596-371-0x00007FF911170000-0x00007FF911171000-memory.dmp

Download

memory/5596-370-0x00007FF911F90000-0x00007FF911F91000-memory.dmp

Download

memory/6104-384-0x00007FF910F20000-0x00007FF910F21000-memory.dmp

Download