3167001ac4831ab3fe384813de7c8eb3653fbfc56ff7e42bf328975298da56c8

Analysis

user interaction
yes
max time kernel
70s
max time network
80s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 17:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nexomia.exe
Size 20.2MB
Sample260930-vrg2nstfjf
SHA256 3167001ac4831ab3fe384813de7c8eb3653fbfc56ff7e42bf328975298da56c8
MD5 316b0bc9ed486b9bb3ea171a9eb24048
SHA1 21ed5187cf11819f423cb74de658abd8ec0e0ffc
SHA512 d7ba2e01a4d706cb371ccf4e93c561365aaf54d6112898137eba8d70fa64d67588187bee31dc7669da7420ed59cdee8349f0868cdf2ef03c5882e8c054789417
SSDEEP 393216:j1gXU85gKDERCJgn6sDfNTS8HZ6dLZNP5MI:eXYKiUgZTSu8dNv
TLSH
T1E9279D03F26290E8C56AC175875A6233FA71BC4947347AEB0BE48B253F66FA0673D744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5672	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 5 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 56 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
3908	wmic.exe
3908	wmic.exe
3908	wmic.exe
3908	wmic.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
5504	wmic.exe
5504	wmic.exe
5504	wmic.exe
5504	wmic.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe
1896	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2280	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe
Token: SeDebugPrivilege	1896	Nexomia.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1896 wrote to memory of 2280	1896	Nexomia.exe	88
PID 2280 wrote to memory of 4548	2280	msedgewebview2.exe	89
PID 2280 wrote to memory of 3760	2280	msedgewebview2.exe	90
PID 2280 wrote to memory of 3760	2280	msedgewebview2.exe	90
PID 2280 wrote to memory of 3760	2280	msedgewebview2.exe	90
PID 2280 wrote to memory of 3760	2280	msedgewebview2.exe	90
PID 2280 wrote to memory of 2504	2280	msedgewebview2.exe	91
PID 2280 wrote to memory of 120	2280	msedgewebview2.exe	92
PID 2280 wrote to memory of 120	2280	msedgewebview2.exe	92
PID 2280 wrote to memory of 120	2280	msedgewebview2.exe	92
PID 2280 wrote to memory of 5480	2280	msedgewebview2.exe	93
PID 2280 wrote to memory of 5480	2280	msedgewebview2.exe	93
PID 2280 wrote to memory of 5480	2280	msedgewebview2.exe	93
PID 2280 wrote to memory of 5480	2280	msedgewebview2.exe	93
PID 2280 wrote to memory of 5480	2280	msedgewebview2.exe	93
PID 1896 wrote to memory of 3908	1896	Nexomia.exe	94
PID 1896 wrote to memory of 5504	1896	Nexomia.exe	97
PID 1896 wrote to memory of 5672	1896	Nexomia.exe	100
PID 1896 wrote to memory of 5892	1896	Nexomia.exe	102
PID 1896 wrote to memory of 3964	1896	Nexomia.exe	104
PID 1896 wrote to memory of 1580	1896	Nexomia.exe	106
PID 1896 wrote to memory of 4864	1896	Nexomia.exe	108
PID 1896 wrote to memory of 2988	1896	Nexomia.exe	110
PID 1896 wrote to memory of 4888	1896	Nexomia.exe	112
PID 1896 wrote to memory of 4708	1896	Nexomia.exe	114
PID 1896 wrote to memory of 3208	1896	Nexomia.exe	117
PID 1896 wrote to memory of 1096	1896	Nexomia.exe	119
PID 1896 wrote to memory of 3112	1896	Nexomia.exe	121
PID 1896 wrote to memory of 4304	1896	Nexomia.exe	123
PID 1896 wrote to memory of 6120	1896	Nexomia.exe	125
PID 1896 wrote to memory of 4400	1896	Nexomia.exe	127
PID 1896 wrote to memory of 2536	1896	Nexomia.exe	129
PID 1896 wrote to memory of 3336	1896	Nexomia.exe	131
PID 1896 wrote to memory of 2668	1896	Nexomia.exe	133
PID 1896 wrote to memory of 1988	1896	Nexomia.exe	135
PID 1896 wrote to memory of 5692	1896	Nexomia.exe	137
PID 1896 wrote to memory of 4708	1896	Nexomia.exe	139
PID 1896 wrote to memory of 2144	1896	Nexomia.exe	141
PID 1896 wrote to memory of 5340	1896	Nexomia.exe	143
PID 1896 wrote to memory of 3208	1896	Nexomia.exe	145
PID 1896 wrote to memory of 1880	1896	Nexomia.exe	149
PID 1896 wrote to memory of 812	1896	Nexomia.exe	151
PID 1896 wrote to memory of 4152	1896	Nexomia.exe	153

C:\Users\Admin\AppData\Local\Temp\Nexomia.exe
"C:\Users\Admin\AppData\Local\Temp\Nexomia.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.2 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1896.4912.16237797022939101812 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ffc3d085fd8,0x7ffc3d085fe4,0x7ffc3d085ff0
    3⤵
    PID:4548
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1804 --field-trial-handle=1812,i,553039477173970568,13242453791594318948,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:3760
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2040 --field-trial-handle=1812,i,553039477173970568,13242453791594318948,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2312 --field-trial-handle=1812,i,553039477173970568,13242453791594318948,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713
    3⤵
    PID:120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.2 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3384 --field-trial-handle=1812,i,553039477173970568,13242453791594318948,262144 --enable-features=MojoIpcz --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version /pfhostedapp:bd52d24624f6b85a0f9e6cafcfeaef3b099f1713 /prefetch:1
    3⤵
    PID:5480
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:5504
- C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
  "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp --definitions=@roblox=C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\globalTypes.d.lua
  2⤵
  - Executes dropped EXE
  PID:5672
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5892
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3964
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1580
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4864
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2988
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4888
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4708
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3208
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1096
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3112
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4304
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:6120
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4400
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2536
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3336
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2668
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1988
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5692
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4708
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:2144
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:5340
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:3208
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:1880
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:812
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
  2⤵
  - Reads the TCP/IP host and domain name from the registry
  PID:4152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 02bc350982941b4647f422c52c98e24130451d735a58add795840d629fcb3313
MD5 26ac9782f810e6fa5399b41019680d06
SHA1 303438b138f88c2d929052394d156d4b1216e426
SHA512 c7f9d800ead3a3ce133da140927e84bc4fb817df0a9504641f80382b04aa9c4769fd3ba52b8e8d67759a0cef193f1be9543aace936dbe006cd6d0f4036c5cbc5
TLSH
T109D0243373114575C01030331053751C0D41D10FC057400DD43CC51D3F4C0500D034F1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 085654926fb10a75be6a5934edddd6a2ce67c0c996d2ce7d70fde238fa2d26fd
MD5 4829eebfe9cfab17830337edda9f670c
SHA1 ac08cf8ab27db23340d551450a2892fcb22e2562
SHA512 d7146db881e41ff705ffcc842e3610d528eda855fbd9c1105977a87696e4bf36398a59b3ae3cd002e2b6c9b63f017cbc2b0c9f58a30a2c9294e25ad13ef71c77
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 0b6aa836334d468c44f26f183e56ffc484034c1ca5198db6bd178a02cd1eac83
MD5 35e21d015f1b0207726fd15d5063cd5c
SHA1 50eccb916d09fd0416cc1e7ae131cf218c0405a6
SHA512 2df2025475f2106ac9427d2e5de7af3a70573f8e50cc11daa335a52ab6be670c39cbcee3999ec581ef9eb0f09aca7c1eaf5e7334a1b687f89fffe45b4a254426
TLSH
T15AF0392123AAC02DDFBB9E7007C10A18767CBAC09817DF0A4453DC747C353A34C53655
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a707e.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5a707e.TMP
Size 48B
SHA256 e1c1d60cce1151adc007bab21f3e4ad42b63d4f03a53debe7cd74e4c817b65fe
MD5 1e06db6de03e09f9a6ba37a9707a9ff1
SHA1 7928a5f8e0611da52040976d5250767a1daab889
SHA512 dc73b0133fc63bbd139ddfe2b335860f70b220f0bdf535928f3e6888e88fa62517875de09612b2e96597380298c7fb3f870d20ed7f3c938fe9b31d80722e1984
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 7f5fadb420f458abb8ae17368a5306c86ce14e1680f4aea39ef6c5ccf1da2fa5
MD5 1a86371a8971da29f704d703bd51b1ea
SHA1 3a33a7a0d1eb0c44b6754a8631131d639c6e2492
SHA512 6883aed4282de06f2ff1b1023671ebe8f53df17c9009e0074d2908d1bc81a503cc7d4bfe42971e036882636a2ab69d44e89d990729b3d65def5f8267e6bb2e32
SSDEEP 96:stz/dpk5Jb91kHo5h16Z0bs7/x+6MhmuecJn01ejeaK+g4o28XM1C7K:str32AonbsV+Fdn0QjmOoG6K
TLSH
T1CAD194025E64BABB4CC6E509BB39BA17E2F5607170D51E5CE7F8462C08EA6CC2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a52e4.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences~RFe5a52e4.TMP
Size 5KB
SHA256 4307a226e3152a0483d60f827977d1d436c4618696cfb543ff3c7a2df72a1a6b
MD5 04a007488ce4f2dd1118f672f6623699
SHA1 4985230dc1cdddbd3930c22cd412c560b77df871
SHA512 813d6824cdd9912bd88c66d847f17b0cdc61b385aff1a4434312da2f5518b997ae54920fd5f4c4aff7148432de1051b83458130ae2bdcc531fa57d350596e1d9
SSDEEP 96:rz/dpk5Jb91kTdo616Z0bs7/x+6MhmuecJn01ejeaK+g4o28XM1C7K:rr32co6bsV+Fdn0QjmOoG6K
TLSH
T13EC1A6065A64BABB4CC6E508BB397A17E2F5617170D51E5CE7F8862C08DBACC2317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 66236067e2612716120756e5b82d9afb65cefaac8b6a231e56bcc399a8cdf4f8
MD5 9ac4751fd758a2b45e7449085b3361c7
SHA1 5b65210772e5b26557d2037e68ce1ea0998078e8
SHA512 7561436b8fa7dbcee750731577bda62bed15327e3169d7ee2248823c28b92b2926f030e63e42800e8bf57c8a788bc0af3d2d039cef79c0ef4b93eb89e75da48c
TLSH
T18D71862765B8EA774EF2DA05BD867B02AAB15063E5913F99D9EC0F0C01D72CC1382C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 2KB
SHA256 98e180f17528744cd48bd33e128715d27107dc038ed86d7fc57dbad9d90a4ee2
MD5 31c63b1981a07b128ef6aa0e251bb334
SHA1 1f040250a20a54e88cbf72b73e6d9c3d39efbe0d
SHA512 f6e04b11654dd54a8852bb28d50a39fb8478f0deaae8e9b91c0852cce5c125c779fc38e2d4b3b4f06c90cd2d5798b0d18fc7a97e30d7b1ccbd66c640edef3405
TLSH
T16851A7336868A7779EB28B09B9877B13DE7591A2A5512F549ADC0F1C00C768C1341C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 3KB
SHA256 5b2ff76d547ffce4d7a86106b08314e3418d4e892b338cd74ff2a0920363e6f0
MD5 683aef68ae1783bea1cf3d9d56227aeb
SHA1 77a43868e8f6203f0a0f96ffb17197938e61bb3b
SHA512 028e8af5c8837e61ae3725ea4375477a62a0154dca69198b71df3b93c59fc36760f267bbf242575a81c79a8a20f83491b6ad4538f326044547bc9cffcbc4b7b4
TLSH
T14D61A53B69B8EA774EF29A05B9862B06ABA15173E4913F98DAEC0F0C01D77CC1341C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 15KB
SHA256 9154069d8f784d1a5e61f4c799fd0b8b3a994bc4d7ab803c9033d954a3e22821
MD5 61403f99b7f7ea3b7f9a9afe63991198
SHA1 0d1d9465f2d515a4e8a56003a7a9803cf30005f8
SHA512 d9eba48ca7b43494daa8f59f851510c5712b63cca5b4e62adce3d21ae64afa3d3cff76f6ecb243948cf1c8af41d636f14867269fd4c32523beacbc2aa6e18e86
SSDEEP 384:z+aQikB+z/xvxjg/qhEwNBSsBcBcxVP9z3:S/UxvxjgC+ccSxVPF3
TLSH
T17C72AE3B59797E239AF2F604BE49474BCEF994B290817AB84EAD5F0D06C77D80342D42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59e67e.TMP

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State~RFe59e67e.TMP
Size 1KB
SHA256 665d771ba51a366bd0023f11329d30a6ee75b5c65b3acf76def183e02a703d4b
MD5 00acef1a6288782aa2a2321b5fc5c4ae
SHA1 9ebf24a169dcd722011219a38078634b5b2193a4
SHA512 1d7718cb5a7d257ea882204085e5177555784708cc49c22917355a892956ed7c2c78f10e24483a529db754c45d6427efce2612306c524456c46baef98ff8e3c9
TLSH
T13421B773D1B89B72AD72674B7143EB475E3051B781104E04A5DD4F1C15D76CC9252D37
MD5 SHA1 SHA512 TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
Size 17.0MB
SHA256 89e9162cf7ab828ccd48af158a43e680f263586e53b21c0de5732718224940bd
MD5 efedce25091d8971e64ddcc82df708b2
SHA1 6aafaa5729a7c936e9d6a74428de485c803cd4d5
SHA512 24cd70a7f7ba2a7e9e2fab797afe9b79629e5b7c363687e8267d51a45db682826cc4b06d09816a5ee65c508970d5c99e8cbf438a14efdd3530449d1e27b7fa78
SSDEEP 393216:M/DrfkggngQggwg7gfTXlgW2ggqgggA7DgLgV+IKVgggggQAfk6ggggX1ggggvgZ:MnMggngQggwg7gfTXlgW2ggqgggWDgLV
TLSH
T125075B3A61AC01CCF17BD0BD86DB9E47D7B2340903319ADF05D15AAA1E1BDED4A7E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
Size 2KB
SHA256 4a3a32e8a0a32a9f292d48130660ee8495004e5909deb557e7f2de0177466233
MD5 7dc33ca3230cd6d5e6e9db0df35e1a8b
SHA1 491162e6e480e0bfcd5cff8c63cf18d80033aa9c
SHA512 dd8557f2edec2f0b87c3318b6a74c982f20fc4b5a00de1a2e6fb7d3ca034b913b2b14c32c1c5837286faefc0a46c409ed2ac088abbbae540b2e2d312481a53f9
TLSH
T1C0512B4E4A83FBC83DCCD47A6A1EEC44526F0580B7A6315994DD1B49ADA3443EA35C2D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-140-0x0000026106410000-0x0000026106411000-memory.dmp

Download

memory/1896-142-0x00000261065E0000-0x00000261065E1000-memory.dmp

Download

memory/1896-141-0x0000026106420000-0x0000026106421000-memory.dmp

Download

memory/1896-143-0x00000261065F0000-0x00000261065F1000-memory.dmp

Download

memory/1896-144-0x0000026106600000-0x0000026106601000-memory.dmp

Download

memory/1896-139-0x00000261063E0000-0x00000261063E1000-memory.dmp

Download

memory/1896-145-0x00000261075D0000-0x00000261075D1000-memory.dmp

Download

memory/1896-138-0x00000261063D0000-0x00000261063D1000-memory.dmp

Download

memory/3760-239-0x0000016557EC0000-0x0000016557F68000-memory.dmp

Download

memory/3760-24-0x00007FFC5C7F0000-0x00007FFC5C7F1000-memory.dmp

Download

memory/5480-82-0x00007FFC5C7F0000-0x00007FFC5C7F1000-memory.dmp

Download