3c010c7dcd8864c2f3d9574adbf3b90715fba55fafac0dab54b73ee60311424a

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-13_d86b90bf5236db96c0500fdcdd54930d_akira_cobalt-strike_glassworm.exe
Size 17.7MB
Sample261014-e8m19afw9w
SHA256 3c010c7dcd8864c2f3d9574adbf3b90715fba55fafac0dab54b73ee60311424a
MD5 d86b90bf5236db96c0500fdcdd54930d
SHA1 e13e37699b4919649fbaa0cb72a68e100c06edab
SHA512 71b4675a8a3a928c92a07a46024ed787979d13b5f6d7a18282304fe5cbae2d44cdfbab9ac04d0584ca031a954eb01e8471b68618433824e4b786cc75b7b79a54
SSDEEP 393216:Pq5WsCI4rAyKKeFOLIYfzA4/pW1zCkq1gQ3Mt:i5WsCI4l9sY7b/pW51GQt
TLSH
T16517AD43F66280E8C16AC175835A6233FB21BC4907357AEB5BE44B213E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	Nexomia.exe

Executes dropped EXE 4 IoCs

pid	Process
4436	Launcher.exe
2480	Nexomia.exe
2664	Nexomia.exe
2372	luau-lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Nexomia.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 3 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3740	tasklist.exe
844	tasklist.exe
4308	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 5 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe

Drops file in Program Files directory 20 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_994185628\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\LICENSE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-DE	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-RU	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1200026032\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_994185628\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Filtering Rules	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-FR	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-IT	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1200026032\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\adblock_snippet.js	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-ES	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-ZH	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1200026032\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_994185628\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-NL	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3768	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 64 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Nexomia.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wmic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wmic.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Launcher.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Launcher.exe

Delays execution with timeout.exe 3 IoCs

defense_evasion

pid	Process
3528	timeout.exe
3392	timeout.exe
1176	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2480	Nexomia.exe
2480	Nexomia.exe
2480	Nexomia.exe
2480	Nexomia.exe
2480	Nexomia.exe
2480	Nexomia.exe
2480	Nexomia.exe
2480	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe
2664	Nexomia.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2536	msedgewebview2.exe
2816	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	tasklist.exe
Token: SeDebugPrivilege	844	tasklist.exe
Token: SeDebugPrivilege	4308	tasklist.exe
Token: SeIncreaseQuotaPrivilege	3956	wmic.exe
Token: SeSecurityPrivilege	3956	wmic.exe
Token: SeTakeOwnershipPrivilege	3956	wmic.exe
Token: SeLoadDriverPrivilege	3956	wmic.exe
Token: SeSystemProfilePrivilege	3956	wmic.exe
Token: SeSystemtimePrivilege	3956	wmic.exe
Token: SeProfSingleProcessPrivilege	3956	wmic.exe
Token: SeIncBasePriorityPrivilege	3956	wmic.exe
Token: SeCreatePagefilePrivilege	3956	wmic.exe
Token: SeBackupPrivilege	3956	wmic.exe
Token: SeRestorePrivilege	3956	wmic.exe
Token: SeShutdownPrivilege	3956	wmic.exe
Token: SeDebugPrivilege	3956	wmic.exe
Token: SeSystemEnvironmentPrivilege	3956	wmic.exe
Token: SeRemoteShutdownPrivilege	3956	wmic.exe
Token: SeUndockPrivilege	3956	wmic.exe
Token: SeManageVolumePrivilege	3956	wmic.exe
Token: 33	3956	wmic.exe
Token: 34	3956	wmic.exe
Token: 35	3956	wmic.exe
Token: 36	3956	wmic.exe
Token: SeIncreaseQuotaPrivilege	3956	wmic.exe
Token: SeSecurityPrivilege	3956	wmic.exe
Token: SeTakeOwnershipPrivilege	3956	wmic.exe
Token: SeLoadDriverPrivilege	3956	wmic.exe
Token: SeSystemProfilePrivilege	3956	wmic.exe
Token: SeSystemtimePrivilege	3956	wmic.exe
Token: SeProfSingleProcessPrivilege	3956	wmic.exe
Token: SeIncBasePriorityPrivilege	3956	wmic.exe
Token: SeCreatePagefilePrivilege	3956	wmic.exe
Token: SeBackupPrivilege	3956	wmic.exe
Token: SeRestorePrivilege	3956	wmic.exe
Token: SeShutdownPrivilege	3956	wmic.exe
Token: SeDebugPrivilege	3956	wmic.exe
Token: SeSystemEnvironmentPrivilege	3956	wmic.exe
Token: SeRemoteShutdownPrivilege	3956	wmic.exe
Token: SeUndockPrivilege	3956	wmic.exe
Token: SeManageVolumePrivilege	3956	wmic.exe
Token: 33	3956	wmic.exe
Token: 34	3956	wmic.exe
Token: 35	3956	wmic.exe
Token: 36	3956	wmic.exe
Token: SeIncreaseQuotaPrivilege	2052	wmic.exe
Token: SeSecurityPrivilege	2052	wmic.exe
Token: SeTakeOwnershipPrivilege	2052	wmic.exe
Token: SeLoadDriverPrivilege	2052	wmic.exe
Token: SeSystemProfilePrivilege	2052	wmic.exe
Token: SeSystemtimePrivilege	2052	wmic.exe
Token: SeProfSingleProcessPrivilege	2052	wmic.exe
Token: SeIncBasePriorityPrivilege	2052	wmic.exe
Token: SeCreatePagefilePrivilege	2052	wmic.exe
Token: SeBackupPrivilege	2052	wmic.exe
Token: SeRestorePrivilege	2052	wmic.exe
Token: SeShutdownPrivilege	2052	wmic.exe
Token: SeDebugPrivilege	2052	wmic.exe
Token: SeSystemEnvironmentPrivilege	2052	wmic.exe
Token: SeRemoteShutdownPrivilege	2052	wmic.exe
Token: SeUndockPrivilege	2052	wmic.exe
Token: SeManageVolumePrivilege	2052	wmic.exe
Token: 33	2052	wmic.exe
Token: 34	2052	wmic.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2480	Nexomia.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4436	4292	2026-10-13_d86b90bf5236db96c0500fdcdd54930d_akira_cobalt-strike_glassworm.exe	86
PID 4292 wrote to memory of 2480	4292	2026-10-13_d86b90bf5236db96c0500fdcdd54930d_akira_cobalt-strike_glassworm.exe	92
PID 2480 wrote to memory of 2536	2480	Nexomia.exe	94
PID 2536 wrote to memory of 3316	2536	msedgewebview2.exe	95
PID 2536 wrote to memory of 5036	2536	msedgewebview2.exe	96
PID 2536 wrote to memory of 5036	2536	msedgewebview2.exe	96
PID 2536 wrote to memory of 5036	2536	msedgewebview2.exe	96
PID 2536 wrote to memory of 4688	2536	msedgewebview2.exe	97
PID 2536 wrote to memory of 216	2536	msedgewebview2.exe	98
PID 2536 wrote to memory of 216	2536	msedgewebview2.exe	98
PID 2536 wrote to memory of 3976	2536	msedgewebview2.exe	99
PID 2536 wrote to memory of 3976	2536	msedgewebview2.exe	99
PID 2536 wrote to memory of 3976	2536	msedgewebview2.exe	99
PID 2480 wrote to memory of 3768	2480	Nexomia.exe	103
PID 3768 wrote to memory of 3740	3768	cmd.exe	105
PID 3768 wrote to memory of 3112	3768	cmd.exe	120
PID 3768 wrote to memory of 3392	3768	cmd.exe	108
PID 3768 wrote to memory of 844	3768	cmd.exe	111
PID 3768 wrote to memory of 3940	3768	cmd.exe	112
PID 3768 wrote to memory of 1176	3768	cmd.exe	113
PID 3768 wrote to memory of 4308	3768	cmd.exe	115
PID 3768 wrote to memory of 1184	3768	cmd.exe	116
PID 3768 wrote to memory of 2664	3768	cmd.exe	117
PID 3768 wrote to memory of 3528	3768	cmd.exe	118
PID 2664 wrote to memory of 2816	2664	Nexomia.exe	121
PID 2816 wrote to memory of 4436	2816	msedgewebview2.exe	122
PID 2816 wrote to memory of 4864	2816	msedgewebview2.exe	123
PID 2816 wrote to memory of 4864	2816	msedgewebview2.exe	123
PID 2816 wrote to memory of 4864	2816	msedgewebview2.exe	123
PID 2816 wrote to memory of 2968	2816	msedgewebview2.exe	124
PID 2816 wrote to memory of 3296	2816	msedgewebview2.exe	125
PID 2816 wrote to memory of 3296	2816	msedgewebview2.exe	125
PID 2816 wrote to memory of 3760	2816	msedgewebview2.exe	126
PID 2816 wrote to memory of 3760	2816	msedgewebview2.exe	126
PID 2816 wrote to memory of 3760	2816	msedgewebview2.exe	126
PID 2664 wrote to memory of 2372	2664	Nexomia.exe	127
PID 2664 wrote to memory of 3956	2664	Nexomia.exe	129
PID 2664 wrote to memory of 2052	2664	Nexomia.exe	133
PID 2664 wrote to memory of 1624	2664	Nexomia.exe	136
PID 2664 wrote to memory of 4808	2664	Nexomia.exe	138
PID 2664 wrote to memory of 3844	2664	Nexomia.exe	141
PID 2664 wrote to memory of 3664	2664	Nexomia.exe	143
PID 2664 wrote to memory of 4456	2664	Nexomia.exe	145
PID 2664 wrote to memory of 1740	2664	Nexomia.exe	150
PID 2664 wrote to memory of 1740	2664	Nexomia.exe	152
PID 2664 wrote to memory of 5044	2664	Nexomia.exe	157
PID 2664 wrote to memory of 3312	2664	Nexomia.exe	159
PID 2664 wrote to memory of 1740	2664	Nexomia.exe	161
PID 2664 wrote to memory of 684	2664	Nexomia.exe	163
PID 2664 wrote to memory of 3188	2664	Nexomia.exe	165
PID 2664 wrote to memory of 1828	2664	Nexomia.exe	167
PID 2664 wrote to memory of 1484	2664	Nexomia.exe	169
PID 2664 wrote to memory of 1392	2664	Nexomia.exe	171
PID 2664 wrote to memory of 4400	2664	Nexomia.exe	173
PID 2664 wrote to memory of 3312	2664	Nexomia.exe	175
PID 2664 wrote to memory of 1484	2664	Nexomia.exe	177
PID 2664 wrote to memory of 2024	2664	Nexomia.exe	179
PID 2664 wrote to memory of 1908	2664	Nexomia.exe	181
PID 2664 wrote to memory of 3328	2664	Nexomia.exe	183
PID 2664 wrote to memory of 2136	2664	Nexomia.exe	185
PID 2664 wrote to memory of 4828	2664	Nexomia.exe	187
PID 2664 wrote to memory of 1860	2664	Nexomia.exe	190
PID 2664 wrote to memory of 3124	2664	Nexomia.exe	193
PID 2664 wrote to memory of 3948	2664	Nexomia.exe	195

C:\Users\Admin\AppData\Local\Temp\2026-10-13_d86b90bf5236db96c0500fdcdd54930d_akira_cobalt-strike_glassworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-13_d86b90bf5236db96c0500fdcdd54930d_akira_cobalt-strike_glassworm.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Nexomia\bin\Launcher.exe
  "C:\Users\Admin\AppData\Local\Nexomia\bin\Launcher.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4436
- C:\Users\Admin\AppData\Local\Nexomia\bin\Nexomia.exe
  "C:\Users\Admin\AppData\Local\Nexomia\bin\Nexomia.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2480.2512.14714490195336224657
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:2536
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff904a8b078,0x7ff904a8b084,0x7ff904a8b090
      4⤵
      PID:3316
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,1368986340937399080,7206516972640581758,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:2
      4⤵
      PID:5036
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2016,i,1368986340937399080,7206516972640581758,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:3
      4⤵
      PID:4688
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2356,i,1368986340937399080,7206516972640581758,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1696 /prefetch:8
      4⤵
      PID:216
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.2.5 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3572,i,1368986340937399080,7206516972640581758,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:3976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat" "
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Nexomia.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:3740
  - - C:\Windows\system32\find.exe
      find /I "Nexomia.exe"
      4⤵
      PID:3112
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3392
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Nexomia.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:844
  - - C:\Windows\system32\find.exe
      find /I "Nexomia.exe"
      4⤵
      PID:3940
  - - C:\Windows\system32\timeout.exe
      timeout /t 1 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1176
  - - C:\Windows\system32\tasklist.exe
      tasklist /FI "IMAGENAME eq Nexomia.exe"
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:4308
  - - C:\Windows\system32\find.exe
      find /I "Nexomia.exe"
      4⤵
      PID:1184
  - - C:\Users\Admin\AppData\Local\Nexomia\bin\Nexomia.exe
      "C:\Users\Admin\AppData\Local\Nexomia\bin\Nexomia.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Reads the TCP/IP host and domain name from the registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2664
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msPasswordReveal,msPasswordManager,msAutofillSavePasswords,msAutofillPasswordsInInputs,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2664.2912.15717105512840723630
        5⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:2816
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x174,0x7ff904a8b078,0x7ff904a8b084,0x7ff904a8b090
        6⤵
        
        PID:4436
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1808,i,16307248929046950050,4526167994304913733,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1804 /prefetch:2
        6⤵
        
        PID:4864
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,16307248929046950050,4526167994304913733,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:3
        6⤵
        
        PID:2968
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1356,i,16307248929046950050,4526167994304913733,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:8
        6⤵
        
        PID:3296
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3480,i,16307248929046950050,4526167994304913733,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        6⤵
        
        PID:3760
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3756,i,16307248929046950050,4526167994304913733,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
        6⤵
        
        PID:2200
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3520,i,16307248929046950050,4526167994304913733,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
        6⤵
        
        PID:4776
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4208,i,16307248929046950050,4526167994304913733,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=776 /prefetch:8
        6⤵
        
        PID:4440
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\win.nexomia\EBWebView" --webview-exe-name=Nexomia.exe --webview-exe-version=0.4.6 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4684,i,16307248929046950050,4526167994304913733,262144 --disable-features=msAutofillPasswordsInInputs,msAutofillSavePasswords,msPasswordManager,msPasswordReveal,msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
        6⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
        
        "C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe" lsp --definitions=@roblox=C:\Users\Admin\AppData\Roaming\win.nexomia\Cache\globalTypes.d.lua
        5⤵
        Executes dropped EXE
        
        PID:2372
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:3956
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2052
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1624
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4808
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3844
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3664
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4456
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1740
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1740
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5044
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:3312
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1740
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:684
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3188
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1828
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1484
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1392
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4400
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3312
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1484
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2024
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1908
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3328
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2136
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4828
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1860
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:3124
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:3948
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3956
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4228
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:5048
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1752
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1800
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4808
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2092
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4624
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4396
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4456
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1228
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3508
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3880
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3532
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:392
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1728
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1940
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:1088
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2284
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2996
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:4228
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4676
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:972
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        
        PID:1084
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:2676
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:4712
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:3452
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" process where name='RobloxPlayerBeta.exe' get ProcessId,CommandLine /format:csv
        5⤵
        Reads the TCP/IP host and domain name from the registry
        
        PID:732
  - - C:\Windows\system32\timeout.exe
      timeout /t 2 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3528

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
PID:3112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Filtering Rules

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Filtering Rules
Size 2.1MB
SHA256 5e301c48e6d7290990971e9f0bcb2263c8adba06ed0a2c6db5086949825d999b
MD5 43f62d9f35fa6597cec4e2ad5643e282
SHA1 8dba6404724ffd6a2e89901e8dc6e5e55fed3374
SHA512 91891d23464f89e6769d9ec7a28867e28f77925e6e3b3b75fb628d8672157ba239676c07699c931ac307a21ccc4dae95dd707d410f988ff82be4015103d4d6a3
SSDEEP 49152:ua2qP9SKIrivd04TxN/7Uw+zJEhs6dl61n4Kmq9SL6bbBT0HjTsQc8cxjw:u8d
TLSH
T1BAA55D237518BDF45BB31F3EA44B6D48823962A483E3EDC5EA2BD10ED5E014F79601B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-AA

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Filtering Rules-AA
Size 2.3MB
SHA256 95beb1f39b4cd5b29f5ebaced4a33753fb0bb876f078ed3de041f12be16cec5c
MD5 b91a6cf79bedefedcb5603d3477cc3ed
SHA1 b3512a426a6a613f8cdf7f9ae3a0d02b700d1843
SHA512 9d85945f7f963fd9277adc20a0af459e8bb5904ef7038584e510ebd041b3029bf24ecae2047b24ecfa853154beef7e2bc5bd34ff8d90aeda000fbcdde741341d
SSDEEP 12288:DUoPNPlfiCBGkqNEWymqMD2N3FRgVfFRg3oFRgHsFRg/sFRg7dFRgImFRgJ1FRgs:JNhiSGkqdT5+9
TLSH
T189B51BF69947509145B9631938ADB2C82B14A28147ECCBF2EBB4C4AA2791DC737C05FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules-CA

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Filtering Rules-CA
Size 11KB
SHA256 65aa171487dca70aad69973d0459c6a4b0882fcc6223bdfb53cd9ab711c5b125
MD5 40b3ba01a09be340fdf879f97b31c867
SHA1 b6ac58d1653c1b76e0e9898b17cfea3e6b56de94
SHA512 97f82f162588a761a13a2efd38d2c9518954400c7898cdd12923ce26e90818d94310b4a9f2a2cb2f55f5101c9a2e177dc1b14de8c9486eafc910271e2991dea9
SSDEEP 96:MKSlCviF3P2DoTc+cTKSlCviF3P2Do3lTKSlCviF3P2DoT:MaviVucryaviVualTaviVuC
TLSH
T17C3275333E488D6792A4C1A0DC92752C9E3087D98C9CBEC31235B9776BD1E6A508B5F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICENSE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\LICENSE
Size 24KB
SHA256 ed0f972d56566a96fb2f128a7b58091dfbf32dc365b975bc9318c9701677f44d
MD5 aad9405766b20014ab3beb08b99536de
SHA1 486a379bdfeecdc99ed3f4617f35ae65babe9d47
SHA512 bd9bf257306fdaff3f1e3e1fccb1f0d6a3181d436035124bd4953679d1af2cd5b4cc053b0e2ef17745ae44ae919cd8fd9663fbc0cd9ed36607e9b2472c206852
SSDEEP 384:mva5sf5dXrCN7tnBxpxkepTqzazijFgZk231Py9zD6WApYbm9:mvagXreRnTqzazWgj0v6XqK
TLSH
T140B2526EB64903731AF30116AA4B64DBF31ED03F362A4564346CC1481FB6E7443FA6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-DE

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-DE
Size 305KB
SHA256 367ad4a5699a69499d13e8bf9ed5e8bab3573e3731ff8127178e539735ba46a8
MD5 fa08e85d713ad46803e924d443e4bf7e
SHA1 bbcce20f5ce73be4b34cf5c43d6f71bb4ae2c5ff
SHA512 884314e04cab57c9907f90525a4fea7710fdff5e47db4500c03d4dc6c5491a3f4df4868620a2a1817444ee75bfc913e79f9a414e3a68108deb7abab700ae9f85
SSDEEP 6144:7FjHKfRBie5M0SPtVRY7od0x6qNgKWIescUHVTl1dKcJEtmmt4l843NWKOb2P5+S:5T41N/IuscpL1Kxa
TLSH
T10264C693296AFAB12A320E7D600A1C4C5322F111C2C7DDD9F775C98DD1E468BBAC16F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ES

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-ES
Size 137KB
SHA256 55e005c8aea4180093fcb56f4ddeb9fc763892d8cf1fcc840f612a7531b7ed18
MD5 6e8f660d075254a08948dc3517304256
SHA1 bc8abaa82d6d555ee9482c568a1d661453fbc956
SHA512 cc3484fe628e4242eeec2ce969c51e817ec9ab3feecec8d8097f43a319c9dc226771eefe63316d8ec2ad895f23ed4603c4836faa49369db785580455ecf21f37
SSDEEP 3072:NiZ3EhHST197h/6Jl06bBeS1G56asSnGpFrUboki9a8jRU+Zw1:/RxbR1EnYpLv/Vy
TLSH
T166D30D55AADCA8B55A73102C64D9254C911772D082CECDE4FB6686CECAE05CF3BA03FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-FR

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-FR
Size 528KB
SHA256 56e80041432156be4f08bac11e3494f2f06f65b61a60b7dcb61d15debb7b318c
MD5 6804859c589fa0ce46529c3a53b882d6
SHA1 70ffd62bb826e29500d36bbdd7c8d9c6895e2d1d
SHA512 3a659c284f55d203fded7f2754673e55a43d2c131b4790fcfe374af138158a690b5a330d4e720348c03aabb561b0aee7d818dcc111698c05ecd99c239d07735c
SSDEEP 6144:zfi0kH6u1I6c2Qiw934vv8gxK2SzX6rDVu9cBwZp0CiEksn7p0heBB6pHIgnb3hc:aT43+R5I7p0ABaIgne
TLSH
T114B45D136619F9F11FB31E3D640B5C088235B2A183E3EDD5EA67C14DD4E468FB9A02B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-IT

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-IT
Size 216KB
SHA256 e1552312fc16e0f279e72f7eb4189a47e0beb36733220b0ef605f66defcc5fa7
MD5 268f6a3c0990d434175268cf09cfa6ad
SHA1 464e10c57c536e6bb55a326a48469246a9241505
SHA512 5154048a794227c45b950ec2d2ca378f9e7a9542b9fc79c1fef1f1615e97a263168927d883967b06f8b52227a47e3ac75ac7061b25400ebaa63e4536a368d50a
SSDEEP 6144:1quRAGty7QiWYIeezuu2CGiXTyRl+XPWRq14T/KfY:HRZtQl+XPWRS4T/5
TLSH
T16524E9176A54EDBE4E22156CA09F5E0C7225758182C7CED4F3D5C08DE5F827A2BA03EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-NL

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-NL
Size 79KB
SHA256 935465fc40adbb4ae89ba37542ed37609014666c67fdf5115927809d69144b41
MD5 65126d1e76de4f0872e6cfa96609beba
SHA1 95268d3b2134894040afd0530d062a3b836f63c7
SHA512 0c6dd17cf622ad1a1a4ddc43fdc6f36567a98309e145e16d95edf38e9b21905867b28865bee591b52eecaa371138ac436eee6d18ff8d78f4c8f7031ba4e7ad84
SSDEEP 1536:x3ACbKFpRTfKGy7Dpj+u9huKCe/MELfmoRyQpnokj:x3ACbYpxfKGy7Dpj++hu8/L7moRyQpnv
TLSH
T14A83D70AAD68F8754A331D2FA4990D1C9625B600C7CAFDC4E725908EC9F52DF2AD07ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-RU

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-RU
Size 1.2MB
SHA256 f8abf856660805e271d9d2033accf4f8cc43b19b7662fc2b96f56739229a90fe
MD5 e946014ae78f059f0698731a745a3f00
SHA1 afeb8dc2d86d2763b69f97717e454a7c6b8a267a
SHA512 3c699d3205c3a000c13d20411a0e958f2107f62d813591652cfc573f9a29647badfb1703e499a8896644f1485ecc19cdcaca0c6bd5ec1e5e328339c95784cfa3
SSDEEP 12288:4o9g8Q9u1Xku8Uc24wpDs2zGFtyKnVgLxB7rsvAyLuQCdj9/CwYJWj0Ek0ozM/vQ:4Oe9u1Xn1KFtyKnKq1CvH0Ra3Rnkd
TLSH
T1F44560137254F9F04F734E7E549A9C089275B1A083D7EDC5CA29C19C98F2A9FFA402B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Part-ZH

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\Part-ZH
Size 686KB
SHA256 9645edd48b978354345b657bacb3f30be1f450300856a82ba4d5dbf1236c7c9e
MD5 3e8cbee42dcb97db0df88cb96643e3fc
SHA1 94cd9e2bc876e04bfd2f311cdc160b6ae1d3c9f3
SHA512 319c69fcba623a0fea9ba4e1dcfabe3e9bd47f31dce7146e317835331217730fb61d0449abe7e66b1bc6f06a50c12269f7f09dbb633c85b4fd8dcc7b21c95304
SSDEEP 12288:g3gaBN1zyZzxT04duSeYXzhW+svzgAfk+XTAdXUd84nT4x09/xSE8Y:CgaBN1zyZzxT0N9YVW+sv8Afk+XTAdXy
TLSH
T114E491132168FCF51EB21E7D284B6D48813A76A047E3ECC6D62BD54ED6F025F39A01B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adblock_snippet.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\adblock_snippet.js
Size 2KB
SHA256 9aa899e0bf660ee8f894b97c28f05db06cc486915953b7f3b2ff9902fa8da690
MD5 f5c93c471485f4b9ab45260518c30267
SHA1 ee6e09fb23b6f3f402e409a2272521fdd7ad89ed
SHA512 e50a1baf20db9bc867e85ab72f9976430e87d8516ca552f9342a5c91822c9e1404e4f915042d48d841cca3fb16fd969bf0aa01195791ce29de63c45814fcdcda
TLSH
T1C541F146AB3477B703EC24D158271C03B3684494562CE519FB51EBAEAE1C46B4EEED23
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1111985179\manifest.fingerprint
Size 66B
SHA256 b1c8d3a1e8d3d85433eaa60a50001e5d1599809fb03a7b31bc19f963058a0d54
MD5 58d2918fbd8bfa6cecc58ecb48dd0723
SHA1 1c6f36fa1434000e97d6f32f32edf02772bb40ad
SHA512 31a3a6d71ec58392f3330df1cb23088c437d72c8709da71598fd626af76b45f26091daa1ae3d49ef15929b6b518a3fac0a911d09cf79ef67bc823d52db4580a5
TLSH
T18FA0220C20C82AA088BE0A0302082803832000A0AC383380A30CA3C8BC0C80820C00FA
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_1200026032\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_994185628\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2816_994185628\manifest.fingerprint
Size 66B
SHA256 bc8d4367c67f869cbf134ee18cc34007003022251fd5d54980fae22d990f1563
MD5 c3d8ccd4813a33b2ad5ece6575c67046
SHA1 0630d245e905f65fbb619c087fa117559ca170b0
SHA512 4691eb27a8f859aae2a4bbe5727a927674cfda0f9970d7384f01761705097bd8629562d0cef462551b9ae5699074e0d5cdb68a3e82150b21f3063012c1eb4ea5
TLSH
T1CEA022C2F2A20022C8030382A38A00008008882CCEC32030002E0E3BC02F0020022A00
MD5 SHA1 SHA512 TLSH

Submit Download

Launcher.exe

Path C:\Users\Admin\AppData\Local\Nexomia\bin\Launcher.exe
Size 1.1MB
SHA256 6796150b61813d0426e7057d5ccc246f684a4b31987c99f6801bfa7bffb72fcc
MD5 3181daa42425fdd5727cc285f93ac3e5
SHA1 287897366f78b3e91aa9d983ef61a61d02becfe5
SHA512 a13be48451cf4c2bf8e91a268ba814d92b60002cbd269d3e591e8f9c1e3eb0e473e7023f594975e51542517bd998b686da3d90ef0a008cd2b6fa3405ca0636c7
SSDEEP 12288:Ebs/m0E54jwaFXGc8lEBBBHGBKq2IZwDpwvfqItNqdg:EbOVE5ifGPRZwFwvf3fd
TLSH
T1AE357C83E7A385D8C116C9B5534BF137F9627C8E4B157197ABC41E633A67BA4E22CB00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Nexomia\bin\Nexomia.exe
Size 16.5MB
SHA256 fb8a82d843199bbfa0367265ccf883c602101886d78b4bdb71b2668552aed831
MD5 bbfc4f7b5328a3d188703d18dfee5407
SHA1 e5cc4cc2fab108758443e85ece1f4a48ad7de98d
SHA512 f1b4fabaa8a071133b255dc4080cc4dfca95e9cc9c8097bb683fc6566aa233439cb01b5fb31445ce308d14d920a79709a27e122e83464d7b8a1251645b78f5cf
SSDEEP 393216:nq5WsCI4rAyKKeFOLIYfzA4/pW1zCkq1gQ3M:q5WsCI4l9sY7b/pW51GQ
TLSH
T13107AD43F66280F8C16AC175835A6232FB21BC4907357AEB5BE44B213E66FD06B3DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nexomia.exe

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\Nexomia.exe
Size 20.1MB
SHA256 1329d2097c5b8537e0ab5a8d4fd49b72a18d7078d1510289c5133ced9bc00957
MD5 4c00d0c5bef833074d96fb7fad68b788
SHA1 f5f86807d9e5c1ceb1c210ee1ce5ea64b52e1edd
SHA512 6b5f0c78e35c51cb1c39f1e99a519939f5698304a143327a8ed99f0bded0ad922f6b4f010f024ad420b3197d7a4c97723a0695a1e619fe32747bc1b7f104c720
SSDEEP 196608:jpYjvsoXDdNLT5wLgImXyPdXdwVHbRN4wU7zvXHwQOMA6Ip5CLLe168HyTog8OC5:EXDdNnUbm+dXd44wUn/eo+mj8OCZNrq
TLSH
T1C5279C03F26290F8D56AC175870A6232FA71BC4947347AEB4BE48B213F66FA0673D754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update.bat

Path C:\Users\Admin\AppData\Local\Temp\Nexomia\update.bat
Size 539B
SHA256 f623b693b692260d8a3a33d071598ecc2c597fcc9965bdc1c62df4a011b03dca
MD5 4aadbe6561fc13a93e1dfae70418619e
SHA1 c99053620769d56267558e2b4550bf47896cc49f
SHA512 90a056866109a11da8878020e8a08fc87841605c5cb78b8c8c85f5685c1270bcbc7f38fa69c99b2cdcd52cfe3eb4f9487f5f510e23d6a5ae14881c718db1b877
TLSH
T120F05038882906B500749A99DF5E3544D5FED64FA7DD79C014C0D68D366F18A1E873C2
MD5 SHA1 SHA512 TLSH

Submit Download

2e44fe17-8904-4b33-acd1-f176bf1eebcb.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\2e44fe17-8904-4b33-acd1-f176bf1eebcb.tmp
Size 2KB
SHA256 925204f1277648b4c1b98596c282c16dba838f34392d5ff2468b2828b090e7bb
MD5 c3d07dcb6652266b69f0ce561f97fb07
SHA1 32b3a19aea9e495ca3429c3db804d017d0fbccff
SHA512 57cbf5433a654c9319738f92ce4f4b52a16191c41d96b51cd5216487a5baa447ecb3ec13ab2135effdc6b3cd25c2687384ef621b09cf5027aa7ca7198807ec3a
TLSH
T1B451C872F894BB7788D29B45B9C57F17AA3641A6E1921F6495DD0B1801C71DC2313C37
MD5 SHA1 SHA512 TLSH

Submit Download

4a1793c8-dc05-4cf5-b495-c6de12992ab6.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\4a1793c8-dc05-4cf5-b495-c6de12992ab6.tmp
Size 3KB
SHA256 92fa41d0272b2a7484d6761812b685b78c409d55efc4de6a71dd9551cffa0d06
MD5 3ce1a7d6d8166f4c3369f51bfdf76145
SHA1 a8cd2e8f7797e43d75db64d39e15c159e2d5d6a4
SHA512 b66a16a3cd82ff1dcfed9f9b416b83803a266c62899f7c21debd9aeb0e1c0750b41b32cd5f51049e55bc5199eecab49bc56b6775535cd555802e5f825db34e97
TLSH
T132719772E9B4FA374DE2AA41B8C56F16B6654127E0D52FA8D9ED0F1C01C73D82352C27
MD5 SHA1 SHA512 TLSH

Submit Download

57a7bcb0-0009-495d-b199-260166922455.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\57a7bcb0-0009-495d-b199-260166922455.tmp
Size 4KB
SHA256 b3ce8f81cc0947449ebf1596a2356166c5f9098e8d8185ec51bd8a9efd820bb3
MD5 84eab386face3acf54c914f8c8aafbd4
SHA1 6b282a51ae614cff21793bf5065a0f443c03d999
SHA512 afb7a3958700689591b4ef3de1caca2ff8f8c8deec7c2103b7904b17df546cd33427313a4bd7c6d4a364b56d60f2132c67608b65061620b3cc587f2886b0f32f
SSDEEP 96:zuo03NkCEffemHUtoA8Frh/cInURoDotoN57NVDGTBWZw6mIZRjgTqPlta:zP03NbRm0qvooDUaxdGNWZfj4qu
TLSH
T1EF91A562A8B4FA778CE2DA45B8952F07B6A54127E0956FACD9ED0F0C01DB3D81352C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6004408c-24ef-4c2e-b987-fe8859dd0a18.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\6004408c-24ef-4c2e-b987-fe8859dd0a18.tmp
Size 1KB
SHA256 ce763d7549b3f66e1f63d5f7ae16cc6c3b614ca25208eae1bb99245d009eb351
MD5 11464ca13d2d2765f1a7fef238333073
SHA1 f8006439725227361279cc7be31d722e6feb4e99
SHA512 b37e1fe2c5f9b1e865025e5fd25d848f7f890fc5f143d04165f62f224332bb917bc3884b3a6e25464c2777c38e50c8f7438e753a32b99614516f9ae2b7628183
TLSH
T13C3162B2E5E47B738C81A782B1C2EE5B2E3101ABE0514E5CA5DE472846D75DC523BC33
MD5 SHA1 SHA512 TLSH

Submit Download

680943af-3373-40a3-ad31-c5630b91da28.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\680943af-3373-40a3-ad31-c5630b91da28.tmp
Size 4KB
SHA256 595d60d6a764f2af76483402f960e75610df1c4bfa07c958f4dbbb8686101efd
MD5 a6d30f7f7f7a3bb7b9a23d99ee635e48
SHA1 7111a98026580919f49cef3259198493bac6e0a7
SHA512 670e3570ef9955f331695fe6fe8d17ea85f471337aa1d85d2d618fc357f5ba319cf5126d9999ccddabf7bdc72dbc53f2b252bfdc0fe1d71b8326f13b05c4d08c
SSDEEP 96:zuobNkCEffemHUtoA8Frh/cInURoDoto+57NVDSBWZw6mIZRjgT0lta:zPbNbRm0qvooDUhxdyWZfj41
TLSH
T1B8919632A4B4FA778CE2EA45B9852F07B6A14127E0956FACD9DD0F0C01D72D81352C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69a1168f-d838-471a-ba3e-deb7b82b0b9e.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\69a1168f-d838-471a-ba3e-deb7b82b0b9e.tmp
Size 4KB
SHA256 84f86ef3673e19a66e02a26216210ccaf31fb4b8d59303a72c83b26599537177
MD5 d82ef714215b54b2540443052167e7d1
SHA1 1b8c402bddcce08f7a90ea1ddc7cc885cc635235
SHA512 38e3e9107296a932c5960467f995740a1e6354d3e5cda4bdba1eca5f6c5b7d2517278d5b1131c60e6ac6a6fc3e4a1b54443e090294c7770b691cfa8ba4af320d
SSDEEP 96:zuo03NkCEffemHUtoA8Frh/cInURLl8DotoN57NdDGTBWZw6mIZRjgiqTlta:zP03NbRm0qvoiDUaxFGNWZfjpqi
TLSH
T146919662A8B4FA778CE2DA45B8953F0776A54127E0956FACD9ED0F0C01D73D81352C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76f3246b-eea9-444d-bdb2-0ea6979ad03e.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\76f3246b-eea9-444d-bdb2-0ea6979ad03e.tmp
Size 16KB
SHA256 d22c8de50d325be73c80d0e6083ddffec455cd6610bab49b71514ba16f37cce8
MD5 11d5f7d3bd973f1e1349e899f209371c
SHA1 971788282a48602bac300a925ad607beb574b98a
SHA512 d665dc1190ed1cb8c15dcc9123805f62152fc2722ea37ef284b6efc2fce3102c9c3dde37b49f1e92191320d3d89d36e7bcc6db4d675e33324b9736a612f2f2e8
SSDEEP 384:z6+aQikB+z/xvxjg/qhEm3NbJgQS9NEqjUae9zv:p/UxvxjgC+mKa8ReFv
TLSH
T173729F3794A87E2394B7FA4579994B4FDBB8847290C25AB84EED5F090AC73D41303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\CertificateRevocation\6498.2025.9.4\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f9f2fe6bc857d4dc1d509233f247e6020931ef1f02c1df9ea483ae9965293910
MD5 bccfee164b470679eb9b82d5168bb718
SHA1 9775b172c2166787db70252f75c4ab8a49d9d318
SHA512 f3f74f1e333fb61b0acdb8c09b3ff3328801dd26e838494ca8616c495180606720b450e7db5dd0bfaabe8de31678a53a0d24ba87777fdbf1aded37563ef1bdc1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5c74c43ee88886c3300abc5fb631f4366a4d56f0c6b5d58a6710ef24aad0dc92
MD5 aa39e278b5dbade263ac1f3bb05b0039
SHA1 54d11a7e1519936a0aedd285e28d7508b097174f
SHA512 0cbf565f93de608d458a7581fd44b765097d31b0a9b2fb7e94c8a8c084cf6403592d8284ff81ee4ac1117b466e799fd1928a044fa8bd1d5896a5488595196555
TLSH
T1FFD012163E111735D41027724131610D1540C00B82068100642CD62D9E082900A03441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2c76498a37e60dd5db65851bf64b853d17a55f0bc6a05f934df93244b2102110
MD5 b1d34b58041604ef9cd3b7b1d23bfdc7
SHA1 38603298cdba6cf7944186870367284342799f7e
SHA512 194221bb88a5141be9cf6ceef26093618dd0491f76dfb01e08197b7e4ee0c20545d99afe07a3c40142c7bbcb639c6a2e27f555073e4547159317f860540d7c36
TLSH
T19CD012163A110B35D41026734172610D1440C10B81068000642CE61D9A082900A03441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

071b1e17-3584-459b-bdea-890142d053b1.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\071b1e17-3584-459b-bdea-890142d053b1.tmp
Size 7KB
SHA256 4833eb319310d3afc5a70f1aa90ea7b7926963f352624d3d2ce31f8b0cc1fa4d
MD5 15b4fd841cef2f68215893982d8320f8
SHA1 4e0ac6d8601ae78b307f285827361d48ca3ba904
SHA512 8701a6ae0d1d2785da0a8d0d3b7d0ca1cacd7ce66d068108c5dbc7bac5af82d45ceca6e1db8b42c4b59dec866b4d234777027e01f8f4063e26f9bb26020d399d
SSDEEP 96:sti05byxvbDHffq3dZ8i0vhEtkt3m/7qx+WVHMSm+uecJDuSMk8dQjA+gucGP0MC:sti0xYfEZ8paMW/S+WiTDZQd1DGP0MC
TLSH
T199E1A842DE28AA7B8CC7F659B975BF52D2F6115271C10E48ABFC861C09D66CC630790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d32bbcc-3310-46d9-8ea2-176669978719.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\5d32bbcc-3310-46d9-8ea2-176669978719.tmp
Size 6KB
SHA256 bbc6b427cc23a6572b461f6189551ba2ac151dcd8d6108f5eed683c90466cf27
MD5 52b72dcfe92ddc63fc834592a03885cc
SHA1 eed25ec56d8ae639907401083905678352db4670
SHA512 8cd30ce68093d154ad0131f76f20c6e07832127489010c36bbda3b965a751bfc51d9a704dfe6d33832d777bf9fb29a09b79b5e01b6403493db0a6a9e85f53284
SSDEEP 96:sti05byxvbD6ffq3dZ8i0vhEtkt3m/7qx+WVHMSm+uecJDuSMk8dQjA+gLrEGP0x:sti0xlfEZ8paMW/S+WiTDZQd1BQGP0M8
TLSH
T154E19742DE28BA7B8CC7E619BA75BF56D2FA115271D10E48ABFC851C08D66CC630790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5
MD5 d1f604157b0745a40453afb93a6caa42
SHA1 3d5d77429b03674ebb0ba34d925ba1b09310df5e
SHA512 0644ce93724a57dedd8aec208e5a038e323a1b9871d5046d58a87c60479626693e6c8f25b7c7f7b60fd35aac133d2e660ecbd8f8d579ad1fc6703ae117a485a0
SSDEEP 3:MsFl/ll+l:/FE
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 0ff81bfe8be0518d8f0d6ac60e1782d0c04745701c9ec549404fddf3e0604f8f
MD5 42f45fe60d4fc7b74fca481a35dfb6dc
SHA1 cc94dbd2fc84990d3ca849deedbe78d37331c735
SHA512 c8855091db9b73ca924a8d3c8c84edba9bc5cc4766816872561d7f2b0d09874636247db6f82815f3d8dfd7a2202e8d664f7b8668925af166cb3e4b01163a2bf9
SSDEEP 3:MsEllllkEthXllkl2zEklslMlZll:/M/xT02znEk
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 af1cae5afd846dbea3d7b218e18cf90eaa96c7ae530c0dd70412343df460f8ce
MD5 e0d85688a4413518373d3bfd261d2e81
SHA1 ee6e6afdeac8ae5d2533e55bcf061fb8a5049967
SHA512 6e2490e047995b8426e3e89a04c14f0b23cb2014ef2cb00bec6e7fe2f9441cd1b8de2dd5eb306fd455083625cecba436682848bacce34097922cbebaf912a621
SSDEEP 3:LstlNllkll/lemK1:LsX3lEtPe
MD5 SHA1 SHA512 SSDEEP

Submit Download

09f4703a13aac448_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\09f4703a13aac448_0
Size 258B
SHA256 ba7dc6c3459fcccb9153a3636c249e5fe193f951550af0438f558ef46f00ba76
MD5 7606316e65c73734efb435a0d8a26026
SHA1 11663706d758c45e148269f590732133ba8cb750
SHA512 180e88a5adb5814432cc5fc840c389cbeb47b6e59b694e1bda450f9744ae7166a8ec5b4f129506e71102032d1a91107b8a3bdb13faf55e6e0fdcc5dc2670f8f9
TLSH
T175D0A78FC8318248C7BEA7F4DFE55D0E9753C0F055AC68828022DC626195A757A24246
MD5 SHA1 SHA512 TLSH

Submit Download

1e563e37976b37a6_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\1e563e37976b37a6_0
Size 2KB
SHA256 f41d7f2a48518c068ba7b6864e8e768b5500dc635c4b78a9d22ec1de38f567d5
MD5 a08c630d11d5da366135a1e40a7b67d4
SHA1 cb97db96b2be5326c0edb26d7807dc575048cf62
SHA512 acafd186628a9567e482bde6f325e85e459084f15f04cd362919cf04d3c01624683a63e4aeb67942f3afab0b9ed1dcf512e10ecaa27e6ab18506250fc3d52719
TLSH
T16F41E815F4441F60EA7BD3F190629B3BD39560D14B2B9C57BA99F7F23002CA22B16F81
MD5 SHA1 SHA512 TLSH

Submit Download

3388eb6fbce30a16_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\3388eb6fbce30a16_0
Size 454B
SHA256 23c47eba6d99e62e4b43e34a4083c7822bfc7569cf13314e94354d416847e3a6
MD5 156d6f4f8e4244596fa11ffaa476c387
SHA1 81e25040d4ba87faa683b4c66e59245cb013b6c5
SHA512 fe622e51867a7746be8f188aa4dc0c0cb246d4778081bd66dbfe43b12e5b1e008bf4d90c262f29fc5cfbcc3b7fb150685cbcfbde4e969468e1a35edb29f3c558
TLSH
T1ACF0A34F9C1A1466D0B5A8744B994A78C5161C71D5BD301AA15AC5D6036072ABDAC748
MD5 SHA1 SHA512 TLSH

Submit Download

46c0a8d58500e4bc_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\46c0a8d58500e4bc_0
Size 503B
SHA256 c780ae0aa2ba914b201fe22ee1fa68051f020b715736b9c4b8cd279916eaf221
MD5 c388a86f76a38cee4506f851b256a458
SHA1 0237edccb4b6bc5ee09b2ef23b5493b8728813e9
SHA512 72bd7b8c3204608b895e378c4d80ce580dd4e1cff88289a7fad9a9aa479443d26698a1d60608bebd7b0b0736c78043976db8ad4c600faf77b8e456369358fdff
TLSH
T1EDF09E9E7416DC64D66A55F18BE6C99EC70940E092252544D4CCC9E56250D39FB48100
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 408B
SHA256 fb87b424a4031bd5a3c14d760c2208781d076fa987c6f0ea48aa43cd2f95bb2e
MD5 b7ad8ea4d5ee207901c99dfbdcda06b0
SHA1 6a14c777c19ab96f304b4b86b6457b5866ec4d13
SHA512 ebe1426e8ebd688d9886a3abb561f18bddb1dae515c206e9bf61a6e6649fd9d2860d26da0a4419062f7f2ff85a03acf37662f73a0a810cd3bc76db4078c13186
TLSH
T1EDE02E9389C1D002DFC78AF9944C1C082A2089337C10A70324FE3B6AC663CD0F0AD3B4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 888B
SHA256 93c45631c2dbc159edf3a3e08e81046176490035f3dc87777e993cbc6fef965b
MD5 4227d23f8772c39bd309a35a430d5235
SHA1 e56a44b4eaaae1f2fb037221819bab6ecfc0e73c
SHA512 8efffa1a6167690c736518aea783c20a7399a544b80dc950bae36f11da72174f0ea256a244c499e236c6de19626aaddcb4b0e6690091a096cd9afd581320d1e8
TLSH
T14211DC0380C8D1E5EF836ABC4CD81C155A3C88D63901A76359BE3B96C6D7ED1F6593A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 659026610ddf57597b7f7e899b50de58e52f442f85b1d27b4ec56fca96f24746
MD5 b4c50d5854a586f0838d5869b54796ba
SHA1 294f8c542e84d4a689eabbb8d0b61bcfea6cceca
SHA512 8ca78f3f9efbe9518d231f50ec4dd2f4d914b8807a8dc460c43c3c160a0bdc5f6094736b491590e096c357f0f111eebdaab3eef989d0c981a2b86f9a09ca6129
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\DawnWebGPUCache\index
Size 256KB
SHA256 a829db00dcd5b7c4ae719da3d8831e2deb808bfcd16f7a80e50a1fba0fe8a794
MD5 3c8270cb63faf8896bdd5687065f8e64
SHA1 57345be26eaa297313bb5689460d6028dfbbf4b3
SHA512 463d127efd8a51fe393b2ff2d9199f7c288c9312ece77890240d0b2526975508cf3a9d3cee909fae5cfd5a87a31bd5bc74da369b56e206e28c56660b5cc4413a
SSDEEP 3:LstlNllkll/lIo+0/t:LsX3lEtIo+0/t
MD5 SHA1 SHA512 SSDEEP

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

History

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\History
Size 184KB
SHA256 e7766d986ec3d8c9edb5834f6de9f5462fbf212a28eeb0aab5c0507f0607128c
MD5 8c854e55031da96aab3c34082306d1f7
SHA1 73f84d329ced30d1c9ff441d73137139f43a4760
SHA512 00410d87789b4350ded1dc90bd54f766841439a774e13222278f34c621374355c4030add965dbbde8a74cf1e5d702648b62c6f8fede3038da6b6f5d76abeda49
SSDEEP 192:HBJNPH+bF+UI3iWGVLWN3qL/lCnCxVgZQW3/V:h3PIkUI3ijVLWN3qL/MCJWvV
TLSH
T13D040D1E5F243212CDBD523A68E645B3587DF03F8B136AC62C6144B1CEE2646B02D9FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b50d62a-bbd3-4387-9615-74a7197700ce.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\4b50d62a-bbd3-4387-9615-74a7197700ce.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

99c69324-1ff1-4315-9da8-ce2da3b0409e.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\99c69324-1ff1-4315-9da8-ce2da3b0409e.tmp
Size 352B
SHA256 d4331eb391ec0dbb9ae739593a41e179ef9498857943a96b3b633ca68659122d
MD5 d230db83461e4d291a04054d6a07a1f1
SHA1 f65629bfad29fedb9b73eb0cd320c1b09052b6f1
SHA512 886137affb67e301ce8b231f6ef21de9cff41c14f6781bf677361d246e6d1ad90d7219ce1e45ea02fee5713a99f62d8690edeabef033bf20f3162058dbfa6d64
TLSH
T1E9E026E740BBF477207D8E260CE07C911A76B2302191E5ECEAC3477CB0846A75A12873
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 951ea521116baf347ce89b628eabc22479fb8e3edfb7597659db2174fbb59804
MD5 fa739570350b78ef09e5d8ca61d0d71f
SHA1 d4e932ca96e76aeb84d3a151d847658df6a5555e
SHA512 8dc44c2f20c0a051568e7479e4553dbbf8ad4ee6b4d5474d8493c4b957f563f858918d862621ff7ccb190be693877dfb0a1245998925f47f9976d431a007ac86
SSDEEP 48:TqIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB:+IEumQv8m1ccnvS6
TLSH
T1BDF2149E0B1D3A10C4F89674EAC10DC37D7D141D8B96EFC45AEC06F2FF866A2A538429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\TransportSecurity
Size 188B
SHA256 3f6f042fb65834ea2aaabc17aaefbf1f719cec6cbf507b03a72551b9e8644465
MD5 9fcc5d431dd9f7d8bd656ab4792e27b4
SHA1 5ad6ee50805bd8e086de7142110f7c27d7723217
SHA512 daf9d5cce218c9e188f33cbf49d06d6f14fce492eeba6eea2b163a85119e8dff8b271a86669da3348043784220181ba9a48c97881ea867228fb3633e5cdc4e40
TLSH
T15EC012A1407AE47610790A361DD46D456E36A13421C1D8FDD6D2476960511A66203033
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1f64cb6-429d-49ec-9700-7c64573dea8c.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Network\f1f64cb6-429d-49ec-9700-7c64573dea8c.tmp
Size 624B
SHA256 f2261c176a4459a9d9c3d70f3235678a8abac59d8c5f470ce6e5690cbb12a9df
MD5 2d4fa9356cbb97ad20300b0dd30b857c
SHA1 92bda296b3b64b1010909ac43f15192d524b6f8c
SHA512 61c8bc690e13f780f0b4b1f3f7055a4a2abb6fedf9ae244b4a8c536549d6e775b22784a247f1e005ec56219a9b14278b88c676b40535979ee01ba3e8b4775d66
TLSH
T1BCF07DB783B0C9BE871196A437347D07CD3D0416531C6E3B9DEAAB6A57E24B1E01094B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Preferences
Size 6KB
SHA256 af2485f37395a8a667eda08e999e9b5e5384d23ebaec5778d42a3f94ad47e743
MD5 9914d147ceb0410e514ff164b9e5ae95
SHA1 47001693e6a1a056442e14c3345b27e41afe30b9
SHA512 5120f7ca882ff31ed86d4a95e1111394bc093bd8e1fb2a4c6e189d43d11a60fe2bfeb764d178843882835e94d03b57d114d031e09d07a6a49ca80f02b80e6e1a
SSDEEP 96:sti05byxU7b96fftdZ8i0oEYktCm/7qx+WVHMSm+uecJe91idQjA+gNvMEB:sti0x5sfPZ8pFjf/S+WiTe9wd1/vM8
TLSH
T1B9D186429E28797B8CC7F609BA35BF12D2F5116161D50D98EAFC862C0CD96CC631780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 fdd88ca4a59929bdd3359218c0b88554842855190a3626490e4f8c14683ab0d1
MD5 4cd1ae0b81aef7566c4f743084ef3d24
SHA1 9ca659b0e76391c4d532dc0835445c57e53668c2
SHA512 e148c36325bbbab72b42892395dcb570af85ff26d0a21b11e60d606380ca760353366412a109f8c8d2f8ef6a910bdf7da76325f1f5d6c9de31eb3a1dbfe40e8a
SSDEEP 96:HleiOPlf/ROoKOpkF5d1eij7sMaTEv9V5h5pg5+eexp3ncHYkmYV4ho7:HZyWG2f9lbtcFmYz7
TLSH
T1BFD1C6A34669C538AF455FEBDC393ECBDDA6019F88D64C05A6E6C04807C2AFC21DD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 62337497c63bf6d6dd0853c7b37facdc7693666dd59d4eb175f316b6a8a339bd
MD5 445a1114253948ab3e9253db270cf2f8
SHA1 b2e161f4d6954d4677acb22bd446785af329626c
SHA512 5cf74c4aa2707b5aea0ba9788bada1553b0dfcd47d47102ec92739e47c2b30b4dfbc025f00d12c1cd2385abe2eede55a3b2196c6bf46a16d96fb6f4f961cfbca
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\LOG
Size 303B
SHA256 2e3b163da359a5687719204966f2ef38b824fc96464227459f033bd3439c807b
MD5 93eda024355a56c976cb3ae11aa7dace
SHA1 d167538bffbe539f7815f8faaaf65beb0d56f4be
SHA512 b9fcd7a74456a243364c4d4c2988b2bf4e27447922b6bb558eb85b19eebe397db00395f45c589c12279e3a8f9a4a0fa87e29d8be24390a96d30f7ef5b236dba4
TLSH
T165E0262119CACE3B935989AF2933F30CC766A000EAE621161FB4EA88214F4587082740
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Sync Data\LevelDB\LOG
Size 277B
SHA256 6074d09319b77d6b75fbedd18438bf75abf1671ec908be4c04fed618242e00fb
MD5 c1b03d37f8239be059d1902d5dfad7c8
SHA1 42d465cbc103be4586b844ddf884ed02c04378f7
SHA512 badd52caa6ca91d3d1724f920bdafec333609aaa9a343f66dc6c8204eb58edefc6cdfd22311525eb01c584a3eb3babc398abd7d8f84d9c80994623ece5c63705
TLSH
T19ED0CD7459C9C9368A54C9DB1D73BB0DC7749504A7D136095F66D944344B554B090381
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Visited Links
Size 128KB
SHA256 76d34c5baeed25421025303fc9ea94c62ef5603417feefc43e6ffa65b1fc407f
MD5 73cd7061e7c11fe81393ea2f87e41499
SHA1 dd0675afacf1016cb0e86be3ae214f10025d618a
SHA512 5f6106cfa0c35f187252c45e09b34940a8a4969b7ee1f707cd45c240904d4344282d2605f027d48740d8975460c120a2fc307668e0efdfc55697296aad04373e
SSDEEP 3:ImtVuUAhl/tYuxlX:IiVuU2auxl
TLSH
T1F4D3024411010625C438083989C10A45601A816490A6000353681C0185D60014206840
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da3215e2-080b-4132-a85c-7cf2b7a2eed2.tmp

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Default\da3215e2-080b-4132-a85c-7cf2b7a2eed2.tmp
Size 6KB
SHA256 3b73deb62fea3fd6faea2cb866f68e31d9811cb84b8be1f5c816e435e5d5c035
MD5 9c7bada022847fc0b6093fd826870fd3
SHA1 ebc13812cb2451096da95b69caf212eafac46d77
SHA512 d84b555ee49d1571a7490d07dee85e204f20da22b6e5bbc5bd3e8e8499dc2aa7e18b4621053196cf2d6ae89558017f2f716bac94f0223e303bfa70a15235987e
SSDEEP 96:sti05byxU7b96ffq3dZ8i0oEYktCm/7qx+WVHMSm+uecJe91idQjA+gWEGzKEB:sti0x5sfEZ8pFjf/S+WiTe9wd1tGzK8
TLSH
T190D196469E28BA7B8CC7E509B935BF12D2F9116261D51E98EBFC851C0DDA6CC630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\GrShaderCache\index
Size 256KB
SHA256 d0b6731555fbdbe38e1d11ca0dd825fc17903312d5fd35ec6df4829fec75c06e
MD5 528b6173f9ca2a7a74e8a95bcb817cf5
SHA1 c91718551e6a2fc059ecb698936991352d6c4d20
SHA512 be730fe0b606be0d4ec89e6082a5f6bc2c8b41b98a341fc7128a746e7690f16a215f8be59402de0c01f699cd65a757407fd305efd87da5e3130de2292221f482
SSDEEP 3:LstlNllkll/l9Z+X:LsX3lEt9cX
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Local State
Size 1KB
SHA256 dab5f65c418e835705216edf97efb1d0d47779bad69223e1bc88d6c7573effe1
MD5 feaf27c6f2aae3dcee77776ee64f59e9
SHA1 2899f9bc8714597db4c522a6947e19c97c762a76
SHA512 88e0d8ed1e059b80c90cc7b0ccd74fe470c7caf8903d1da0a8c6b7e8e98308a4a880c14df9abc7336944cd3f5f25964af1ac37e9b600a9a2a9659d078509c4d7
TLSH
T15C2120B2D4E87B739885A652A1D2EE4F2E6102AAA0544E2CA5DE431446C75DD1337C33
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\ShaderCache\index
Size 256KB
SHA256 be4bedb665e0ec7dab1de9f0d20a1586ed784895589b8bcfc17366e2049217dc
MD5 7f1b7237dc4e5e98eb272b2edf9d0b78
SHA1 86a6b7c7b4dad40e8a3b7243c10ce54c9328ef8e
SHA512 57bb6fb067659d1312d8fc81267ee04e42d58df5afe7d4dbf0d1a7601e1b942b6c47b98cdb3560bd8c3e0f7d6dbb7876c5428e7207368ac9c2f34a74a219c712
SSDEEP 3:LsOllllklkXlX+Z+lt:LsUlPX+Z+lt
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Subresource Filter\Unindexed Rules\10.34.0.84\manifest.json
Size 116B
SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
MD5 daf93729356a67ea1f849554827fdab1
SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
TLSH
T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
MD5 SHA1 SHA512 TLSH

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\win.nexomia\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

Injector.exe

Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\Injector.exe
Size 3.6MB
SHA256 34b8e23536b0728dc5c9001ca28de98b183175597ec4399c305f7df2e652722f
MD5 c67e05ebd81db97646f0cde7d468c6a9
SHA1 0f69735f35744ed91f977866548d7788ab778b9f
SHA512 7bec08185780c4852f2f5364677ba2d6b8017a1ed53ab57847008199a5e762db6949c28ab608ba81620635060ba72f4b8f8b2eb2bc17b2be7469ad7843ce62a6
SSDEEP 49152:JYUSye2OpihcR6apsQYw/3/w9ZT/wIC2C0vAozq3RPPiivfXZWnUs0E/PZAEzSmv:Q2fo2LvdmNfXZW1PbY8
TLSH
T13A06D017FA09A05CD18671B9924C1BA792E373A04F1079FFB0B29790F6745941FAA32F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nexomia.dll

Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\Nexomia.dll
Size 8.1MB
SHA256 73b465c743c72ab7df6d4a04326f286fdb16bb59281a57efcaf0247ebfd90847
MD5 d836761b2cfff01db29bbe835f3fe668
SHA1 65a9251842eaf0715cd353b3e61de618275a0e7a
SHA512 b94bfeabc1debbd9199e6c4fcb3deb1898338d7d3173b8ba2e96fe5b9a17d83428271e595a27b015b31d048220a2b42435fef6a1ac23f441f879ef06662a58d9
SSDEEP 196608:FXWpFQsAlUlTp5ZYkgL0b5esviSoXdnUGZ:tpsAlUlTekgwb5Zv2nnZ
TLSH
T1DF861218CBA21D3C18901792AFDAC997708402607D4CB71E6C5F9DAEDEDB0E548DBE68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

luau-lsp.exe

Path C:\Users\Admin\AppData\Roaming\win.nexomia\Bin\luau-lsp.exe
Size 17.0MB
SHA256 3c834f9402c82681ef2b8cc171c769f239eb094028bb31469296e1f0f4c489a6
MD5 8f890ca7382ce4517422a73ec3c432b0
SHA1 0a69749e532f7bc7a08a09c711b8d87149b22876
SHA512 692a35d1494649f96851ec333a0265805e46cc6f8f2688371a88ba3b4b8d899ea403dfd3bd2e4ee94a9d1c4eb7fe4a7b2d5a61c5092354a220e6edfc6f0f2552
SSDEEP 393216:dWfmgggFgl6ggDg/gpQiMRgFEggUggg3dgfgi1UBgggggUuMwFgggg6NggggggeD:YDggFgl6ggDg/gpQrRgFEggUggg3dgfF
TLSH
T1FA075B2A21AC10DCF17BD0BD8BDB9E47D6B2340903319ADF05D15A9E1E1BDED4A7E620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.json

Path C:\Users\Admin\AppData\Roaming\win.nexomia\settings.json
Size 2KB
SHA256 fcf7057a593c1b5060c35ed59e46a9a67ac2c0de9669341736544809f0cce7d0
MD5 0433d19083f5b00eb8b7d573c05768e0
SHA1 a9b72a379b141e817e41116e1575638361180703
SHA512 ecf00135cdc56453280777e2fbc5eb6136069fee299586c32c12f4c7728a3929a1eb6d8ffe414baa54944a6d255c34fb966b94bd2b6c0bd121cbc329b571ccca
TLSH
T1F8513B5F1004F712ACDF41D4610E3D1A0562F6B54ECDB266B3326B18FA63A5F3941350
MD5 SHA1 SHA512 TLSH

Submit Download

memory/216-63-0x00007FF920AE0000-0x00007FF920AE1000-memory.dmp

Download

memory/216-64-0x00007FF920640000-0x00007FF920641000-memory.dmp

Download

memory/2480-206-0x00000201A1320000-0x00000201A1321000-memory.dmp

Download

memory/2480-207-0x00000201A1330000-0x00000201A1331000-memory.dmp

Download

memory/2480-208-0x00000201A3060000-0x00000201A3061000-memory.dmp

Download

memory/2480-205-0x00000201A1310000-0x00000201A1311000-memory.dmp

Download

memory/2480-224-0x00000201A35B0000-0x00000201A35B1000-memory.dmp

Download

memory/2480-204-0x00000201A1300000-0x00000201A1301000-memory.dmp

Download

memory/2664-528-0x00000224B9E90000-0x00000224B9E91000-memory.dmp

Download

memory/2664-526-0x00000224B9E80000-0x00000224B9E81000-memory.dmp

Download

memory/3732-846-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-844-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-845-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-847-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-838-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-840-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-839-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-848-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-849-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3732-850-0x000002C43CE60000-0x000002C43CE61000-memory.dmp

Download

memory/3976-166-0x00007FF91FDA0000-0x00007FF91FDA1000-memory.dmp

Download

memory/4292-380-0x00007FF6AD910000-0x00007FF6AEACE000-memory.dmp

Download

memory/4292-271-0x00007FF6AD910000-0x00007FF6AEACE000-memory.dmp

Download

memory/5036-34-0x00007FF91FDA0000-0x00007FF91FDA1000-memory.dmp

Download