File scan report
Verdict Suspicious
Is Nexomia.
None of the 71 antivirus engines that checked it flag this unsigned Rust desktop app, but eight malware-specific community YARA rules match it, so caution is warranted until its…
Read the whole reasonShow less
Why Suspicious? A community rule for known malware matched it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't run it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged this file, and the sandbox runs showed a WebView-based desktop application with no injection into other processes. However, eight community rules aimed at stealer and ransomware patterns matched it, and it carries no code signature identifying its author.
The engine picture is clean: 0 of the 71 antivirus engines that checked it flagged the file, including all 18 major antivirus engines that returned a result. Against that, eight malware-specific community YARA rules matched, several describing RustyStealer-style build artefacts and one generic ransomware rule. Those rules often fire on ordinary Rust builds, and the file is widely submitted by more than 2,000 sources, which weakens them considerably. The three sandbox runs recorded a WebView2 application writing its own profile data, with no named injection target and no malicious run. Because the file is unsigned and no publisher identity backs it, the rule matches cannot be fully dismissed.
What We Detected
None of the 71 antivirus engines that checked it flagged this 64-bit Windows program. Eight community YARA rules that target specific malware patterns matched it, including stealer build-artefact rules, a generic ransomware rule and a Telegram-bot framework rule. The file is unsigned.
Threat Behavior
Across three sandbox runs the program launched an embedded Microsoft Edge WebView2 window, wrote browser profile and cache data under its own application folder, and contacted Microsoft content hosts. Our host cross-check found no known-malicious contacted hosts.
What To Do Now
Only run this program if you obtained it from the developer's official channel and trust that source. If in doubt, keep your antivirus enabled, scan it again later, and avoid entering passwords or sensitive data into the application.
Where this verdict could be wrong1 caveat
- The RustyStealer rules match Rust toolchain and crate-path artefacts that many legitimate Rust desktop applications share, and the sandbox runs only showed an embedded-browser app writing its own profile data, so the file may well be benign.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file
- Widely seen, with more than 2,000 distinct submitters
- Sandbox runs showed no injection into other processes and no malicious verdict
- No known-malicious hosts among the inspected network contacts
- Eight community rules aimed at stealer, ransomware and bot-framework patterns matched the file
- The program is unsigned, so no publisher identity is verified
- External analysis tools tagged anti-debugging and keylogging-related capabilities
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 20sandbox rule tags
- 11spawned processes
- 4network contacts
- 37filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Listed the programs running on the test computer.
Note: Talked to servers over the internet during the test run.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as recording keystrokes; no keylogging was confirmed.
Not confirmed: A sandbox rule tagged this run as weakening security settings; no setting change was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
Nexomia.exe
35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
executable.exe
"C:\Users\<USER>\Desktop\executable.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
msedgewebview2.exe
"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=executable.exe --webview-exe-version=0.1.2 --user-data-dir="C:\Users\<USER>\AppData\Local\win.nexomia\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4916.2020.10160635389368155988
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
throttle_store.dat
C:\Users\<USER>\AppData\Local\win.nexomia\EBWebView\Crashpad\throttle_store.dat
Test run - Evidence 5 of 7: Written fileSeen in the test run
settings.dat
C:\Users\<USER>\AppData\Local\win.nexomia\EBWebView\Crashpad\settings.dat
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
www.msn.com.edgekey.net
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
e592.d.akamaiedge.net
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes 20 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 21, 2026, 1:12 PM UTC
- SHA-256
35aec247abc007311e3f3584157ca1da956d307eee57c9ced36cdefe68df5fa7- SHA-1
2c1f7771a8e24691bc39f7bf17609fa9cf628e2e- MD5
411e27893f6e210f32cea7e28662adb2
About this file
Nexomia.exe is a Win32 EXE file of 17.3 MB.
- Claims to be
- Nexomia.winFrom the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 17.3 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 25, 2026On VirusTotal.
- Submitted by
- 2,290 distinct sources
- Packer
- None detected
- Entropy
- 7.07 of 8
First scanned Updated
Includes every engine result (75), 26 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Nexomia.exe safe, or is it malware?
What is Nexomia.exe?
How many antivirus engines detected Nexomia.exe?
I already downloaded and ran Nexomia.exe — what should I do?
What is the SHA-256 hash of Nexomia.exe?
How up to date is this analysis of Nexomia.exe?
Community
Member reviews and reports for this exact file hash.