Analysis

  • max time kernel
    141s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/06/2023, 12:18

General

  • Target

    CosmoNaut-Setup-1.0.6-Staging.exe

  • Size

    40.5MB

  • MD5

    17289416b3a23833ade327a0f6613bc9

  • SHA1

    212e706438cf9d51eb31dd24951d4cf21a6d85a6

  • SHA256

    c52d894c98adc5b478e5e35982d240a6ea6630023e6447d390615f6f5063c79e

  • SHA512

    2f0c3918cad347a703264989e2f625953f2df65f3658b799818735bdbc6053e245e781b68aacd897cedaf271dcb7f3f94198fea384051ee875f5494478e399f2

  • SSDEEP

    786432:qvJt+2Xr4NAE3rjFajBml3hVJjwmQQ/VgXqW7oAkLUQU20zr0ULrLO:qvXb4n3F1Jjw7QdgaULzrTfy

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 19 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CosmoNaut-Setup-1.0.6-Staging.exe
    "C:\Users\Admin\AppData\Local\Temp\CosmoNaut-Setup-1.0.6-Staging.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2284
  • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe
    "C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe"
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4980
    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe
      "C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe" --type=gpu-process --field-trial-handle=1784,7717200750431366939,16085216580111444228,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --gpu-preferences=IAAAAAAAAADgAACgAAAAAAAAYAAAAAAACAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --service-request-channel-token=8814320740146550085 --mojo-platform-channel-handle=1792 --ignored=" --type=renderer " /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      PID:3088
    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe
      "C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe" --type=renderer --field-trial-handle=1784,7717200750431366939,16085216580111444228,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --lang=en-US --app-path="C:\Program Files (x86)\CosmoNaut\resources\app.asar" --node-integration --no-sandbox --no-zygote --background-color=#fff --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12563228681746963682 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2376 /prefetch:1
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:2320
    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe
      "C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe" --type=gpu-process --field-trial-handle=1784,7717200750431366939,16085216580111444228,131072 --disable-features=LayoutNG,SpareRendererForSitePerProcess --disable-gpu-sandbox --use-gl=disabled --gpu-preferences=IAAAAAAAAADgAACgAAAAAAAAYAAAAAAACAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAABQAAABAAAAAAAAAAAAAAAAYAAAAQAAAAAAAAAAEAAAAFAAAAEAAAAAAAAAABAAAABgAAAA== --use-gl=swiftshader-webgl --service-request-channel-token=17947531894685710077 --mojo-platform-channel-handle=3344 /prefetch:2
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      PID:3572
  • C:\Windows\System32\CompPkgSrv.exe
    C:\Windows\System32\CompPkgSrv.exe -Embedding
    1⤵
      PID:4876

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe

      Filesize

      82.4MB

      MD5

      c6605cf8e132000fbf1f5d808dc5f9b6

      SHA1

      a45061a7cc1d4208a54c48c429c66105936eca2c

      SHA256

      119d4649dd3ad1f225251624120839d48e8df11c24c17c5a492871d92c5ae9a4

      SHA512

      9b350b22d53be33ba99adbc26e3b711357979c0079b59b003ea7db864f0cb3a0320551edd6649237a41423c4fbe47c94f2a035ee144af240d13667d2fbe9b112

    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe

      Filesize

      82.4MB

      MD5

      c6605cf8e132000fbf1f5d808dc5f9b6

      SHA1

      a45061a7cc1d4208a54c48c429c66105936eca2c

      SHA256

      119d4649dd3ad1f225251624120839d48e8df11c24c17c5a492871d92c5ae9a4

      SHA512

      9b350b22d53be33ba99adbc26e3b711357979c0079b59b003ea7db864f0cb3a0320551edd6649237a41423c4fbe47c94f2a035ee144af240d13667d2fbe9b112

    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe

      Filesize

      82.4MB

      MD5

      c6605cf8e132000fbf1f5d808dc5f9b6

      SHA1

      a45061a7cc1d4208a54c48c429c66105936eca2c

      SHA256

      119d4649dd3ad1f225251624120839d48e8df11c24c17c5a492871d92c5ae9a4

      SHA512

      9b350b22d53be33ba99adbc26e3b711357979c0079b59b003ea7db864f0cb3a0320551edd6649237a41423c4fbe47c94f2a035ee144af240d13667d2fbe9b112

    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe

      Filesize

      82.4MB

      MD5

      c6605cf8e132000fbf1f5d808dc5f9b6

      SHA1

      a45061a7cc1d4208a54c48c429c66105936eca2c

      SHA256

      119d4649dd3ad1f225251624120839d48e8df11c24c17c5a492871d92c5ae9a4

      SHA512

      9b350b22d53be33ba99adbc26e3b711357979c0079b59b003ea7db864f0cb3a0320551edd6649237a41423c4fbe47c94f2a035ee144af240d13667d2fbe9b112

    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe

      Filesize

      82.4MB

      MD5

      c6605cf8e132000fbf1f5d808dc5f9b6

      SHA1

      a45061a7cc1d4208a54c48c429c66105936eca2c

      SHA256

      119d4649dd3ad1f225251624120839d48e8df11c24c17c5a492871d92c5ae9a4

      SHA512

      9b350b22d53be33ba99adbc26e3b711357979c0079b59b003ea7db864f0cb3a0320551edd6649237a41423c4fbe47c94f2a035ee144af240d13667d2fbe9b112

    • C:\Program Files (x86)\CosmoNaut\CosmoNaut.exe

      Filesize

      82.4MB

      MD5

      c6605cf8e132000fbf1f5d808dc5f9b6

      SHA1

      a45061a7cc1d4208a54c48c429c66105936eca2c

      SHA256

      119d4649dd3ad1f225251624120839d48e8df11c24c17c5a492871d92c5ae9a4

      SHA512

      9b350b22d53be33ba99adbc26e3b711357979c0079b59b003ea7db864f0cb3a0320551edd6649237a41423c4fbe47c94f2a035ee144af240d13667d2fbe9b112

    • C:\Program Files (x86)\CosmoNaut\D3DCompiler_47.dll

      Filesize

      3.5MB

      MD5

      d2d0ff97605d2c2f8921e93062eb01ff

      SHA1

      586cdca915f47fa4b1010f781ec0504e3138efd2

      SHA256

      4056e0804a13d791362555636ba34158fade7c1e71599e415a285de1472d83d5

      SHA512

      7bff38be4c5c41a978b33b9458dc885c59e68fa3dd4e56c6b980d334837bef37b2205b1b69aa1f058c0d8e24e3938c29da917a198b640b521d9726a505683b10

    • C:\Program Files (x86)\CosmoNaut\chrome_100_percent.pak

      Filesize

      142KB

      MD5

      8d56d44c318d122f7931d03ba435f00b

      SHA1

      387f530e06f79a2a9f7fbf4446c71c31db08e7e0

      SHA256

      fcb4faaa82d13d90c42dfa0669f67391b3124d30310d0f4c510f31412974cab2

      SHA512

      03bd2f56f73ad06fe22ebd94fb0de4e37d1771f8a9d82a47ea93002ba4696d906b59d0e25db63e98af10a169a8c3dc9d047cfcbca01030924bf93abe7bce1590

    • C:\Program Files (x86)\CosmoNaut\chrome_200_percent.pak

      Filesize

      204KB

      MD5

      879f88cafa5714994744bde20e7bd2c2

      SHA1

      d63b55f9f7c0e40f9585cac8a5cb28c0ea9f32ee

      SHA256

      76126341d0dc2b4b6ddccf30559709e6a856cd47148107808bd18ceb16ed1df3

      SHA512

      4d70ae16c2656cf3a8aaad00e2ce0ddcc030bf1ad29bbb1d0e90c03f866c413f893b273b8b03aa12c9ea5ae01537ad1d2d1b2c52b35bf7773278121a09a3af9c

    • C:\Program Files (x86)\CosmoNaut\d3dcompiler_47.dll

      Filesize

      3.5MB

      MD5

      d2d0ff97605d2c2f8921e93062eb01ff

      SHA1

      586cdca915f47fa4b1010f781ec0504e3138efd2

      SHA256

      4056e0804a13d791362555636ba34158fade7c1e71599e415a285de1472d83d5

      SHA512

      7bff38be4c5c41a978b33b9458dc885c59e68fa3dd4e56c6b980d334837bef37b2205b1b69aa1f058c0d8e24e3938c29da917a198b640b521d9726a505683b10

    • C:\Program Files (x86)\CosmoNaut\d3dcompiler_47.dll

      Filesize

      3.5MB

      MD5

      d2d0ff97605d2c2f8921e93062eb01ff

      SHA1

      586cdca915f47fa4b1010f781ec0504e3138efd2

      SHA256

      4056e0804a13d791362555636ba34158fade7c1e71599e415a285de1472d83d5

      SHA512

      7bff38be4c5c41a978b33b9458dc885c59e68fa3dd4e56c6b980d334837bef37b2205b1b69aa1f058c0d8e24e3938c29da917a198b640b521d9726a505683b10

    • C:\Program Files (x86)\CosmoNaut\ffmpeg.dll

      Filesize

      1.9MB

      MD5

      749ce69c4ce3118a12756d672341ef20

      SHA1

      7dad6145fdee7bc957c24d85549d0d3f3cd78a7d

      SHA256

      3104bdd46ae1fb130a76fdfafab0266aa3532cbf2a607a4ffbfc781bd6f0ae4c

      SHA512

      fedae1795823f6ee3d02a8ff8adf2c5013a3b4ecadd7854e7bd2e8e60c64ebb51defbdec2a8c35194b1b530c6d266a5d5c5fd3ede0147576ce0e43b7cb89f3c2

    • C:\Program Files (x86)\CosmoNaut\ffmpeg.dll

      Filesize

      1.9MB

      MD5

      749ce69c4ce3118a12756d672341ef20

      SHA1

      7dad6145fdee7bc957c24d85549d0d3f3cd78a7d

      SHA256

      3104bdd46ae1fb130a76fdfafab0266aa3532cbf2a607a4ffbfc781bd6f0ae4c

      SHA512

      fedae1795823f6ee3d02a8ff8adf2c5013a3b4ecadd7854e7bd2e8e60c64ebb51defbdec2a8c35194b1b530c6d266a5d5c5fd3ede0147576ce0e43b7cb89f3c2

    • C:\Program Files (x86)\CosmoNaut\ffmpeg.dll

      Filesize

      1.9MB

      MD5

      749ce69c4ce3118a12756d672341ef20

      SHA1

      7dad6145fdee7bc957c24d85549d0d3f3cd78a7d

      SHA256

      3104bdd46ae1fb130a76fdfafab0266aa3532cbf2a607a4ffbfc781bd6f0ae4c

      SHA512

      fedae1795823f6ee3d02a8ff8adf2c5013a3b4ecadd7854e7bd2e8e60c64ebb51defbdec2a8c35194b1b530c6d266a5d5c5fd3ede0147576ce0e43b7cb89f3c2

    • C:\Program Files (x86)\CosmoNaut\ffmpeg.dll

      Filesize

      1.9MB

      MD5

      749ce69c4ce3118a12756d672341ef20

      SHA1

      7dad6145fdee7bc957c24d85549d0d3f3cd78a7d

      SHA256

      3104bdd46ae1fb130a76fdfafab0266aa3532cbf2a607a4ffbfc781bd6f0ae4c

      SHA512

      fedae1795823f6ee3d02a8ff8adf2c5013a3b4ecadd7854e7bd2e8e60c64ebb51defbdec2a8c35194b1b530c6d266a5d5c5fd3ede0147576ce0e43b7cb89f3c2

    • C:\Program Files (x86)\CosmoNaut\ffmpeg.dll

      Filesize

      1.9MB

      MD5

      749ce69c4ce3118a12756d672341ef20

      SHA1

      7dad6145fdee7bc957c24d85549d0d3f3cd78a7d

      SHA256

      3104bdd46ae1fb130a76fdfafab0266aa3532cbf2a607a4ffbfc781bd6f0ae4c

      SHA512

      fedae1795823f6ee3d02a8ff8adf2c5013a3b4ecadd7854e7bd2e8e60c64ebb51defbdec2a8c35194b1b530c6d266a5d5c5fd3ede0147576ce0e43b7cb89f3c2

    • C:\Program Files (x86)\CosmoNaut\icudtl.dat

      Filesize

      9.9MB

      MD5

      4c8a9e9c260dc5a6fee2a3c37520f5bf

      SHA1

      5a9883dbeb5314a98e7ab5326f9868e78ba387dc

      SHA256

      8c2df1f6e2ea8df2e5fc5e4b016b0cddd64a7ce6985189ca45be3c0ec99472c2

      SHA512

      c0da0b08a0b0eaa898f96c6e6c6fb65bc7f773f5814fc0d612a40e2fcaea4049c67cd2812716a564dbc16d609677ee62eaa9f9747d2a7bc5c9bce43cd2208aa7

    • C:\Program Files (x86)\CosmoNaut\locales\en-US.pak

      Filesize

      69KB

      MD5

      15e8556f737d17bd4d645513ee190990

      SHA1

      a24844d68fe3e9f4c57d14e6091a06f5e6b5f327

      SHA256

      12e4fd083a49e038578ea2993e6c88239083c8d098231527eee861299a4e1c99

      SHA512

      4e5c423b2b14def0e6ebb9c7844bdc050198064c9db69d3a880c1444314211995b1f0dec6fcbb12c6d5e59f690c3ffc893c2265bf7168d1ecbc8d83dfa5e1465

    • C:\Program Files (x86)\CosmoNaut\natives_blob.bin

      Filesize

      81KB

      MD5

      f8ac49858ca8739658ff44c296f8aba6

      SHA1

      427b4da3bd619d85381c36d61daf2ce392e07909

      SHA256

      354ff502a0e1ed73df4e5c7b52970356b04777461f6e169f72a8567ab5f4c317

      SHA512

      52e875aedbdc5dad21e01a42e333ff5aefed9ae6468a00e80f2bb373b871196f9a82bc3f43a6c72c9dd6be0e4fbc591d3ede41ca47b23a806b788db5aa9bf313

    • C:\Program Files (x86)\CosmoNaut\resources.pak

      Filesize

      8.1MB

      MD5

      b6830e889fad2ffafded27266a80df62

      SHA1

      07ad626b5de507d9ff357f4e8990724e689a5f0b

      SHA256

      bfb1edea4ee192b61d00d000cbf1fa1ad18e49da5739ce418d36686fa3fc74c9

      SHA512

      d5816c600e37a294478b9d84abff20ff3bc5947d74c51b8183be50fe0ec5f641a664c860c33746e3ab02267141044213a396a44fb11e1c3c46c2f719f2fb00a7

    • C:\Program Files (x86)\CosmoNaut\resources\app-update.yml

      Filesize

      97B

      MD5

      70bffa1115aa1ccff601cc05ff3f6c3c

      SHA1

      d1770a5daf85a8b48511279e47ba4bf041db341f

      SHA256

      1c332577e0473258a40c1fc23ef607430bb09a5ff4d2d5532fb9c9fc4440e94a

      SHA512

      b8c6a26d63534dca1536c8f385cf19122f90666e04ee561bdc369a0eb24af96eaf2505c6f3a18f85eac0c75b90b04b691bbb6163a4765621d096a60a9771b0a1

    • C:\Program Files (x86)\CosmoNaut\resources\app.asar

      Filesize

      3.3MB

      MD5

      b71f7910ed7dc8725d11bca2ea6c5ebb

      SHA1

      1b0afb3c5b7431b0601b3bee1ef74ea61ce70672

      SHA256

      054bc6cff50ff7f423555edf6331d3c89c6cb3ec545533d2c23fed2884824cb8

      SHA512

      99eb9038244da6de816b0783980d63581cf95d44ba1a9b12a291f041246ccc35e59cebdbb4b7ac49d2744773a691a86bf367d64efda4c422391fde9c45839871

    • C:\Program Files (x86)\CosmoNaut\resources\electron.asar

      Filesize

      344KB

      MD5

      b61369fb1e6b08fdf70ea8b71e2ac3a7

      SHA1

      a2067ed4007be43710ca67a7182f5c2075c3e806

      SHA256

      a08e71b922d0d579028c40d835cc7b6aaad90f2229972a096938d72c0e386730

      SHA512

      2014e88b92837a7cfecba25b1d0a334ce457943786d8dae40455340f6ba5014bfc2d954016686a230f95d4206a71ade72ec2efc4abd70f9016ebaeac0550c2ba

    • C:\Program Files (x86)\CosmoNaut\swiftshader\libEGL.dll

      Filesize

      252KB

      MD5

      138846462a58f0c8a3403030c2747c86

      SHA1

      8a87047cec0324e581e3e4cf0f8ed26a6ee71224

      SHA256

      a9933dd2c49b895f320958c4c4d4046e9206b7e42c10c20d3fe6d2b7b30cb0b9

      SHA512

      59511f3bc2386208b272993f5ca6ccbe2a2968354a6b9f9ec5865a483036652cf42fe77a0013aab558d7c85162750a14b5def20f5f5394e17f0ccc6ccdf62814

    • C:\Program Files (x86)\CosmoNaut\swiftshader\libEGL.dll

      Filesize

      252KB

      MD5

      138846462a58f0c8a3403030c2747c86

      SHA1

      8a87047cec0324e581e3e4cf0f8ed26a6ee71224

      SHA256

      a9933dd2c49b895f320958c4c4d4046e9206b7e42c10c20d3fe6d2b7b30cb0b9

      SHA512

      59511f3bc2386208b272993f5ca6ccbe2a2968354a6b9f9ec5865a483036652cf42fe77a0013aab558d7c85162750a14b5def20f5f5394e17f0ccc6ccdf62814

    • C:\Program Files (x86)\CosmoNaut\swiftshader\libGLESv2.dll

      Filesize

      2.9MB

      MD5

      1cb9f7e93104b5bf2b3af199d0302ee1

      SHA1

      6988c5e5f51134a1b3be3533a53a7e8ec9f2788e

      SHA256

      8456ee3c3577cc2582098b21a11a3d5f13ad930a3164dd4014cd7f7e2d540fcf

      SHA512

      c6f89d95d8d5e0c6f5b09f2bc56cf09bb3ea34393f390bf01570c8df6e427c1c436cfbaed2188f0125fbac3aa65d27ae69ebc1fa663bb5f0b8165d1d94439e84

    • C:\Program Files (x86)\CosmoNaut\swiftshader\libGLESv2.dll

      Filesize

      2.9MB

      MD5

      1cb9f7e93104b5bf2b3af199d0302ee1

      SHA1

      6988c5e5f51134a1b3be3533a53a7e8ec9f2788e

      SHA256

      8456ee3c3577cc2582098b21a11a3d5f13ad930a3164dd4014cd7f7e2d540fcf

      SHA512

      c6f89d95d8d5e0c6f5b09f2bc56cf09bb3ea34393f390bf01570c8df6e427c1c436cfbaed2188f0125fbac3aa65d27ae69ebc1fa663bb5f0b8165d1d94439e84

    • C:\Program Files (x86)\CosmoNaut\swiftshader\libegl.dll

      Filesize

      252KB

      MD5

      138846462a58f0c8a3403030c2747c86

      SHA1

      8a87047cec0324e581e3e4cf0f8ed26a6ee71224

      SHA256

      a9933dd2c49b895f320958c4c4d4046e9206b7e42c10c20d3fe6d2b7b30cb0b9

      SHA512

      59511f3bc2386208b272993f5ca6ccbe2a2968354a6b9f9ec5865a483036652cf42fe77a0013aab558d7c85162750a14b5def20f5f5394e17f0ccc6ccdf62814

    • C:\Program Files (x86)\CosmoNaut\swiftshader\libglesv2.dll

      Filesize

      2.9MB

      MD5

      1cb9f7e93104b5bf2b3af199d0302ee1

      SHA1

      6988c5e5f51134a1b3be3533a53a7e8ec9f2788e

      SHA256

      8456ee3c3577cc2582098b21a11a3d5f13ad930a3164dd4014cd7f7e2d540fcf

      SHA512

      c6f89d95d8d5e0c6f5b09f2bc56cf09bb3ea34393f390bf01570c8df6e427c1c436cfbaed2188f0125fbac3aa65d27ae69ebc1fa663bb5f0b8165d1d94439e84

    • C:\Program Files (x86)\CosmoNaut\v8_context_snapshot.bin

      Filesize

      596KB

      MD5

      4453a66a6e810591ea9f5122514d7cb7

      SHA1

      d005ab8967c98338f381af090f68206c31dfdeef

      SHA256

      71a3723be4d336849ad93174116a1d8566a07fd3fe0a3bed781ea386589fb441

      SHA512

      e88fc5a4adfe34ac81668df1703b675a2ee36f0e0bc583b367be6a9c009a79b80b223432dfdc52a2dc76eaefceb577e8f0bf9a9722a08b61f268c994f3bfe928

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\SpiderBanner.dll

      Filesize

      9KB

      MD5

      17309e33b596ba3a5693b4d3e85cf8d7

      SHA1

      7d361836cf53df42021c7f2b148aec9458818c01

      SHA256

      996a259e53ca18b89ec36d038c40148957c978c0fd600a268497d4c92f882a93

      SHA512

      1abac3ce4f2d5e4a635162e16cf9125e059ba1539f70086c2d71cd00d41a6e2a54d468e6f37792e55a822d7082fb388b8dfecc79b59226bbb047b7d28d44d298

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\StdUtils.dll

      Filesize

      100KB

      MD5

      c6a6e03f77c313b267498515488c5740

      SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

      SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

      SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\StdUtils.dll

      Filesize

      100KB

      MD5

      c6a6e03f77c313b267498515488c5740

      SHA1

      3d49fc2784b9450962ed6b82b46e9c3c957d7c15

      SHA256

      b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e

      SHA512

      9870c5879f7b72836805088079ad5bbafcb59fc3d9127f2160d4ec3d6e88d3cc8ebe5a9f5d20a4720fe6407c1336ef10f33b2b9621bc587e930d4cbacf337803

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\System.dll

      Filesize

      12KB

      MD5

      0d7ad4f45dc6f5aa87f606d0331c6901

      SHA1

      48df0911f0484cbe2a8cdd5362140b63c41ee457

      SHA256

      3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca

      SHA512

      c07de7308cb54205e8bd703001a7fe4fd7796c9ac1b4bb330c77c872bf712b093645f40b80ce7127531fe6746a5b66e18ea073ab6a644934abed9bb64126fea9

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\WinShell.dll

      Filesize

      3KB

      MD5

      1cc7c37b7e0c8cd8bf04b6cc283e1e56

      SHA1

      0b9519763be6625bd5abce175dcc59c96d100d4c

      SHA256

      9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6

      SHA512

      7acf7f8e68aa6066b59ca9f2ae2e67997e6b347bc08eb788d2a119b3295c844b5b9606757168e8d2fbd61c2cda367bf80e9e48c9a52c28d5a7a00464bfd2048f

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\nsProcess.dll

      Filesize

      4KB

      MD5

      f0438a894f3a7e01a4aae8d1b5dd0289

      SHA1

      b058e3fcfb7b550041da16bf10d8837024c38bf6

      SHA256

      30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

      SHA512

      f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\nsProcess.dll

      Filesize

      4KB

      MD5

      f0438a894f3a7e01a4aae8d1b5dd0289

      SHA1

      b058e3fcfb7b550041da16bf10d8837024c38bf6

      SHA256

      30c6c3dd3cc7fcea6e6081ce821adc7b2888542dae30bf00e881c0a105eb4d11

      SHA512

      f91fcea19cbddf8086affcb63fe599dc2b36351fc81ac144f58a80a524043ddeaa3943f36c86ebae45dd82e8faf622ea7b7c9b776e74c54b93df2963cfe66cc7

    • C:\Users\Admin\AppData\Local\Temp\nsv8969.tmp\nsis7z.dll

      Filesize

      424KB

      MD5

      80e44ce4895304c6a3a831310fbf8cd0

      SHA1

      36bd49ae21c460be5753a904b4501f1abca53508

      SHA256

      b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592

      SHA512

      c8ba7b1f9113ead23e993e74a48c4427ae3562c1f6d9910b2bbe6806c9107cf7d94bc7d204613e4743d0cd869e00dafd4fb54aad1e8adb69c553f3b9e5bc64df

    • C:\Users\Admin\AppData\Roaming\CosmoNaut\Code Cache\js\index-dir\temp-index

      Filesize

      408B

      MD5

      33c841cc529da9814405472f972029ce

      SHA1

      a8a4875c37139683f5d0c404f59ea9abad5d83b4

      SHA256

      43aac49dd57b989544a01162c6d552cb8958d5101cd32e4705f8695a525ac773

      SHA512

      ac8a0b59d340a8a3112d91713f8be0f77346dddc9850402a561083ec7804c303eacbd702f9855c76d9bc4c45f377989428ebcb8fef72df9ee234fa4bf1596231

    • C:\Users\Admin\AppData\Roaming\CosmoNaut\Code Cache\js\index-dir\the-real-index~RFe5770fa.TMP

      Filesize

      48B

      MD5

      e8bc1dde7f459db8e1017bb674fe4ffb

      SHA1

      a316bf50ac51349d60cd7048cf4feed76371524e

      SHA256

      784f9dce65a4310b72e839d6fac338bf5a18106d3a619455f98b9c5ab3a88a97

      SHA512

      2d17de3c7fdf479ff843eb9637818431ceafcf70570d9b19cc06079bae99aa07d66adf3462da45447f948cabcf99dd103a16a1c3c16c2a7b73e0e78ebb211d26

    • C:\Users\Admin\AppData\Roaming\CosmoNaut\Network Persistent State~RFe57f944.TMP

      Filesize

      59B

      MD5

      2800881c775077e1c4b6e06bf4676de4

      SHA1

      2873631068c8b3b9495638c865915be822442c8b

      SHA256

      226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

      SHA512

      e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

    • C:\Users\Admin\AppData\Roaming\CosmoNaut\Session Storage\CURRENT

      Filesize

      16B

      MD5

      46295cac801e5d4857d09837238a6394

      SHA1

      44e0fa1b517dbf802b18faf0785eeea6ac51594b

      SHA256

      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

      SHA512

      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

    • C:\Users\Admin\AppData\Roaming\CosmoNaut\Session Storage\MANIFEST-000001

      Filesize

      41B

      MD5

      5af87dfd673ba2115e2fcf5cfdb727ab

      SHA1

      d5b5bbf396dc291274584ef71f444f420b6056f1

      SHA256

      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

      SHA512

      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

    • C:\Users\Admin\AppData\Roaming\CosmoNaut\b0f22047-72c2-4f5f-9f7b-dda0c3616756.tmp

      Filesize

      293B

      MD5

      9de5f27bd37078b791aa65985295839f

      SHA1

      2424f7a51a88350ab305a56ccb24b989fd11f6a2

      SHA256

      58f7604db919918f8e77134b0310a465991de673990aa7055dbe92df9671eb74

      SHA512

      e4923f5b07c9e20d976e0d0a5fcf2031e4d75754f360ed94605c1b150d0d2d2cebc0c30e1c46772b0c5fce7ee16b2e6d61793cd530b07adb960d52adfa8c7c3e