cb5de97e9244216b395d884cb3cff3d55f988e2790c9c4e6a65b110d6ccc2f03

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
patched.exe
Size 16.2MB
Sample260620-m2pkhafw71
SHA256 cb5de97e9244216b395d884cb3cff3d55f988e2790c9c4e6a65b110d6ccc2f03
MD5 748bd6d13b47240599f0bb4ed892b21c
SHA1 24773fbb2c15212bc1845bb9326c178d25c3fed5
SHA512 98e387f8e70f376c9c0bec151f7a6792f7762e058f0c5f3a4c942a34a3f1511bdfa20290d66e6caef14c0c665978e5582985d220920b2ab9121468f2a4aea74f
SSDEEP 196608:hrXVG3JHAFzmqXKC8V6Faaya8l0S7oxT8TSfg2lhu:hXVG3JgF3Z46FaayFsxT8TSfg4h
TLSH
T1790706217B5A996DC05BC474834B8B724A7130CA0B39B9FF449496383F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1468	lsp.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	patched.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
13	raw.githubusercontent.com
19	raw.githubusercontent.com
20	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 59 IoCs

discovery

Process Discovery

T1057

pid	Process
5712	tasklist.exe
1992	tasklist.exe
1740	tasklist.exe
1244	tasklist.exe
1108	tasklist.exe
756	tasklist.exe
4388	tasklist.exe
3952	tasklist.exe
1188	tasklist.exe
2796	tasklist.exe
2204	tasklist.exe
1792	tasklist.exe
1568	tasklist.exe
2308	tasklist.exe
4276	tasklist.exe
5932	tasklist.exe
1888	tasklist.exe
824	tasklist.exe
1560	tasklist.exe
2100	tasklist.exe
3236	tasklist.exe
5608	tasklist.exe
2908	tasklist.exe
1556	tasklist.exe
4668	tasklist.exe
3344	tasklist.exe
2244	tasklist.exe
3296	tasklist.exe
4948	tasklist.exe
5780	tasklist.exe
2884	tasklist.exe
3908	tasklist.exe
5820	tasklist.exe
5448	tasklist.exe
5884	tasklist.exe
2872	tasklist.exe
2152	tasklist.exe
5664	tasklist.exe
1404	tasklist.exe
2352	tasklist.exe
2780	tasklist.exe
2448	tasklist.exe
924	tasklist.exe
612	tasklist.exe
4628	tasklist.exe
5728	tasklist.exe
5392	tasklist.exe
2672	tasklist.exe
2184	tasklist.exe
2352	tasklist.exe
3748	tasklist.exe
5456	tasklist.exe
2656	tasklist.exe
1484	tasklist.exe
1008	tasklist.exe
2268	tasklist.exe
4436	tasklist.exe
4192	tasklist.exe
1204	tasklist.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_72700618\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_262958859\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_262958859\kp_pinslist.pb	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1856133164\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_72700618\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_262958859\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_416319294\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_416319294\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1856133164\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_416319294\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_72700618\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_262958859\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_262958859\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1856133164\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1856133164\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_1856133164\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5896_416319294\metadata.pb	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5288	msedgewebview2.exe
5288	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5896	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	tasklist.exe
Token: SeDebugPrivilege	5664	tasklist.exe
Token: SeDebugPrivilege	3748	tasklist.exe
Token: SeDebugPrivilege	4192	tasklist.exe
Token: SeDebugPrivilege	1404	tasklist.exe
Token: SeDebugPrivilege	612	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	2872	tasklist.exe
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	5456	tasklist.exe
Token: SeDebugPrivilege	2308	tasklist.exe
Token: SeDebugPrivilege	1108	tasklist.exe
Token: SeDebugPrivilege	2656	tasklist.exe
Token: SeDebugPrivilege	5608	tasklist.exe
Token: SeDebugPrivilege	2780	tasklist.exe
Token: SeDebugPrivilege	2204	tasklist.exe
Token: SeDebugPrivilege	4628	tasklist.exe
Token: SeDebugPrivilege	1560	tasklist.exe
Token: SeDebugPrivilege	5712	tasklist.exe
Token: SeDebugPrivilege	1792	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	5820	tasklist.exe
Token: SeDebugPrivilege	2448	tasklist.exe
Token: SeDebugPrivilege	4436	tasklist.exe
Token: SeDebugPrivilege	756	tasklist.exe
Token: SeDebugPrivilege	4276	tasklist.exe
Token: SeDebugPrivilege	4388	tasklist.exe
Token: SeDebugPrivilege	3952	tasklist.exe
Token: SeDebugPrivilege	3236	tasklist.exe
Token: SeDebugPrivilege	5728	tasklist.exe
Token: SeDebugPrivilege	924	tasklist.exe
Token: SeDebugPrivilege	1992	tasklist.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeDebugPrivilege	1484	tasklist.exe
Token: SeDebugPrivilege	1008	tasklist.exe
Token: SeDebugPrivilege	1740	tasklist.exe
Token: SeDebugPrivilege	5448	tasklist.exe
Token: SeDebugPrivilege	5932	tasklist.exe
Token: SeDebugPrivilege	5780	tasklist.exe
Token: SeDebugPrivilege	1204	tasklist.exe
Token: SeDebugPrivilege	4668	tasklist.exe
Token: SeDebugPrivilege	1888	tasklist.exe
Token: SeDebugPrivilege	1568	tasklist.exe
Token: SeDebugPrivilege	3344	tasklist.exe
Token: SeDebugPrivilege	1244	tasklist.exe
Token: SeDebugPrivilege	5392	tasklist.exe
Token: SeDebugPrivilege	2884	tasklist.exe
Token: SeDebugPrivilege	3908	tasklist.exe
Token: SeDebugPrivilege	2672	tasklist.exe
Token: SeDebugPrivilege	2244	tasklist.exe
Token: SeDebugPrivilege	2184	tasklist.exe
Token: SeDebugPrivilege	2152	tasklist.exe
Token: SeDebugPrivilege	2352	tasklist.exe
Token: SeDebugPrivilege	5884	tasklist.exe
Token: SeDebugPrivilege	2796	tasklist.exe
Token: SeDebugPrivilege	2908	tasklist.exe
Token: SeDebugPrivilege	1556	tasklist.exe
Token: SeDebugPrivilege	824	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5848	patched.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5848 wrote to memory of 5896	5848	patched.exe	88
PID 5896 wrote to memory of 1920	5896	msedgewebview2.exe	89
PID 5896 wrote to memory of 1944	5896	msedgewebview2.exe	90
PID 5896 wrote to memory of 1944	5896	msedgewebview2.exe	90
PID 5896 wrote to memory of 1944	5896	msedgewebview2.exe	90
PID 5896 wrote to memory of 1944	5896	msedgewebview2.exe	90
PID 5896 wrote to memory of 2072	5896	msedgewebview2.exe	91
PID 5896 wrote to memory of 2328	5896	msedgewebview2.exe	92
PID 5896 wrote to memory of 2328	5896	msedgewebview2.exe	92
PID 5896 wrote to memory of 2328	5896	msedgewebview2.exe	92
PID 5896 wrote to memory of 5568	5896	msedgewebview2.exe	93
PID 5896 wrote to memory of 5568	5896	msedgewebview2.exe	93
PID 5896 wrote to memory of 5568	5896	msedgewebview2.exe	93
PID 5896 wrote to memory of 5568	5896	msedgewebview2.exe	93
PID 5896 wrote to memory of 5568	5896	msedgewebview2.exe	93
PID 5848 wrote to memory of 3296	5848	patched.exe	94
PID 5848 wrote to memory of 5664	5848	patched.exe	97
PID 5848 wrote to memory of 3748	5848	patched.exe	99
PID 5848 wrote to memory of 1468	5848	patched.exe	101
PID 5848 wrote to memory of 4192	5848	patched.exe	103
PID 5848 wrote to memory of 1404	5848	patched.exe	105
PID 5848 wrote to memory of 612	5848	patched.exe	107
PID 5848 wrote to memory of 2352	5848	patched.exe	109
PID 5848 wrote to memory of 2872	5848	patched.exe	111
PID 5848 wrote to memory of 4948	5848	patched.exe	113
PID 5848 wrote to memory of 5456	5848	patched.exe	115
PID 5848 wrote to memory of 2308	5848	patched.exe	118
PID 5848 wrote to memory of 1108	5848	patched.exe	120
PID 5848 wrote to memory of 2656	5848	patched.exe	122
PID 5848 wrote to memory of 5608	5848	patched.exe	124
PID 5848 wrote to memory of 2780	5848	patched.exe	126
PID 5848 wrote to memory of 2204	5848	patched.exe	128
PID 5848 wrote to memory of 4628	5848	patched.exe	130
PID 5848 wrote to memory of 1560	5848	patched.exe	132
PID 5848 wrote to memory of 5712	5848	patched.exe	134
PID 5848 wrote to memory of 1792	5848	patched.exe	136
PID 5848 wrote to memory of 2100	5848	patched.exe	138
PID 5848 wrote to memory of 2268	5848	patched.exe	140
PID 5848 wrote to memory of 5820	5848	patched.exe	142
PID 5848 wrote to memory of 2448	5848	patched.exe	146
PID 5848 wrote to memory of 4436	5848	patched.exe	148
PID 5848 wrote to memory of 756	5848	patched.exe	150
PID 5848 wrote to memory of 4276	5848	patched.exe	152
PID 5848 wrote to memory of 4388	5848	patched.exe	154
PID 5896 wrote to memory of 720	5896	msedgewebview2.exe	156
PID 5896 wrote to memory of 720	5896	msedgewebview2.exe	156
PID 5896 wrote to memory of 720	5896	msedgewebview2.exe	156
PID 5848 wrote to memory of 3952	5848	patched.exe	157
PID 5848 wrote to memory of 3236	5848	patched.exe	159
PID 5848 wrote to memory of 5728	5848	patched.exe	161
PID 5848 wrote to memory of 924	5848	patched.exe	163
PID 5848 wrote to memory of 1992	5848	patched.exe	165
PID 5848 wrote to memory of 1188	5848	patched.exe	167
PID 5848 wrote to memory of 1484	5848	patched.exe	169
PID 5896 wrote to memory of 2436	5896	msedgewebview2.exe	171
PID 5896 wrote to memory of 2436	5896	msedgewebview2.exe	171
PID 5896 wrote to memory of 2436	5896	msedgewebview2.exe	171
PID 5848 wrote to memory of 1008	5848	patched.exe	172
PID 5848 wrote to memory of 1740	5848	patched.exe	174
PID 5848 wrote to memory of 5448	5848	patched.exe	176
PID 5848 wrote to memory of 5932	5848	patched.exe	178
PID 5848 wrote to memory of 5780	5848	patched.exe	180
PID 5848 wrote to memory of 1204	5848	patched.exe	182
PID 5848 wrote to memory of 4668	5848	patched.exe	184

C:\Users\Admin\AppData\Local\Temp\patched.exe
"C:\Users\Admin\AppData\Local\Temp\patched.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5848.1756.16170648594246991552 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7fff53025fd8,0x7fff53025fe4,0x7fff53025ff0
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2096 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2272 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3292 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd /prefetch:1
    3⤵
    PID:5568
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4400 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:720
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4344 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4456 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4536 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5288
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=patched.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4268 --field-trial-handle=1788,i,8489072172816586585,3111680190785343636,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:4476
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3296
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5664
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Users\Admin\AppData\Local\Temp\bin\lsp\lsp.exe
  "C:\Users\Admin\AppData\Local\Temp\bin\lsp\lsp.exe" lsp --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Temp\bin\lsp\docs.json --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\sunc.d.lua --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\synx.d.lua
  2⤵
  - Executes dropped EXE
  PID:1468
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4192
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1404
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:612
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2872
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5456
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2308
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1108
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2656
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5608
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2204
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4628
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1560
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5712
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1792
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5820
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2448
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4436
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:756
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4276
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4388
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3236
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5728
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:924
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1992
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1484
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1008
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1740
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5448
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5932
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5780
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4668
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1888
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1568
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1244
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5392
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2884
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2672
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2244
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2184
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2152
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2352
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5884
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2796
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2908
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1556
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

docs.json

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\docs.json
Size 6.6MB
SHA256 9271cc34574b6fefbacd15cb797ca65004caafbd746da0190f3f8161aefb8c7a
MD5 c67eba5c2d7dcd4b52cbfdb397b60b50
SHA1 138cab1e1bba6bfee5f612cc569df053807c3697
SHA512 e5c114e8fae2e72e7b395c237c595237d2cd7456ca168c29eb4aa33241e78539e9c61f21a4cc3d1b4c20bf16e32173cb19073d2e14444d2853303f44bad428e7
SSDEEP 49152:fcvemzo/SZQJGYbihxzWwvkeFvJVwG9he/a:k
TLSH
T10766CD72C9A01D932686165DF8B9425AF83840DB285D3D88BA9C732C6F88D7F51763CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

globalTypes.d.luau

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\globalTypes.d.luau
Size 747KB
SHA256 7d62f8f4201011319783054438983a458734e0740c57be029b19038af039cc69
MD5 507c16f4edb4b560d694a254d89e4954
SHA1 506ee497f58f96f5c6d78d2ea8de262790ab84ea
SHA512 23a8126a2cc5fafa7353f6a17799264f414ff73f0fbcc954c1c86b2e386c6bae61f25fc75c18ee5d567f67e924572f3be70976dece544f775b305b8016937657
SSDEEP 6144:2SgNZUqKy4qO2CZ6zBXlpv9btJJQc3zVvDtTmRGytFY/OSRlXACAPplC6fTU2AgF:iJQc3zVvDtpDnmXca
TLSH
T126F4441DB6047130194F53F6A9AF4844ACB1B2C6916C50F8E4FCB7891B7F87D22A6ADC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsp.exe

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\lsp.exe
Size 11.1MB
SHA256 911203eb5acaaade326eec106b48824f64881269c85513fdb30e6455d9e6d721
MD5 f8c9f2f036ac7c6e8d100834b5c49ee6
SHA1 421a756eb507ab22a3e5c714231c2a5d7d22f2e9
SHA512 6c0ba341633e3b362beabc140d73c88dde88c9d716f80e88d2164fd38e6ed826473e0aeb450a735f402963e196fdc974d3adfb9d643844b8a576a7d01a5d268e
SSDEEP 98304:VKETtoj3FI6XomceAPRHB7YABv0xn+QW0WHk:cCSjFIWXAu0QW0
TLSH
T147C66D77229C01D8E0BBC07D8BCB9E93DBB2340903719AEF05A045565E5BEE95F3A712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunc.d.lua

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\sunc.d.lua
Size 25KB
SHA256 61dbe3cbbcc60adefe1b8fad53560d83893fc60ea93fa1ca9ab3a548b5593089
MD5 0125416ff324bbdf84633babc980d427
SHA1 5bf2acd0027c8859127690a53e60a821f5a481b2
SHA512 1db0ae12de64e4e1eb3e79c8a9dd7fe6d75523d83c66df01d125701b71ace6551586265748d390a2af6b4579de5064705ec7642f5ed6bc6d44af7e5d4232b0ed
SSDEEP 384:n6WH55qkrzzOzWjylahPuh4yEF82BC41HGkD6FHPYgPpxA2hsn4x:KgzzOzWgahPu8F1C41H5+FQ6Zhsn4x
TLSH
T124C2954AB740B37289671313F5AF624DFA799159232120E8B5FCC19A0F3247D42BBD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

synx.d.lua

Path C:\Users\Admin\AppData\Local\Temp\bin\lsp\synx.d.lua
Size 1KB
SHA256 150aff3ca32e4b8a8f7e4ff86c32546eb9855fdad35001059a9367655ce108ae
MD5 36446716c9214dcb220d1be67cb2929f
SHA1 eec2a86690753df3c924cc861764d9e1609dbd9f
SHA512 ccfa66fcbab0ec334dbbc77ce76f760b2608b8c8b775507549988af2062fae311bc1fc0646a51a62d0672adec192c0b1788dde0b45c308f4105d42ee4f7a7c20
TLSH
T1523141071FD963A295C24B03D1AF41E92A679A133A2974B9F4D4C0A11B9E17CA1F28DC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 19a0deb770d8cdcc4d9324e979db563605a706a70269b77ee253b71cbeeb6df0
MD5 e6fb654cebdecf2a5107553e9d4b4438
SHA1 46eb70606fd5e6502de47d857314480d4a127de1
SHA512 d72a10067c3904042e13e90aff548c6d466620ccd7b9bbbff8bdc4a2e5d61eadff92b7952e33d4f1deb507aec34a279c53b2c0ce444e35ec71ef5aeec221ef6e
TLSH
T16AD0112332030238C2203A332083AA082C00E22B800A8008A828CAEFAF280A00A02882
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b5551007313c7c3aed6a4338091849dadcd69b0923222083d6753d128c7f485c
MD5 9199723760e6e53a8c5fd309109dd585
SHA1 7146b434c60041f412668382df12ee789e68b976
SHA512 aa9cda8969687dad06637c0b9f475289c01fd3d65677503962c6585850ad8c9691684008e2975cde1f1331ef369d911a150ffd32ea50f15b027f30876bb3ba25
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

2d768a4a-c13b-42d6-9ce9-342a7c6a6af3.tmp

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\2d768a4a-c13b-42d6-9ce9-342a7c6a6af3.tmp
Size 6KB
SHA256 f33cb7b65517669d8cdfc3b9b60c3350d715ca770fd34f53ffc5e480dcc466d7
MD5 06e88568c84d3203945705d1c2e6f6a7
SHA1 a4af163d57db221faf56c8e1ce9eab4c54e94c43
SHA512 b0c065838ff627c0a0272ccd37fa48f3a578648dec958af227c155f93823d18d2d46747177c7798496b8d0a3a54100cfccdb13530ea0b0486f463f6108dbeb29
SSDEEP 96:stg/d7uGNb9okuo5h16Z01s7/x+6MhmuecJq21ejeqK+g8e28XM1C7K:stUhyZon1sV+Fdq2QjyaeG6K
TLSH
T11ED1A5025E38697B8CC6E519BA797B17E2F9607275D21E48E7FC4A1C08DA9CC630790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 0611d8c6c78ae555e4a2ffed127c596f636e7f01fed96c1739a8403a16e639e7
MD5 fc645a191cc5c72d76cbd097abeb1bad
SHA1 d6c32d4b13fa5370d45c6e1d3302f4494b9a1e6e
SHA512 6a6f52b7974747184292ecf910627828e1b71acf7a6b804bb4c50dad035f6711beda98b4ddd2bca6f60ca3153bd6d5ea1bd4cb5f53d52a6caa3f9d6bdd24f92b
TLSH
T1CDE0176B05C00845CF5704BB25F508A7737CAA2658D73F0AA09065F461E278197CB410
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595fd9.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe595fd9.TMP
Size 48B
SHA256 aba061716be865ef0d79f295ba3574832479eda88c0b0f0fe840fe44a57d8145
MD5 7ea2e533f00dc9d00766028661858244
SHA1 4dc4362cd22e39f00f8ac2bba7885108a56157ac
SHA512 1100d97f62b091e834e627ae8ba1b882fb5073ac53b3eede0bd7c2d8ac8fb8aac5240300cba0b8b47b672028da50d178b288974f377185b7159f1e2d25a5bf0d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

18dbc00d-4141-442a-aa03-135fa3919c74.tmp

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\18dbc00d-4141-442a-aa03-135fa3919c74.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 be3427e537ab067b01870689abaa98b29b832cd0b735abacf27ce189cd159275
MD5 67052806f8a88e572ac09b3efeadcebc
SHA1 9c803687f30862833c365932023849f298bc1fe2
SHA512 00ce02208aa5043a6715c1e241950483b01a26ed26d99dfa87e6e1ae65300242be87e438bf993ffb995a1d8edea713ca696f8b360b419f8debe6fe17bb680f10
TLSH
T11631BCA6C7E4C66D895166E027343C17CC2D051992383E2BCDEBEFEA67D24B1E21060F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a0b2d.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State~RFe5a0b2d.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 6KB
SHA256 a55c989d7ec72075b106ca65782e4a70d9fb5130f4e3f06d4fa62bf627f158f6
MD5 cb43f96b8cf76e61630c000386ac696e
SHA1 1d4651f3b0f043378b6bd5489ec40bb09f2a20a4
SHA512 7eb807fe9c624d4d1e1ad16692d61e487c62b73fbd542e85f6ace420bdf3be1633dbd8e2f80486a39fd81ca7d92d5294a38ac6a19b26a216ca17517b7b360b91
SSDEEP 96:stg/d7u9GNb9okuo5h16Z01s7/x+6MhmuecJq21ejeqK+g8Fq28XM1C7K:stUhcZon1sV+Fdq2Qjya4G6K
TLSH
T14AD1B5025E24697B8CC6E519BA797B13E2F9607271D21E48E7FC4A1C08DEACC630790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 15KB
SHA256 5fe71882a06fb408da51fc6329c7ec32675c6ad05125c0ac049143a6fc800a48
MD5 ba13d0823c3a36941c454168fb91b3a0
SHA1 dd2abc8c9352731d865b1e1b1c4a6ed584463762
SHA512 fcfa27c3f75b923e7d7639d0e8c21e115e581471adca002361a7650eb29f1ef7419b0f8ac0f0ec3cdd4097dff685eb470b68be8db6d3a52708538b785a736230
SSDEEP 384:1Ojae3af7pOMe4tyUOh8iqLyWpMmGrNBSCFGw/q3Xz:YjaeqD4MlshiLdMmlEq3D
TLSH
T1EC728DAB99B46DBB8C33880A6E456E975B7040EAC2D37F9DECD81B0D059B1CD134781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 2KB
SHA256 63555622b35d1557a2462fc47111f563b5ae275dc0ee1cd6f8ec8d876e8872db
MD5 459d080f26f78a1051a86a34ace0585e
SHA1 abbfd44db340b49f916f65e3566d7b9afa52ff62
SHA512 163a8a34fc22ae4593136e75418d99fe703f431dcf135da7e203069c0f7719910a93a0beb3b697c5f34f50e46415006af710c1702bb0f061188831bdfcd58616
TLSH
T1205163736920AB7BC5A34A167D9A6F529A754076EB931F50A6DC0B0C04CF95C2347C3F
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 7d3ea23b47f88fa0886fbc75600809bc314eb37ee8a8dafbe574185d81f1c628
MD5 66a2498d49916d7d98fbeaec4248c209
SHA1 0c126baba6353ebd4401b7bf664be7f7085b02a4
SHA512 a158eab8293a96f907ba44876ab8741ae7773116346c6c084176a3444edd73dd0627fcc1ab11a5ea38da92b9087074b4601d4a2a86a8c13810ae1250362c985a
TLSH
T14A71857B5970AA7B89E38E157D852F06B7A54037E5C26F94D6EC0F0C05CB6881353C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58f661.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State~RFe58f661.TMP
Size 1KB
SHA256 7490452ba303fa3a426f75d09335280807f72579cb66b58562c2a37eed13630c
MD5 e87cf12d261039914b22c7b917b2dc3a
SHA1 6e8b2df5dddb6f72c148dd5e80df3fb82196e985
SHA512 5e6ca82fd8a496f18c71bb4704e5ee1f0ea10800d47f7b3aba986ec69bf552c0cc33ccc420569564a75cd8289985c29c6cf9ab55c19d3944075fc13594801846
TLSH
T1BC3154B7D5601B76A88656163A95AF976F61007BD2428F44B2DD0B0C09DF44C922BC36
MD5 SHA1 SHA512 TLSH

Submit Download

ui-state.json

Path C:\Users\Admin\AppData\Roaming\Cosmic\ui-state.json
Size 1KB
SHA256 f1d6cb057d7b41ec33d784eb06b7087ca95b9ac6bb964853d0c4f4abee0e0d3a
MD5 4b1a377a905c9ae3447556718afd8dfb
SHA1 57135a4721160c35beb700c678f3d956b831d830
SHA512 6610a3abd08a1251a718cb1baada54a4acb5f8f588829121b746a43ed92612d0f6f5572411ef02c2c6ddc75f89be879feaab87350bade0c0fd2e7d1377400075
TLSH
T1BF412929C6640C7710E476699CED92537A7482130D693C28B38C5A4C5F9E32E61F69ED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/720-317-0x00007FFF74650000-0x00007FFF74651000-memory.dmp

Download

memory/720-318-0x0000011CEBE40000-0x0000011CEBE41000-memory.dmp

Download

memory/720-335-0x0000011CEBE10000-0x0000011CEBE3A000-memory.dmp

Download

memory/952-376-0x000002894DF30000-0x000002894DF31000-memory.dmp

Download

memory/952-387-0x000002894DF00000-0x000002894DF2A000-memory.dmp

Download

memory/1944-26-0x00007FFF74F40000-0x00007FFF74F41000-memory.dmp

Download

memory/2436-349-0x0000017F06BF0000-0x0000017F06BF1000-memory.dmp

Download

memory/2436-363-0x0000017F06BC0000-0x0000017F06BEA000-memory.dmp

Download

memory/4476-420-0x0000021302CF0000-0x0000021302CF1000-memory.dmp

Download

memory/4476-437-0x0000021302CC0000-0x0000021302CEA000-memory.dmp

Download

memory/5288-400-0x0000015E8A020000-0x0000015E8A021000-memory.dmp

Download

memory/5288-395-0x0000015E8A020000-0x0000015E8A021000-memory.dmp

Download

memory/5288-399-0x0000015E8A020000-0x0000015E8A021000-memory.dmp

Download

memory/5288-398-0x0000015E8A020000-0x0000015E8A021000-memory.dmp

Download

memory/5288-397-0x0000015E8A020000-0x0000015E8A021000-memory.dmp

Download

memory/5288-396-0x0000015E8A020000-0x0000015E8A021000-memory.dmp

Download

memory/5288-389-0x0000015E8A020000-0x0000015E8A021000-memory.dmp

Download

memory/5288-391-0x0000015E8A020000-0x0000015E8A021000-memory.dmp

Download

memory/5568-47-0x00007FFF74F40000-0x00007FFF74F41000-memory.dmp

Download