22c126f7eec588ee722f5474b1a9520e64fe6fa8d51448234e6e7906bf3ede2f

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cosmic-UI.exe
Size 16.2MB
Sample260702-ryf66sds5r
SHA256 22c126f7eec588ee722f5474b1a9520e64fe6fa8d51448234e6e7906bf3ede2f
MD5 aaa2f3b63451b9c651279f227b97fdd7
SHA1 e92f161641650ad08d79a3e1b02dda9e358576c3
SHA512 9c916ebc43fb683b64eb7c8a4314bd6b5ee5d36e8ade1c80445ec7dbb14a9297502d495f5390695e9694ed190a12e42d7d5f8746edd942142bfebc3e6a0743f4
SSDEEP 196608:arXVG3JHAFzmqXKC8V6Faaya8l0S7oxT8TSfg2lhu:oXVG3JgF3Z46FaayFsxT8TSfg4h
TLSH
T14B0706217B5A996DC05BC474834B8B724A7130CA0B39B9FF449496383F6ABF46F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Cosmic-UI.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Enumerates processes with tasklist 1 TTPs 59 IoCs

discovery

Process Discovery

T1057

pid	Process
5124	tasklist.exe
3956	tasklist.exe
5812	tasklist.exe
5936	tasklist.exe
3612	tasklist.exe
4924	tasklist.exe
1500	tasklist.exe
5600	tasklist.exe
1060	tasklist.exe
4284	tasklist.exe
1116	tasklist.exe
6080	tasklist.exe
2268	tasklist.exe
5896	tasklist.exe
4612	tasklist.exe
1824	tasklist.exe
3732	tasklist.exe
5400	tasklist.exe
2780	tasklist.exe
3972	tasklist.exe
4948	tasklist.exe
5124	tasklist.exe
2080	tasklist.exe
1500	tasklist.exe
5684	tasklist.exe
4688	tasklist.exe
4484	tasklist.exe
4896	tasklist.exe
5800	tasklist.exe
2016	tasklist.exe
2356	tasklist.exe
5936	tasklist.exe
4968	tasklist.exe
5988	tasklist.exe
5624	tasklist.exe
5568	tasklist.exe
5440	tasklist.exe
4156	tasklist.exe
2644	tasklist.exe
1952	tasklist.exe
2304	tasklist.exe
1288	tasklist.exe
2860	tasklist.exe
5812	tasklist.exe
4452	tasklist.exe
3700	tasklist.exe
2700	tasklist.exe
932	tasklist.exe
5500	tasklist.exe
2984	tasklist.exe
2100	tasklist.exe
3864	tasklist.exe
2568	tasklist.exe
5180	tasklist.exe
6076	tasklist.exe
2372	tasklist.exe
5036	tasklist.exe
4408	tasklist.exe
3748	tasklist.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1614135981\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\adblock_snippet.js	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1177270369\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Filtering Rules	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Filtering Rules-CA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Part-IT	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Part-RU	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1177270369\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1177270369\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Filtering Rules-AA	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Part-FR	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Part-NL	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Part-ZH	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1614135981\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1614135981\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Part-DE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3696_1116096309\Part-ES	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3932	msedgewebview2.exe
3932	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3696	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	4408	tasklist.exe
Token: SeDebugPrivilege	3956	tasklist.exe
Token: SeDebugPrivilege	5896	tasklist.exe
Token: SeDebugPrivilege	1952	tasklist.exe
Token: SeDebugPrivilege	5812	tasklist.exe
Token: SeDebugPrivilege	1824	tasklist.exe
Token: SeDebugPrivilege	2080	tasklist.exe
Token: SeDebugPrivilege	1500	tasklist.exe
Token: SeDebugPrivilege	5600	tasklist.exe
Token: SeDebugPrivilege	4156	tasklist.exe
Token: SeDebugPrivilege	5400	tasklist.exe
Token: SeDebugPrivilege	5988	tasklist.exe
Token: SeDebugPrivilege	4968	tasklist.exe
Token: SeDebugPrivilege	3864	tasklist.exe
Token: SeDebugPrivilege	1060	tasklist.exe
Token: SeDebugPrivilege	3972	tasklist.exe
Token: SeDebugPrivilege	2780	tasklist.exe
Token: SeDebugPrivilege	4948	tasklist.exe
Token: SeDebugPrivilege	2860	tasklist.exe
Token: SeDebugPrivilege	2304	tasklist.exe
Token: SeDebugPrivilege	5684	tasklist.exe
Token: SeDebugPrivilege	3732	tasklist.exe
Token: SeDebugPrivilege	2700	tasklist.exe
Token: SeDebugPrivilege	932	tasklist.exe
Token: SeDebugPrivilege	5500	tasklist.exe
Token: SeDebugPrivilege	4612	tasklist.exe
Token: SeDebugPrivilege	4284	tasklist.exe
Token: SeDebugPrivilege	5936	tasklist.exe
Token: SeDebugPrivilege	4688	tasklist.exe
Token: SeDebugPrivilege	1116	tasklist.exe
Token: SeDebugPrivilege	5124	tasklist.exe
Token: SeDebugPrivilege	2644	tasklist.exe
Token: SeDebugPrivilege	2984	tasklist.exe
Token: SeDebugPrivilege	4484	tasklist.exe
Token: SeDebugPrivilege	3612	tasklist.exe
Token: SeDebugPrivilege	5812	tasklist.exe
Token: SeDebugPrivilege	4896	tasklist.exe
Token: SeDebugPrivilege	2568	tasklist.exe
Token: SeDebugPrivilege	3748	tasklist.exe
Token: SeDebugPrivilege	5624	tasklist.exe
Token: SeDebugPrivilege	5800	tasklist.exe
Token: SeDebugPrivilege	5568	tasklist.exe
Token: SeDebugPrivilege	2356	tasklist.exe
Token: SeDebugPrivilege	3700	tasklist.exe
Token: SeDebugPrivilege	5936	tasklist.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	5180	tasklist.exe
Token: SeDebugPrivilege	5124	tasklist.exe
Token: SeDebugPrivilege	6076	tasklist.exe
Token: SeDebugPrivilege	2372	tasklist.exe
Token: SeDebugPrivilege	6080	tasklist.exe
Token: SeDebugPrivilege	4452	tasklist.exe
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeDebugPrivilege	2100	tasklist.exe
Token: SeDebugPrivilege	4924	tasklist.exe
Token: SeDebugPrivilege	1500	tasklist.exe
Token: SeDebugPrivilege	2268	tasklist.exe
Token: SeDebugPrivilege	1288	tasklist.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4636	Cosmic-UI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 3696	4636	Cosmic-UI.exe	88
PID 3696 wrote to memory of 1796	3696	msedgewebview2.exe	89
PID 3696 wrote to memory of 5188	3696	msedgewebview2.exe	90
PID 3696 wrote to memory of 5188	3696	msedgewebview2.exe	90
PID 3696 wrote to memory of 5188	3696	msedgewebview2.exe	90
PID 3696 wrote to memory of 5188	3696	msedgewebview2.exe	90
PID 3696 wrote to memory of 5328	3696	msedgewebview2.exe	91
PID 3696 wrote to memory of 5240	3696	msedgewebview2.exe	92
PID 3696 wrote to memory of 5240	3696	msedgewebview2.exe	92
PID 3696 wrote to memory of 5240	3696	msedgewebview2.exe	92
PID 3696 wrote to memory of 5784	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 5784	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 5784	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 5784	3696	msedgewebview2.exe	93
PID 3696 wrote to memory of 5784	3696	msedgewebview2.exe	93
PID 4636 wrote to memory of 4408	4636	Cosmic-UI.exe	94
PID 4636 wrote to memory of 3956	4636	Cosmic-UI.exe	97
PID 4636 wrote to memory of 5896	4636	Cosmic-UI.exe	99
PID 4636 wrote to memory of 1952	4636	Cosmic-UI.exe	101
PID 4636 wrote to memory of 5812	4636	Cosmic-UI.exe	103
PID 4636 wrote to memory of 1824	4636	Cosmic-UI.exe	105
PID 4636 wrote to memory of 2080	4636	Cosmic-UI.exe	107
PID 4636 wrote to memory of 1500	4636	Cosmic-UI.exe	109
PID 4636 wrote to memory of 5600	4636	Cosmic-UI.exe	111
PID 4636 wrote to memory of 4156	4636	Cosmic-UI.exe	113
PID 4636 wrote to memory of 5400	4636	Cosmic-UI.exe	115
PID 4636 wrote to memory of 5988	4636	Cosmic-UI.exe	118
PID 4636 wrote to memory of 4968	4636	Cosmic-UI.exe	120
PID 4636 wrote to memory of 3864	4636	Cosmic-UI.exe	122
PID 4636 wrote to memory of 1060	4636	Cosmic-UI.exe	124
PID 4636 wrote to memory of 3972	4636	Cosmic-UI.exe	126
PID 4636 wrote to memory of 2780	4636	Cosmic-UI.exe	128
PID 4636 wrote to memory of 4948	4636	Cosmic-UI.exe	130
PID 4636 wrote to memory of 2860	4636	Cosmic-UI.exe	132
PID 4636 wrote to memory of 2304	4636	Cosmic-UI.exe	134
PID 4636 wrote to memory of 5684	4636	Cosmic-UI.exe	136
PID 4636 wrote to memory of 3732	4636	Cosmic-UI.exe	138
PID 4636 wrote to memory of 2700	4636	Cosmic-UI.exe	140
PID 4636 wrote to memory of 932	4636	Cosmic-UI.exe	142
PID 4636 wrote to memory of 5500	4636	Cosmic-UI.exe	146
PID 4636 wrote to memory of 4612	4636	Cosmic-UI.exe	148
PID 4636 wrote to memory of 4284	4636	Cosmic-UI.exe	150
PID 4636 wrote to memory of 5936	4636	Cosmic-UI.exe	152
PID 4636 wrote to memory of 4688	4636	Cosmic-UI.exe	154
PID 4636 wrote to memory of 1116	4636	Cosmic-UI.exe	156
PID 4636 wrote to memory of 5124	4636	Cosmic-UI.exe	158
PID 4636 wrote to memory of 2644	4636	Cosmic-UI.exe	160
PID 4636 wrote to memory of 2984	4636	Cosmic-UI.exe	162
PID 4636 wrote to memory of 4484	4636	Cosmic-UI.exe	164
PID 3696 wrote to memory of 1200	3696	msedgewebview2.exe	166
PID 3696 wrote to memory of 1200	3696	msedgewebview2.exe	166
PID 3696 wrote to memory of 1200	3696	msedgewebview2.exe	166
PID 4636 wrote to memory of 3612	4636	Cosmic-UI.exe	167
PID 4636 wrote to memory of 5812	4636	Cosmic-UI.exe	169
PID 4636 wrote to memory of 4896	4636	Cosmic-UI.exe	171
PID 4636 wrote to memory of 2568	4636	Cosmic-UI.exe	173
PID 4636 wrote to memory of 3748	4636	Cosmic-UI.exe	175
PID 4636 wrote to memory of 5624	4636	Cosmic-UI.exe	177
PID 4636 wrote to memory of 5800	4636	Cosmic-UI.exe	179
PID 4636 wrote to memory of 5568	4636	Cosmic-UI.exe	181
PID 4636 wrote to memory of 2356	4636	Cosmic-UI.exe	183
PID 4636 wrote to memory of 3700	4636	Cosmic-UI.exe	185
PID 4636 wrote to memory of 5936	4636	Cosmic-UI.exe	187
PID 3696 wrote to memory of 4416	3696	msedgewebview2.exe	189

C:\Users\Admin\AppData\Local\Temp\Cosmic-UI.exe
"C:\Users\Admin\AppData\Local\Temp\Cosmic-UI.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4636.4856.17850864805214015391 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3696
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x160,0x198,0x7ff908485fd8,0x7ff908485fe4,0x7ff908485ff0
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,2036325248425767690,17045801534635070293,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:5188
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=1936 --field-trial-handle=1768,i,2036325248425767690,17045801534635070293,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:5328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2460 --field-trial-handle=1768,i,2036325248425767690,17045801534635070293,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:5240
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2788 --field-trial-handle=1768,i,2036325248425767690,17045801534635070293,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd /prefetch:1
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4448 --field-trial-handle=1768,i,2036325248425767690,17045801534635070293,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4592 --field-trial-handle=1768,i,2036325248425767690,17045801534635070293,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:4416
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4732 --field-trial-handle=1768,i,2036325248425767690,17045801534635070293,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=Cosmic-UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2288 --field-trial-handle=1768,i,2036325248425767690,17045801534635070293,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:4368
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4408
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5896
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1952
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5812
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1824
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2080
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5600
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5400
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5988
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4968
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3864
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1060
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3972
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2780
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4948
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5684
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2700
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5500
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4612
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4284
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4688
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1116
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5124
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2644
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2984
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4484
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3612
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5812
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4896
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2568
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3748
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5800
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5568
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:3700
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5936
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5180
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5124
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6076
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2372
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:6080
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:5036
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2100
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:4924
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1500
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  PID:5440
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:2268
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Enumerates processes with tasklist
  - Suspicious use of AdjustPrivilegeToken
  PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0ac8c863d01eaa44e433f2f5f95391f4bb8dab79b33ae5b0f5299f1cb5440931
MD5 c5f12254b91afb93ffb799d93cd8eed4
SHA1 39d35f9094252738f1b877fada3ddc2cf8b5a1be
SHA512 46c7cacf5fd248e2c651ae02d9e22b78602e4dcdc5892a4504ea31ffb06bde60e313bed5dfff54967299d57b290f9512ba0c8e01a936d03edb67b082b933cb81
TLSH
T19ED0123332520278C01020331003711D0481C10F408645056428CE1DAA140A00D13481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6a09b1b2c8efe1f694ad57e84a2bab71c0a8f91767db6981f911d776c7c43dea
MD5 39eae6fac118ddea1a629c3ff55d4349
SHA1 c68d0032c28ee71c90a02fac4760c786fc752233
SHA512 467d51cee66e36f3d47a7e6d8b806fb8c30c0971244c6f65e9ac6b110932fff1824568da57aac9b8b103bf3c9ff2b1066373d12e067630445173be98085554b5
TLSH
T1E7D0043151510154C00550311015513501C1C44C04D30F0511104D04D4500514413044
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

417f5b53-4c36-4851-aa15-63a09a07685a.tmp

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\417f5b53-4c36-4851-aa15-63a09a07685a.tmp
Size 6KB
SHA256 04a3b7ab84878fced420e6e8b243280849e256458c351bf3c6e5cabfe02abc4d
MD5 094aacd29339b12a9886c2476b2242ff
SHA1 7250d82eeb0c8d4cd91888d901bc736ae5c67f6b
SHA512 3ce56c68af27cef6baba0d66bcf0e346910d0d40d3908db6d30fb42af4f1791a17f0cfa90baa131e3654f20df925a7dd00fc12a9fc705f2a12c9bd798cf53795
SSDEEP 96:st7/d7WrcxxGOb9QkzMo5h16Z0As7/x+6MhmuecJwG81ejefK+ggp+28XM1C7K:stDh0x7onAsV+FdwG8QjBKp+G6K
TLSH
T114D1B6025E24697B4CC6E609BB397B43E2F9607261D52E5CEBFC461C08DB6CC631790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 fa640d3530daac334a7f8c33267210b33bc169dd9c116692c133ee7f88dc410c
MD5 b008ce5bbe643e148fadc1b81f44d8c1
SHA1 cb4ba6a5c8d7ac5eabb57bb0c48387763b6deb16
SHA512 88ab9d54004b229e5a4b4683e6462e78e7400e14bd6e135cbf176e18bf3f57eb207dfad9e6b9da119b880874d29d5911a6bd5301491d23dfcd99664f8e6b8686
TLSH
T1A8D0127C0B4049C4D7875174B4E70CF07FF48D5450B71D0FB15741705551B40570A521
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 f000026baee9c8caa3ab08f34001fdb8dede3b4f9048146f8f7d097cf458206e
MD5 fdda91d15bee2055ca61a7284742063b
SHA1 c3cc76ac58007f6851b24f69807bfb3f7d8d7aae
SHA512 d7720b03f3e2658a5c028b2e037d771776a509914c4348726c6b410bc22edfb8b6e8587e5efa0e236d92a59e115e22cfc92c831f2918a13e7140d98c60afa9d4
TLSH
T14BE017BC07C409C6DB8B41B4A8F80CE0BFF48DA95077DD0FAAC385B860967805A49420
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593128.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe593128.TMP
Size 48B
SHA256 b39d371b2c267c0fbe1092ee17dfa441e8a00189bc1f3fb6ec22402db8b658d6
MD5 f3be46fd320920997a15e2f5914183a0
SHA1 f9d4e0ab362145b8379d64c0424214b19f1c17cc
SHA512 fdb9b20e0b2930affd5795ce515dafb2a47bc8d7c78b0c5b88f74501d8f20250129ae7e1a19de0a5c305ab582d687885efc9303d92052f1517aa924751e8e622
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

76a46b2e-e90b-4eb0-ab39-597e3f874e29.tmp

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\76a46b2e-e90b-4eb0-ab39-597e3f874e29.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 5ad5e167d972f8b10b021c4a2638c96cc7c10b34030fb98ed0a670e725cd496d
MD5 fd012fe5c0c0fd6871db22cadf4b9b2b
SHA1 aee980d5167588001c85839eab4456ef7a49d83d
SHA512 c950d3f7f63e4ff2067f802ad8e0619addcb8c9fa08807b08e4f7f728c1063777bf1319b71cfde1fd73a6ebe0adb952143b0f052185df6b60ae671ed511ea0ec
TLSH
T11B416AA2C3E4C66D894166F427347C17CD2E0519A2286E3B8DDBFBDA67D20B1D22124E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f3eb.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State~RFe59f3eb.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity
Size 859B
SHA256 95fe858191ef458ae6403d6eef4136b07b794185e9836231da46288bae7035f3
MD5 93d90e4049c1c785399917afd5ba6461
SHA1 17b0a9fbaa5e7c99750a0e02509c77971a7a1d1e
SHA512 00133b9933df8eef8c2316f628e54d29d119e6ef1647a1b9d9d3d35b5e48fcf68756e9fab55ef26f5f94b26c8c008fa2e816c6834838057509ea94fc51d5d1b2
TLSH
T1D411559B817FA46B44BD197B0E847C495BBAF831316168F8CB53827C70805E75A26032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 607235e2e2171e13d4e4e5b50b5d7ef877228e95e577c807e127faaa8e2c329d
MD5 2ea1a756bbf3ae7e1bb6e259d4293e39
SHA1 fedbfb5906a216c19e5fba9729402a6d481c9df1
SHA512 7ce22b762c66aac517fd07a4c592baf610dc2e7efb403c0044c075aeec94b3fb613912a213831764dc7658adb32e6b30beb674bdf8859a800b5ed363b2eb93cc
TLSH
T1110176EB80BBA86B88BC193B0E487C455FBAF436342168FCCF53827C70904E74A16422
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe599793.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity~RFe599793.TMP
Size 356B
SHA256 64f8d70257713c55ac4669431d571d633a87124217af8b9ec7bea848089f8f08
MD5 c82ae427454406697d7cba02b319b48f
SHA1 f734c37d04102809104fa58810284e9d647b25bd
SHA512 f5220e538253c42e61675a84877008622852c63b9837aedb439c80531c5560fa91ab1ea77acbff4bf4a67aa61529fef58424cab9076d6cdde19afb325b01922e
TLSH
T149E020D3417FE57710BC0D2A2C407C456E7AB13155605CF8DE92817D60515E75916421
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 6KB
SHA256 c6c1a01ea37fd49cc6fb5df289594b7c307fbcfcbc591ae8004038f11aa252a1
MD5 6ab46db7ab8a408e4fe2104cc0585055
SHA1 a865a43f54f90b4e7fb523c983c4c5b22fb00b49
SHA512 bed99a59e274ca11f3fb3df4905ae6e4946d06bf8c8f366b64d5e72c50189c26c11f3860f7a81f106e39c35f9b909113fc68bc24ee8532e25d7bfdbf38be0d81
SSDEEP 96:st7/d7Wrcx4GGOb9QkzMo5h16Z0As7/x+6MhmuecJwG81ejefK+ggA+28XM1C7K:stDh0j7onAsV+FdwG8QjBKA+G6K
TLSH
T173D1B5025E24697B4CC7E609BB397B53E2F9607261952E5CEBFC461C08DB6CC621780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 2KB
SHA256 8be16ca10918680eb8e9a580d300944baeb61b1d1a5f6427be32552f515f72be
MD5 606b5797fc44cd0dbf565ea5e8ee2ff0
SHA1 49071ba205a1f300477b710cb2818a8064809a0d
SHA512 34f37fcaa237a857d223f84b05247ed11a4366c5dd94a224ddad4d810bed6ad058e162ea39688b731d1924cfcb34a894438c62b245ab131c04918cc3f4dbeeb3
TLSH
T19E518433AC109A7745E39B09798A6E53CFB55065AA523F54ADCC0B0C02DB54C2353C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 a3928a8966018009a2c3d2e8e39b755cbbb121129dd19779e6c078dd9d777a16
MD5 e50e3db41e37061c4a922d6e4f0f9183
SHA1 b1f2af4af6fde179b6c421227dca8058a182155a
SHA512 a32e6f2a7640a109efa744ad26e918432370b82ff9f1271d20db2dd2b84d130eaebc232c6d83e35c494f4c38f2b7a385094c50e492d0e9049cedc76186cafef1
TLSH
T1D0717577AD60A97749E3DA0979862F56ABE15037E5853F98DDDC0F0C02D72881353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 15KB
SHA256 3ac7006356bc7c79e462cb1de754b1ab403384f51154fb74186aeecf70eaa00b
MD5 18f03c539b34ab07b0d5db54ed723b00
SHA1 28f70154cc242b5e262f27ab5270d6eab7f1abe7
SHA512 b53d51892f157a1f1a3a0b3cc9b93a71a2b1914d96c3e867a1d6fbdc07debd621867d5a21be71c70b61a42974002dfcd9fe397fc961332878b0434c318d5466e
SSDEEP 384:msrv+89zHqlDNP9oid6NBSFgJXSF70YisdriNm:Rrv+4UNbdHyXYAYistiNm
TLSH
T14272AF33E838A6374DB3D909F48A6B077BB860A765C21AB4D98D4B8C42DB0C92317D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58df9d.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State~RFe58df9d.TMP
Size 1KB
SHA256 2f212a67f43ae496e6ed2c5284d8466622b1c9985c49a18b054f2e111128cfc4
MD5 b6f235ec70aaadd197f4104719f8d853
SHA1 e46b0836cf914b074ef88634d27b9fd85eb3a262
SHA512 c5c3411c5fc8c50afb703126e5bf03c1f1c28c6086c775b84db38c8c0fd4f6b419d2284e37d9a177ca179dd323788ff4ab47367cf3b2e3765b1d72450b3339fa
TLSH
T16D3174B2EC905B726897A60A3156AE879F60507A92426F44BDCD4A0C12D704C513BC37
MD5 SHA1 SHA512 TLSH

Submit Download

ui-state.json

Path C:\Users\Admin\AppData\Roaming\Cosmic\ui-state.json
Size 1KB
SHA256 f1d6cb057d7b41ec33d784eb06b7087ca95b9ac6bb964853d0c4f4abee0e0d3a
MD5 4b1a377a905c9ae3447556718afd8dfb
SHA1 57135a4721160c35beb700c678f3d956b831d830
SHA512 6610a3abd08a1251a718cb1baada54a4acb5f8f588829121b746a43ed92612d0f6f5572411ef02c2c6ddc75f89be879feaab87350bade0c0fd2e7d1377400075
TLSH
T1BF412929C6640C7710E476699CED92537A7482130D693C28B38C5A4C5F9E32E61F69ED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1200-335-0x00007FF92A860000-0x00007FF92A861000-memory.dmp

Download

memory/1200-334-0x00007FF92B180000-0x00007FF92B181000-memory.dmp

Download

memory/3932-381-0x00000160A9350000-0x00000160A9351000-memory.dmp

Download

memory/3932-374-0x00000160A9350000-0x00000160A9351000-memory.dmp

Download

memory/3932-376-0x00000160A9350000-0x00000160A9351000-memory.dmp

Download

memory/3932-385-0x00000160A9350000-0x00000160A9351000-memory.dmp

Download

memory/3932-383-0x00000160A9350000-0x00000160A9351000-memory.dmp

Download

memory/3932-382-0x00000160A9350000-0x00000160A9351000-memory.dmp

Download

memory/3932-380-0x00000160A9350000-0x00000160A9351000-memory.dmp

Download

memory/3932-384-0x00000160A9350000-0x00000160A9351000-memory.dmp

Download

memory/5188-212-0x0000014FA7A30000-0x0000014FA7B46000-memory.dmp

Download

memory/5188-26-0x00007FF92B060000-0x00007FF92B061000-memory.dmp

Download

memory/5188-230-0x0000014FA7A30000-0x0000014FA7B46000-memory.dmp

Download

memory/5188-287-0x0000014FA7A30000-0x0000014FA7B46000-memory.dmp

Download

memory/5188-406-0x0000014FA7A30000-0x0000014FA7B46000-memory.dmp

Download

memory/5784-213-0x00000186B3DE0000-0x00000186B3EF6000-memory.dmp

Download

memory/5784-63-0x00007FF92B060000-0x00007FF92B061000-memory.dmp

Download