f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0

Analysis

user interaction
yes
max time kernel
103s
max time network
105s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UI.exe
Size 16.4MB
Sample260803-vmfytace89
SHA256 f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0
MD5 a2b6b7198b6699f866a745c8ba55c2c1
SHA1 ab063e32b77137604c214916dffce1b5a3871cd5
SHA512 c158333918433e47c3c08901034b85ba99894ee37a719520c358618d74555f0bc19af2c2f274a6f4005a56d42a814ee804d8e684191084c46437e78ec751fff5
SSDEEP 196608:5sC0dlkPaQbao2Faaya8l0S7oo3TwhRCuMqoW:l0d0uFaayFso3TwhRX
TLSH
T1A30706257B5A996DC05AC4B4834B8B72497130DB0B39B9FF449492382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1480	UI.exe
5236	lsp.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
74	raw.githubusercontent.com
82	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 35 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
1660	tasklist.exe
3596	tasklist.exe
2904	tasklist.exe
2512	tasklist.exe
3156	tasklist.exe
4736	tasklist.exe
3676	tasklist.exe
2312	tasklist.exe
4584	tasklist.exe
2772	tasklist.exe
1744	tasklist.exe
4748	tasklist.exe
4424	tasklist.exe
4352	tasklist.exe
1380	tasklist.exe
1716	tasklist.exe
4424	tasklist.exe
2400	tasklist.exe
5624	tasklist.exe
2456	tasklist.exe
2628	tasklist.exe
1572	tasklist.exe
700	tasklist.exe
4152	tasklist.exe
2684	tasklist.exe
1716	tasklist.exe
2816	tasklist.exe
4084	tasklist.exe
5204	tasklist.exe
124	tasklist.exe
5444	tasklist.exe
5500	tasklist.exe
3644	tasklist.exe
1224	tasklist.exe
892	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1092_655093241\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1092_655093241\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1092_655093241\manifest.fingerprint	msedgewebview2.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2524	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
268	cmd.exe
4092	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1968	PING.EXE

System Network Connections Discovery 1 TTPs 1 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
2812	netstat.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2812	netstat.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1968	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2524	powershell.exe
2524	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4332	msedgewebview2.exe
1092	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 58 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	tasklist.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeIncreaseQuotaPrivilege	2524	powershell.exe
Token: SeSecurityPrivilege	2524	powershell.exe
Token: SeTakeOwnershipPrivilege	2524	powershell.exe
Token: SeLoadDriverPrivilege	2524	powershell.exe
Token: SeSystemProfilePrivilege	2524	powershell.exe
Token: SeSystemtimePrivilege	2524	powershell.exe
Token: SeProfSingleProcessPrivilege	2524	powershell.exe
Token: SeIncBasePriorityPrivilege	2524	powershell.exe
Token: SeCreatePagefilePrivilege	2524	powershell.exe
Token: SeBackupPrivilege	2524	powershell.exe
Token: SeRestorePrivilege	2524	powershell.exe
Token: SeShutdownPrivilege	2524	powershell.exe
Token: SeDebugPrivilege	2524	powershell.exe
Token: SeSystemEnvironmentPrivilege	2524	powershell.exe
Token: SeRemoteShutdownPrivilege	2524	powershell.exe
Token: SeUndockPrivilege	2524	powershell.exe
Token: SeManageVolumePrivilege	2524	powershell.exe
Token: 33	2524	powershell.exe
Token: 34	2524	powershell.exe
Token: 35	2524	powershell.exe
Token: 36	2524	powershell.exe
Token: SeDebugPrivilege	2812	netstat.exe
Token: SeDebugPrivilege	4152	tasklist.exe
Token: SeDebugPrivilege	1716	tasklist.exe
Token: SeDebugPrivilege	2816	tasklist.exe
Token: SeDebugPrivilege	4084	tasklist.exe
Token: SeDebugPrivilege	3676	tasklist.exe
Token: SeDebugPrivilege	1744	tasklist.exe
Token: SeDebugPrivilege	4424	tasklist.exe
Token: SeDebugPrivilege	5500	tasklist.exe
Token: SeDebugPrivilege	892	tasklist.exe
Token: SeDebugPrivilege	5204	tasklist.exe
Token: SeDebugPrivilege	124	tasklist.exe
Token: SeDebugPrivilege	4748	tasklist.exe
Token: SeDebugPrivilege	3644	tasklist.exe
Token: SeDebugPrivilege	2400	tasklist.exe
Token: SeDebugPrivilege	5624	tasklist.exe
Token: SeDebugPrivilege	2312	tasklist.exe
Token: SeDebugPrivilege	1572	tasklist.exe
Token: SeDebugPrivilege	1660	tasklist.exe
Token: SeDebugPrivilege	3596	tasklist.exe
Token: SeDebugPrivilege	1224	tasklist.exe
Token: SeDebugPrivilege	2904	tasklist.exe
Token: SeDebugPrivilege	4424	tasklist.exe
Token: SeDebugPrivilege	2456	tasklist.exe
Token: SeDebugPrivilege	2772	tasklist.exe
Token: SeDebugPrivilege	1380	tasklist.exe
Token: SeDebugPrivilege	2684	tasklist.exe
Token: SeDebugPrivilege	2512	tasklist.exe
Token: SeDebugPrivilege	2628	tasklist.exe
Token: SeDebugPrivilege	4352	tasklist.exe
Token: SeDebugPrivilege	3156	tasklist.exe
Token: SeDebugPrivilege	5444	tasklist.exe
Token: SeDebugPrivilege	4736	tasklist.exe
Token: SeDebugPrivilege	4584	tasklist.exe
Token: SeDebugPrivilege	700	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5136	UI.exe
1480	UI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 1716	5136	UI.exe	89
PID 5136 wrote to memory of 2524	5136	UI.exe	92
PID 5136 wrote to memory of 2812	5136	UI.exe	94
PID 5136 wrote to memory of 4332	5136	UI.exe	96
PID 4332 wrote to memory of 2324	4332	msedgewebview2.exe	97
PID 4332 wrote to memory of 3740	4332	msedgewebview2.exe	98
PID 4332 wrote to memory of 3740	4332	msedgewebview2.exe	98
PID 4332 wrote to memory of 3740	4332	msedgewebview2.exe	98
PID 4332 wrote to memory of 3740	4332	msedgewebview2.exe	98
PID 4332 wrote to memory of 5672	4332	msedgewebview2.exe	99
PID 4332 wrote to memory of 5132	4332	msedgewebview2.exe	100
PID 4332 wrote to memory of 5132	4332	msedgewebview2.exe	100
PID 4332 wrote to memory of 5132	4332	msedgewebview2.exe	100
PID 4332 wrote to memory of 4112	4332	msedgewebview2.exe	101
PID 4332 wrote to memory of 4112	4332	msedgewebview2.exe	101
PID 4332 wrote to memory of 4112	4332	msedgewebview2.exe	101
PID 4332 wrote to memory of 4112	4332	msedgewebview2.exe	101
PID 4332 wrote to memory of 4112	4332	msedgewebview2.exe	101
PID 5136 wrote to memory of 4152	5136	UI.exe	102
PID 5136 wrote to memory of 268	5136	UI.exe	104
PID 5136 wrote to memory of 1716	5136	UI.exe	105
PID 268 wrote to memory of 4092	268	cmd.exe	108
PID 4092 wrote to memory of 1968	4092	cmd.exe	109
PID 4092 wrote to memory of 1480	4092	cmd.exe	110
PID 1480 wrote to memory of 2816	1480	UI.exe	111
PID 1480 wrote to memory of 1092	1480	UI.exe	113
PID 1092 wrote to memory of 3020	1092	msedgewebview2.exe	114
PID 1092 wrote to memory of 1840	1092	msedgewebview2.exe	115
PID 1092 wrote to memory of 1840	1092	msedgewebview2.exe	115
PID 1092 wrote to memory of 1840	1092	msedgewebview2.exe	115
PID 1092 wrote to memory of 1840	1092	msedgewebview2.exe	115
PID 1092 wrote to memory of 1796	1092	msedgewebview2.exe	116
PID 1092 wrote to memory of 2016	1092	msedgewebview2.exe	117
PID 1092 wrote to memory of 2016	1092	msedgewebview2.exe	117
PID 1092 wrote to memory of 2016	1092	msedgewebview2.exe	117
PID 1092 wrote to memory of 4320	1092	msedgewebview2.exe	118
PID 1092 wrote to memory of 4320	1092	msedgewebview2.exe	118
PID 1092 wrote to memory of 4320	1092	msedgewebview2.exe	118
PID 1092 wrote to memory of 4320	1092	msedgewebview2.exe	118
PID 1092 wrote to memory of 4320	1092	msedgewebview2.exe	118
PID 1480 wrote to memory of 4084	1480	UI.exe	119
PID 1480 wrote to memory of 3676	1480	UI.exe	121
PID 1480 wrote to memory of 1744	1480	UI.exe	123
PID 1480 wrote to memory of 4424	1480	UI.exe	126
PID 1480 wrote to memory of 5500	1480	UI.exe	128
PID 1480 wrote to memory of 892	1480	UI.exe	130
PID 1480 wrote to memory of 5204	1480	UI.exe	132
PID 1480 wrote to memory of 124	1480	UI.exe	134
PID 1480 wrote to memory of 4748	1480	UI.exe	136
PID 1480 wrote to memory of 3644	1480	UI.exe	138
PID 1480 wrote to memory of 2400	1480	UI.exe	140
PID 1480 wrote to memory of 5624	1480	UI.exe	142
PID 1480 wrote to memory of 2312	1480	UI.exe	144
PID 1480 wrote to memory of 1572	1480	UI.exe	146
PID 1480 wrote to memory of 1660	1480	UI.exe	148
PID 1480 wrote to memory of 3596	1480	UI.exe	150
PID 1480 wrote to memory of 1224	1480	UI.exe	152
PID 1480 wrote to memory of 2904	1480	UI.exe	154
PID 1480 wrote to memory of 4424	1480	UI.exe	156
PID 1480 wrote to memory of 2456	1480	UI.exe	158
PID 1480 wrote to memory of 2772	1480	UI.exe	160
PID 1480 wrote to memory of 1380	1480	UI.exe	162
PID 1480 wrote to memory of 2684	1480	UI.exe	164
PID 1480 wrote to memory of 2512	1480	UI.exe	166

C:\Users\Admin\AppData\Local\Temp\UI.exe
"C:\Users\Admin\AppData\Local\Temp\UI.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1716
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2524
- C:\Windows\system32\netstat.exe
  "netstat" -ano -p TCP
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:2812
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=5136.3932.11438596563215963182 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc12715fd8,0x7ffc12715fe4,0x7ffc12715ff0
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1820 --field-trial-handle=1824,i,17539231156953356998,16467526819984966912,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1824,i,17539231156953356998,16467526819984966912,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:5672
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1824,i,17539231156953356998,16467526819984966912,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
    3⤵
    PID:5132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3328 --field-trial-handle=1824,i,17539231156953356998,16467526819984966912,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd /prefetch:1
    3⤵
    PID:4112
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4152
- C:\Windows\system32\cmd.exe
  "cmd" /c start "" /b C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:268
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1968
  - - C:\Users\Admin\AppData\Local\Temp\UI.exe
      "C:\Users\Admin\AppData\Local\Temp\UI.exe"
      4⤵
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1480
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2816
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1480.4980.15071133303379086001 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:1092
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x1c8,0x7ffc12715fd8,0x7ffc12715fe4,0x7ffc12715ff0
        6⤵
        
        PID:3020
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1736,i,5005990561422732352,4564422389288444718,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        6⤵
        
        PID:1840
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2000 --field-trial-handle=1736,i,5005990561422732352,4564422389288444718,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        6⤵
        
        PID:1796
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2292 --field-trial-handle=1736,i,5005990561422732352,4564422389288444718,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        6⤵
        
        PID:2016
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3572 --field-trial-handle=1736,i,5005990561422732352,4564422389288444718,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd /prefetch:1
        6⤵
        
        PID:4320
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4452 --field-trial-handle=1736,i,5005990561422732352,4564422389288444718,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:d280e25cef9455cd3ed6334bd12848513888c5bd
        6⤵
        
        PID:6000
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3676
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1744
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5500
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5204
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:124
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4748
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3644
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2400
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5624
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1572
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1660
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3596
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1224
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2904
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4424
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2772
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:1380
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2684
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2512
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2628
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4352
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:3156
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:5444
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\bin\lsp\lsp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\bin\lsp\lsp.exe" lsp --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\globalTypes.d.luau --docs=C:\Users\Admin\AppData\Local\Temp\bin\lsp\docs.json --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\sunc.d.lua --definitions=C:\Users\Admin\AppData\Local\Temp\bin\lsp\synx.d.lua
        5⤵
        Executes dropped EXE
        
        PID:5236
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:4584
    - - C:\Windows\system32\tasklist.exe
        
        "tasklist"
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:700
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cosmic_ui_update.bat

Path C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat
Size 340B
SHA256 7058d95695ce73764a5e89fe312ee54ed0379ebb15eec833324ec02bb2f735a1
MD5 bca7a5375609b20dcc7f68df6e196fe9
SHA1 33a58ace5caa4ee19600a036b11c78836d36266c
SHA512 a4310f9ea2ab040b33f3e498a46eb902a662f65e2516b87d3de1e9da86d074c53466b11a4b0f58345123dac2a6934277747f3efb04de76236aa93f3c64bffeb4
TLSH
T119E026174183C95E242868020EBE238FD5AE8C8D2B0D7BD88274C80F214F11CFBC96AA
MD5 SHA1 SHA512 TLSH

Submit Download

ui_update.exe

Path C:\Users\Admin\AppData\Local\Temp\ui_update.exe
Size 16.8MB
SHA256 72094291f65421f2fe386e88ae9ed80cb224986bb8fe7e14619ac92ace00d2d1
MD5 8bd7d9adf4ba5b4bee41b499a7d8cd18
SHA1 5df6d8512bb5a96ba3595b656611dac5fcba1dec
SHA512 28bc1be849f82d86b14b2c453e15b3e5d4976067bbdedb102ceb9b631166c703b7a13d71a00b348a4092f2da1d88a5ada4d76625511e7fde657b902dbcd8e4bd
SSDEEP 393216:By7AsyOLF2xBsupdKhIaq5uXFaayFsJT/:M7AsyOLF2xBsupdKhfq5uXUDsF
TLSH
T16C0718257B5A996DD09BC47483478AA20A7030DB0F39B9FF5485963C2F79BF46F38218
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f619e0ec43e869765cb07c9c614c1cab7df1c2d3b24b49bcc616b027a70c1681
MD5 dd60bf14f208690271281062ad7be367
SHA1 ce9ac12c4ffaf2d19bf00b2b1a2264b22aaff237
SHA512 2f2f4054bbb77de4b79cbfebebf6167f772e8b8043991c686ea6a5679ef9f8f07bf723704414e5d5b3845e6b82b73934655cc7066e8d88dab75f1ab4e3cbd3c1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8250a9319f3dddc3d495a2a6fd3995854e511e409b8d48a990f22efa27813b89
MD5 4ed178d0e8ea4661d00241ba80392d8c
SHA1 fe36f406f227913aa6909c524c1c6ee89955ba13
SHA512 ec0466a7326fa86043fd27f7a74a1163c741abf4ff9bf6be5b6ab59528293566ff552a83a80a74b242268b354de5026e740cb660aa9594e227501f07d3b3d00d
TLSH
T1FAD0121736020374C02025330001F6080501D21A424593005828C52DDE154540E42441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 22ff215da25d8be3298f9671ac2df8e3646842bf2ddd0543807d6141df75e34f
MD5 0e329b256c6d695d4750e67969cb3f23
SHA1 0975dc25f05a39f8d09aeb6d4a525013c5475cbe
SHA512 db6de0a888015c1a17d2cbee9dabebc15d84c7a9a0f5b1e7351c150da0e3f17b50537c3976f84ade69bf53cd295a47b17edc94f9e37cfa6762ac34b5a5aefff5
TLSH
T1C1D0121732020374C02024330002F6080401D31B414592005828D51DDE144540E02441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 c6ea5c116497201f20c0db8ce6384db225946a525d31da16f17618629755878a
MD5 33556a5b35c923a67eec0bc412d80d06
SHA1 80439ecbf4a0c2e5944f56cb975550010c6d0633
SHA512 ff1a5f927f8d4a031e2e0bd1e044a8c46d8ea494a47b21a0f0ee305c3e20ca248f2040bc34d9451786f31c33af508a8117e95caaed96369555d28940d6d26319
SSDEEP 3:MsFlthltlluJsF1+flHkwmWG8+KFsDrXyWmXTKG8+KYN//6l++bcS+652Uetl:/F83NEwFGdKefiWuKGdKYV/6QLVPt
TLSH
T118134CADA6C90D47F3FDF038908EB7B0DE30CC1446A5069311A1BE31F59824D4589649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 7d40d9445da36f37fa7ad08cea796ba14d96b7391a8adf5f49daa5de1aac026a
MD5 0acd56fed8b455bffc24fb17204a24dc
SHA1 e404b5ac8ea7ef195f12b4e502284bd039bd8c62
SHA512 787ed8bad7a536329284c7b6d16162c36720e134b56f9feae4b4b9f18077e9e0355940955effe7c1ee16555f163fba8d489cd84580f3ef12a6fa37204782ed88
SSDEEP 48:gigp6CtGpnNhV12Jqkto6U7w0U8OT/m6GTHm2NiW9eK:MUgynN1GWJY8OO6GTHm2NP
TLSH
T11244DADE5B06D48BF02081B878E47D3F4E2BC89701D9AF6AB851EC0344EBBC5085197C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_2
Size 1.0MB
SHA256 224a5593635d54598218503a82ebdefb81f499ecc1984ca453f3fdc3a81008a9
MD5 f075357d396182921fa46abff16b1819
SHA1 73e26ca1a04a27c10a402fbce4265f14e341ad19
SHA512 212bda945467ef49820fbb5e3223034666dda3f115ee43176565fa96fd0e938853f3512a3a908edd324ca5f021b2bc214bea2953c9b72d552b9b33afecbba8e2
SSDEEP 48:N6sx8WlPFBXdqitAUnJtHOFwalcvTNuvQGP6YrhWPaUYF:rxRFBtqnUnHuGvTNgbP67e
TLSH
T159250C822EED9949DC284779B6B65C8571B4F8D0314F657C0CD1BB5D71FA0E117D3828
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 d5080d41f1a27bff3ebb6e0534b09795b6c96db31c5828fbafc2538b6788cff8
MD5 e31df6c8d4625791a1a5dbec64202b7d
SHA1 c958ab963d23e8abeec480dba601e5eea6c5cac4
SHA512 ed32d6041a4619a0d6f2cde109610870ab16f5f9d04ba5a9a5090351ca122a45a8f4dff343c1c0466f30d54fcc1b4cedce0ba8004ed05e76f87382b4c4513ca8
SSDEEP 384:+9An9aQu+JEYJ2An9aQu+JEYJhAn9aQu+JEYj58QQu+JEY:+SMgJBMgJ2MgqMg
TLSH
T167163CEB4F74A546EA01EF70ABC4DD3C7CF046A77D97B8D2A90680E918E0BC4274615E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\f_000001
Size 71KB
SHA256 2c295d99e26dcf357d4d01bcf270fd6924b600c9a13dd8c363ef114f4c6976fa
MD5 4b73e2ff3024784eca66d2120a9bcb22
SHA1 2870bcb8ece10145e089262bb6634d18ac85bec6
SHA512 9ebe0b2cc7ed7298d931fc246732ed90881f0252b957afbf14f390c75c1da3fddf1b3fbb00be8d489cbb7b5a18f9dbda17a24e18594d44ebba4b7ca3f50bb10a
SSDEEP 1536:MO6PxhqwEppt5fUo8w4d+X5JlhLzcua67BYePELa:M3qh7VdDf8GPH
TLSH
T1F0630245820BA35EE09D4A79D27481F61FC2CB5C2BBF5C27538289AB5F57DBF6410134
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 b62fa85167552be210521d2b7dbd72e0af61cb320d611044120d4e84761e9b2e
MD5 c2311b0478f1083918fd0565053bb716
SHA1 36bfc326c7551d8e2d16463ed792efae4b7b668c
SHA512 62b954dae7b15373283c3659368ee27654a502294a8bc7e296ed6d946de52b53e6b7fa1c2fd578916aab08fd6476f9c890f98be5c6623d59ec717dcfe7b03794
SSDEEP 3:LsYllfltlNllkll/luk+KtBll8ncNtlB/3ll//9lXl:Lso13lEtu5KtBNxdl/
TLSH
T14644012A93E14D06EB946ABD49078B601724C900858A8347070545213C81B600E1A181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2223ee708600aff3_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\2223ee708600aff3_0
Size 265B
SHA256 2eadeff47b20213b5529bbe3e295bd948a484c979d89edb04435d7902f4ba791
MD5 41d49699bd80bb064f71c783fd2336b2
SHA1 e12941f835d403e3addeabea37ea48270670bf8b
SHA512 fb3c33184fd426830c989e50d8be3ba08eae156ca9f80ab5eb9ab900772d7f8a2fa800d474f422b21925e699a1073431f4a7b36420b047cf8c0ec1c0a2dda87c
TLSH
T1DBD0A7CF4532650BF2DE9DF1C6EA468D8B3BD4F2046ED8057044E95666C0124662DF25
MD5 SHA1 SHA512 TLSH

Submit Download

3ad623ae869b34b5_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\3ad623ae869b34b5_0
Size 265B
SHA256 23becf4345042f0e397a64f523d84407010e42f5546f6b607ba0fd071e543a08
MD5 a20a58f40bf9876edcc669ccea39c0c1
SHA1 406d7959d479ca998790b7086b9682531ce2a504
SHA512 2dd4c557c3aa6fd23a0f88b875631f9a522f2cc018ff2ee8973edcdec9d4dae22664cc2108c695c38ce4cda17b5bf729fd6e8a778c8d8bf8379c0255b8beef8d
TLSH
T160D097CF828AF40BC21AFDFCEABE8B4A820790B0228F88012420EC6A10D02242868744
MD5 SHA1 SHA512 TLSH

Submit Download

47b41a32c37a9401_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\47b41a32c37a9401_0
Size 265B
SHA256 6a4cc20d10df8ad402cb5aff564c1eec776cc3dd99ef1f25afb6acbac678d3be
MD5 46c9bab7e905404a1a70f8023e6218de
SHA1 b955d3bbc3295d7d1727c566b9bd8bb12a1af87a
SHA512 e2728358cf184c4dfa1412460a2e5f492e61179a7dd0dfde8a98c73f7a7ee78ee5288ca324c170b598a06714652c5d857b12dfbff52959ad5c4f74a26d5272ca
TLSH
T12AD097CFC507AC09D3E8BDF0CAFE8F0882068CF050AEEA072116E4C32480E682528310
MD5 SHA1 SHA512 TLSH

Submit Download

57357386120da46a_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\57357386120da46a_0
Size 265B
SHA256 27513f36400db584fb7347c92fc8af10bd155bd669c7f47391fb986de838dc50
MD5 1454b7649fe7a4eae8ce6f351bc34a1e
SHA1 17c3d46a05ba90ec5d8e757bab05c8139fefd1f7
SHA512 d737915179f55dc73b4c21b49d6b3b8e37243fc609c0d3b93c6b1004cf89d0c125f546ac5a30da79c4868d1725a0a58f9b3e7075d41243d190ab7d0243d2edfd
TLSH
T18ED0978F0E15B60EE93ADDF0CFEE8F05830B8CB0906D8480600AD98B60C0528753DB1F
MD5 SHA1 SHA512 TLSH

Submit Download

a094f4fcb0bc2962_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\a094f4fcb0bc2962_0
Size 268B
SHA256 6b589220f9331a97ec1f3e6ab86a53fc721f8b487d10e398c857dce1408cb86c
MD5 4eacf1a85491494ddf8438725b53eda7
SHA1 248e0bb70aedbbc10b3cf05ff7b834a81e128e86
SHA512 2d3849609f9f4e2b9c0d7e22325a70f2610938fa56306fc3deea9b63c1b47f6c1c7db3334890a9ed35f4932aceeb7cad959242a3cdcd2cdad23e5bb2785e378b
TLSH
T10CD0958FC65C1147C33657F49FFB1305CA0F40F0659D60012109F4D616D1124303C600
MD5 SHA1 SHA512 TLSH

Submit Download

ba005ce25f7b24ba_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\ba005ce25f7b24ba_0
Size 266B
SHA256 8c96f954325375d00468f770c871ff724106d4d3dfe30a8f6aa32df3c964f90c
MD5 06b462a2ac7a1b24742d1f35ed1f2a9b
SHA1 4366c766f83abef44897d91d545664ed94b66397
SHA512 f892084868f846c4c12b699783589e941074fbe3c5c573bd57616234f90fee038a977f71577d3c8808f4503f170105223abc2a3c2a749db5b237e57f750afe74
TLSH
T1B1D097CF5901190AC188E4F0E3F50A494E0BF4F010EC022B2200D46315A0B1C343DB28
MD5 SHA1 SHA512 TLSH

Submit Download

bbade47e7e037fb8_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\bbade47e7e037fb8_0
Size 265B
SHA256 8b1e87a9bfbd3e5efaf7652057b5949ea7b09bfe9c876ddd41cfa0699807eccf
MD5 388850808d7b3fca6234aa03df3642c3
SHA1 3501d94f54ca5b8dc4ceef9dd01339e6f751f418
SHA512 fc2a76857b1739fe86172b2f8da13b19d2fde38e87f58ce1956c246ff9c69e1902207b1428524affc383f54ccbca6743b3cf89915f1679e8e43b5d6f4e9a6bfa
TLSH
T1A1D02ECF8912350EE229D8F48AEC8B2A9B0B08F0427801731100E81224805283A38A0A
MD5 SHA1 SHA512 TLSH

Submit Download

bc2154cc967d815b_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\bc2154cc967d815b_0
Size 266B
SHA256 00e541cc60587e4d9bacba7b653ae52c09c4931e2ed6721f752ce792b57fdaf5
MD5 3595e58e81bfa59200c643a02fa892a8
SHA1 52cdebff81f3715c23affc121f862d88a98c9c8b
SHA512 b55604e9f8c812e9de622153f36d761ff17010cbfb3fd44c45f42c2906b4ef6923ca8bf11678412a84fae714d01cefb92610705bda3921d67a6d7124e2ec295c
TLSH
T15AD0974F8A1B84A6C21AEAF5DAEE4945D72B90E00C3E8CF21000ECA3E180178B108A00
MD5 SHA1 SHA512 TLSH

Submit Download

f79be75cb90606ea_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\f79be75cb90606ea_0
Size 265B
SHA256 d2ffe991141ff105ae73ae5e9800ab758796ac102c00a102343f1e62439bdf24
MD5 78a1fc27f675f8bd645669a4f7c59a8b
SHA1 c17f3a27cdcd7d8bd806032c914c38d2d3a6cfae
SHA512 6518bead18f9856e60b6fa43d33f0f3140175209c74b93d5b48cb80c5347ad626700c3c2e798974fa712f5b5692c153c1dcd89f3904f33b278ace94d1faa37b1
TLSH
T11ED095CF0E01750BE59558F1DFEE0F55C52548F0151D4E531021D40710C0054733B318
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 8d158879ef0531d101e96c0bcccabf4dab9a0add6051a400bb2a558b8acf9ca1
MD5 95d49601140bd46231ae77496fbfbac2
SHA1 43c7a6850604dc36ec2d5d65b2f5f8547c864e7b
SHA512 45236b24a72d1067c947d3285b43dad6498d0b4f56cc519ce40d4cd608177e7ae6900ac14beb80cfd994a1276c5271e457982ff04b6ad2c6622b7f1fbe061a4d
TLSH
T1F5D01200A0040383FB9D81B36DC9FBB43C351F4480834DDB83AA20B5C50579C88A5018
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 480B
SHA256 924a83246d03284534bfdf14047672bd38e2ca92c2962fd7d2a2d85368149a64
MD5 ab90b9e35b350ff0f1e9627afac650d8
SHA1 2cec0245a7e5003725ccc7291c6400f16ee6fee7
SHA512 6ca8589fd390d058c2db07a1ecb62d3b954f39e5132f4af6649e0ce308c27cb2ef1035bc9a76fec58855645f44751125c2f747edb6aa90d2e04cbf0f60e12652
TLSH
T1BCF01262A5402282F7A941B31DF8EBA13C704E5041934CCF03BA223295ACBAC885147D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cd68.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59cd68.TMP
Size 48B
SHA256 f96aae9b65a45051c7b86c60a50f2128f21e978c3bfe997a5cf4ea6f10a33b11
MD5 d60e61f2df44501f45d0a4f1c3f8192c
SHA1 d308d46bf286af5a0b15ae1453d33fc4dea474cc
SHA512 318bb672fbdedfa2fd57ec5e65185cead542a604aa82a002b85a097945f16c6fe3c8157936ffcd0a4880b5c790e632d030e94cf6d108506267dfbb704d6beef4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension State\LOG
Size 285B
SHA256 5e76b8e2e36588f94ac89ed7ab765f47936988f5b84c66f3a0a9eed6e091b015
MD5 fb408b9dd3b2dbc3e5e7c2605129174a
SHA1 5f4f2f125d4063dd104caa8834853a922323bfdb
SHA512 def2f5c4034b2e3a5b0fe1d603e8713d21f443bc6ea942b674a87f559b8cc13b0fc2eda1824c03e53c961d237f4aa1f093c6b273606b18cd9884406e311bb03f
TLSH
T188D0C20538CCCA764D44DCF7AA76638DCB913847BAD837054FA8DE06384689CA445741
MD5 SHA1 SHA512 TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\History
Size 164KB
SHA256 a362f18ffa9c37fb010875143485c916b4be9ce330d5b8eb876e623b25885996
MD5 a9222bab9760fea22ce1a00948371214
SHA1 1dcf6a2b9cf6d132dfa41148e276238286cfacbb
SHA512 3fdad18ba0e6d8b77175bb641726ed026f474e3b2491f4642e9b0560c714fbe4c283a3ce0a89bdfb17dcdee495a1c100b228907940e2b2d4860f975b54857b6f
SSDEEP 96:8Bz/dU5LqL/uejzH+bF+UIYysX0fxQp97YEHt/DfLVVVN6zRk/E0OV:8Bi5qL/tH+bF+UI3iWGVYWNVVV631V
TLSH
T179F3F95E5F243312CDBD913669E749B3587DF03F87236AC56CA108B1CEE2656A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State
Size 611B
SHA256 dd2e311d17cbcd4e0f9b7587e672ea01f588c48b305387db636e8b2c52bc80d6
MD5 35243f7f47ff6876b9bff51b29fdf5a4
SHA1 7d1423f6e7a6e29ecd9e6a95eebcfa466e5b646c
SHA512 a4437405eb730a88ed4df99eaa71cd07d8309b8827aab4605a3622e8600cd2ddcdb191abc5e34134bc40dd4eb18db0647f5a5ce20cbb0b262e26c31a5d7613ec
TLSH
T1DCF0A2A6C3D8C57E4B0152E567346913CD3D0817922C2E3BCDE9AB9DA7E14B5D11044F
MD5 SHA1 SHA512 TLSH

Submit Download

Reporting and NEL

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Reporting and NEL
Size 36KB
SHA256 8f579a4efa4b8d08cdba7877b8cdbd6af7297866dcdd8e62ee2463c37ca9fdcf
MD5 a69641d8d8d4a0b1244b223102108b33
SHA1 529bde4ef2a03cf3ca41d765045733a2007ebb4a
SHA512 273ae2127d2dda67b5f42219cc1ac304de61509630c1fadcb85e25b5f91e4b1ab6c0ca1db1d138684069cb986e33848d77c30fe0fb607c5d1b74d79dc330243b
SSDEEP 48:T0IopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSBjK:YIEumQv8m1ccnvS62
TLSH
T183F28ADE0B18B614C4E49578E6900DC7BD3E142D8B96AFC59EEC06F1FF821B2A538219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity
Size 189B
SHA256 6a121f03b2f3efb957a0b47e626f15974a6936a8eea97318e14d50cb95a2dbc0
MD5 adda52a4a0040de6378e0648a9416bc4
SHA1 438ef7d2e0218ddb9fdaff4c0188209b9a8acbac
SHA512 d4afd97c03adec4af11c539c814c624a49b51fa1cce3a31cb3eb4cd4ec259bb0fb5396060e82d4c0a7a0293d6c1ffd7b3a289c589b3f7de11589701949965b17
TLSH
T127C080D780B5F877106CA67A68057C656735517015751CF1D9438C7CF4C25E71D14475
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\TransportSecurity
Size 356B
SHA256 2e7328c93e696265548e5aa246f1a0d77abe31363e0e9009e1f02fda2605ca56
MD5 7a9c57b1de72c4335db957e6f081d7f6
SHA1 426932d4617005c57584bff2386d46274bbb6740
SHA512 c05667241e5b04ca62dca87ec67993fa17a02874876cad30d7ede1e5ff02bb899b7cec4b44648b39c51b2220c781fd620d2f2b55a4c15198999ebb168f346cfd
TLSH
T1BEE026E7C0BAE437502C5A2B1D42BD552F3AA1300195A8F5DA938D7CA0811E75A02472
MD5 SHA1 SHA512 TLSH

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 2d4ccf8ac8ae4f5c6ec8e0566210ff56585b6ba0290501a1a11ed9b23bfc226e
MD5 7289d4bdfbd73ed571278f95cb4c1939
SHA1 7c911f54243d9777a34666f4526a49c7e7aea244
SHA512 6e7d48e18b0317449807c4ac2c377b3cccf5bd6121077d51152d7e188ba1ea3cf62372b7611036938986dd0c84465dbd747fe8580e3a699f8470229a6d57a749
SSDEEP 24:TLB3lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T131DtX5nDOvyKDhU1cSB
TLSH
T1D8F2689BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 6KB
SHA256 30ea42db98b12c19407ab476b85b8c321ec9b022e23b0482453746f428c77bce
MD5 922603aa12342e1516497d50797b16ef
SHA1 e3509cfd484f666c1b88096808ec14abd3face28
SHA512 c0e2092d2f71b0075449172788252852e9581933b8e940143d1f0b5ab55159be5a5340b6006edf0e317e20dee449b0577bc8a754de12a274bde64fb268279700
SSDEEP 96:stL/d7qcDbDrk+Ddo5h16Z0fTs7/x+6MhmuecJf/TbMkkje3K+gOOV28XM1C7K:stThTlonfTsV+Fdf/TbwjJ8QG6K
TLSH
T1BED1A5026E24B97B4CC7E518BE75BB5BD2F9606270D51E18E7F84A2C09D76CC6207D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 6KB
SHA256 487e1e07504c2eabf96d17bd7fb3dc0f2e55eb5718164922db9bb8a7ae4ea0c2
MD5 7530cac7d994ff8007b3d7a8fd598302
SHA1 bad4af9c912d6c4357f921294ebdbd472d051b6a
SHA512 288a7bc6ce8b95a161dc139c5eed55f2230bf9abb15409ebf288ba2cfe1e83f83a548d7d755e1686b27277a7f783c0bbea7d750bb8db12af4a8886a54e50c808
SSDEEP 96:rL/d7qclb9rk+Ddo5h16Z0Has7/x+6MhmuecJH3zn1eje3K+gYW2I8XM1C7K:rThXlonHasV+FdH3znQjJ+3g6K
TLSH
T1E6D1B5026E24A97B4CC7E508BE79BB5BE2F9506270D01E18EBF8492C05DB6CC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 0628922305d2478ba75a48efadf932d439616eaf1ff908be334793f7bde28107
MD5 91dbaf73c1a8c55254d90272f998e412
SHA1 2b86b31c8c00c937291e5ac3b1d134a5df959acf
SHA512 109f4f59616cc1d1682b4d9468804f7668c77ce1878afec06a57037193f31a9c1c39f5d269277462936373b129d26488cddcc34d455c27185534e7754baaa988
SSDEEP 24:TLWr6bXYFpFNYJqH1kwIY6UwpQ9YH8rwZ6HfB:T+6LopFS+awWUOh8B
TLSH
T126926B4E5F346221C0F48B36EDE1855B2F7C201CD3B32655DA5860F3DE9299BF10956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 627816fd47bd719bb0fefd3f0a562442aae6e16f86ebf7a44dfdcddc073d8cd9
MD5 f480ede55ad76eff64de3d563358987e
SHA1 ffe7180667b16deaf4648eb793f51bb062f1db85
SHA512 afcfe447baaa1b331f5956356915b9e1edb44780c86ffed5226ac7aa8e678dde4dda98a867f8842eca3a4009c8110e66551cff262320d4b449ef359490d70597
SSDEEP 96:vcigPlf/ROo1pkF5d1mib7VaTEv9V5h5pg5+e02V0GHG7jcXUPG8Y:lEvad9lWVl3XUDY
TLSH
T181C1C6E74569C675AF444AEFDC393ECF9DAA00DF88CA4C1A92E2C04807C1EFD11DA895
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 9f2864e6879614262803ab35bd9a4f6e3c6ac67d95216504a1dbcc1fdb195ff7
MD5 f7660f7432a59abb28e649c4901b1aee
SHA1 7b3319c2b0dd92721d2b91bc0fcc98e3c667f017
SHA512 59605c2e10e7f971832a11abfa96876dacf6525cebf6d9dbad1b5ebfb03b75773bb2522b3133b2d6178b36651c6266711ef2463918c225b0966c8525213bbfd7
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 79b107307408e5ad9a145c87533316174fd13f4ad943497d079522fbe325b3b1
MD5 71ccdda9f3186c8e729bb559f93bb992
SHA1 3712c11bb21b8e2a74bb879d47b2819ed1ac14a8
SHA512 19f8134fcd1211964111b07884b52878b1649644b6ec623bb586df1a9b7dabc7f8c8a755d2a52c908b563bdd968135f4f703cc35103696e40d0ab0020c8dc4bd
SSDEEP 24:TL6iuaJhPwMuz6G0ZestjteXUSQeCl7ZIeNa6+6Uwg8hPq81fBG:T2TaOk17ZfnUdoqSB
TLSH
T1B0139A0F2E587564D1BD0635E9A34E6B2B7E30489B8329D125F02AF24DE251C5D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Site Characteristics Database\000003.log
Size 112B
SHA256 dc01a23c1b29000cd0fb360673438abe707e473ec7347cdc500615949c7e0553
MD5 dfab9f6bcde45e9ca46fd6ec9e48a504
SHA1 3db2744666552591dac6c68989a4c9235819dfb1
SHA512 28375cdf77cc2703c91f40bdb85f35a6819eae7f3e934cce811219772dc46f523bdbfd57eb11389ef513e817b7e44d48c93f2454e4649394d622a4d2a32d0989
TLSH
T106B01280BF50D12BD6E91E3D0294C7E0A320E3036501590358548F210FA73F42E048D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Site Characteristics Database\LOG
Size 315B
SHA256 60b816a374347257272084f7595c1505c3e958406237798aa8ac480d49cbeaa4
MD5 2b38bc5f81ccbfb51bba519039c681db
SHA1 1c466b55790c0db9a574d7800fd47ef02e5008de
SHA512 b609e35176c9a175f89186c01c10b2110a146e5bdad76a5234fc27bea650522cd94a9fefe2fb0009b25695a2d942cc738af9d2254e433f8d83ded790d2651aa4
TLSH
T113E0262039CD8E770E8698EB7531B38DC662B407FAE912150E64E701294B488B502B51
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Sync Data\LevelDB\LOG
Size 289B
SHA256 e152de8db751c31542cf9309946169151a3d4fb77dbed1a9cadaa1f8069f23db
MD5 d37c37a228d09388a8bba060bc3aa70e
SHA1 a28423a9cb5a5d56c46b7b8786710c07205ffcf4
SHA512 7bda76a3930327b54899f073560cfa60cb9d70213a7fee26fc606367249583e398d6e59350acad7fd9ab396f75e6eefa6279e62c01c2aafa0f36193c5d763057
TLSH
T1C7D0C23078C88B764D40C8EB6975738EC6B0BC06ABD93709CF68AA063C8649CB420682
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Visited Links
Size 128KB
SHA256 50659a1b98aa3b8c11823cd4dc0a9fa2ebb5b6e43b5bb2a6c2cbc7553b62a1e5
MD5 4a827ded00c4dc4f8dea921d8ab5e6ce
SHA1 55847af5f56669c4251d6ee3dac65e795eb3a919
SHA512 2b34773db2400bea09cea20180ba434e3c1b0b87f68850f5c26458c0346df2557b2050200a349335c920c73f0323822f63dfcfbd49f318c8b059b998ba8f6807
SSDEEP 3:ImtVu8c3v+yu/:IiVu8cmyu/
TLSH
T140D3040C01055504F55C10744FC44F554114D100D3174407573F0573D4D04174153703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Last Version
Size 14B
SHA256 d75607a88bb0f572f8863a3ea4737b635664178e97e0b7cb057887f2736fe3fe
MD5 3b746b6e8b8e101ee7cd41df1bb565d0
SHA1 ff5ff645ada097814fb4890d00dba8a309e1a506
SHA512 71d487cff7f744f046d993889c770a877075378b8d47d6c2f80fd94a5c1150a627f4a69d9e55f272f3aa4257e5dbb5296643591d5d23804a95550a3f2d91e2d9
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 15KB
SHA256 92c41023f1e241f053037169654c1cdcee5d8e5c33e8220bf30637e7c451c4eb
MD5 933f933de9e5f149d432257a40856bd5
SHA1 2ccfb0775e6e650e1a53fcd0b609f259507ec231
SHA512 7acec0f26e575cd39e56a6fdd722365a7204ca6a5b93af19fa7afc1302a43cd6b2e76203e4e48da9a918dc31e2639858da822682edf780862d4799f0371463b8
SSDEEP 384:c+aQikB+z/xvxjg/qhEb3NBSjxU7OAVdpVT9zcS:7/UxvxjgC+bIEOUxFcS
TLSH
T1F5729F1768797E27A5F3F604795D1B8FDBB884B285C12EB44AB99F0906C72DC1342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 2KB
SHA256 028394273acf346129bfc3dfb34fb92a22d4c21bbd0329f206bd4eef222d8b94
MD5 53b567674a03ac3be2ddb4cc6984dfb9
SHA1 26d36fc8ea0ee1f7981f1a288243669199a0126a
SHA512 44545a08f92ed8f5b6ab5418dc4039029d36d8f6d81e46510c8097b11977d12da7b97c1fbf284320f7e508864cecce8dce1b91ef6db6d5bd7892d7962585efaa
TLSH
T1FC519533B864AB37D9E256447D9A3F269E3550A19F912F60D6ED2F1802DB18D2342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 29ca65cef5275795b5c86f26acb11ce11a19801edce85796b4398ef97c8582a0
MD5 f38c1ee6d50756af8389b94701739356
SHA1 c50cc4f8a5c27e4441a0bb96143f182270de66bf
SHA512 c9d2a804efb752ccaa1ff1432b5b9709f09add13ee0f9acb9a010b288d2e93a63013f7488a54cfef1832b7aa11b23284d3f52017bbf15d7d47fbb5b7d4cbd946
TLSH
T1B2819622B8A4A9379DF3D945B8963B1ABA745063D9853FA4C6FC1F1D01D72CD1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 c6aceb03ecf7d74b8302465acd86545ac0a5c1e85ea68ec7cf53d5ada6c612c9
MD5 898ff9f17e588ce2ae03eec2cab18764
SHA1 2801058be66c8418cc7a8c09b2b0cf822dc1d144
SHA512 c8af4342b285fcb60b70d8efe219a56080515b3f2c1ac3846a42d6e63da40745119b4f6cad82190fcc42c543ed886d532db8f9df40c97b0fae57ae4aca1074d5
TLSH
T1B6818522B8A4AA3B9DF39545B8963B0ABAB45063D9C53FA4C6FC1F1C01D72CD1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 bf6b694c8a410c26f6c2efdeb60d6db77c01362309dff7e29d559e9e03a242a2
MD5 e7e95bb3a7acf543dc3c965b2a13d734
SHA1 a8f6b6568104a3f7a4180e54666e86de8c186d22
SHA512 fa4a619b09c7f99e2a3e93bb4135b39b907358bd46a522aa1f4ac74cc3ad87a24f0f8c05b145532ce83af68d7291331c7d6dd99da83fe5b69dee9851686e0203
TLSH
T150616636B9B4AA378DE29A04B8D63B16BB655067D9C13FA4C6FC1F1D01D728C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 f01c4625b51ddebd9f227b1d6eeb66e78afc4320970d9c34304581dc19392099
MD5 9c13fd0ade17c02f89c029b8884504ca
SHA1 b695c95275ace782700d03bf66f221e402304876
SHA512 e0accc2702aad1d1fecab8be7347085bed8f6b7e8727e2c504725e0a59908c101eb34393214db3e8491f9257734235f84554b4614687ad204f9b3d7b19e0c400
TLSH
T189818626B8B4A93B9DF29505B9963B17AAB45063D9C53FA4C6FC1F1C01D728D1342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59b8a8.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State~RFe59b8a8.TMP
Size 1KB
SHA256 96762ce230d42e91c3bd2090a45a1cac5343b750f07ef3aa22f647226b7285e3
MD5 7354b60ea0fad96c9409867d2075aa78
SHA1 9fd3abfaf5906c35f0018c667e2b2c7201bcd405
SHA512 8d3c3844e9b0e160d8ac8da8878059068a4a971afbd7beff66c29a3817e5a3f505719d2f12a5df136b7bedc61e7501815840f2945416e835035b377943508acb
TLSH
T1EB213572F8A86B33ECD5264565A27B0F6E311067C6914E1092EE9F2D02D618CB56BC32
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\ShaderCache\index
Size 256KB
SHA256 0694cc2806e1c45ff49c1abc6df1d2bf385e1398debb0292733e935585d2736c
MD5 380fdb348993967c3cd9f3f9c3624dee
SHA1 3d07639924910aa782b5aef35292fad93c0586a6
SHA512 8c555f34997ed3528a52ada31cb143b13f85d0e1f3ded94c73310dfa9b2b9a39152feabf194f08bae33c714625cc3972ca1c45af899fe5bfd2db01d46de6c518
SSDEEP 3:LsOllllklkXl+da:LsUlPJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ui-state.json

Path C:\Users\Admin\AppData\Roaming\Cosmic\ui-state.json
Size 2KB
SHA256 e4a17198a7be8cecadb68009ea372c2f186c23af9121633990c43a8e96e82217
MD5 25bace007e73d81d3160a5f4fbc61ef1
SHA1 151126f33672ef4760b6ddfd3ea31772a161b482
SHA512 3b87d98028264d7a4673c41a18d99ac3676564add842e58b0a872ab5db12ed7af3b43b9453ad0620400ada7a32467837fbe012a2b6bfd43dd182473b32636195
TLSH
T11841492ACA680C7710E4762A9CED52436A7582530D593C2CB78C5A0C1F9E33F65B79ED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2524-14-0x0000024EF8AF0000-0x0000024EF8AFA000-memory.dmp

Download

memory/2524-2-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-6-0x0000024EF8860000-0x0000024EF8882000-memory.dmp

Download

memory/2524-23-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-22-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-25-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-15-0x0000024EF8B20000-0x0000024EF8B3E000-memory.dmp

Download

memory/2524-21-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-20-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-9-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-7-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-18-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-3-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-0-0x00007FFC1245F000-0x00007FFC12460000-memory.dmp

Download

memory/2524-1-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-13-0x0000024EF8A30000-0x0000024EF8AE2000-memory.dmp

Download

memory/2524-8-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-12-0x0000024EF8A10000-0x0000024EF8A2E000-memory.dmp

Download

memory/2524-19-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-16-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/2524-17-0x00007FFC122D0000-0x00007FFC12C74000-memory.dmp

Download

memory/3740-52-0x00007FFC33170000-0x00007FFC33171000-memory.dmp

Download

memory/4112-78-0x00007FFC33170000-0x00007FFC33171000-memory.dmp

Download

memory/6000-547-0x00007FFC333A0000-0x00007FFC333A1000-memory.dmp

Download

memory/6000-548-0x00007FFC341D0000-0x00007FFC341D1000-memory.dmp

Download