f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0

Analysis

user interaction
yes
max time kernel
49s
max time network
45s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/09/2026, 02:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UI.exe
Size 16.4MB
Sample260930-ckqfcstyct
SHA256 f3d84f67065f746d9236b8f5507e7ba60403f59129719f7df95bac5a3ca44ae0
MD5 a2b6b7198b6699f866a745c8ba55c2c1
SHA1 ab063e32b77137604c214916dffce1b5a3871cd5
SHA512 c158333918433e47c3c08901034b85ba99894ee37a719520c358618d74555f0bc19af2c2f274a6f4005a56d42a814ee804d8e684191084c46437e78ec751fff5
SSDEEP 196608:5sC0dlkPaQbao2Faaya8l0S7oo3TwhRCuMqoW:l0d0uFaayFso3TwhRX
TLSH
T1A30706257B5A996DC05AC4B4834B8B72497130DB0B39B9FF449492382F6EBF42F38359
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 2 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	UI.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 19 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4496	tasklist.exe
2004	tasklist.exe
1184	tasklist.exe
5384	tasklist.exe
5256	tasklist.exe
5300	tasklist.exe
3880	tasklist.exe
1188	tasklist.exe
4516	tasklist.exe
1732	tasklist.exe
4600	tasklist.exe
1304	tasklist.exe
6024	tasklist.exe
1388	tasklist.exe
1964	tasklist.exe
5152	tasklist.exe
6016	tasklist.exe
5036	tasklist.exe
4500	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4788	powershell.exe
5284	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	UI.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	UI.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4516	netstat.exe
492	netstat.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4516	netstat.exe
492	netstat.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5316	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4788	powershell.exe
4788	powershell.exe
5284	powershell.exe
5284	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4132	msedgewebview2.exe
4200	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5152	tasklist.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeIncreaseQuotaPrivilege	4788	powershell.exe
Token: SeSecurityPrivilege	4788	powershell.exe
Token: SeTakeOwnershipPrivilege	4788	powershell.exe
Token: SeLoadDriverPrivilege	4788	powershell.exe
Token: SeSystemProfilePrivilege	4788	powershell.exe
Token: SeSystemtimePrivilege	4788	powershell.exe
Token: SeProfSingleProcessPrivilege	4788	powershell.exe
Token: SeIncBasePriorityPrivilege	4788	powershell.exe
Token: SeCreatePagefilePrivilege	4788	powershell.exe
Token: SeBackupPrivilege	4788	powershell.exe
Token: SeRestorePrivilege	4788	powershell.exe
Token: SeShutdownPrivilege	4788	powershell.exe
Token: SeDebugPrivilege	4788	powershell.exe
Token: SeSystemEnvironmentPrivilege	4788	powershell.exe
Token: SeRemoteShutdownPrivilege	4788	powershell.exe
Token: SeUndockPrivilege	4788	powershell.exe
Token: SeManageVolumePrivilege	4788	powershell.exe
Token: 33	4788	powershell.exe
Token: 34	4788	powershell.exe
Token: 35	4788	powershell.exe
Token: 36	4788	powershell.exe
Token: SeDebugPrivilege	4516	netstat.exe
Token: SeDebugPrivilege	4600	tasklist.exe
Token: SeDebugPrivilege	3880	tasklist.exe
Token: SeDebugPrivilege	6016	tasklist.exe
Token: SeDebugPrivilege	4496	tasklist.exe
Token: SeDebugPrivilege	1188	tasklist.exe
Token: SeDebugPrivilege	2004	tasklist.exe
Token: SeDebugPrivilege	4516	tasklist.exe
Token: SeDebugPrivilege	1184	tasklist.exe
Token: SeDebugPrivilege	1304	tasklist.exe
Token: SeDebugPrivilege	5036	tasklist.exe
Token: SeDebugPrivilege	5384	tasklist.exe
Token: SeDebugPrivilege	5316	taskkill.exe
Token: SeDebugPrivilege	5284	powershell.exe
Token: SeIncreaseQuotaPrivilege	5284	powershell.exe
Token: SeSecurityPrivilege	5284	powershell.exe
Token: SeTakeOwnershipPrivilege	5284	powershell.exe
Token: SeLoadDriverPrivilege	5284	powershell.exe
Token: SeSystemProfilePrivilege	5284	powershell.exe
Token: SeSystemtimePrivilege	5284	powershell.exe
Token: SeProfSingleProcessPrivilege	5284	powershell.exe
Token: SeIncBasePriorityPrivilege	5284	powershell.exe
Token: SeCreatePagefilePrivilege	5284	powershell.exe
Token: SeBackupPrivilege	5284	powershell.exe
Token: SeRestorePrivilege	5284	powershell.exe
Token: SeShutdownPrivilege	5284	powershell.exe
Token: SeDebugPrivilege	5284	powershell.exe
Token: SeSystemEnvironmentPrivilege	5284	powershell.exe
Token: SeRemoteShutdownPrivilege	5284	powershell.exe
Token: SeUndockPrivilege	5284	powershell.exe
Token: SeManageVolumePrivilege	5284	powershell.exe
Token: 33	5284	powershell.exe
Token: 34	5284	powershell.exe
Token: 35	5284	powershell.exe
Token: 36	5284	powershell.exe
Token: SeDebugPrivilege	492	netstat.exe
Token: SeDebugPrivilege	6024	tasklist.exe
Token: SeDebugPrivilege	1388	tasklist.exe
Token: SeDebugPrivilege	1732	tasklist.exe
Token: SeDebugPrivilege	4500	tasklist.exe
Token: SeDebugPrivilege	5256	tasklist.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5156	UI.exe
2476	UI.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 5152	5156	UI.exe	80
PID 5156 wrote to memory of 4788	5156	UI.exe	83
PID 5156 wrote to memory of 4516	5156	UI.exe	85
PID 5156 wrote to memory of 4132	5156	UI.exe	87
PID 4132 wrote to memory of 4932	4132	msedgewebview2.exe	88
PID 4132 wrote to memory of 1668	4132	msedgewebview2.exe	89
PID 4132 wrote to memory of 1668	4132	msedgewebview2.exe	89
PID 4132 wrote to memory of 1668	4132	msedgewebview2.exe	89
PID 4132 wrote to memory of 4520	4132	msedgewebview2.exe	90
PID 4132 wrote to memory of 4820	4132	msedgewebview2.exe	91
PID 4132 wrote to memory of 4820	4132	msedgewebview2.exe	91
PID 4132 wrote to memory of 5224	4132	msedgewebview2.exe	92
PID 4132 wrote to memory of 5224	4132	msedgewebview2.exe	92
PID 4132 wrote to memory of 5224	4132	msedgewebview2.exe	92
PID 5156 wrote to memory of 4600	5156	UI.exe	93
PID 5156 wrote to memory of 3880	5156	UI.exe	95
PID 5156 wrote to memory of 6016	5156	UI.exe	98
PID 5156 wrote to memory of 4496	5156	UI.exe	100
PID 5156 wrote to memory of 1188	5156	UI.exe	102
PID 5156 wrote to memory of 2004	5156	UI.exe	104
PID 5156 wrote to memory of 4516	5156	UI.exe	106
PID 5156 wrote to memory of 1184	5156	UI.exe	108
PID 5156 wrote to memory of 1304	5156	UI.exe	111
PID 5156 wrote to memory of 5036	5156	UI.exe	113
PID 2476 wrote to memory of 5384	2476	UI.exe	116
PID 2476 wrote to memory of 5316	2476	UI.exe	118
PID 2476 wrote to memory of 5284	2476	UI.exe	120
PID 2476 wrote to memory of 492	2476	UI.exe	122
PID 2476 wrote to memory of 4200	2476	UI.exe	124
PID 4200 wrote to memory of 388	4200	msedgewebview2.exe	125
PID 4200 wrote to memory of 2104	4200	msedgewebview2.exe	126
PID 4200 wrote to memory of 2104	4200	msedgewebview2.exe	126
PID 4200 wrote to memory of 2104	4200	msedgewebview2.exe	126
PID 4200 wrote to memory of 4900	4200	msedgewebview2.exe	127
PID 4200 wrote to memory of 5616	4200	msedgewebview2.exe	128
PID 4200 wrote to memory of 5616	4200	msedgewebview2.exe	128
PID 4200 wrote to memory of 976	4200	msedgewebview2.exe	129
PID 4200 wrote to memory of 976	4200	msedgewebview2.exe	129
PID 4200 wrote to memory of 976	4200	msedgewebview2.exe	129
PID 2476 wrote to memory of 6024	2476	UI.exe	130
PID 2476 wrote to memory of 1388	2476	UI.exe	132
PID 2476 wrote to memory of 1732	2476	UI.exe	134
PID 2476 wrote to memory of 4500	2476	UI.exe	136
PID 2476 wrote to memory of 5256	2476	UI.exe	138
PID 2476 wrote to memory of 1964	2476	UI.exe	140
PID 2476 wrote to memory of 5300	2476	UI.exe	142

C:\Users\Admin\AppData\Local\Temp\UI.exe
"C:\Users\Admin\AppData\Local\Temp\UI.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5152
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4788
- C:\Windows\system32\netstat.exe
  "netstat" -ano -p TCP
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5156.1632.8171865121891802193
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x10c,0x7ffc26d0b078,0x7ffc26d0b084,0x7ffc26d0b090
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1708,i,6868688117258829059,2110442084019904407,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1704 /prefetch:2
    3⤵
    PID:1668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2028,i,6868688117258829059,2110442084019904407,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:11
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,6868688117258829059,2110442084019904407,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
    3⤵
    PID:4820
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3576,i,6868688117258829059,2110442084019904407,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
    3⤵
    PID:5224
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4600
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3880
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6016
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4496
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1188
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2004
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4516
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1304
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5036

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2316

C:\Users\Admin\AppData\Local\Temp\UI.exe
"C:\Users\Admin\AppData\Local\Temp\UI.exe"
1⤵
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Windows\system32\tasklist.exe
  "tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5384
- C:\Windows\system32\taskkill.exe
  "taskkill" /F /PID 5156
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"
  2⤵
  - Enumerates connected drives
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5284
- C:\Windows\system32\netstat.exe
  "netstat" -ano -p TCP
  2⤵
  - System Network Connections Discovery
  - Gathers network information
  - Suspicious use of AdjustPrivilegeToken
  PID:492
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=2476.656.5172437737026983719
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x174,0x7ffc26d0b078,0x7ffc26d0b084,0x7ffc26d0b090
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1856,i,3326866703974550056,3015158744057119571,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1848 /prefetch:2
    3⤵
    PID:2104
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1720,i,3326866703974550056,3015158744057119571,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:11
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2284,i,3326866703974550056,3015158744057119571,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3464,i,3326866703974550056,3015158744057119571,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
    3⤵
    PID:976
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:6024
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1388
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4500
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5256
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:1964
- C:\Windows\system32\tasklist.exe
  "tasklist"
  2⤵
  - Discovers running processes
  PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3fc98f1a0dd73c0067a28034a6d84e86b27418d68cc2fdf26345be6f4217dcf1
MD5 9f3107a91c0a75eb75418f89fe7dcbcd
SHA1 4538595145969d10d68c8d5fd73d51a58cde93d4
SHA512 12506d31fba03a505c3921876135d8b9cd5fd3659c5c97b2158001ab788f0f9dcff055e95be1bd33583098848efd1036d05c0b6e23d7191b02b444a37d0dbf2c
TLSH
T1F381CD323375A0D4C9563F07192C19C463AF4396EA58AF4CB658620EE92B54BDB222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 244ec6e2daa18abb7d0c4e48a4505d259fcaf116bcfb9dc3a6434f78833185a6
MD5 74ddd8311407d230e62dfc135becf2b0
SHA1 00a5834d79e28fd9498f57dea17dee229e18af7f
SHA512 f82aa1058cd5eac93b64a378553de9f46bcda04c5a2a010229d4aece83bdd59295e5e52276f2951ca878b3a35d68444b0bf42771e2be0b9b6293ce2b8d2d739d
TLSH
T12D216533B3ECC565C8D9117A208CAD00B2B5C3C7449E8F8B6A84C619957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_a5vq4l5p.g3w.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_a5vq4l5p.g3w.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

856b9874-7c1a-421c-90e8-7689745874ed.tmp

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\856b9874-7c1a-421c-90e8-7689745874ed.tmp
Size 1KB
SHA256 beb75452b0c973c704ff9a950cb4f298e9695fb257415b8e6aa8e07fbf070418
MD5 af5986814aa57d9ca565f6acd437cfe8
SHA1 e32cd61f3117e18349be801c9ff251083561331a
SHA512 546f61fdd7a814f662682ecacac5f4d4aa15a63e6565e695b797784b5695ab6287df884ed72d4cca7f719612b129a7e5988ae3e2f3b7b97c086a65e1f5b38cf3
TLSH
T1CA3185F2D8E86E776D910A4AB2827B976F301026C1508F8461DD0B1C12F31EC663BC32
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2152d76a4b9a97b498078f1774e217f85e365a5316b8b9b1d7879d25cfe00156
MD5 2b209d75aa59373d0c576d62e6a9fcea
SHA1 5ae7f0de853284804a3491d1a54e565530d67729
SHA512 203fc7a5fa98dda6d6123d102c7188d1532bc635060b625e5c434a175de4b6b1af63e57a90ff442e6e5e1071f16dde8c0719975a3dc60c5530bf95f8b6644962
TLSH
T168D0121276110334C0202033090673480A10D11F40094200942D89DD5F044640B12841
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 231b075643c75c4afeb19354291c7d6b40570d8434c517e8dc18bac16b56d375
MD5 160aec5e0cb5d9038410e876624b6ff8
SHA1 8e5dcaf4803a17526db4d59b6a76f504ffc5287b
SHA512 97459598470f45457c36c4435d7cf6e39333cec3b25b03254d516ef9013100ef617d18cc8efbb670a58f5aa0ce79ddf1619aa460b0ce9e99b4590e22e51a0bc6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b8e0faad0ff53ba9bae455d194523df42c6c2f9fe63338ecdbeefc9442449bba
MD5 32eade9b50b8e58e8a5845e4cc958a97
SHA1 2bf72715ed0e95c559989afc217a93c6d992757f
SHA512 e1e998067b500f975030f7ec308e78be5251de07746d8e6788aa7739d7869072f7722ff281439f871b6069df049f236b5a374adbdd3e4e223f59f1d683252435
TLSH
T182D012127A110334C0202133090573480B10D01E41094300942D89ED5F044644B12841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Cache\Cache_Data\index
Size 256KB
SHA256 fcafe09fb07e0fc5845ede067462974f579a79d8c36f551bcd01836b0ffbc9dd
MD5 15f3d32a399ebd78db0b2289b32597d7
SHA1 723eea79e7f98df7c3a38b002cc85e0a127c32d5
SHA512 23b03d42e4f35810a5fa228759bf0a45da3719eff747ce57748bad2c55030338aaf8c641de6cc50c2234fe7cef91872b209d5679c382bf2cd6fc50a39cb1315d
SSDEEP 3:LstlNllkll/lQ:LsX3lEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 254e5920518c45fc9daf08a3678a0e13954393a90e3397f55b8de613fdac30f5
MD5 6d0789f4812d061ff89a1948b994ace8
SHA1 ef03729f81198fb3ded93b3dd23d5d2029600618
SHA512 64b765b6a891248916bf66c2c074623d4b406bc9c3d754e7b4514d0cb23ed584d28c1d3c90414f13a378bbf1fc226d75d38f1fab732605072db7590d53bef245
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 0f820b30be7e1d895ade27a2b6517e74526844d77f5145c69e8cf6927346d833
MD5 7b59f519eb61353973aa965d02759d7d
SHA1 85ad09280f3c7c6e5106fb503ea80078807d6001
SHA512 bd6f151bd6af22260e7c599f057716f6ce70295b0863140ed6ac9fc4edf04ab4b9c14ac9713c9e5ed1cd501d85b11477a44654af86ed6a0bb47551635e8652d4
SSDEEP 3:LstlNllkll/l+Je+l:LsX3lEt+Je+l
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension State\000003.log
Size 114B
SHA256 e2610960c3757d1757f206c7b84378efa22d86dcf161a98096a5f0e56e1a367e
MD5 891a884b9fa2bff4519f5f56d2a25d62
SHA1 b54a3c12ee78510cb269fb1d863047dd8f571dea
SHA512 cd50c3ee4dfb9c4ec051b20dd1e148a5015457ee0c1a29fff482e62291b32097b07a069db62951b32f209fd118fd77a46b8e8cc92da3eaae6110735d126a90ee
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Extension State\LOG
Size 287B
SHA256 a902924e23e3d63bc0260a572723f87259cc2cb02db2dbdf2b9dfb7c6a4b5d45
MD5 8cb02c44663a75d87e71102235e3e8b1
SHA1 a0242188419e67f622e277844b08aaae684c3854
SHA512 d0ea4e2ff6a4386caae8856abf4e00792d828c501226e1f7c16c9972fa0bb83a6a159544b12ff9ab7ebe652b45a355f44307d2c92573113c40045f08dfd848cd
TLSH
T143D0C20A68AEC5768D488CFB9A77234ECBA23906B6CC3B050F5ADA0C3483089E941746
MD5 SHA1 SHA512 TLSH

Submit Download

Favicons

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Favicons
Size 20KB
SHA256 46b5ecada4edb2585f87953f7847aefc938be2404b9d9455c772b97295b7b1cb
MD5 babd43551f1b29eb82e221460676126a
SHA1 e9bff307613a14b35830893bdb6d1ecc931b425d
SHA512 5ab681c170dbd1d374bd66edd02cbe21272819ef7389ad1e886bcba112deb91eb68fa930747986da5ca794881939570013e38edd9f8e6f718f7d202e74a82f41
SSDEEP 24:LLipxh0GY/l1rWR1PmCx9fZjsBX+T6UwcE85fBmI:UBmw6fU1zBmI
TLSH
T1C292EE075E383407DBA10E7D366B18768E3FE26C5FA29C94347410618CF9482D5394FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

History

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\History
Size 184KB
SHA256 7ac0739f534f89ae63c46cd41f0cffaf0335fe348933e3e3d660044351f2a746
MD5 c77e3d0b59e286bc3b50eff7cb8f464c
SHA1 b260bf6f86fb9aff5b2396bfb49dea658a6f05e5
SHA512 e9d95b19019dda281d5cdc16315ae5368b3bab7786955354de93dabe5885c958c556a09e4b57a707244e0052cbabb00029619deba1810677bf9ea06e7287e8fb
SSDEEP 96:xhBttejzH+bF+UIYysX0fxQp97fEHt/DfLjLqL/hbgI4VgNr2jWRk/E0:xhBqH+bF+UI3iWGVfWN3qL/8VgZQW3
TLSH
T1AA04EC1E5F743612CDBD513668E745B3597CF03F8B636AC62CA114B1CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Trust Tokens

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Network\Trust Tokens
Size 36KB
SHA256 19e1e0d60dc0a70455014fec98b5e4b73e93a80651600368745ab0d4a49c9529
MD5 4203aba60fd9de5b4232fc624db3f817
SHA1 1f07dfc552d6b509c83c36cb05986007ce29e250
SHA512 6240f8ef505e093f0ea99306adfa90969b3de094cde08b61076bd2c737763c0815108f532ec17e766fe15f9b1bcb9d82096f799ef04d50c3ce2305d8247bfeb1
SSDEEP 24:TL33lIIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:TL31DtX5nDOvyKDhU1cSB
TLSH
T15EF2469BE93C6FA3CCC56FB08B47E5B51F752BDEE68276C4247130A10EA860055E7443
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 5KB
SHA256 57971d51b901d829bb1c02cb4635d4b8d2844334048c49d0b1ed7355f8c3cc2a
MD5 34641773839e14dd97e8015ed87abf3c
SHA1 d6f93f76ae6d7a2cc91a9265b12f42e1b05a36b6
SHA512 45b8bf951a8467214faeb06714f88ba12ec5efa87254910e1550658a683b161ae69c36fd07b998b737ff556cf95e7813b20137456b42297d8e48484a0029e747
SSDEEP 96:rPYZ05vsQBfYTUb9exffB7dZ8i0oEoUGklm/7qx+WVHMSm+uecadQjiN+gPudKK8:rPYZ0qQJYRxfZxZ8pFoUo/S+Wi8dBNBZ
TLSH
T1A8C198025F6869774CCBF21DBA35BB42D2FA102265D45E5CEBFC852C09D55DD130B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Preferences
Size 6KB
SHA256 63f930cd3bf7ab2fb7a64380cc41af5111d3977661235a2d20b8150d798b3f46
MD5 882bc7aab325f08436b054480e1402fe
SHA1 b48dc1d1e6ad98da160d6f5ef6a9203f1c9a389d
SHA512 76ddc490064a7873d47bf9d6630b3f5c0cfb31a85e033f85dfbeef26cb785a9178edb7a41f7cdb6e576907733ac1f1fa23f2d9e1d3a66dad55fe459ef68e8482
SSDEEP 192:stPYZ0DQJYVxfZxZ8paoUOX/S+WiTFCwxgFFBNQudrM8:stPYKDQJYVxxUp//Vkwx2iOY8
TLSH
T11AE1A9425E7869B74CCBE619BA35BB52D2FA1022A5D04E58EBFC852C08D65DC2307D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Safe Browsing Cookies

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Safe Browsing Network\Safe Browsing Cookies
Size 20KB
SHA256 e87b3d155c7582d4c1d889308b58f84e8fe90a1581014b21b785d6694bd156cc
MD5 a156bfab7f06800d5287d4616d6f8733
SHA1 8f365ec4db582dc519774dcbbfcc8001dd37b512
SHA512 6c8eeab3ae6fb0d5be7758cca521665b216f31aed1aeeeaf121c99dc9f0192b385de0da36e94f90dd4a9bbbac6be2c5a55d2f284a24ccb7dec2c5302fb9b027c
SSDEEP 24:TLekLbXYFpFNYbatqn1kweka6za6UwpQ9YH8PATZ6HfB:T66LopFMatSaw/auUOt8B
TLSH
T101928A4E5F346220C0F44B36EDD189672F7C212CD3A72699DE1420F3DE929ABF1095AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Secure Preferences
Size 6KB
SHA256 fef536b5c3ed9814617203639acb1dacfc7b33391e9e4451f2b786e2ecfcaadb
MD5 e2c68ae26b32fadc63d5049d43391a65
SHA1 5e16bd37d7a12f8ba2744a3f1d640a73ea4618d6
SHA512 c6deaba2e60b984ae3e180e44b63461236a513b4d7e7cf6bcfc7862b22ea9daf371e29c2715785ee1f4af5c139f5e752949428b44da141d7b593ea7ba074625e
SSDEEP 96:Hl5mhiQVPlf/ROoKOpkF5d15mhiQY7sMaTEv9V5h5pg5+eeiXQXD/X/acpHbVdXA:HXmoQVWGSmoQc9lMXQXDnC
TLSH
T12CD1D5A3046DC539AF848BEAEC383ECADAA600CF98D54C4997D2C44807C2BFD21DE4D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 48B
SHA256 33f31787f88f0494a9fa42c55439453b5e374b2d28f4b7fcf7653786d9a4bb1b
MD5 f9d5cf643034c08ced68dd67791911e0
SHA1 38176c732ecdcfe335d2490eac3df507f76970f9
SHA512 c8a243b29d08b848399fce6abf6f9bd4ee00cac4b050a87c67fe268f353e3bc3c80e0bb5a2372a0a9080a3bcdc3e15860d137296a784546a51fcb8af96e949af
MD5 SHA1 SHA512

Submit Download

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Shared Dictionary\db
Size 44KB
SHA256 f8e7cd835195e4eff7855d20676484ca75f7e7e4fe5b13164fc926b365e1dea0
MD5 b581f0ff8f8aa3371ae47b48c95329e8
SHA1 4f588efadf3675f3526cbe762c50eb8e79d9f2e5
SHA512 e0a79452acb39838afea8ce34e05c7e5cde68f2a786fe4423ddf2588fc6047339e8e4c3140d7e0447f938b2266f52b9ddbdcc0f40c495d833b47b3f27d7996de
SSDEEP 24:TL6xgJhPwMuz6G0ZestjteX4yNQeYlv+1b3IeNS6+6Uwg89oIPq81fBG:TFOIy4m1b3fbUdSo2qSB
TLSH
T16513AA0F1E187551D1BD0235E9E64E6B2E7E204C9B8369D125F01AF24DE251C9D2F27F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SharedStorage

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\SharedStorage
Size 4KB
SHA256 1fe8f6113488865c546d2faa55b21482662ce4be19d4f505eeefa09bc3131489
MD5 b9263bbf24428aaca95d04d04f3aeb6f
SHA1 5346015345f6df766df4bc9b42da076f6fdd440f
SHA512 5bc2978bc96e1347500db552e2a2dfd9e5df25c8e16d3ab57e5519de43cb9c08f5aeefd1a6f6947d7fa253505918763b932f622636fc2a7a429fa72a5b49c7cc
TLSH
T1EE810440534000F1D05407F755D1130C0F07D3D4D5410F0355010041CC51D445C70FC4
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Site Characteristics Database\000003.log
Size 40B
SHA256 f096bc366a931fba656bdcd77b24af15a5f29fc53281a727c79f82c608ecfab8
MD5 148079685e25097536785f4536af014b
SHA1 c5ff5b1b69487a9dd4d244d11bbafa91708c1a41
SHA512 c2556034ea51abfbc172eb62ff11f5ac45c317f84f39d4b9e3ddbd0190da6ef7fa03fe63631b97ab806430442974a07f8e81b5f7dc52d9f2fcdc669adca8d91f
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Site Characteristics Database\LOG
Size 313B
SHA256 43742f6be8a134fb3b47271dcca7334dc001dfcf254628ea10c131f2ebce9724
MD5 ddcb83c654ceca96334776a6d749f145
SHA1 9482f6dc30889189ac314c11b9826c0d6056238d
SHA512 909fd0df8ca2867697f865c4457c413e2e6bb6e647e226fe7cd3718fb1b9c67fe9c8cce0258c7ba334c8c3919149131490a9035a4a5de0dd5091be69673f214f
TLSH
T1B9E026316AC9C677578548FF6632F34DC6A37802EAED2B150E14E3442547088B402741
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Sync Data\LevelDB\000003.log
Size 46B
SHA256 a2ca52e34b6138624ac2dd20349cde28482143b837db40a7f0fbda023077c26a
MD5 90881c9c26f29fca29815a08ba858544
SHA1 06fee974987b91d82c2839a4bb12991fa99e1bdd
SHA512 15f7f8197b4fc46c4c5c2570fb1f6dd73cb125f9ee53dfa67f5a0d944543c5347bdab5cce95e91dd6c948c9023e23c7f9d76cff990e623178c92f8d49150a625
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Sync Data\LevelDB\LOG
Size 289B
SHA256 0145ac6f4a9e2f3e42605d6e27575447cebd6bee811d79bfbf6334b2edd1e52f
MD5 1dee2c68380436dfce94e729874c2c23
SHA1 1e8bbcb267a63a74cc18e6447fa4e1639faa1c60
SHA512 f6ec114476b61e5aba14cc816c305a9937253af42fbb0f2e5e6b868e515616c70afba53cc6a467cfaad6e5d335e6d96ff814467913e628902ea3066ff8835a8b
TLSH
T12FD0C271A9D8C6379A80C8EB5676B78EC2F0BC07A7DD3B094F08A6093C4204CF421682
MD5 SHA1 SHA512 TLSH

Submit Download

Visited Links

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Visited Links
Size 128KB
SHA256 c532e77ba140540197dc7eecb1f873657a4209cf40ed888a5f34446fdd7daccd
MD5 2c60929d40c7c5438eaf5d8d54e9f161
SHA1 21bb7c448406f1bbff2f1e69e6ce02b868e111c2
SHA512 e2684ff58bccc83896e986796a1ee9ce273298db4bb9e50d0b44bdbb7c6f522edf5c0ba4390a4fd68463180b085cc0b7c6a0389cc3ca17f91a7c4e544e8b43c0
SSDEEP 3:ImtVmIvll:IiVmIv/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Web Data

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\Web Data
Size 216KB
SHA256 2a7b3bb5ac287c4d5fd81c76626b1e8e15f32f34d2b37738fdc98fa6ad43baaf
MD5 4ebc7325aec489f53e4635ea414d14a5
SHA1 c85641375cd9bd4a26922883598a02e8861a6bec
SHA512 a2ad8a907e9d3405fefc533ef4ae65fcb32615914163af646c6af02a412df1d3a2250d0ec8e04ab5d04b6d8453122d43d97aa3340358fe5e7c748e9e2117fb74
SSDEEP 192:njQLsS6Xuv9PhDnLUMjA03VpQYouZtuQKIqJZWTVTdhsrV0dwe:nEL3CuvrDnwMjA0FpQY5Z0QKIqJE6K
TLSH
T14924440A7B746001EDA6E9721CB080771D3C61AD8F22E6826DB254694DF6853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\shared_proto_db\LOG
Size 285B
SHA256 d624560e49eaea9489d97c56ec99eae0ed0d029ff3b892e4baead13d6bb65481
MD5 295df0db1abd7eac2b153c547b1f2bcf
SHA1 5283c8e0a0442bbb0fb448a62982fd825dcd569b
SHA512 54e81cca4c3acadde5fbf56e03806517cccf1b17b94fb0c9ed2fc22913d63a670a493ce989157aeb38cdcd0d91eea956e7b8e0191f0339983f95c8c55788dfe3
TLSH
T1F9D0C212FC99C57BA55488EB3433638DD745BC47FBEC3B090E01D6092843048F802342
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\shared_proto_db\metadata\000003.log
Size 450B
SHA256 6b33308850ca9c9dd8c56e39783a061a61901ab9d9d24ad488d07f2ac95ed70b
MD5 99a781474e62f3e861ab06fc3eb5f2b3
SHA1 3446a70f8941a1b1c8c2580a24b2e441aeb622d2
SHA512 e117eec2625ada72cad65e4d8af676be47787920450a71509e00da9bfce6948ac28527de466e382b2babdce17ab4b0d1c04807f7cc85054a5a1ef06d9a99f65c
TLSH
T19EF08C52F334C418E00A923B643697221379D5518FF8DD0F497AA0202EB3A150D0B7D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Default\shared_proto_db\metadata\LOG
Size 303B
SHA256 ca6e5792e7e130f50837d86b5d56a3397105be2e561855b1434c1f7e39dd282c
MD5 aecf2d237c999bed0a7d607b8d175241
SHA1 8d4972095fa797629f22bd2d9119bac2b64c729a
SHA512 e075e87eac89c0c13d364698a72421b1514ac4646cd9e5003ef7d512b056a628d47c3d3c2dcd4f23bfbbd627d7f5f658b57b202f4793e8e091be0f6bf4165590
TLSH
T1DEE08C12BDA9C5AB955088A725B263899256BC4BFBD82F090E41DA096846488F806242
MD5 SHA1 SHA512 TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Last Version
Size 14B
SHA256 06205ebe5acf3073d12a4ac419377a3449e6d6b5fa7fa2b1c4201f007c4ddd91
MD5 96fb5f155aee0f8cd88274656c58ca83
SHA1 1fe86d9df188b0f86ae2d8da8f7c1ef663258baf
SHA512 fee0061ef23ef3fc35d050501b47db921f490c2aec2a016304c9f27228d3ecf7df9641fd681d9babd275ffd3dbd20e33e38fa5bf583c2852ffcd4b04bedf015c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 2KB
SHA256 cdac376bac7bb36e977315cff5e830fab6111e25d1936765e0ca3e2c2b5b940e
MD5 f8d1309a2321d38d6067a0317185389a
SHA1 772f8d761c3526e049d9a0fdec5dfe04839d7d92
SHA512 e2c1f231b032e74c33824110fe8dab1ce8577c6164ebb12b4afd400205edbd81828b1a48b460ea04a8b4551f0a4c38ed6580d025ccb048ec83b8d716b23f9043
TLSH
T10E51F8B3ECACAE7B49E24A48BA8A3F12EA355066D6505F9095DC0F1C01E71AC2303C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 3KB
SHA256 048ea374e0042a2c378fd216fd0b7be5435b68e7ca2fec35b1a351899697e27c
MD5 5741e857d57ed6770a92d3c003cb24f8
SHA1 fff5a8c26f0e695650c8ce7557d7c6a06c564817
SHA512 bf3cdac12602aecc54293ed110e1c61ade5218cd3e0420da0c337eab86704b82a420f6b00972bb6d253b3d46e8c0baff90e13fbee415652f93aef5492ae3b742
TLSH
T1DD71B472A9B8AD7B4DF28A04B9C62B12B7655137D5907F98C9EC0F1C01E72DC2352C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 4KB
SHA256 38a65c639688daa5c2285e16b868ee2bb8e066f3ddf2d54da7890ac63f4d3b87
MD5 9550b1901cbcf1cd1ce1192c27e10c3b
SHA1 5fdf064279810e3103ed6d25d8d6fd898418433a
SHA512 ca6d144dfd44d174cef102fc94201d7dbe892a2fc06e3b8590ea9d05a6e392e11c5d6cf19e6296db6da9e60e6194f3f643814dbb3d929cbafdcce62357284830
SSDEEP 96:zuOYF3NkCEBf4ypLsD58Frh/cInURoDotoTP91CDPzNBl0ZH26LeXZ4CyTT63a:zvYF3NbpypwuooDU4PwPzTl0ZHXTCqB
TLSH
T19991B572A9B8AD774DF6DA49B98A3F02B6645027D1946FD8D9EC0F1C01EB2ED1342C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 4KB
SHA256 3ed56ce69e7b828a84bfcc7ac8498ca24d0ad5b717b7538607e10309542b25d1
MD5 f478fb0a76d016f9db3bbebb9ac2a4b5
SHA1 dc1812df9be286bfbd7dc62c14c1632be42d0bc7
SHA512 dd120199e260dd5e324f6d3401a005ee568ee8c88a7c6c5e8f2a711a5502b191e8c82031ea7675bf07bb8efa164392a16c670b4465b3c1daec9d4f3badb2c29d
SSDEEP 96:zuOYF3NkCEBf4ypLsD58Frh/cInURoDotoTP91CDPzNBl0ZH26LeXZ4CyT963a:zvYF3NbpypwuooDU4PwPzTl0ZHXTCqT
TLSH
T17D91A462A9B8AD774DF6DA49B98A3F02A6645027D1946FD8D9EC0F1C01EB2ED1342C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 4KB
SHA256 a127e0173f082d9032546b04bc5e5d85ced230c7985d2bb532b2f93d34e986fb
MD5 b25dbc786b9db549389708bd9edbc8f0
SHA1 18355709fbec630111c8bdf27ed033b10e551d63
SHA512 047c38a2215902ffc3b94f517de4fff5a64b2819739fa460f63016c0b43b8a7b0c71c019be09fa4c98ecd85b39b4598591b99b880a647d565576d4ef1f0ff227
SSDEEP 96:zuOYF3NkCEBf4ypLsD58Frh/cInURLl8DotoTP91FDPzNBl0ZH26LeXZ4Cyi963a:zvYF3NbpypwuoiDU4PRPzTl0ZHXTCbT
TLSH
T1D891A56299B8AD374DF69A45B98A3B06A6B45023D1946FD8D9EC0F0C01EB2EC1342C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State
Size 16KB
SHA256 4244c873bfd272d0a1bd110efc6cfba402658126e75aa0b3b421128be573c78c
MD5 b4cf05c795580ceb64d17d8117f36951
SHA1 a5a2aadae405d607da0cf3291ec5663d16bb574b
SHA512 0c1dbe3df30dd45f244e47aecde9f28f66e25569ddd2e4b9fe770c3e59a370676acb8860817b06ce7b1eb6464bebdf3b865c107de3c97e640d81c87596374b75
SSDEEP 384:zvA+aQikB+z/xvxjg/qhEP3NbLwf2O3l8HXD+JV09zc:b/UxvxjgC+PMW+JOFc
TLSH
T1DF729E2B54BD3E2768F3F9057A8D0B9BDBB884A290C15EB84AED5F0D16C72D81342C46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5865ca.TMP

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Local State~RFe5865ca.TMP
Size 1KB
SHA256 840279c32a8ffc1957dceaa29e3e6f42e7eecdb91540e8b4e9d17c416cbdc6e2
MD5 139ae056ce9c70a5e664948771c4f9d0
SHA1 89f0e62092272211026c862e6be18ae744652587
SHA512 5216157eee530d4e3037529bfd62c6aaf8ad5d04da1fd889ef1ea9a3d247252a4b30baeb8adb9f54d69f2727682d6661feb0fda91b124edc1cb5e01384edc9e8
TLSH
T1322162B3C4E86EBB7991095AB282BB862F20116681508F48A1DD0B1C12F74EC573BC32
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\ShaderCache\index
Size 256KB
SHA256 9702f9979b697f760d5272813a4004e1b4d8e48a6bd6691ee3b0cd07afc105f6
MD5 ec89d1621ba3b39cd0257bbd18968864
SHA1 8f3769e8d679b7b6f10a5fccf8a3458b6b7c0f1a
SHA512 a66510b41c0ffa33f2f915d33fa36019f779b97f991ff25694898c03a8d45cee0df563db6ca7e32f649acf9b4fe87ccc7b9860a660ce7a59f9a9574ebefc3218
SSDEEP 3:LsOllllklkXlZ+l:LsUlPcl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Variations

Path C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Variations
Size 86B
SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
MD5 961e3604f228b0d10541ebf921500c86
SHA1 6e00570d9f78d9cfebe67d4da5efe546543949a7
SHA512 535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472
TLSH
T196A02407C473C00FF4144051C45C034114FCC447011DD0015074D31314D40CF03F5435
MD5 SHA1 SHA512 TLSH

Submit Download

ui-state.json

Path C:\Users\Admin\AppData\Roaming\Cosmic\ui-state.json
Size 2KB
SHA256 e4a17198a7be8cecadb68009ea372c2f186c23af9121633990c43a8e96e82217
MD5 25bace007e73d81d3160a5f4fbc61ef1
SHA1 151126f33672ef4760b6ddfd3ea31772a161b482
SHA512 3b87d98028264d7a4673c41a18d99ac3676564add842e58b0a872ab5db12ed7af3b43b9453ad0620400ada7a32467837fbe012a2b6bfd43dd182473b32636195
TLSH
T11841492ACA680C7710E4762A9CED52436A7582530D593C2CB78C5A0C1F9E33F65B79ED
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1668-48-0x00007FFC353C0000-0x00007FFC353C1000-memory.dmp

Download

memory/4788-0-0x000001753C040000-0x000001753C050000-memory.dmp

Download

memory/4788-19-0x0000017558060000-0x000001755806A000-memory.dmp

Download

memory/4788-18-0x0000017557FA0000-0x0000017558053000-memory.dmp

Download

memory/4788-17-0x0000017557F80000-0x0000017557F9C000-memory.dmp

Download

memory/4788-10-0x00007FF4617B0000-0x00007FF4617C0000-memory.dmp

Download

memory/4788-9-0x000001753C040000-0x000001753C050000-memory.dmp

Download

memory/4788-3-0x0000017557CF0000-0x0000017557D12000-memory.dmp

Download

memory/4788-20-0x00000175582F0000-0x000001755830C000-memory.dmp

Download

memory/4788-1-0x000001753C040000-0x000001753C050000-memory.dmp

Download

memory/5224-148-0x00007FFC353C0000-0x00007FFC353C1000-memory.dmp

Download

memory/5284-333-0x0000023474380000-0x0000023474433000-memory.dmp

Download

memory/5284-335-0x0000023473290000-0x0000023473D52000-memory.dmp

Download