cosmu | 4ae2a367b88e236d253ad535bbe31aefd2db3954a01156bbff1b51ccd00f4b22

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 12:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
Size 284KB
Sample260907-p31ehaxcqa
SHA256 4ae2a367b88e236d253ad535bbe31aefd2db3954a01156bbff1b51ccd00f4b22
MD5 8fe581cacc911a980cb493fc36b05589
SHA1 e1b8eb3c8b85bf91c42012fbd5ba714cf8ec444c
SHA512 9f72789f575e2bb69391ff398bb10cf8ecef76b67b186e2ecf025026024a8f28eacf2d4d19bc2aac57d578b7dc80977f1759a580da399b068f8c20f4a40c20cb
SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTOoAXjiU4bzF:ofBQGH6SfaoAX+U41
TLSH
T16A5402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery cosmu worm

Malware Config

Signatures

Family: Cosmu
Cosmu is a Windows worm written in C++.
worm cosmu

Detects Cosmu payload 3 IoCs

Cosmu is a worm written in C++.

resource	yara_rule
behavioral1/files/0x0003000000022b20-11.dat	family_cosmu
behavioral1/files/0x000700000002459f-50.dat	family_cosmu
behavioral1/files/0x00090000000245a4-142.dat	family_cosmu

Enumerates connected drives 3 TTPs 10 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\I:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\K:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\N:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\O:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\E:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\H:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\J:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\L:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened (read-only)	\??\M:	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Internet Explorer\iediagcmd.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX7784.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX7788.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX776E.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX7785.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX77DF.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX7858.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX7647.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX7659.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX76C9.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\dotnet\RCX76EB.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX77CE.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7zFM.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX77AB.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\RCX7869.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\7-Zip\7z.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Internet Explorer\ielowutil.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\crashreporter.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX7813.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX787C.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX789E.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX779A.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\RCX77F0.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7z.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\uninstall\RCX789F.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX77AC.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX7648.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX7770.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\RCX77BD.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX787B.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Mozilla Firefox\RCX788E.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX7772.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX7786.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Google\Chrome\Application\chrome_proxy.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Java\jre-1.8\bin\jabswitch.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\RCX7646.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\RCX7773.tmp	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe

C:\Users\Admin\AppData\Local\Temp\2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_8fe581cacc911a980cb493fc36b05589_elex_rhadamanthys_smoke-loader.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7z.cab

Path C:\Program Files\7-Zip\7z.cab
Size 549KB
SHA256 707f415d7d581edd9bce99a0429ad4629d3be0316c329e8b9ebd576f7ab50b71
MD5 0b24892597dcb0257cdb78b5ed165218
SHA1 5fe5d446406ff1e34d2fe3ee347769941636e323
SHA512 24ea9e0f10a283e67850070976c81ae4b2d4d9bb92c6eb41b2557ad3ae02990287531a619cf57cd257011c6770d4c25dd19c3c0e46447eb4d0984d50d869e56f
SSDEEP 6144:vXREiNYVLKZn56Vq2UjCpd0v5prE6v0GSxWUPZl1JP+1Lix7NGZIVuXQ82g4zrr8:vXZNYVLeyUji0h90ZD0wxpGZIVuKrHs
TLSH
T1C1C40916F6748335D073C0B9C5D2A68EE972308657308ACB4286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 320KB
SHA256 9d13946130e6b857a1fce2928a2758076bb72af1dbe70a046bba03c90a45c392
MD5 06bfbc8f5a276abfef999c67c4dca135
SHA1 e74141467015c905119cb752e92c166b42b1367b
SHA512 79ea2feb6933533e76801f70e467233acc8dd524f9271a8d2e3757d40bee5f35b0f5e42454798ba882ebab2cc173dc0c044257275eb8e9e3455f6f3f864388a2
SSDEEP 6144:3FlKgzelZNQSBQGH/CSpWqTOoAXjiU4bz:ofBQGH6SfaoAX+U4
TLSH
T1506402457D93C4B3D0414D3188E68BE18B7F6C137AA6E11BFB9D0B4B1EB13884BA6761
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.cab

Path C:\Program Files\7-Zip\7zFM.cab
Size 963KB
SHA256 028cf2158df45889e9a565c9ce3c6648fb05c286b97f39c33317163e35d6f6be
MD5 004d7851f74f86704152ecaaa147f0ce
SHA1 45a9765c26eb0b1372cb711120d90b5f111123b3
SHA512 16ebda34803977a324f5592f947b32f5bb2362dd520dc2e97088d12729024498ddfa6800694d37f2e6e5c6fc8d4c6f603414f0c033df9288efc66a2c39b5ec29
SSDEEP 12288:O8vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/:7a7/ezSC6vUyD/aqgrvWx6q8wyu
TLSH
T1F225E815F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.cab

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.cab
Size 281KB
SHA256 6d54694077faf07473196da7b7f1c6981c8ad6a462fcea4777a80cfc6bc5769e
MD5 3dc3594fb3b25c55081fe4b3226abbc2
SHA1 7eaddfd597fc76244f71f98877f7149c9e85dc9e
SHA512 8f268673c86e2c38d1713696ed25b75a565d8beb5b05ea755c9cbb12f625b8d4abfc1bb3f9f54c297ba4bd7dd9e465737c30f492aaef0034b0e1568ce13d2445
SSDEEP 6144:zOOr/BJ/GKWWBNU6ITLBi0qttclOKgU91Bg:meBNUbTVO86Uq
TLSH
T11254E73BEE28FCD2C27A8DB85A918640E77274704B61A3CBD175830EDE235E15E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX76B8.tmp

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\RCX76B8.tmp
Size 284KB
SHA256 d1031624246ec8d0e6a15556511680fce9f185cb3ba3ad1975523e669c320032
MD5 d7bdac1d9c1f319ea94bd0f6ab11cefb
SHA1 c259a6d9b7443566ee6400517d81f993ee9c066d
SHA512 dfd633e09bd4981eb518f12afeb6a64a40f1cb79284210f75703d35b20d5ee5f7524eba75ea1918ae2555f653bf8e59ce03c49f82ce1935b25f103d41df7b261
SSDEEP 6144:SFlKgzelZNQSBQGH/CSpWqTyoAXjiU4bz:1fBQGH6SfeoAX+U4
TLSH
T1BF54F1457D93C4B3E0414D31C9E68AE14B7E6C037AA6E11BFF5D0B4B1EB13884BA66B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.cab

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.cab
Size 2.1MB
SHA256 7e0976036431640ae1d9f1c0b52bcea5dd37ef86cd3f5304dc8a96459d9483cd
MD5 b8d69fa2755c3ab1f12f8866a8e2a4f7
SHA1 8e3cdfb20e158c2906323ba0094a18c7dd2aaf2d
SHA512 5acac46068b331216978500f67a7fa5257bc5b05133fab6d88280b670ae4885ef2d5d1f531169b66bf1952e082f56b1ad2bc3901479b740f96c53ea405adda18
SSDEEP 24576:GCbRquA/m2z+L5WqJdrHCYRFiV+XenmE3Pnzc344:GCbRquA/m2yL5zbfFiV+XenmE3/z
TLSH
T156A55B0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.cab

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.cab
Size 6.1MB
SHA256 ca434df4bbfcadf6a6610a6bbea4eb435adb91751670f63c0a6bc3207e4a89a2
MD5 428bb0fbc37685cdb17b836b0887a520
SHA1 80c2eb353a27e5c0fdded4f71328ed154d1682aa
SHA512 280812ff44ecc30c50e01e959dfc5df3473fde39833222c8fd406aa8ea5bf0c72753e54098525dcb61cb1c8dfda4ecbf5c76891499770cdf2c0a6db6151766f9
SSDEEP 49152:8j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeKAaLSF259ruMHwpXMi4FqJLd23UQ:TQRQyi36YOcP+Lvw2gAf+PN34
TLSH
T196565B13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.cab

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.cab
Size 1.7MB
SHA256 415ddfcaeb5f4240359dd12ed5cc53610c27d144ce44df6013ea5f6546102080
MD5 e53748309e257e3e145d90b1690c44fd
SHA1 0f055917f8b56a97a9bab0b2815bf17f5b45f64b
SHA512 801769fdc53e73369266b5b34148ee64cd069de14880113abf5db3413fe29bb88fd6823ec36edea3e9f76b08344037748f81ff4f8059a37c764abac33d0caad7
SSDEEP 24576:OwvLof6SRQ+rn/fDboqxN1nnh6z7DaHGTNHu7PNU3/5W/ohL01:468Qg55nhoeWu7PNU3/Q
TLSH
T190850633B2F600A9C44DE1769F4A873196D27C758FE0E3DB851572061BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.cab

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.cab
Size 3.5MB
SHA256 e0004b24f9d4e74eff4e221871e5bb7233b57033f5725c5d5c67c07f0a8976ab
MD5 ac0c48a3dc1f5d35a05c38530f83f5bb
SHA1 f568c5bc6c0b9bad138c08d25c9a2292fea7d33c
SHA512 b3a2cba38817630b4e99623416f36dc9395485537636eee63f2877fee8e4727319b57a404b9123764bac435dbf0286b4156b3b871f2a36380f6296347f0fe7e1
SSDEEP 49152:Y3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbgN3Oh6tznm2FQ/nho2qkrk99f:Vy5112gYy5azzVvf69nLKnhZO
TLSH
T192F55A13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX7771.tmp

Path C:\Program Files\Google\Chrome\Application\RCX7771.tmp
Size 284KB
SHA256 f918ea700a3e1bc05285dc4b0fb28a83fb6f954dc0ea57831311153512365236
MD5 c36e17e72bced19416523632975422a3
SHA1 b449ae4f272a1726b54b327483801e3e7f0b9057
SHA512 b668f2a312cd38c930826f5d055b84efa358457584df4c79d9270d2404d595447606ee2eba24bfd2026af79ebdfea99d8be8c89372b4a686f1ff51b085fa3a78
SSDEEP 6144:yFlKgzelZNQSBQGH/CSpWqTuoAXjiU4bz:VfBQGH6SfqoAX+U4
TLSH
T1E25402457DA3C4B3D0414D3188E68BE19B7F6C137AA6E117FB9D0B4B1EB13C44BAA261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome.cab

Path C:\Program Files\Google\Chrome\Application\chrome.cab
Size 3.1MB
SHA256 fdcfa390134b6d9a6bb68f9b7c452c01701e2b27fca1b9227e5b92f652df2457
MD5 fa63967c128ae8a0849c916979790211
SHA1 7064ec510e9828d290aacdee2af26855ca816c84
SHA512 db167c33774c8032501e36488c9f6724a7394f9e7134a1c9235df8bc7f71658132bc39a84967cf98ef8a61e68ce2d4c813f156ae445a8f6273c811e746fe181f
SSDEEP 49152:VyLSrJhMeJNvjLAE3dGGj8b2EGcjesaNkYQd0XNJKcvaAcPTY6Y5AX:Um7vj1BDlZG
TLSH
T19DE58C13F2D940D8D059D079874A9232EA72BC494B3166DF0A90BB562F7BFE06B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.cab

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.cab
Size 1.4MB
SHA256 79587605707bb61fde6eb92ee778b2e2a01725daac73e07f1569f9de4368f72b
MD5 1a6bc1b508c4cdef8c5139e4e140fbea
SHA1 5ef6d8fd408616028f2fb37a797d6daf0711b91e
SHA512 5a5b74ab2c104458243b4bf137b1c9eebfa80a2c6a9fa119003f13427605310f5042404ceee190d3a717ad6cdce1fb83a90f14126b9d618ca132f384baa7e5d1
SSDEEP 24576:2hiavrPSLT8EARn+FgyUgd0fJY6B1i3iy9CTn0AP5+2QLy:2htSn8EApI0fig1giDn0AP5w2
TLSH
T180658C13F2D900E8D05ED178C7568632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.cab

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.cab
Size 23KB
SHA256 ea8543b0eab31dece2b50ef45a2585f4de09af35c68d9a63152944f8a831ac29
MD5 f63d14c000dfcadf2394c737edaeaec9
SHA1 1c9d16d93f58d2c0a4708ffeaddf9d2c26ef33e8
SHA512 4cffa0d1c4c1a1ddb91ade23e17a76dac807174d022115592caec2d0927af8188455e0c7b8273972de4e27e4bb816e83deed70551075b6effd4f32aecf994053
SSDEEP 384:v/XJFVL/3DkKF5CInef2IYi1oCBxPxh8E9VF0Ny0Wl:X3VL/3RFDefrYixBxPxWEOW
TLSH
T15BB27D13CDA40CA6FA064A70F4E5164AEDB97A47ABC182DB332CC1141F517813BEA2FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.cab

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.cab
Size 23KB
SHA256 955f386e3af5d87a46dcb2064967e34eb25a44ca3d2436e54bd5b84f4a2ab2ee
MD5 952fc862806f000e37d22897243c2bc4
SHA1 2da507ba99d86deee0fed3238e5e9fb170a562d2
SHA512 c74263c02d2066c0ff8a236c9fc620e2e088b3c1d3b54852de45f7b7dfbea799ffef41787919a196ff4e7ff03d1c7dc1bb2b876f1c7f829e04aa577ff728ef05
SSDEEP 384:m/X5FVl/3YbxTVKF5iPi8ef0IYi1o4LCPxh8E9VF0NydaT/:u3Vl/3YtT0FUi5fFYiqPxWE/Q/
TLSH
T15FB27B16CDA50C96FA068970B4E5024ADEB9BB47ABD1C2DB332CC1045F517813BAA6FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.cab

Path C:\Program Files\Java\jre-1.8\bin\jabswitch.cab
Size 44KB
SHA256 7f1b10f0679401e5360f7e0baf903035728a631c03056b7d40dbb6ae734fecae
MD5 f0f1575cb0a27c0815cd6a6ee694c7a1
SHA1 347aabf545b26e24293e7983a34a88fb1f132ed3
SHA512 6713667c5a1cc7d8aef24b3214f045411d41f1d0c14a4d994ec4f53302d9293bb56360e30c51f31542ad67d540b0f0c9f0530783481bc810d1634b127e48989a
SSDEEP 768:H0U2XvUNQWVjxPiGrdttFiHBBpOfrTqpsgqsZ4VYiYMGPxWEKM:HlYvDWVjZiMttFihBpOfreqsZ4V7YMGp
TLSH
T109136B126BA904D2E867D674D8F24116E7F6BC96AB32C3DF5710054A0F723C0BE74BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.cab

Path C:\Program Files\Java\jre-1.8\bin\java-rmi.cab
Size 23KB
SHA256 ee8ecfd717dfde63ff423f21fca560d80ec333ebfe2d55aba23fb7a1c4bffaaf
MD5 5aab08e129caf5c4595f21142e3c32bd
SHA1 1ee57e2d3e4939945939d4df180c1f9128fb2582
SHA512 5b5481ff4d75762419322ed491eb932b7a2dc89497f15a5cb020406de717e9463e3494974945b0ff459b2acff2c314c42ebecf5580d4a40e9e3d555bbc0cfe2d
SSDEEP 384:DtdGI14EKF5i1efTIYi1oMDrPxh8E9VF0NyyMyg:Tz1SFAEfcYiLPxWEUQ
TLSH
T128B28D22CDA10C56FA064570B5E4465ADEB8BB9BAAD1C3DF332CC1042F913803B996FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSPPREARM.cab

Path C:\Program Files\Microsoft Office\Office16\OSPPREARM.cab
Size 238KB
SHA256 ac66bafa0e7196b9f7b4a83b9625b32e83db7731418ecd0f4a8de474f7355254
MD5 3f1c773a2e54f4d27b29c3fc1edd7d43
SHA1 ef9a5cefd1f3c76b0fa5c8ea4a261dc46e59d185
SHA512 d6636ba0c800757d361212169f770d3799cc46583c79e0b9cc7cc49c565b86849e8965fe0783100bfb8039f12b717db88f95062e7b6b6f67a7f8bd38144a4297
SSDEEP 3072:2un2u3APYV1h7lLVNGZeUImflqjdqHJuxxwSv0nvP3o/VTU6B0u6+Oz2y:2u2EAPYvRtUidCJuxxwNl8uNzz
TLSH
T138343B4A7BA484E1D553A2B49966DAB1F6B2F5811F30A30F0291C33F2F737A0BD19721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashreporter.cab

Path C:\Program Files\Mozilla Firefox\crashreporter.cab
Size 3.4MB
SHA256 180179d0b6cd38c05a5c6b42789517d8ff5e53123cef96004e27a476a069266b
MD5 a26f22b7c4c5e4dade46026358f7b32e
SHA1 4a15632aefe3b06254e1746b0357809fdbcbebc9
SHA512 030e32ba056abd1638b03edcc3df1935ea4806e0ab4d242768283635c1c83231d8c815ba472c01b23f1b4cf9169e540a1634b347f6e3fc7b07a1b0cfa0a68822
SSDEEP 49152:oAUF58RGQBOa74nO28wsz3iDT4JmeDNB05FQz/NTmXLhm6kV93:oAOwBN7P2Jg9f05FylaLhm6+
TLSH
T106F50742EB611DDAC025C07482266723B761FDBD073036F74A906735AE68EE01FF9B99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default-browser-agent.cab

Path C:\Program Files\Mozilla Firefox\default-browser-agent.cab
Size 34KB
SHA256 685f420616cb6ec8720f194bb9fdb45c79973f1976f2b3288f1efbf7b0fd0fde
MD5 a9c87b332300155735abd945a18ccbc5
SHA1 80c3c45586c30b39098ef6ec8addbd7a66a25565
SHA512 8203123ca15e130dcd8f1a2672fdabaa25abed24bb0ca88a756218686c7f017714c07924168e3b036a7f335cf2165c0fbbe283e21af4d2929d74aae1215df282
SSDEEP 384:fX/yd7YiyksV9tUHlJbdrxsPVxc+AUvaHgKbOK9D6UjTsuy2gMO2Jd2UtLIYiaxo:fx99OndKWQqgK3N6Rfg8Yi2NEGh0
TLSH
T17EF26C57CB9448C1FC5BD13AA2E15A37E671BA025B6191C7632683180F31BC1EF7A3E6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

helper.cab

Path C:\Program Files\Mozilla Firefox\uninstall\helper.cab
Size 1.3MB
SHA256 adeb96785772bef583c62e7796393cdb33489638dacce17b320704fb1844713d
MD5 5b80beb4e837fd3d825b0a19cae4981d
SHA1 f0bc1c7a09bf56aacbc196124d967a969d017b53
SHA512 7b971c4423edefa5cd67a1e0f155cfe732d108e308c5ca811dba4b7022428e49a23cc33be42898b9253f7acc05efa0757ce131e4101501604859e94d58102e97
SSDEEP 12288:jTyUjD5xN9euP+bnEPKSjlSoRUJDJ095+B7a2SooEP2WKtsm45c:jTTHhmbEPKSjIov0BW1oZP21tT45c
TLSH
T167656C41B790D822D8AE493078F8D7262B39FDD16F61C6B7331AB39C4E71791996830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.cab

Path C:\Program Files\dotnet\dotnet.cab
Size 143KB
SHA256 7ae20d0542a544b54730a5520a2c7b56dc9235be1a4dc1331763786a16fabed9
MD5 7d4ea76b6e0659fdd36b34499f964aea
SHA1 6b7700ed5632d176fc0efbc5611192644bc391d4
SHA512 41ecf5f0a70828d114056bacd8fde364e2685e3c2f58a785540af7056e3698b027cd3bcce64ab840814ad3d2c5a0eac0a3528cdd88b737eb02671e816eff27cf
SSDEEP 1536:8vJ9psmemUoXVpuoM+/7BUNs9OFVJqp+uIBQepE4XKF3QcOzm:8vJ9psmeIBcV8pQFq4XKF3QP6
TLSH
T1FBE3C31AD29802E8C06E6179C7568A41B7337C6687E1D3CB53D0F53E1F766909EEAB03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

createdump.cab

Path C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.cab
Size 56KB
SHA256 6e25f414dd65440cd0c285990f4eef789a831fff640dadb4afdf79a5dfd95bc2
MD5 8e4a401d4862a3ab07d4e7e17cbdfc78
SHA1 8ff6d2c100a2ba9b8159b9f733da011c8e448534
SHA512 74477239112082429db839be011cbe3d7d8fa66c9b8089dc93b18c1392ae57c935f39446227049e6f7f29e86122d191fa4f2f8d59b87f1f7b6eba3ae4d61a579
SSDEEP 768:cQ6XULhGj8TzwsoeZwVAsuEIBh8v603eQdWu/idw1R9zZb3:SCVbTGkizguid8zR
TLSH
T15D437D0A67B900E6E46B81B4C5E25A47FE7AF552231196CF0FB8C21A1F637C09F39B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads