ghostsocks | 4fd281c9b5fb0a23a852294ee425bbc5982526ebe23535c38daf221a235296fa

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Size 92.1MB
Sample260815-bfpgtscn6v
SHA256 4fd281c9b5fb0a23a852294ee425bbc5982526ebe23535c38daf221a235296fa
MD5 dbb482c7e939eebf218c32ba59cc4b8e
SHA1 536764ceede7441685d747b2a68d14974c046ac4
SHA512 fe43d301c3b3fee774a887951badfe6915f28ad2968712100a95afb6f4dbb4c3fb4a085ea936cd11a2d51d0467f22ebe7624ca5496c1521b5122c54c0926bbec
SSDEEP 1572864:wU+HdItp6c09ncF1+toZ/DgEyIUeRc74ZLAsRFifTJrKlMlt4hQyC:wn96p6h2+tM/byIZc74J3RFiyMoS
TLSH
T1E3282301BA5A9964D05EC8B4D3474B934F3170DA123AA4FFA1E941283F9B7F05B3E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery execution ghostsocks persistence privilege_escalation spyware stealer

Malware Config

Extracted

Family

ghostsocks

https://147.45.197.92:443
https://194.28.225.230:443
https://94.228.161.88:443

Signatures

Family: GhostSocks
GhostSocks is a proxy malware written in Golang.
backdoor ghostsocks

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/files/0x000500000001dab3-45.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/files/0x0008000000024687-2005.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables referencing combination of virtualization drivers 2 IoCs

resource	yara_rule
behavioral1/files/0x001500000001db2e-50.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb
behavioral1/files/0x000500000001dab3-45.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	serveless.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	SkyBridge.exe

Looks for VirtualBox drivers on disk 2 TTPs 8 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SkyBridge.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	serveless.exe

Looks for VMWare drivers on disk 2 TTPs 4 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	serveless.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	serveless.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2216	netsh.exe
5164	netsh.exe
5592	netsh.exe
5964	netsh.exe
32	netsh.exe
5648	netsh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	audioconfig.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ProfileMgr.lnk	vsghssl.exe

Executes dropped EXE 22 IoCs

pid	Process
1880	serveless.exe
5388	SkyBridge.exe
6044	DeltaNet.exe
4108	node_ipsec.exe
1968	vicontrol.exe
4644	vsghssl.exe
5524	cloude_edge.exe
1208	audioconfig.exe
3776	ngrok-daemon.exe
4140	sqlite-host.exe
5936	serveless.exe
5600	geminsync.exe
6068	genodeb.exe
4056	GeminiService.exe
536	ncat-daemon.exe
5360	VBoxVMM-service.exe
876	chef-client-service.exe
3192	osqueryd.exe
4808	GraphicsHost.exe
3008	cloude_edge.exe
4312	vsghssl.exe
3064	data_sync.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SyncCoordinator = "C:\\Users\\Admin\\AppData\\Local\\SessionData\\data_sync.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DriverManager = "C:\\Users\\Public\\Videos\\DisplayProcess\\MonitorModule\\serveless.exe"	serveless.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\ProgramData\\nodes\\geminsync.exe"	serveless.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceDriver = "C:\\Users\\Public\\Music\\IntelController\\GraphicsUpdater\\cloude_edge.exe"	cloude_edge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	pastebin.com
28	pastebin.com
96	pastebin.com
99	pastebin.com
138	pastebin.com
7	pastebin.com
93	pastebin.com
101	pastebin.com
135	pastebin.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	checkip.amazonaws.com

Checks system information in the registry 2 TTPs 3 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SkyBridge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	serveless.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1968	vicontrol.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File created	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File created	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Ansible\ansible-agent.exe	SkyBridge.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Chef\chef-client-service.exe	SkyBridge.exe
File created	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File created	C:\Program Files\Ansible\ansible-agent.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Nginx\nginx-service.exe	SkyBridge.exe
File created	C:\Program Files\Nginx\nginx-service.exe	SkyBridge.exe
File created	C:\Program Files\Chef\chef-client-service.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File created	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File opened for modification	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe	SkyBridge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3756	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsghssl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsghssl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	audioconfig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	audioconfig.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	audioconfig.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	audioconfig.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	audioconfig.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	audioconfig.exe

Enumerates system info in registry 2 TTPs 8 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SkyBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SkyBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	serveless.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
5896	ipconfig.exe
748	ipconfig.exe
2392	ipconfig.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
5460	reg.exe
3132	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
548	schtasks.exe
1948	schtasks.exe
2592	schtasks.exe
5728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
1968	vicontrol.exe
1968	vicontrol.exe
1968	vicontrol.exe
1968	vicontrol.exe
1968	vicontrol.exe
1968	vicontrol.exe
4108	node_ipsec.exe
5388	SkyBridge.exe
5388	SkyBridge.exe
5388	SkyBridge.exe
5388	SkyBridge.exe
1880	serveless.exe
1880	serveless.exe
1880	serveless.exe
1880	serveless.exe
3756	powershell.exe
3756	powershell.exe
3756	powershell.exe
1208	audioconfig.exe
1208	audioconfig.exe
1208	audioconfig.exe
1208	audioconfig.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3756	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 5896	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	84
PID 4424 wrote to memory of 3788	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	86
PID 4424 wrote to memory of 1880	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	98
PID 4424 wrote to memory of 5388	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	99
PID 4424 wrote to memory of 6044	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	100
PID 4424 wrote to memory of 4108	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	101
PID 4424 wrote to memory of 1968	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	102
PID 4108 wrote to memory of 2216	4108	node_ipsec.exe	103
PID 4424 wrote to memory of 4644	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	106
PID 4108 wrote to memory of 5164	4108	node_ipsec.exe	107
PID 4108 wrote to memory of 5592	4108	node_ipsec.exe	109
PID 4108 wrote to memory of 5964	4108	node_ipsec.exe	111
PID 4108 wrote to memory of 32	4108	node_ipsec.exe	113
PID 4108 wrote to memory of 5648	4108	node_ipsec.exe	115
PID 5388 wrote to memory of 748	5388	SkyBridge.exe	119
PID 5388 wrote to memory of 1940	5388	SkyBridge.exe	121
PID 4424 wrote to memory of 5524	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	127
PID 4424 wrote to memory of 1208	4424	2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	128
PID 1880 wrote to memory of 2392	1880	serveless.exe	131
PID 1880 wrote to memory of 5332	1880	serveless.exe	133
PID 1880 wrote to memory of 5464	1880	serveless.exe	135
PID 1880 wrote to memory of 548	1880	serveless.exe	137
PID 1880 wrote to memory of 4504	1880	serveless.exe	141
PID 1880 wrote to memory of 1948	1880	serveless.exe	145
PID 1880 wrote to memory of 3756	1880	serveless.exe	149
PID 1880 wrote to memory of 3168	1880	serveless.exe	161
PID 1880 wrote to memory of 2592	1880	serveless.exe	163
PID 1208 wrote to memory of 3776	1208	audioconfig.exe	170
PID 1208 wrote to memory of 3820	1208	audioconfig.exe	176
PID 4644 wrote to memory of 5460	4644	vsghssl.exe	186
PID 4644 wrote to memory of 3132	4644	vsghssl.exe	194
PID 4644 wrote to memory of 3300	4644	vsghssl.exe	196
PID 4644 wrote to memory of 5728	4644	vsghssl.exe	198

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_dbb482c7e939eebf218c32ba59cc4b8e_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe"
1⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:5896
- C:\Windows\system32\getmac.exe
  "getmac" /FO CSV /NH
  2⤵
  PID:3788
- C:\Users\Public\Videos\DisplayProcess\MonitorModule\serveless.exe
  "C:\Users\Public\Videos\DisplayProcess\MonitorModule\serveless.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks system information in the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\system32\ipconfig.exe
    "ipconfig"
    3⤵
    - Gathers network information
    PID:2392
- - C:\Windows\system32\getmac.exe
    "getmac" /FO CSV /NH
    3⤵
    PID:5332
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN ChromeUpdateSvc
    3⤵
    PID:5464
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN ChromeUpdateSvc /TR C:\ProgramData\gemini\genodeb.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:548
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN AdobeCloudSync
    3⤵
    PID:4504
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN AdobeCloudSync /TR C:\ProgramData\nodes\GeminiService.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART /DELAY 0001:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OneSync.lnk'); $Shortcut.TargetPath = 'C:\Users\Public\OneSync.exe'; $Shortcut.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3756
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN AdobeUpdateHelper
    3⤵
    PID:3168
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN AdobeUpdateHelper /TR C:\ProgramData\Graphics\GraphicsHost.exe /F /RL HIGHEST /RU SYSTEM /SC DAILY
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2592
- C:\Users\Public\Documents\SystemMonitor\AudioHandler\SkyBridge.exe
  "C:\Users\Public\Documents\SystemMonitor\AudioHandler\SkyBridge.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\system32\ipconfig.exe
    "ipconfig"
    3⤵
    - Gathers network information
    PID:748
- - C:\Windows\system32\getmac.exe
    "getmac" /FO CSV /NH
    3⤵
    PID:1940
- C:\Users\Public\Documents\IntelUpdater\GraphicsHelper\DeltaNet.exe
  "C:\Users\Public\Documents\IntelUpdater\GraphicsHelper\DeltaNet.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:6044
- C:\Users\Public\Videos\AudioDriver\SystemAgent\node_ipsec.exe
  "C:\Users\Public\Videos\AudioDriver\SystemAgent\node_ipsec.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_57001 dir=in action=allow protocol=TCP localport=57001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2216
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_57001 dir=out action=allow protocol=TCP localport=57001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5164
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_57002 dir=in action=allow protocol=TCP localport=57002
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5592
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_57002 dir=out action=allow protocol=TCP localport=57002
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5964
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_56001 dir=in action=allow protocol=TCP localport=56001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:32
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_56001 dir=out action=allow protocol=TCP localport=56001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5648
- C:\Users\Public\Pictures\ServiceUpdater\USBComponent\vicontrol.exe
  "C:\Users\Public\Pictures\ServiceUpdater\USBComponent\vicontrol.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:1968
- C:\Users\Public\Videos\WindowsHandler\DriverUpdater\vsghssl.exe
  "C:\Users\Public\Videos\WindowsHandler\DriverUpdater\vsghssl.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:5460
- - C:\Windows\SysWOW64\reg.exe
    "reg.exe" ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v SyncCoordinator /t REG_SZ /d C:\Users\Admin\AppData\Local\SessionData\data_sync.exe /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:3132
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Query /TN WorkspaceMaintenance
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3300
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /Create /F /SC DAILY /ST 15:30 /TN WorkspaceMaintenance /TR C:\Users\Admin\AppData\Roaming\MediaCache\runtime_bg.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5728
- C:\Users\Public\Music\IntelController\GraphicsUpdater\cloude_edge.exe
  "C:\Users\Public\Music\IntelController\GraphicsUpdater\cloude_edge.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5524
- C:\Users\Admin\AppData\Local\Temp\Logs\DisplayAgent\GraphicsModule\audioconfig.exe
  "C:\Users\Admin\AppData\Local\Temp\Logs\DisplayAgent\GraphicsModule\audioconfig.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless
    3⤵
    PID:3820

C:\Users\Public\ngrok\ngrok-daemon.exe
C:\Users\Public\ngrok\ngrok-daemon.exe
1⤵
- Executes dropped EXE
PID:3776

C:\Users\Public\SQLite\sqlite-host.exe
C:\Users\Public\SQLite\sqlite-host.exe
1⤵
- Executes dropped EXE
PID:4140

C:\Users\Public\Videos\DisplayProcess\MonitorModule\serveless.exe
C:\Users\Public\Videos\DisplayProcess\MonitorModule\serveless.exe
1⤵
- Executes dropped EXE
PID:5936

C:\ProgramData\nodes\geminsync.exe
C:\ProgramData\nodes\geminsync.exe
1⤵
- Executes dropped EXE
PID:5600

C:\ProgramData\gemini\genodeb.exe
C:\ProgramData\gemini\genodeb.exe
1⤵
- Executes dropped EXE
PID:6068

C:\ProgramData\nodes\GeminiService.exe
C:\ProgramData\nodes\GeminiService.exe
1⤵
- Executes dropped EXE
PID:4056

C:\Program Files\Nmap\ncat-daemon.exe
"C:\Program Files\Nmap\ncat-daemon.exe"
1⤵
- Executes dropped EXE
PID:536

C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe
"C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe"
1⤵
- Executes dropped EXE
PID:5360

C:\Program Files\Chef\chef-client-service.exe
"C:\Program Files\Chef\chef-client-service.exe"
1⤵
- Executes dropped EXE
PID:876

C:\Program Files\osquery\osqueryd.exe
"C:\Program Files\osquery\osqueryd.exe"
1⤵
- Executes dropped EXE
PID:3192

C:\ProgramData\Graphics\GraphicsHost.exe
C:\ProgramData\Graphics\GraphicsHost.exe
1⤵
- Executes dropped EXE
PID:4808

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3852

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1552

C:\Users\Public\Music\IntelController\GraphicsUpdater\cloude_edge.exe
C:\Users\Public\Music\IntelController\GraphicsUpdater\cloude_edge.exe
1⤵
- Executes dropped EXE
PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3984

C:\Users\Public\Videos\WINDOW~1\DRIVER~1\vsghssl.exe
C:\Users\Public\Videos\WINDOW~1\DRIVER~1\vsghssl.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4312

C:\Users\Admin\AppData\Local\SessionData\data_sync.exe
C:\Users\Admin\AppData\Local\SessionData\data_sync.exe
1⤵
- Executes dropped EXE
PID:3064

C:\Users\Admin\AppData\Roaming\MediaCache\runtime_bg.exe
C:\Users\Admin\AppData\Roaming\MediaCache\runtime_bg.exe
1⤵
PID:5932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data_sync.exe

Path C:\Users\Admin\AppData\Local\SessionData\data_sync.exe
Size 6.2MB
SHA256 d7c14f7704f837946a3c4583ef0a4cc84309724bb1cc0ceb2b5b52cf3fec61e6
MD5 3644bd1d9fc4aedfb109c466121eec5b
SHA1 4d386f44d638ec4650e45c3a57ac81e886bbcd5a
SHA512 e49bfe9b1c59261c3f98738d73605b2aa8377f541e5fbb1a2c045af8ef4c763b291e8708643bd198102eeff4a08d716c190b7650196a087a045be586739f4a4d
SSDEEP 24576:tLZUcqJGSlovWoRlzsjD7X6fDM0B79nxHHTMz5c4RJ5i3LrmqAgWOTZpy9fUeZrv:t18JxxMzad
TLSH
T11866E8F8B573D6C1CD69071AE680BB881E520777414B9FB8D33C7A52A2D1D1BBA2C847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FTvumMGI7RwHPqXPwEBTDyVPNxU

Path C:\Users\Admin\AppData\Local\Temp\FTvumMGI7RwHPqXPwEBTDyVPNxU
Size 32B
SHA256 c39679e062ad0abe79e4bc9e52091b2237f1ea2be589b2705f6d275935053f03
MD5 8e850aa732cb33a908ddb4a9de7c7801
SHA1 7796d27825176eec715c74288c212f53ac601441
SHA512 f367add8b49d0a697b0fc187a3384139cfdb4ff8d6b28db41114f8c1bfb31474a627275282300eadeb28fb8c35d2b63c0c69da8ae76406a978d3be2bf86472b0
MD5 SHA1 SHA512

Submit Download

audioconfig.exe

Path C:\Users\Admin\AppData\Local\Temp\Logs\DisplayAgent\GraphicsModule\audioconfig.exe
Size 29.0MB
SHA256 0704a462e08a63a36e202645c405c4c0df2b3d6f417e5051b5768f714de2dc4e
MD5 580d514eb2cbdb387285fbeb6140d4df
SHA1 3c37d792e9f8c577e98a26c0deb5594df2a50b10
SHA512 040648331c903f01201f1ce853b44b8bf90602e36680318b5e43d531ed64305c1db667a261b427a3eabcc7146610365a378de584aa8f9a8d1ebc201b5ed4dbcd
SSDEEP 196608:CE52QKjnJpwtmhvP3IiRgSTvlRSCPRYVcGwo4Tj:CEcQKjnJ6oP3IiRgSHSgYuoo
TLSH
T1C5677EBCB633D2C2DE4A032AA600BBC50B771A7B154765B8E33D669066C1D2F673C5E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SzpT8GwQAZUck7hQ7nw29XfdVtX

Path C:\Users\Admin\AppData\Local\Temp\SzpT8GwQAZUck7hQ7nw29XfdVtX
Size 32B
SHA256 969f60581aaa9ea773da8dcb56bd63ec82089d1e5e9e464a1978f607db6dcff3
MD5 aa573fafd5927cf33ad571614e47f74b
SHA1 7f1061d88cee462ed161cd9b66760ec0c272ad36
SHA512 b36f429a52226a299d406e04e8838560c60ecf82087cf6a5fcf6b45f3ab9f1670f824f07bd92bbc7e3f1f8240296e622afdff8cdd5c07a27a5a8429872ad0fd3
MD5 SHA1 SHA512

Submit Download

W9titOTFhgg784gYzwPE1cnWOGB8ld

Path C:\Users\Admin\AppData\Local\Temp\W9titOTFhgg784gYzwPE1cnWOGB8ld
Size 578B
SHA256 0b6c342ab32dddc9eaa44096b13900c16a2df461fd8381d3f5ae0744b20d27ab
MD5 2c1f8ae920a4227ae2969224580f1bf7
SHA1 5ddfc5df23825d2ac504862ccae8658819c1d91a
SHA512 f173c3d33138f3dde923b10f30ff919e1de5eec40f6c299f3c4e85031643e51a62aafd9a3d993ec36db28311c3b75fb526435ab1fbf87d147261e500de8ad7f0
TLSH
T11AF0962A21234422D01C34320F7B44852A62CA3869D86A598DBB9024A21C8DF7001F37
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bdk5pmpq.ot1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bdk5pmpq.ot1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bAf9hWPjBkVcZwSMvi9aJu

Path C:\Users\Admin\AppData\Local\Temp\bAf9hWPjBkVcZwSMvi9aJu
Size 640B
SHA256 6cbbf089be9106d24abca3739c9e0934ace4632bc99d1b46c85a1e1beca03197
MD5 b9a548ae7d1fa154b494940dc9e8a4e0
SHA1 b43de120c6e9208a9946444a1d2c77b3182c0965
SHA512 c10ca24324b8a3664ff7b06b1679ab90b209af0f3fb5bd8a21934038ba7d12f64f31699ea8dccf688beccce57d516b2720368c3105931d7afde9a6920ea58fae
TLSH
T10FF0624DE7BA31D0E0132BBE20B66EC51A97E4D8C6718581D5004060E1335A2E71DDB7
MD5 SHA1 SHA512 TLSH

Submit Download

system_log.txt

Path C:\Users\Admin\AppData\Local\Temp\system_log.txt
Size 20B
SHA256 efc321a20e2a68dd58d4725c09cde20341e4cbe88bcfe8addb995d78902c1313
MD5 c6a1f365d4d0b1e960a70ffcc927060b
SHA1 4f54b8fa23c2355a61790d5e831b19d3422cf8fb
SHA512 152e5da8b0504850f669ed0f5e40eea3f10dfcbbe31d86d024546b847cb684015994f61f2d327b896b6ce16d8cc65348d44c9dd675a0592c16ce457bef37d7e4
MD5 SHA1 SHA512

Submit Download

upd152b_log.txt

Path C:\Users\Admin\AppData\Local\Temp\upd152b_log.txt
Size 510B
SHA256 6c635dcf47e75c77fd8d2e989e06cf0f2f833a310d9eac1924a8f6365328072c
MD5 7b24694856cb34c2b8d96ff1a83f168a
SHA1 b52f34deee90216453d76b6357f904c2cfc58117
SHA512 79c8ac2d001515af1012bc5b8583fb548d0ff9474221638767a6eecf0efdf1261ce3ced837824d2891f11ea4d9c07e90c0fd8699cf43b6882e5b5a414cd2b57b
TLSH
T1DCF0BB5827E5207D1F15730BC6052FC67D4B3F7399684AAF1A34044CA5F0A26EF3E594
MD5 SHA1 SHA512 TLSH

Submit Download

runtime_bg.exe

Path C:\Users\Admin\AppData\Roaming\MediaCache\runtime_bg.exe
Size 6.0MB
SHA256 68421040d03f81b0ff65b30110b062994ab9026920ca2bbb3c891aa6b2cfc21f
MD5 4bd0d08f97f1fd85abd2171512de2da0
SHA1 e9e4b0039459c1ef7a9d1c7e55cc2f428684cd08
SHA512 1b8077c032896dcc39abbede5e83f48dbc9bc3006b9a1e36e6a33e05c24c900406c03889124f5c7945068bff526d24b9eadb80d005bee8ce48667557cb9e7747
SSDEEP 24576:tLZUcqJGSlovWoRlzsjD7X6fDM0B79nxHHTMz5c4RJ5i3LrmqAgWOTZpy9fUeZrP:t18JxxMzal
TLSH
T10856E8F8B573D6C1CD69071AE680BB881E520777414B9FB8D33C7A52A2D1D1BBA2C847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

update_helper.exe

Path C:\Users\Admin\AppData\Roaming\SessionStore\update_helper.exe
Size 3.8MB
SHA256 65046196f841622a412538447170ebb94a423b5a7e346da5822d893a29514e33
MD5 51825a2c3b5219341b1e7c7a8d741cd1
SHA1 5ac2e978d83646443d5b81efd2ef5695706ecf99
SHA512 0be75886cee30d1b218730f87015747dc6f95aed70db6017a8b7503fdcb7a0ddb0fa47e23044e8f6e61d4eb84840e80a5c7e999778b148273c9b6c7f33c2bb05
SSDEEP 24576:558rnOkn9XogudFJeuO2nxmUfRVpfk2dpJVltq9fNjRDlPJmPczfwPeBVeESLRIg:5OOkdoBdFJePOJr
TLSH
T1BD068D23F26829E6C6CF52BB955E13A52B7B73692305A0FC413D93902FD1B399F2E114
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.test_write_access

Path C:\Users\Public\.test_write_access
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

DeltaNet.exe

Path C:\Users\Public\Documents\IntelUpdater\GraphicsHelper\DeltaNet.exe
Size 2.3MB
SHA256 28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2
MD5 5d2a851492391161e22ec4de655ea1c4
SHA1 f7cca766d81fae6d50b211533e878d4decf70959
SHA512 2571cebbc018d8d8a51fa5574470e840eb64823f9c5d4cc41a89f9ae1f3c2c53fb7f76ac8c4b2b72988b5f33705654b164b0e62bd0c32998601cd2c647e35fb9
SSDEEP 49152:/HqMycZ3pHEueIJDvKRtx2rzgItSYIU6iU:/LytOJrr1Sn+U
TLSH
T1CDB56B03E795C4EAC49AC078C3579732BA72788A3720FDAB57D44A2C2E66BD05E1C717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SkyBridge.exe

Path C:\Users\Public\Documents\SystemMonitor\AudioHandler\SkyBridge.exe
Size 3.2MB
SHA256 c1aedede6dd973466e09ea124a8d466d2ef4d6491003284ee735a4b76aeaa3eb
MD5 e9033ed73b674d5ddbe2c25dc8c33f03
SHA1 2e28db2e526b26e4c4d14a6b466fc9cc6c56edb0
SHA512 5ed0862cca91bc316453e08ced12c2e4283efdb7612723d0b933d67766359c0f126db71c7a289eebbbba77d3902f8011c3b47c19f35eaee715e05f97b2d2fba3
SSDEEP 49152:dRgOBNP6pSRMn3umTOl3Bjs/5zjkztIfbWOv0xY7pX7OIQYIU6is:ffipFefzz6bhpZSn+s
TLSH
T18BF57C03FA9585E9C49DC078C35B9233AB32B88D4B20B7AB2BD446213F56F605F9D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloude_edge.exe

Path C:\Users\Public\Music\IntelController\GraphicsUpdater\cloude_edge.exe
Size 2.4MB
SHA256 fb851a56210c4e622be83730a65433a3d9d86a7f3393d2d47ad80ec84666f458
MD5 80c0a4ccf2d3f37918c45c8c8469e3e0
SHA1 cff284281e1ca36806a1f34aa8738fad7b582e95
SHA512 85ca79737240efae9707e0d6ac7eb67b6b529e5668851b0bc13384e93df4179b472e560caa2127cc9a058abd421141340af67620ddae0591282fee7dda2048ce
SSDEEP 49152:8GXKQ3GMIYJAmys8NYQGtEv7uiWuDSxIksmYIU6i:8KKj68uQUSWulmn+
TLSH
T183C56B03E795C4E9C45DC07883579732BA32B8893720FEAB27D44A6D2EA6FD05A1D317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vicontrol.exe

Path C:\Users\Public\Pictures\ServiceUpdater\USBComponent\vicontrol.exe
Size 4.2MB
SHA256 9b4bc2a8930906442f30d08aa4f6fb813c1025c09708c5567e30d86a705dc402
MD5 f795ca12122db1e6c26b00f2e8a688be
SHA1 e82f21ec2de9105b81e5788f3c64e3aad4b8f628
SHA512 fc9766a9a42f7e2ab0b613dee95420361e03a35d6fb67327d8b51342955ffa951f39fe56860cfe61a4e85b4efb1fb3eb2b00e56694d7830ae09a0d5c17d74545
SSDEEP 24576:BYX+wnRZxUot0eGdV5dySsM2D/5ld2H857IdcselTOBjyVaigknuLvykswPozFOT:BYOwnRIoC/d/r2txbfJX2aUW
TLSH
T12D165AB8B633D5C1DE59073BE640BB881F62267701475AB8E33C6A5166C0E1FB73C986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serveless.exe

Path C:\Users\Public\Videos\DisplayProcess\MonitorModule\serveless.exe
Size 3.3MB
SHA256 bc381c2bac4899d7145e429e8316aa04c4241663a885cdd7d817ea30f5734757
MD5 c35bb76ca3807c303c615c074dfe01ed
SHA1 78567bf229a31ef286f80da252007207fd228b63
SHA512 6d2e32bd7acb3b9479bb2771b678442bcbfa2aa4acd54c843b0407bb24e7e9e7ced66d53c6786e32c5e09a053a95dba5c9d4e4a5f3ef59a676c4c332b983668f
SSDEEP 49152:D/+YNOZXny1O6ijfEO5kygTseVpKZOONnAz2nsRjmLogIVYIU6iCAUUUUUUz:D2YmX1ED9KtnWfjB9n+PUUUUUU
TLSH
T1D7F59E43FE9585E9C0ADC43883975672AE32B88D4730B3AB1BD846217E26FD05F5D34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vsghssl.exe

Path C:\Users\Public\Videos\WindowsHandler\DriverUpdater\vsghssl.exe
Size 16.7MB
SHA256 d2c5366b14d49eb262250ae1e7656d121b42ff1b32bc59d2bb82ffc0698095ce
MD5 964794ea13c9aadad99cd7a99b578198
SHA1 39b6e2cc9371edc6f9e725209603e1bb6c2353cb
SHA512 8582a7cb748c791d71bc025776457273e556b95ed30e70207a889d669d75e26c16c27789d45cc84d9beda66c970e1684fa5f72dc7d8b22196ea4c6cffd1383f2
SSDEEP 98304:welCES9lyQXMeyYpedek7djQpDpzuM+QjtUso+LI:5sEwyKByZXspDFx+sxI
TLSH
T1E0077DBCB633D2D2DE4A032AA600BBC50B771A7B154765B8E33D669066C0D2F673C5E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1968-62-0x0000023274CB0000-0x0000023274ED6000-memory.dmp

Download

memory/3756-2036-0x000002708F320000-0x000002708F342000-memory.dmp

Download

memory/4108-122-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-90-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-170-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-168-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-166-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-164-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-160-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-158-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-157-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-152-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-150-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-146-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-145-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-140-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-138-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-136-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-134-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-132-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-130-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-128-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-126-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-124-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-174-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-118-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-116-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-112-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-108-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-106-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-104-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-102-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-100-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-98-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-93-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-172-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-88-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-86-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-82-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-154-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-148-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-142-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-120-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-114-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-110-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-96-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-80-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-79-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-176-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-188-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-182-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-181-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-186-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-184-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-178-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-1979-0x000002DBD6340000-0x000002DBD6346000-memory.dmp

Download

memory/4108-162-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-94-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-84-0x000002DBEEDE0000-0x000002DBEEEB6000-memory.dmp

Download

memory/4108-78-0x000002DBEEDE0000-0x000002DBEEEBC000-memory.dmp

Download

memory/4108-77-0x000002DBD6380000-0x000002DBD63E4000-memory.dmp

Download

memory/4108-76-0x000002DBEEBF0000-0x000002DBEEC9E000-memory.dmp

Download

memory/4424-1-0x0000023F5F150000-0x0000023F5F151000-memory.dmp

Download

memory/4424-2-0x0000023F5F150000-0x0000023F5F151000-memory.dmp

Download

memory/4424-0-0x0000023F5F150000-0x0000023F5F151000-memory.dmp

Download

memory/4644-73-0x0000000005CD0000-0x000000000627C000-memory.dmp

Download

memory/4644-67-0x0000000005CD0000-0x000000000627C000-memory.dmp

Download

memory/4644-74-0x0000000005CD0000-0x000000000627C000-memory.dmp

Download

memory/4644-75-0x0000000005CD0000-0x000000000627C000-memory.dmp

Download