cbc7daf17c4feded3d25c3116e0c27ceda94268d1eb73ba65299b4fdd9d83ef6

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Size 3.7MB
Sample261024-1kssgset3r
SHA256 cbc7daf17c4feded3d25c3116e0c27ceda94268d1eb73ba65299b4fdd9d83ef6
MD5 0f6788dd4e3684dc85cdd2f798f7265a
SHA1 a192e60123a16fc550d1c5a3cbdbea6bc6d41f5b
SHA512 3d129cd78b1301432b4435999eb716b4753d5fdc419bdf9ce6d46e724a935c9e7a575a377e080cc93ddc53a765b1fec5089ede38e17790559d4007e3549e5ac4
SSDEEP 49152:nNzNNiQGTaIQHkHOAPbAQMtIpcMuvuu0w9Is9BPV6QiOFs/Xk:FbivWCOMfb38BDM8
TLSH
T17A063B02BE8A55E8C099C870C38B85739E2174DF1A36B5BF558A51353FBABB45F2C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4600	clouddesk-agent.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\CloudDesk\clouddesk-agent.exe	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
File opened for modification	C:\Program Files\CloudDesk\clouddesk-agent.exe	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe

Launches sc.exe 10 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4632	sc.exe
2192	sc.exe
4492	sc.exe
5440	sc.exe
1452	sc.exe
2432	sc.exe
2008	sc.exe
3012	sc.exe
4704	sc.exe
5452	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4004	powershell.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	clouddesk-agent.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	clouddesk-agent.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4204	ipconfig.exe
2004	ipconfig.exe
2220	ipconfig.exe

Modifies registry key 1 TTPs 13 IoCs

Modify Registry

T1112

pid	Process
1300	reg.exe
3328	reg.exe
4300	reg.exe
3952	reg.exe
4468	reg.exe
5324	reg.exe
2320	reg.exe
4620	reg.exe
4776	reg.exe
5368	reg.exe
5548	reg.exe
3752	reg.exe
2152	reg.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4004	powershell.exe
4004	powershell.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe
4600	clouddesk-agent.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4004	powershell.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 4704	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	90
PID 2352 wrote to memory of 4492	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	92
PID 2352 wrote to memory of 2152	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	96
PID 2352 wrote to memory of 4620	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	98
PID 2352 wrote to memory of 4776	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	100
PID 2352 wrote to memory of 1300	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	102
PID 2352 wrote to memory of 5368	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	104
PID 2352 wrote to memory of 3328	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	106
PID 2352 wrote to memory of 4300	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	108
PID 2352 wrote to memory of 3952	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	110
PID 2352 wrote to memory of 5548	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	112
PID 2352 wrote to memory of 3752	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	114
PID 2352 wrote to memory of 4468	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	116
PID 2352 wrote to memory of 5324	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	118
PID 2352 wrote to memory of 2320	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	120
PID 4600 wrote to memory of 4904	4600	clouddesk-agent.exe	122
PID 2352 wrote to memory of 5440	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	124
PID 4904 wrote to memory of 1812	4904	query.exe	126
PID 2352 wrote to memory of 5452	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	127
PID 4600 wrote to memory of 4204	4600	clouddesk-agent.exe	129
PID 2352 wrote to memory of 1452	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	131
PID 2352 wrote to memory of 2432	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	133
PID 2352 wrote to memory of 4632	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	135
PID 2352 wrote to memory of 2192	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	137
PID 2352 wrote to memory of 2008	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	139
PID 2352 wrote to memory of 3012	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	141
PID 2352 wrote to memory of 4004	2352	2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe	143
PID 4600 wrote to memory of 5996	4600	clouddesk-agent.exe	146
PID 5996 wrote to memory of 1228	5996	query.exe	148
PID 4600 wrote to memory of 2004	4600	clouddesk-agent.exe	149
PID 4600 wrote to memory of 2220	4600	clouddesk-agent.exe	151
PID 4600 wrote to memory of 4520	4600	clouddesk-agent.exe	154
PID 4520 wrote to memory of 6076	4520	query.exe	156
PID 4600 wrote to memory of 400	4600	clouddesk-agent.exe	157
PID 400 wrote to memory of 4148	400	query.exe	159
PID 4600 wrote to memory of 4184	4600	clouddesk-agent.exe	160
PID 4184 wrote to memory of 5428	4184	query.exe	162

C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_0f6788dd4e3684dc85cdd2f798f7265a_akira_cobalt-strike_glassworm_icedid_rusty-stealer_satacom.exe"
1⤵
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query CloudDeskAgent
  2⤵
  - Launches sc.exe
  PID:4704
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query CloudDeskAgent
  2⤵
  - Launches sc.exe
  PID:4492
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v DisplayName /t REG_SZ /d "CloudDesk RMM Agent" /f
  2⤵
  - Modifies registry key
  PID:2152
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v DisplayVersion /t REG_SZ /d 2.2.2 /f
  2⤵
  - Modifies registry key
  PID:4620
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v Publisher /t REG_SZ /d CloudDesk /f
  2⤵
  - Modifies registry key
  PID:4776
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v UninstallString /t REG_SZ /d "\"C:\Program Files\CloudDesk\clouddesk-agent.exe\" --uninstall" /f
  2⤵
  - Modifies registry key
  PID:1300
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v InstallLocation /t REG_SZ /d "C:\Program Files\CloudDesk" /f
  2⤵
  - Modifies registry key
  PID:5368
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v DisplayIcon /t REG_SZ /d "C:\Program Files\CloudDesk\clouddesk-agent.exe,0" /f
  2⤵
  - Modifies registry key
  PID:3328
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v InstallDate /t REG_SZ /d 20261024 /f
  2⤵
  - Modifies registry key
  PID:4300
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v EstimatedSize /t REG_DWORD /d 3824 /f
  2⤵
  - Modifies registry key
  PID:3952
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v URLInfoAbout /t REG_SZ /d https://clouddesk.io /f
  2⤵
  - Modifies registry key
  PID:5548
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v HelpLink /t REG_SZ /d https://clouddesk.io/support /f
  2⤵
  - Modifies registry key
  PID:3752
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v Comments /t REG_SZ /d "Remote Monitoring and Management Agent for authorized IT administration. Installed with administrator consent (UAC). Provides remote desktop, system monitoring, and command execution for IT teams." /f
  2⤵
  - Modifies registry key
  PID:4468
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v NoModify /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:5324
- C:\Windows\System32\reg.exe
  "C:\Windows\System32\reg.exe" add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CloudDesk /v NoRepair /t REG_DWORD /d 1 /f
  2⤵
  - Modifies registry key
  PID:2320
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failure CloudDeskAgent reset= 0 actions= restart/3000/restart/3000/restart/3000
  2⤵
  - Launches sc.exe
  PID:5440
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" failureflag CloudDeskAgent 1
  2⤵
  - Launches sc.exe
  PID:5452
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" config CloudDeskAgent start= delayed-auto
  2⤵
  - Launches sc.exe
  PID:1452
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" sidtype CloudDeskAgent unrestricted
  2⤵
  - Launches sc.exe
  PID:2432
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" preshutdown CloudDeskAgent 180000
  2⤵
  - Launches sc.exe
  PID:4632
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query CloudDeskAgent
  2⤵
  - Launches sc.exe
  PID:2192
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query CloudDeskAgent
  2⤵
  - Launches sc.exe
  PID:2008
- C:\Windows\System32\sc.exe
  "C:\Windows\System32\sc.exe" query CloudDeskAgent
  2⤵
  - Launches sc.exe
  PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command "[Windows.UI.Notifications.ToastNotificationManager, Windows.UI.Notifications, ContentType = WindowsRuntime] | Out-Null; $xml = [Windows.UI.Notifications.ToastNotificationManager]::GetTemplateContent(0); $text = $xml.GetElementsByTagName('text'); $text.Item(0).AppendChild($xml.CreateTextNode('CloudDesk RMM Agent installed successfully. Visible in Add/Remove Programs.')) | Out-Null; $toast = [Windows.UI.Notifications.ToastNotification]::new($xml); [Windows.UI.Notifications.ToastNotificationManager]::CreateToastNotifier('CloudDesk').Show($toast)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4004

C:\Program Files\CloudDesk\clouddesk-agent.exe
"C:\Program Files\CloudDesk\clouddesk-agent.exe" --service
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Windows\System32\query.exe
  "C:\Windows\System32\query.exe" user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\System32\quser.exe
    "C:\Windows\System32\quser.exe"
    3⤵
    PID:1812
- C:\Windows\System32\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /all
  2⤵
  - Gathers network information
  PID:4204
- C:\Windows\System32\query.exe
  "C:\Windows\System32\query.exe" user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\System32\quser.exe
    "C:\Windows\System32\quser.exe"
    3⤵
    PID:1228
- C:\Windows\System32\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /all
  2⤵
  - Gathers network information
  PID:2004
- C:\Windows\System32\ipconfig.exe
  "C:\Windows\System32\ipconfig.exe" /all
  2⤵
  - Gathers network information
  PID:2220
- C:\Windows\System32\query.exe
  "C:\Windows\System32\query.exe" user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\System32\quser.exe
    "C:\Windows\System32\quser.exe"
    3⤵
    PID:6076
- C:\Windows\System32\query.exe
  "C:\Windows\System32\query.exe" user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\System32\quser.exe
    "C:\Windows\System32\quser.exe"
    3⤵
    PID:4148
- C:\Windows\System32\query.exe
  "C:\Windows\System32\query.exe" user
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\System32\quser.exe
    "C:\Windows\System32\quser.exe"
    3⤵
    PID:5428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

clouddesk-agent.exe

Path C:\Program Files\CloudDesk\clouddesk-agent.exe
Size 3.7MB
SHA256 cbc7daf17c4feded3d25c3116e0c27ceda94268d1eb73ba65299b4fdd9d83ef6
MD5 0f6788dd4e3684dc85cdd2f798f7265a
SHA1 a192e60123a16fc550d1c5a3cbdbea6bc6d41f5b
SHA512 3d129cd78b1301432b4435999eb716b4753d5fdc419bdf9ce6d46e724a935c9e7a575a377e080cc93ddc53a765b1fec5089ede38e17790559d4007e3549e5ac4
SSDEEP 49152:nNzNNiQGTaIQHkHOAPbAQMtIpcMuvuu0w9Is9BPV6QiOFs/Xk:FbivWCOMfb38BDM8
TLSH
T17A063B02BE8A55E8C099C870C38B85739E2174DF1A36B5BF558A51353FBABB45F2C318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

audit-2026-10-24.jsonl

Path C:\ProgramData\CloudDeskAgent\audit\audit-2026-10-24.jsonl
Size 174B
SHA256 e14192aa56706327f6cb603ea08543da335f86c741273d4739215df0d00a8f2c
MD5 49434afbe674d43a0b0cfce456c935fe
SHA1 0478c694c73d64f3d09a0bea82d68a287b2c2f2f
SHA512 8166ebed4809035613b6e0042f4eaf5732b7420fda53cb94e7151ff0bbe3c93bdc091d744dcf524d43037143a3a14db15a23835ff1f573e7ab7d02ba367f117e
TLSH
T11DC0804F58CE08321B7827D5DB8B8C1450BC560134F4E554C6F65C053097A6B085B85F
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\ProgramData\CloudDeskAgent\config.json
Size 1KB
SHA256 db4362a4327f8c5e1f255197706df915bd724444edffba172c674630e66cbcf8
MD5 980b2d8e7813f5e83af0903726c931b5
SHA1 32b254f37c5997a6d1e4299ebfd8d781f2f437fa
SHA512 9198a259651a0443188c6e809e351b42848248263519db5e6a20b0f9ba3a541582ce280170e75aa65e4a614850850c981b34bfd23eafd6e3053fd21ba7cefbad
TLSH
T1C61108F19C9E9346BFBD8FA64B7335844CA0B81F39559017434132C0A61303CC80EE45
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\ProgramData\CloudDeskAgent\config.json
Size 1KB
SHA256 c9ef1e795d5247c05dd9ff3fe3185b79dcd50c17a0dbde0a8f4acdecbf1d5d07
MD5 53636e26d149b63340c91232e3d87d51
SHA1 85374e096d086cc6bdc76cfa290341a8f5a6a211
SHA512 853aad7589828b0bb7386daa84df298fb43c31cd7f27e213d09e87bf283b6e159ff6799ea37c217c57e18ba5598033b0fa86b06eec77ad986fa3e9f6a99e774a
TLSH
T16811A87519D07DA96F6D4FB28B543E170C20785F5A01EDC10AC7E2A6B0274B60B5062F
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\ProgramData\CloudDeskAgent\config.json
Size 1KB
SHA256 4414ba02d0bcd99ff2fd648443b94d6587e2c9b412392d937453201e787fac79
MD5 208f2b90921382f3e9f084ea1fd271a3
SHA1 ce539d69e1d2bb3b5c2afb4e069edee058d20266
SHA512 824f13868a0422203de2ba79fce545852a215c1b0cd35bb7e1cb02b25eddaa1791cb041f55b9f6513c24952b32172d71b8531423dfd31a9c4249af294d78bc4b
TLSH
T1C711C8B144A270DA37367540303DF3DDAE5929DBE8343716E44211FF9AA6B05AB1CEA3
MD5 SHA1 SHA512 TLSH

Submit Download

config.json

Path C:\ProgramData\CloudDeskAgent\config.json
Size 1KB
SHA256 af3b93c6bb0bd6f51078e79665a76164b75b803da93eac12897a2e626aebc12f
MD5 0d64fbb8fa08292b4a5b26926f55a4d3
SHA1 432de2ae1e3c9c0db030e8e3764650bc772d88fb
SHA512 6cfc622cffd686721268ab63df186afc4323d45c7cd8f1360138a302d634182143a4cf912fee0e90798e0212dba77f2a5a01687e1d6f3afe4719bbb6d8ee13a4
TLSH
T1C311B5F0716BA4403175B6989408752C6D643F1B182263185386C27E74AEAB0C6326B8
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4004-27-0x00000198654A0000-0x00000198654C2000-memory.dmp

Download

memory/4004-32-0x0000019865420000-0x000001986542A000-memory.dmp

Download

memory/4004-33-0x00000198654D0000-0x00000198654D8000-memory.dmp

Download