b34938358e55bcb22cf96bfa1b7cdf38a9dda9f477b84e163c26ba2dff6fd469

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
Size 95.9MB
Sample261029-2frkasft5w
SHA256 b34938358e55bcb22cf96bfa1b7cdf38a9dda9f477b84e163c26ba2dff6fd469
MD5 9e50f1cb4f7b6617dd96c9a69a408cb5
SHA1 079953b9237912cad28e281819bfcccd6b53ab03
SHA512 b7f5ad38cb7cc1f462472983084117fd0573feb175eafe95d862ca6311d8f4347b7d3923b4dfa1a381669fd600ef10716934d2465a449ec4d608570fa207d815
SSDEEP 1572864:GTHIZeLLcdDACeQPItaTbQi1+jbVEyIUegkdvKLAsRFhh29mKlRLS30DBGCj8qeu:GTosL8hP6aT0xjbGyI4kC3RFhwV0ere
TLSH
T108282345BA5A5964E08AC870D2534B934F3170DB123BE4FF51E981283F9A7F09B3E35A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024599-44.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral1/files/0x0007000000024597-39.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Detects executables referencing combination of virtualization drivers 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024599-44.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb
behavioral1/files/0x0007000000024593-38.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb
behavioral1/files/0x000700000002459f-54.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	serveless.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	hugginghub.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	hugginghub.exe

Looks for VirtualBox drivers on disk 2 TTPs 12 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	hugginghub.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	hugginghub.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	hugginghub.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	hugginghub.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SkyBridge.exe

Looks for VMWare Tools registry key 2 TTPs 4 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	hugginghub.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	hugginghub.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	serveless.exe

Looks for VMWare drivers on disk 2 TTPs 6 IoCs

defense_evasion

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	hugginghub.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	hugginghub.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SkyBridge.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	serveless.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	ntfs_au.exe

Executes dropped EXE 20 IoCs

pid	Process
3608	SkyBridge.exe
2064	cloude_edge.exe
1812	virtualhost.exe
2384	DeltaNet.exe
2784	serveless.exe
560	hugginghub.exe
2456	hugginghub.exe
4092	ntfs_au.exe
2676	cloude_edge.exe
5772	sqlite-host.exe
5332	ngrok-daemon.exe
3860	genodeb.exe
3368	geminsync.exe
4948	GeminiService.exe
5192	VBoxVMM-service.exe
5460	serveless.exe
968	ncat-daemon.exe
644	GraphicsHost.exe
3116	osqueryd.exe
5380	chef-client-service.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\ProgramData\\nodes\\geminsync.exe"	cloude_edge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ServiceUpdater = "C:\\Users\\Public\\Music\\NetworkModule\\WindowsMonitor\\serveless.exe"	serveless.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemAgent = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Logs\\IntelUpdater\\AudioSupport\\cloude_edge.exe"	cloude_edge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 10 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
25	pastebin.com
67	pastebin.com
12	pastebin.com
14	pastebin.com
23	pastebin.com
24	pastebin.com
61	pastebin.com
63	pastebin.com
65	pastebin.com
13	pastebin.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
10	checkip.amazonaws.com

Checks system information in the registry 2 TTPs 3 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SkyBridge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	serveless.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File created	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Ansible\ansible-agent.exe	SkyBridge.exe
File created	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File created	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File created	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File created	C:\Program Files\Ansible\ansible-agent.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe	SkyBridge.exe
File created	C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Nginx\nginx-service.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Chef\chef-client-service.exe	SkyBridge.exe
File created	C:\Program Files\Chef\chef-client-service.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File opened for modification	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File created	C:\Program Files\Nginx\nginx-service.exe	SkyBridge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1896	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 10 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	serveless.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	cloude_edge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	virtualhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ntfs_au.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	serveless.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	cloude_edge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	virtualhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ntfs_au.exe

Checks processor information in registry 2 TTPs 21 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	ntfs_au.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	ntfs_au.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	ntfs_au.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	ntfs_au.exe

Enumerates system info in registry 2 TTPs 14 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	hugginghub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	hugginghub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	hugginghub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	hugginghub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	hugginghub.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	hugginghub.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SkyBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SkyBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	serveless.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1924	ipconfig.exe
3980	ipconfig.exe
5096	ipconfig.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3952	schtasks.exe
1488	schtasks.exe
5788	schtasks.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

pid	Process
2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
560	hugginghub.exe
560	hugginghub.exe
1812	virtualhost.exe
1812	virtualhost.exe
1812	virtualhost.exe
1812	virtualhost.exe
1812	virtualhost.exe
1812	virtualhost.exe
4092	ntfs_au.exe
4092	ntfs_au.exe
3608	SkyBridge.exe
3608	SkyBridge.exe
3608	SkyBridge.exe
3608	SkyBridge.exe
2784	serveless.exe
2784	serveless.exe
1896	powershell.exe
1896	powershell.exe
1896	powershell.exe
2784	serveless.exe
2784	serveless.exe
4092	ntfs_au.exe
4092	ntfs_au.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1896	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 1924	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	92
PID 2704 wrote to memory of 5808	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	94
PID 2704 wrote to memory of 3608	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	103
PID 2704 wrote to memory of 2064	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	104
PID 2704 wrote to memory of 1812	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	105
PID 2704 wrote to memory of 2384	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	106
PID 2704 wrote to memory of 2784	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	107
PID 2704 wrote to memory of 560	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	108
PID 2704 wrote to memory of 4092	2704	2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe	111
PID 3608 wrote to memory of 3980	3608	SkyBridge.exe	115
PID 3608 wrote to memory of 5272	3608	SkyBridge.exe	117
PID 2064 wrote to memory of 2536	2064	cloude_edge.exe	120
PID 2064 wrote to memory of 3952	2064	cloude_edge.exe	124
PID 4092 wrote to memory of 3772	4092	ntfs_au.exe	126
PID 2064 wrote to memory of 5616	2064	cloude_edge.exe	131
PID 2064 wrote to memory of 1488	2064	cloude_edge.exe	136
PID 2784 wrote to memory of 5096	2784	serveless.exe	138
PID 2784 wrote to memory of 4936	2784	serveless.exe	140
PID 2064 wrote to memory of 1896	2064	cloude_edge.exe	145
PID 2064 wrote to memory of 5620	2064	cloude_edge.exe	150
PID 2064 wrote to memory of 5788	2064	cloude_edge.exe	153
PID 4092 wrote to memory of 5712	4092	ntfs_au.exe	158

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-28_9e50f1cb4f7b6617dd96c9a69a408cb5_cobalt-strike_glassworm_icedid_luca-stealer_satacom.exe"
1⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:1924
- C:\Windows\system32\getmac.exe
  "getmac" /FO CSV /NH
  2⤵
  PID:5808
- C:\Users\Public\Documents\GraphicsHost\DisplayService\SkyBridge.exe
  "C:\Users\Public\Documents\GraphicsHost\DisplayService\SkyBridge.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\system32\ipconfig.exe
    "ipconfig"
    3⤵
    - Gathers network information
    PID:3980
- - C:\Windows\system32\getmac.exe
    "getmac" /FO CSV /NH
    3⤵
    PID:5272
- C:\Users\Admin\AppData\Local\Temp\Logs\IntelUpdater\AudioSupport\cloude_edge.exe
  "C:\Users\Admin\AppData\Local\Temp\Logs\IntelUpdater\AudioSupport\cloude_edge.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN ChromeUpdateSvc
    3⤵
    PID:2536
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN ChromeUpdateSvc /TR C:\ProgramData\gemini\genodeb.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3952
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN WindowsSecurityHost
    3⤵
    PID:5616
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN WindowsSecurityHost /TR C:\ProgramData\nodes\GeminiService.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART /DELAY 0001:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1488
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OneSync.lnk'); $Shortcut.TargetPath = 'C:\Users\Public\OneSync.exe'; $Shortcut.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1896
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN AdobeCloudSync
    3⤵
    PID:5620
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN AdobeCloudSync /TR C:\ProgramData\Graphics\GraphicsHost.exe /F /RL HIGHEST /RU SYSTEM /SC DAILY
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5788
- C:\Users\Public\Music\SystemDriver\WindowsAdapter\virtualhost.exe
  "C:\Users\Public\Music\SystemDriver\WindowsAdapter\virtualhost.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1812
- C:\Users\Public\Music\DisplayService\DriverHandler\DeltaNet.exe
  "C:\Users\Public\Music\DisplayService\DriverHandler\DeltaNet.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:2384
- C:\Users\Public\Music\NetworkModule\WindowsMonitor\serveless.exe
  "C:\Users\Public\Music\NetworkModule\WindowsMonitor\serveless.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks system information in the registry
  - Reads the TCP/IP host and domain name from the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2784
- - C:\Windows\system32\ipconfig.exe
    "ipconfig"
    3⤵
    - Gathers network information
    PID:5096
- - C:\Windows\system32\getmac.exe
    "getmac" /FO CSV /NH
    3⤵
    PID:4936
- C:\Users\Public\Pictures\DriverManager\NetworkComponent\hugginghub.exe
  "C:\Users\Public\Pictures\DriverManager\NetworkComponent\hugginghub.exe"
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Executes dropped EXE
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:560
- C:\Users\Public\Pictures\SystemAdapter\SecurityDriver\ntfs_au.exe
  "C:\Users\Public\Pictures\SystemAdapter\SecurityDriver\ntfs_au.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless
    3⤵
    PID:5712

C:\Users\Public\Pictures\DriverManager\NetworkComponent\hugginghub.exe
"C:\Users\Public\Pictures\DriverManager\NetworkComponent\hugginghub.exe" service
1⤵
- Executes dropped EXE
PID:2456

C:\Users\Admin\AppData\Local\Temp\Logs\IntelUpdater\AudioSupport\cloude_edge.exe
C:\Users\Admin\AppData\Local\Temp\Logs\IntelUpdater\AudioSupport\cloude_edge.exe
1⤵
- Executes dropped EXE
PID:2676

C:\Users\Public\SQLite\sqlite-host.exe
C:\Users\Public\SQLite\sqlite-host.exe
1⤵
- Executes dropped EXE
PID:5772

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:656

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1836

C:\Users\Public\ngrok\ngrok-daemon.exe
C:\Users\Public\ngrok\ngrok-daemon.exe
1⤵
- Executes dropped EXE
PID:5332

C:\ProgramData\gemini\genodeb.exe
C:\ProgramData\gemini\genodeb.exe
1⤵
- Executes dropped EXE
PID:3860

C:\ProgramData\nodes\geminsync.exe
C:\ProgramData\nodes\geminsync.exe
1⤵
- Executes dropped EXE
PID:3368

C:\ProgramData\nodes\GeminiService.exe
C:\ProgramData\nodes\GeminiService.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe
"C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe"
1⤵
- Executes dropped EXE
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5252

C:\Users\Public\Music\NetworkModule\WindowsMonitor\serveless.exe
C:\Users\Public\Music\NetworkModule\WindowsMonitor\serveless.exe
1⤵
- Executes dropped EXE
PID:5460

C:\Program Files\Nmap\ncat-daemon.exe
"C:\Program Files\Nmap\ncat-daemon.exe"
1⤵
- Executes dropped EXE
PID:968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3008

C:\ProgramData\Graphics\GraphicsHost.exe
C:\ProgramData\Graphics\GraphicsHost.exe
1⤵
- Executes dropped EXE
PID:644

C:\Program Files\osquery\osqueryd.exe
"C:\Program Files\osquery\osqueryd.exe"
1⤵
- Executes dropped EXE
PID:3116

C:\Program Files\Chef\chef-client-service.exe
"C:\Program Files\Chef\chef-client-service.exe"
1⤵
- Executes dropped EXE
PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

File and Directory Discovery

T1083

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1UateBUfJdiNr3Rsr

Path C:\Users\Admin\AppData\Local\Temp\1UateBUfJdiNr3Rsr
Size 32B
SHA256 051e0fd578f0d3a363e1fb1862babdc7534f9bea328d89d56abc54612aacd457
MD5 0a000efed1819095749636cd5065094f
SHA1 34306caa8497a0fd555fc1d2a5c1fbf40dcb8e59
SHA512 3ebffa9787da72e5d00865116ff82affa4c3f3f1cefdae92a16a5a4d4b1bd6bbda4836725ad997fd817c9a285865a056048e6df896af8896b990266de2d02b2e
MD5 SHA1 SHA512

Submit Download

Hs2I2ooMPKvWDOQmQAzyOW5w0e

Path C:\Users\Admin\AppData\Local\Temp\Hs2I2ooMPKvWDOQmQAzyOW5w0e
Size 578B
SHA256 2cb59bc0fb0a9836dd85043fd31e984d6a347d9c5c0cbc8823d1436de6e8a209
MD5 6b293f112c0d9b489669cde205ca4ad5
SHA1 f87de9d104d29615a5e274fe97626905306adb60
SHA512 470072aea58e4521d3ca4d6748e39de5c28b8400eedabf4a9723afee013fc1dc24e5e6cbf7944b263451186af14dcf1abe14701dee307d291554fc5dc3c40eaf
TLSH
T12BF041F372500CB0B08C02B09737AF7804C642D0731CC250AE1E25809A1EF39807EEF2
MD5 SHA1 SHA512 TLSH

Submit Download

LL1j3zNjrFAcIAxA

Path C:\Users\Admin\AppData\Local\Temp\LL1j3zNjrFAcIAxA
Size 640B
SHA256 3e09d3c3c8583582bd564d74e430f41c40475c195cd08014bd43881d5b1a9e00
MD5 c2b58c87f612085d149ae753ea070c5f
SHA1 47ce998620ef396af019fe7e5fa582b4f133538c
SHA512 8c744b59ecb2843a0a6fb897ced94cc4f608764d6ea5c4a82bbff3a77ab192dbf5ce693eaf6ad020d4adbe94a311ae1477ba41484b42af94b669ac2f45321b90
TLSH
T109F0236503728258E1458BA89ABA5E406965BC3486881284DF808632267D600DD2CB83
MD5 SHA1 SHA512 TLSH

Submit Download

cloude_edge.exe

Path C:\Users\Admin\AppData\Local\Temp\Logs\IntelUpdater\AudioSupport\cloude_edge.exe
Size 2.4MB
SHA256 fb851a56210c4e622be83730a65433a3d9d86a7f3393d2d47ad80ec84666f458
MD5 80c0a4ccf2d3f37918c45c8c8469e3e0
SHA1 cff284281e1ca36806a1f34aa8738fad7b582e95
SHA512 85ca79737240efae9707e0d6ac7eb67b6b529e5668851b0bc13384e93df4179b472e560caa2127cc9a058abd421141340af67620ddae0591282fee7dda2048ce
SSDEEP 49152:8GXKQ3GMIYJAmys8NYQGtEv7uiWuDSxIksmYIU6i:8KKj68uQUSWulmn+
TLSH
T183C56B03E795C4E9C45DC07883579732BA32B8893720FEAB27D44A6D2EA6FD05A1D317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_0m34tnmm.ouq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0m34tnmm.ouq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fqVsZk2Fi6Jhp5uZQpwVMbZjnOu1

Path C:\Users\Admin\AppData\Local\Temp\fqVsZk2Fi6Jhp5uZQpwVMbZjnOu1
Size 32B
SHA256 fbf76c2d981485a99d59be82842b693b704499f54305203a6e81d68ab9ddb5fc
MD5 948e72fcd1291421d4ba7f46515f6e5d
SHA1 c5702e6184e8c5decbbd3cb5941229b61919ff78
SHA512 eb921c6ba7112bd118395c414ba31340e98ac799a10136ee5312cb66912051da9cc1db7f590584ebd3c7e414f86798137931223b536aa337c6eb5eceffb819cf
MD5 SHA1 SHA512

Submit Download

system_log.txt

Path C:\Users\Admin\AppData\Local\Temp\system_log.txt
Size 20B
SHA256 efc321a20e2a68dd58d4725c09cde20341e4cbe88bcfe8addb995d78902c1313
MD5 c6a1f365d4d0b1e960a70ffcc927060b
SHA1 4f54b8fa23c2355a61790d5e831b19d3422cf8fb
SHA512 152e5da8b0504850f669ed0f5e40eea3f10dfcbbe31d86d024546b847cb684015994f61f2d327b896b6ce16d8cc65348d44c9dd675a0592c16ce457bef37d7e4
MD5 SHA1 SHA512

Submit Download

upd152b_log.txt

Path C:\Users\Admin\AppData\Local\Temp\upd152b_log.txt
Size 510B
SHA256 244710008090903743bba5ef9f0ac182d1a33d1914b69b9c4c87ac2e191954dd
MD5 d7d80accdf122fd606421ff1e480acd0
SHA1 b288bb456d8278cf74643cce1f130e7f06bcf2ac
SHA512 e21a645d8e52aa25335384c3c0458889ef2ef3376e80651d38cf98a363deb14cf6c01b34d2bb29004b82989358f423fa2dec67f48ccfaf991d862d7a3cf308af
TLSH
T1EFF0360861A6A47F0616630743063C457D4B26729D6B86EF1F3055AD1BF8B21EF2E6D8
MD5 SHA1 SHA512 TLSH

Submit Download

upd152b_log.txt

Path C:\Users\Admin\AppData\Local\Temp\upd152b_log.txt
Size 670B
SHA256 e6158da5beb282a4d50483586300a4039a44562a6f73bc4b357b3d6f16357249
MD5 766fa22da420731127343cd145c42fe7
SHA1 84a8b93b3d54fe02460852bff81657cb43bd4a5d
SHA512 8650a0120604b3863f2679f999478f6b378c0f68f710a059b126f0eeeb097ee50c9b4e6c97c1a0ee9160eb4af1e4f8e532700c5af9d5df63e8fa3f733676adac
TLSH
T14301D80861AAA4BF03196307430238417D0B27B2A96786DF2B2045AD1BF8A11EF2E2D4
MD5 SHA1 SHA512 TLSH

Submit Download

SkyBridge.exe

Path C:\Users\Public\Documents\GraphicsHost\DisplayService\SkyBridge.exe
Size 3.2MB
SHA256 c1aedede6dd973466e09ea124a8d466d2ef4d6491003284ee735a4b76aeaa3eb
MD5 e9033ed73b674d5ddbe2c25dc8c33f03
SHA1 2e28db2e526b26e4c4d14a6b466fc9cc6c56edb0
SHA512 5ed0862cca91bc316453e08ced12c2e4283efdb7612723d0b933d67766359c0f126db71c7a289eebbbba77d3902f8011c3b47c19f35eaee715e05f97b2d2fba3
SSDEEP 49152:dRgOBNP6pSRMn3umTOl3Bjs/5zjkztIfbWOv0xY7pX7OIQYIU6is:ffipFefzz6bhpZSn+s
TLSH
T18BF57C03FA9585E9C49DC078C35B9233AB32B88D4B20B7AB2BD446213F56F605F9D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.test_write_access

Path C:\Users\Public\Music\.test_write_access
Size 4B
SHA256 9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08
MD5 098f6bcd4621d373cade4e832627b4f6
SHA1 a94a8fe5ccb19ba61c4c0873d391e987982fbbd3
SHA512 ee26b0dd4af7e749aa1a8ee3c10ae9923f618980772e473f8819a5d4940e0db27ac185f8a0e1d5f84f88bc887fd67b143732c304cc5fa9ad8e6f57f50028a8ff
MD5 SHA1 SHA512

Submit Download

DeltaNet.exe

Path C:\Users\Public\Music\DisplayService\DriverHandler\DeltaNet.exe
Size 2.3MB
SHA256 28138e6ab9e5c49f834456ac112ec39e16b5bad11a516007309bf9015dcd0fa2
MD5 5d2a851492391161e22ec4de655ea1c4
SHA1 f7cca766d81fae6d50b211533e878d4decf70959
SHA512 2571cebbc018d8d8a51fa5574470e840eb64823f9c5d4cc41a89f9ae1f3c2c53fb7f76ac8c4b2b72988b5f33705654b164b0e62bd0c32998601cd2c647e35fb9
SSDEEP 49152:/HqMycZ3pHEueIJDvKRtx2rzgItSYIU6iU:/LytOJrr1Sn+U
TLSH
T1CDB56B03E795C4EAC49AC078C3579732BA72788A3720FDAB57D44A2C2E66BD05E1C717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

serveless.exe

Path C:\Users\Public\Music\NetworkModule\WindowsMonitor\serveless.exe
Size 3.3MB
SHA256 bc381c2bac4899d7145e429e8316aa04c4241663a885cdd7d817ea30f5734757
MD5 c35bb76ca3807c303c615c074dfe01ed
SHA1 78567bf229a31ef286f80da252007207fd228b63
SHA512 6d2e32bd7acb3b9479bb2771b678442bcbfa2aa4acd54c843b0407bb24e7e9e7ced66d53c6786e32c5e09a053a95dba5c9d4e4a5f3ef59a676c4c332b983668f
SSDEEP 49152:D/+YNOZXny1O6ijfEO5kygTseVpKZOONnAz2nsRjmLogIVYIU6iCAUUUUUUz:D2YmX1ED9KtnWfjB9n+PUUUUUU
TLSH
T1D7F59E43FE9585E9C0ADC43883975672AE32B88D4730B3AB1BD846217E26FD05F5D34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virtualhost.exe

Path C:\Users\Public\Music\SystemDriver\WindowsAdapter\virtualhost.exe
Size 2.6MB
SHA256 de423e93420ccebcbedc537ef134a634693385d74d2dc20696193e1b73db5692
MD5 61451c2c0847f47519c21ed461025898
SHA1 0b56a25ed4075dda81553a44c3f7bed5baff0e36
SHA512 9a1496460d3753aa1ea7b861f3b063e9f0c01aa0b371dac320b9e7c75adc7652e41605464d42881a5718e26af648403d06cbffceab254441cbf88643b458302c
SSDEEP 24576:ZaN3pwRB1wYKjE9npp+CXzDReubxBV1xLeEZB4qAqE7uXtp6uvHo:ZaN3pwRweB1v4qVFg
TLSH
T11FC58E76FAF2D1D1EF96023AC6A06A455E763137000E4DBCF37C61601BD6D4BAB2C686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hugginghub.exe

Path C:\Users\Public\Pictures\DriverManager\NetworkComponent\hugginghub.exe
Size 19.0MB
SHA256 93664e183dc71bd96f7b962c55a0ad20506093bec471dd58bae78121dd00ff2e
MD5 a2973c8e8d43941bbb0a802082ae4f73
SHA1 aa86bf9ebd3f9f9a0bcdb62bf643417af33e5660
SHA512 910b0ea3bdf519958cf118515b115c7469f3fb293c0b1d8c9be9465b25163d214ab385f93b9523ed88b084c2877c053f2ad3d255ef0b7553aa5815e9a1e21aa6
SSDEEP 24576:LScpQryqOo127lWoeAoQcK5N8RSkvuPxJ/h72ezyNROePgcXk8jqlttyD+Cv4yoI:ReryqOo4Eoeu5N
TLSH
T1C017BFF879047DE5A66F467FCA5ABDD813B326629AC7A4CD806477C30963376FE02804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntfs_au.exe

Path C:\Users\Public\Pictures\SystemAdapter\SecurityDriver\ntfs_au.exe
Size 35.4MB
SHA256 baf547e94b80a32ba6cc82f22b41cb4c488dbbee1e151c014e0610fdc1847056
MD5 23b0c78ae23d6dae9f8980f9e967b3cc
SHA1 3644c300f587308a7c5bb05bd46e68cf07040c95
SHA512 2c2e5ca1814193ef90db06f2acb63f1d69f9fe785edfacbd0ba38a4588deac868b229d14f30f78d824a3009e6fbe37e780faaa7bf26937099bac08a164f69916
SSDEEP 196608:/5NWJ4JmP74aEw+eCwPxDXth7Dh48yNd:hUdURw+eCqxDXthH5ed
TLSH
T1F0874AF8B573D6C1DE59071AA640BBC81F66077701479BB8E33C6A42A6C1D1BB73C886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1812-62-0x0000000001450000-0x00000000016E5000-memory.dmp

Download

memory/1812-61-0x0000000001450000-0x00000000016E5000-memory.dmp

Download

memory/1812-55-0x0000000001450000-0x00000000016E5000-memory.dmp

Download

memory/1896-114-0x0000022B25AF0000-0x0000022B25B12000-memory.dmp

Download

memory/2704-2-0x0000018727750000-0x0000018727751000-memory.dmp

Download

memory/2704-0-0x0000018727750000-0x0000018727751000-memory.dmp

Download

memory/2704-1-0x0000018727750000-0x0000018727751000-memory.dmp

Download

memory/4092-68-0x0000021201F30000-0x00000212028DA000-memory.dmp

Download