1c963b40573439cf8b1ee22c93347f6f222246473df9edcfffaec221c1bd8bcc

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 05:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Size 13.5MB
Sample260711-gg616act7k
SHA256 1c963b40573439cf8b1ee22c93347f6f222246473df9edcfffaec221c1bd8bcc
MD5 9d51725c46ff5ad32b1fadd9f7df7083
SHA1 cca6148ad4dbeeb429682e18d4f32d1eed8d7165
SHA512 b3cdbe16ecc6a95e54126a95d084405b972025e974d0c4332d8f3efbd90205d705a72d748d4ae267c2cfb1f11535fb8e477bd782e6d8b45da4193eb96cae39dd
SSDEEP 196608:RHnuOb6I/gC+uv4O3u2fKEES0jvlzhhw7V5lGgQH:RpOug44O3DKEP0jRwpX/y
TLSH
T180E6AE6AA2B800E8D4BBD178C6565617E7B1B41603709BDF17A046BA1F63FE02F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Detects executables containing URLs to raw contents of a Github gist 4 IoCs

resource	yara_rule
behavioral2/memory/5920-11-0x0000000140000000-0x0000000140FF6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x000d00000001c53c-73.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/5920-99-0x0000000140000000-0x0000000140FF6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/5920-405-0x0000000140000000-0x0000000140FF6000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 13 IoCs

pid	Process
3852	elevation_service.exe
4832	elevation_service.exe
1840	maintenanceservice.exe
2996	OSE.EXE
5644	PerceptionSimulationService.exe
3304	perfhost.exe
5648	ReFsDedupSvc.exe
4184	SensorDataService.exe
1540	ssh-agent.exe
1340	AgentService.exe
5980	SearchIndexer.exe
4064	RobloxPlayerBeta.exe
3564	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
3564	RobloxPlayerBeta.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4a7cd6f623e529ce.bin	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3564	RobloxPlayerBeta.exe
3564	RobloxPlayerBeta.exe
3564	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\SpeakerLight\Unmuted0.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\AvatarExperience\SelectionRing.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\Controls\DesignSystem\ButtonB.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\icons\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\9-slice\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\graphic\gr-game-border-24x24.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Input\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\icons\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\icons\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\families\RobotoCondensed.json	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_2x_6.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\Cursors\KeyboardMouse\ArrowFarCursor.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\Misc\MuteAllSpeaker.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\icons\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\families\Montserrat.json	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\DevConsole\Search.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\TouchControlsSheet.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\icons\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\schemagen.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\meshPartFallback.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\StudioSharedUI\RoundedLeftBackground.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Emotes\Editor\Small\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\InGameMenu\BackgroundGlow.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\InGameMenu\TouchControls\controls_phone_portrait.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\icons\ic-resend.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChatV2\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\RobotoCondensed-Regular.ttf	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ClassImages.PNG	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\loading\robloxlogo.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DesignSystem\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\SpeakerLight\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\xboxX.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\gr-avatar [email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaChat\icons\ic-clear-gray.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\fonts\LuckiestGuy-Regular.ttf	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Emotes\Editor\Large\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VoiceChat\Misc\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\ButtonRightDown.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\PlayStationController\ButtonTriangle.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_3x_1.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\PlayStationController\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jps.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\dialog_purpose_shop.png	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\Controls\DefaultController\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\textures\ui\VirtualCursor\[email protected]	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\ExtraContent\textures\ui\LuaApp\graphic\Auth\GridBackground.jpg	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\content\configs\CrossExpVoicePatchConfig\CrossExpVoicePatchConfig.json	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	perfhost.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\wdc.dll,-10031 = "Monitor the usage and performance of the following resources in real time: CPU, Disk, Network and Memory."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000005fd637e9f810dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046418ae5f810dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002aa194e5f810dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp4	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2v\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\HasFlushedShellExtCache = "1"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MOD	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpe\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp2\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000770f7ee5f810dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000cacbafe6f810dd01	SearchProtocolHost.exe

Modifies registry class 30 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe\" %1"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-36a2600cebf1487d"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-36a2600cebf1487d"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-4bb3958a2cde4efb"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-36a2600cebf1487d\\RobloxPlayerBeta.exe"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe

Suspicious behavior: EnumeratesProcesses 38 IoCs

pid	Process
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
3564	RobloxPlayerBeta.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe
3852	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	1340	AgentService.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5648	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5648	ReFsDedupSvc.exe
Token: 33	5980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5980	SearchIndexer.exe
Token: SeDebugPrivilege	5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Token: SeDebugPrivilege	3852	elevation_service.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 1916	5980	SearchIndexer.exe	99
PID 5980 wrote to memory of 4436	5980	SearchIndexer.exe	100
PID 5920 wrote to memory of 3564	5920	2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe	103
PID 5980 wrote to memory of 5628	5980	SearchIndexer.exe	107
PID 5980 wrote to memory of 5768	5980	SearchIndexer.exe	108
PID 5980 wrote to memory of 3536	5980	SearchIndexer.exe	111
PID 5980 wrote to memory of 2608	5980	SearchIndexer.exe	112
PID 5980 wrote to memory of 1976	5980	SearchIndexer.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_9d51725c46ff5ad32b1fadd9f7df7083_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5920
  2⤵
  - Executes dropped EXE
  PID:4064
- C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 5920
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3564

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:4832

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1840

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2996

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:5644

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3304

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4184

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1540

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-2246396966-3025826688-3847171515-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:1916
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4436
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5628
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:5768
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3536
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3032 3024 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:2608
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 3068 3060 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 2d45e6010e1474a7b7f5a0eea257ca252f08b90151c433d22b1aefe6ce772e04
MD5 615b29d37cc8f652db093bc93be9fcc0
SHA1 a880dbe9f1abec125447f3a41fc85fc95f3403e3
SHA512 657ef379f7fa52a18fef6e3ae65a5c26dcedde86b500af07382b7b12e658c190673e4af6a6ee3428ef29091607aabb7257e4dd55461d1818c133d621676e7c19
SSDEEP 49152:2b+632BuPkFKRrdE6ohvstBhuXjfS4LWxnGxHfJvYrPs9HHC:o3q6sjBDgrExHC
TLSH
T161D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.5MB
SHA256 1ee3f4395f96ec7d29e28180e8668ba5e65d855fc189b44a80e2fb4c66ca30cb
MD5 0661986c55e7fae8eb954c580fd4aea5
SHA1 35135a7df8934acb6937fc11653485c4996e80fc
SHA512 6d9f8d5e4c61328a97410864a971d63571e904e25443a325529352b704c8365a9b8da4bfadfb60430efe9c5a0822fec73c440c0e8f4af921f169c86ec712a1cd
SSDEEP 24576:NXYfDtczAfxHfJaMJWTTXPPC1X9qSH9Y6VyP:YtcYxHfJvYrPs9HHC
TLSH
T1C075022877E509F9ED27827DC8A28111EA337C5547A0E7CB03A499661F333D85E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.8MB
SHA256 93bb74fd394bfb0891d68382317cc6aebe8028c26c5d186b1697e3d9dfb98f3a
MD5 f984977d8f3d16249ade50667f0785c1
SHA1 d9453c66463e6e9296dc48fbdc3b8e93a21b001d
SHA512 0301d5fc68ddb1dcd4c8efc78097cdb81eeccbb6bd33c511e86d5d8feffa9cd3f249e5e3d4f76020ed0cb684a252435a1fe7f113ad26e68eefbcf24ed3e0cc3f
SSDEEP 24576:E0Le5ji0hmxxrM+xHfJaMJWTTXPPC1X9qSH9Y6VyP:EPji0AjdxHfJvYrPs9HHC
TLSH
T130859E16F6748335D073C0B9C5D2A69EE97130865B308ACB0286D77C7E67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 f48d40b57666f57181bcfdc35a58f4c07c6ffc291a74965df57ead7f99ca63c7
MD5 01d2dd61e9138c923cfe56dad90d2c07
SHA1 898bf6929898ef8460865fd57b2c1bc15c446f72
SHA512 6fbe2c2eb06763d25c6bacd51d3b59f3af3473916111037307ca025593c699765540d905fb685d663484928d0366a081683a9318629598c6d6c0bef18a1b247d
SSDEEP 24576:Ta7/ezSC6vUyD/aqgrvWn6q8wyuoxHfJaMJWTTXPPC1X9qSH9Y6VyP:+/ezSC6vUzPveHjypxHfJvYrPs9HHC
TLSH
T1B8755C25F5788323D0B2D0BAC5D6BA99FE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 3a923d5272b0d28d1821da3c74aab51ed635c8f3462398efe1d2c08abc700702
MD5 9a79de7272abaccdb931ac092523fddc
SHA1 bc27cabd6d35f69acb095827ccc870846410655d
SHA512 3cf00e4ec5eee0069313660a91010680c1fc15d7cdba30a3eee28c312a84034ad9f2b243ffcf8e47380d5e6eac042648909522f937ba6e90e717d9445d44de19
SSDEEP 24576:ZVbqPb88hv/l+YTxHfJaMJWTTXPPC1X9qSH9Y6VyP:ZVO88hXl+QxHfJvYrPs9HHC
TLSH
T18E559E66F5748331D073C0BAC4D2AA9AEE3234425B318ACB1246D76C3E677D6D63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 713f954bee5495669fcf308242c58a3ae2cad164112f1b7c0348a670c994b830
MD5 b8cb7cbca0b6c5534f0c09a932bf4006
SHA1 5d10c2e9dca21b37aabe73ed4efb742375de9b6f
SHA512 f777cd35cf442af4755fa05b2a4640cdf8e18a72f483f7b9a2c00605f683d466565f28b6edc3d7c95992bb4599798d46101ab2345dce33657640dd1b5bd31a7a
SSDEEP 12288:mLCxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:mLCxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T172552356DEEE8375EF21037615E762580852BD6DABC7990A1003BCCF253ABA5D00E8B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.5MB
SHA256 65e65b109420cffc8dcaeb2dcee19c851a3359df40b12d844a4491427c87eccc
MD5 b51a9a09845d40b37a9adc3812e18223
SHA1 5dc1cdaf6169b893a7853f67bfaf78cbbea7ded6
SHA512 8df420fb510d4833e8fde9a731eb9e04e80c7d13308e962f9bd4f6de308c6aea7ab74a61074cbe0b93137927bdbff120f8dfe2b3be76a187655cdfbf6c3b8ec7
SSDEEP 12288:XeBNUbTVO86ULxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyV:XJIULxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1C175C03BEE28FCE2C67A4DB95A918340977278304F52A3CBD165C20EDE235E15D7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 d8820a77b7c9d8ee664028ab7994815a05ec921fa73cd1d3e364f359203a50da
MD5 d15c6a792df76997094c043da0b264a6
SHA1 c143a2e2fe4474322157c6bcafec537bdd2add89
SHA512 981b6cb87d8868eb45824a3d6c79ca96db8a98ea9c8e0ad07df53349bf7c9978c39e913c3efd3273421abfe12b1a3bf741c8b67a5a070916a20a8ba0840ee545
SSDEEP 49152:/QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH:/QvGAdlCEL8c/DRNw5C4grExHC
TLSH
T167267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.6MB
SHA256 0b782de6c2070f3338373c6b76146d50d49f5f20029e15325bab598f5007ad59
MD5 79cf074fd2ae4d1b73144e72f01ccfe0
SHA1 6eac1a8f16366fe2234c969817c0e2bf89205679
SHA512 77b8b7a5b4a2e7d0c52964c7330ea016dec8f6ebb53b39fff146956fd28c79c45f691a6ca254422860cc20daba6ff6eef3178c47565261a9068ba2b9d0ef8eb8
SSDEEP 24576:N0ewsAjtxHfJaMJWTTXPPC1X9qSH9Y6VyP:WljtxHfJvYrPs9HHC
TLSH
T19F75E031FE75E036C77B0DB61B26C716142DB9204F9219C3E3A89D8E59342D2237AE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 1eaaa8311a990233af1e6a5e7e984495ff139a2e508ef124821839558d09c31d
MD5 83103a1f6b998298afb84999c40c7f5a
SHA1 90d0b23aa4fa94d02343ad383000c975e252f26e
SHA512 a1eb0682944f0053f29c93bbc625a43ecbefa0027b84cca8338647bebbc8af2bda830af5b50ab3f3788a4df98efd7d0b1f4b6e3a117e9b9bd7e0976ac69f2378
SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJH1gQH:CUEtQevvqc2W1cpV2tI32Wy
TLSH
T119474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 9055a9921daf09e2601f6eb6bceed03ab014da8b3c93c75ec9aff74315c0a6ea
MD5 2983656c24fd33c8817e152cf7028517
SHA1 e27f67a41f281632069aa2581da6c441bbeb60fe
SHA512 dc7e731d98a25b7dd4b9633cbff1124a41c968310b92d474d22c26486aa27c282b8dc0c3361bcc3f07d321f3fae9eb7512caaae70f7d1500411e6efa29b4601a
SSDEEP 49152:mCbRquA/m2yL5zLfFiV+XenmE3/zNxHfJvYrPs9HHC:Loq2Vjnm0grExHC
TLSH
T1CED58D0976B8C2E4D1F6C77886A2C647F37178154B3197EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 758a14ac44e7835eaa3562e57d526f5d45560336165b73568a1009eb912c8f3e
MD5 5f8e5bc13b4968afc3cc2c3dc440f1dc
SHA1 ebb74d16d029cb90984742cc7b90d84b22dfee9b
SHA512 1fe6becfc5bbd375f1d942495e985589151bb78f0f5e7a3958c0fea28630b93a2a19cc501311d621232e0a5024daaac06e00ee2b65333c0c198ae62a462cfd38
SSDEEP 24576:sAhGL3IFoiwtA5l7S53UxHfJaMJWTTXPPC1X9qSH9Y6VyP:sAMUFoiq5ExHfJvYrPs9HHC
TLSH
T1DB35AE81EBF955D4F5B3AA7899B68170EA76BCAA5E31C20F2150D10F1E33E509D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.5MB
SHA256 ac26565625a0cb71b260c7153a02f98274a56073ca905a39819e7db691a47c5a
MD5 72e84f2525424d73380f7e1203d5b405
SHA1 dec0d80de14baaf26c994a3ab949c8a1ac4d9712
SHA512 2b276232ac036902df217849bef490c0e33b58fab03d6dade03024564056495acbd4eb100f4513d3bff15dadac2e5cf16fdac45e9b98cc4346f9c36c8335d4d3
SSDEEP 24576:Twu4OWJxHfJaMJWTTXPPC1X9qSH9Y6VyPZ:TwvOAxHfJvYrPs9HHCF
TLSH
T1C165F14676E90CF9E96342398597C135E7F2BC062A62DB1F1360C64B6F37361AD1EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 78c288db19ed2d218e0eff36ba6a20fd00f0a0aa366f51f51af04c3191f8d4c8
MD5 d1cd24ef2913727fae493922ab41fe29
SHA1 f53d9d7e80856e34e195ba12320b3ae35b16558c
SHA512 93c43408e54984db8f869c94e44f2ad0b8229772fb7b8916e05fbfca487a2b265b2c28e382e5b97187b6d4b6e6804c8892fbbd249d291ff5d655ea6068f3075b
SSDEEP 12288:3eZ1Iy9xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:OZuWxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T19355125A36E861F9E663427D88E252048772786667B343CF1111A68B2F33BD15D3EB33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 27db95d604be976b2750d162d839998f85cb57c8d84a12edc3d588ce887fd378
MD5 9453ae1ad7e2254e4bf4d37cf83f9045
SHA1 75f45c138b054449fe0f4841457da4f31fbbf664
SHA512 6991be06590968519d0bf24468252e6d7b210d177407bf3087118da39d457b209d9b44b3a58122015ac865f04872f634e00bc2e3240f3906f3f294aa018218ce
SSDEEP 49152:Aj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:HQRQyi36YOcPbLvw2gAf+PN3XgrExHC
TLSH
T19A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 a8a1baabae8d507b78e4b98047cb0c2589addfbabfdb5cd25b7ae68bf961713b
MD5 5a328d3dc63271c005f4656b0ab510c2
SHA1 d657a5884d220cbe50bc88b463c3cdb8f1323918
SHA512 3a38e7a270f01fb3513f8b7ff8336bdcd47f1655200de31d9e35056e41e5744840d292d7fe6f5171ef2b721209b815273558f53ef4fa5b677030be268a9db412
SSDEEP 49152:oj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeTAaLSF259ruMHwpXMi4FqJLd23UE:PQRQyi36YOcPbLvw2gAf+PN3XgrExHC
TLSH
T136667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 e3a67c1ac8ba910de1e0a11e441d7b4129e1ceb92323c84fb9e97079ca6f7f8a
MD5 e91dd54e29b0db042d5994900b7c657d
SHA1 e16670b5f77dcc49222807d084c3a87369bcbdfb
SHA512 e9bdcfffc419133ced9cdc1871509ea5230701a5370c7fa2a8b524fa52bf112f01c6284f854b94f1488379fa897344d7049a654d23857996c376731431d0cab1
SSDEEP 49152:i68Qg55nhceWu7PNU3/dxHfJvYrPs9HHC:gthLRc/dgrExHC
TLSH
T1FFB54933B2F600A9C44DD1769F4A872196D27C758FE1E3DB8511720A1BB2AD07B3A71B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 3b33aa1c9c9925864b3cd6ae7acdd2b29ecc4eeea768e003af3abde207d228e5
MD5 7e256b372049c0696ff8ddfd42acf861
SHA1 2f924c34579046b9b763c33a2a4fd8ef717f7fa5
SHA512 a6b680d2946463210e3d8ebdb66cfee99d1cedf139d6a5a0a48f4214be2fba6cf47589387a3e516ecce49f66feefafb525f66c02ad95f679ae4521b85e4d0fba
SSDEEP 49152:d3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbKN3Oh6tznm2FQ/nho2qkrk99K:My5112gYy5azzVvt69nLKnhZCgrExHC
TLSH
T1AA167B13F29901E8D01DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 44765a31fe7e51bbc1724ad06f1bfe55ee85d7c03b0af4bc658984ab94cc3d8c
MD5 ad727e32d4c32905865d1d5952e68fe0
SHA1 e71b249501fa3a7a7e2e0f249d23a0f5dba0847b
SHA512 8d78717cd5a661f5fb2107ff068a064eed7920ea2ce9cbaee29fad30a32c0b6f0fffa70ba2e85aaadcb99d3065b2c0c8b61e08a810ad8066280e496298598258
SSDEEP 49152:gB+taZ3usBWOBr4tEGL0bqx0z+n217aau1glPxHfJvYrPs9HHC:6u6Jmdxd2dPgrExHC
TLSH
T1D4D59D13F1DA01E8D06ED178974A9233EA62BC490B35B6DF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 2242148133d4441ffd0709706295403d7d43362e91268ab0e672cdc937ad15ba
MD5 20b0176c259d67145a491393c7d51390
SHA1 6c087a2ebb3b84775d7765945427169cffd89325
SHA512 47a17b9030daa47d15e263c8802ad6b401cf70c3cfd0cb568096b1471033a68510bbd043ffa140143f1e96f94848aecf1cc0df95f0d79541c022c0292daed00e
SSDEEP 49152:71hpsNoJpF1A63U44CwH7R4xrxHfJvYrPs9HHC:7mifPWR0grExHC
TLSH
T1F5B5BE13F2D901E8D06DC17887569232EA62BC460B35B6DF0A90B7962F7BBE45B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 54b559652a3d5b9228c54088a3c4eb9b9d8858f5d5805ab8de50c6924bf84c92
MD5 6457eedee42248b73709f3073bb29cdd
SHA1 f5837872d977daa5f0a7acb531af9c7e49a4e052
SHA512 4ccd2a15c347c3300131abfa7c14bc99b308fbbf6b26f0015ed0e575192a69c0d2180529bf56900a895d4b70bb25c4be4eed8fbaec6d7ebdc2b642a7ecc128ea
SSDEEP 49152:ASuZQIY0Be2KcRVtOnks6NMHqWxHfJvYrPs9HHC:a5dKii61WgrExHC
TLSH
T146C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 b2b04707fc88d7d5389dbe03ca8417967e9be723ecb1c5f4168a1ab70a2953c9
MD5 0f9d998ac469914d876f9412cdaa9991
SHA1 f48f1ca8e8a6992de2746449fa094a5f170f8d77
SHA512 1c577550044dbbfcfebfccd2900b565ca47c0bd0baefe013196541d3e29012959f4ccc34db12c1310cd1b52cb223bdac9d974449aeda8cbe21e6c415ce7d4d58
SSDEEP 49152:lhtSn8EApI0fig3giDn0AP5wfxHfJvYrPs9HHC:UX2imphggrExHC
TLSH
T19395BE13F2D901E8D05ED178C7468632E962BC160B35AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 3e4699a5a6ab7a5bdbb480a47ad4477f4e9db472a4a57862220c197799fd5590
MD5 b3717eb0e9af78827c44bef6364a02dc
SHA1 7837b453870a7f83f4361c7885852db9e8eab6e1
SHA512 ffa60cc569a5308302100e1f994eb2491ffee949bd5b609fb0539bfbf9f908b69c969f02f21c8df48078fe0f9f151ca8a3ebdff97a9f79f7b15075fff6b6f666
SSDEEP 12288:baxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:baxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T16C552316EDEF8379EA1103B6459353880856BE6EFBC3554A2007B84B367ABE5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 e2bdf70b48c383b054be470a27bdf36012d2acbca5a36cf1a0b335b4299df500
MD5 d880b36777657ab39ac0bd9bc6b9ddb7
SHA1 3d46a86f4d15e42c6cc349b4697bc190d379934d
SHA512 75b6d468bf6874a5239ab1b03be27b7d60699afdc0ea3f2dd42d13ce4070ac859f35d82d7e02e744d2d29492410f20cbf82d104e28aa5209c90f017b25aea2e3
SSDEEP 12288:SRxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:SRxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T15F552315EDEF8379EA1103B6059353980856BE6FFBC3554A2007B88B367ABE5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 736c44a323e9cd0c42c3a27bb65a99513c21ca615c9dad0f63fc33de98ae96d5
MD5 5f7c865e6f3cedbdaf4888088358a048
SHA1 f672afcc7d117da45ac1a885b202064b2aad25e5
SHA512 034aeefdaa13959dad07c6de55924bde190e199bfb4572298f6a5734d38bd6e66e95782a1d8dad18fcdb631df9ff51d57a658984c248df92192a888cdf28df34
SSDEEP 12288:oDxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:oDxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T142552315EDEF8379EA1103BA059353980856BE6EFBC3554A2007B84B367BBE5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.3MB
SHA256 0df8b29e74bd9671e2cee0eba449e334c804e91cce79d8031093366cacdd5539
MD5 e581510a46b6567e201f698fca6b1155
SHA1 8951a713746352d5847d825c3ce4dd048a97307d
SHA512 c5c733868e9030a2cd3948af29c3a2d711571e9e9fc98a5785c5e252580bf10208acc9613dea90fcab910356a3b9e9aea5cf7fd13e32a2a528801f063131689c
SSDEEP 12288:+V0xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:9xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T18C5523117EEF82E5ED2183B985A352540572BC6EFBA3568F1102788B2F727E4540DEB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 e74920ace5815e01b3b50fd3f92897f85a59239ee2e500ca07a699d8bb0f5954
MD5 4aa906c00d2e75ba3450e7f64df44688
SHA1 02173757ebe25b9bc0deca115b8392bc66fd7e8e
SHA512 391e08a15fa671ae2380e429b45703f8ce7a38cce92e4e19ebb23dc00895f0793649bb6447c237258f7aadf51984a1499accca2b4a5a84d159a39bdd4c5ac4d3
SSDEEP 12288:B8xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:B8xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T11F552315EDEF8379EA1103B6059353980856BE6FFBC3554A2007B84B367BBA4510E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 fc8af6a2a636c59e0f0414d4152e7174ad56ab61d7f3ada8c66cf3d23efd1ff7
MD5 b5f76b7e8ab63f115d9b4e811120977b
SHA1 ee58b6447492fed144f98d25fe5f7b355f9ae01d
SHA512 069b63e0a4bb018917dc5525eb6f747d2b26f867d9332b4bf6827fde2a92f4aa5c508e571b5c18edbc1453239e6386c8bc41bafcdd69dcf0b7ac6cc73251d84f
SSDEEP 12288:KFxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:KFxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1FD552315EDEF8379EA1103B6459353980856BE6EFBC3554A2003B88B377ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 72182b63c6cda98460dc80b0b12f8303367100317dc62a20bcd64437c92fcf38
MD5 59f55ae7fe0e79cb229635bc1e69afd9
SHA1 2f52dcc55b1b78410fc8f69825e54573377e198b
SHA512 b8ddc970e499369c64ab0073422d851c48d3bc31548dea4529a347bee70728b4ff1d2a3e4414660f8a077219141dc2c78b2eba5a622356e71f66082613dab995
SSDEEP 12288:D5xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:D5xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T103552315EDEF8339EA1103B6059253980856BE6EFBD3554A3007B88B337ABA5500ECF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.5MB
SHA256 93cfd8bb09b449bc6865f9376be2ac0b9eb6a61e6292df625b196a8702b8a4f8
MD5 aa7990ce1129e6b4cdb920062a01943d
SHA1 52ca253705e920d0be95b3528774d4c8ea81db6e
SHA512 9944c5315f9c6dc098c33280e72f099f7312edb2838e070153d99cd5475bb3bf0f1c668e619f41f49f9978ad4af88a2fd2a9ad7ab5b71f0467cd7eaef88cc2d6
SSDEEP 24576:1ZMRzFVSOxxHfJaMJWTTXPPC1X9qSH9Y6VyP:1ZMRzfVxHfJvYrPs9HHC
TLSH
T1B9750295B39018F8EC63823ECD568905D6B27C5A5BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 8da2447e348b408f670d33260054eb519816d783bdd8901d9bae25921c90c8c0
MD5 61b57a1ab588b0f8a691b32bd0d73fb9
SHA1 1b741aec4dee01da804a6ef4584a0195770901cd
SHA512 1d51e942e597db3d0439eb3ceb946b70aca30d3e26bc96d0302a0d0ac0e1f92bb67945e7e783dea5703ac3d94aa5a52e3b288579fe6bb667d054b852d243baf7
SSDEEP 12288:OmxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:OmxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T178552315EDEF8379EA1103BA059353980856BE6FFBC3554A2007B84B367BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 554d5efc3d7d07e880bedfc59b1e80f397823160b5feb17849dc7358cacccec1
MD5 019d92461a28f89ff3d02e61c5ee9458
SHA1 53a2ff39b51b1efcf74c6c2f58109be86f004474
SHA512 0a25361ca5e0715e10042d331e280a31425d88c9731ddcc33cda0e70948258d6485d2526e76c77264d1a9601fe903a52c24cdff1e4e5670993baccc92b053f7d
SSDEEP 12288:KSxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:KSxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1E5552316EDEF8379EA1103B6059353980855BE6FFBC3554A2007B84B377ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.4MB
SHA256 3ca0690cf4d6266db267531bad419734bc806ba1d038a0b63dd05262cc357602
MD5 cc7f8279f26986fa887fa751eca26319
SHA1 dae60dad48e3364b039bb0d58678f9d2e6955427
SHA512 6b54aa2855c15fbcc607aa6789e0a328495f216c7d96d091c0de63661ea143e2535c5ec32ffb71235c044c3c3de9f8a42a05c089173d98f2fc183c8aa03fe795
SSDEEP 12288:XyPz5L89xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:azy9xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T10065120777E631F8D532823988A21601B772BC365B618A9F1360567B2F377E09D2EB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 2e18bbce07dff617555b2ec8c2625be89954ac24aa4d53f0db7119d1e998c139
MD5 cad87780ee9e42dd91ce6756ca6d1a69
SHA1 1947c5920700b8a713aee44d43fab9e9c8fa166f
SHA512 a72eeb0e7173710d454cf2f7932a30e3ffe8beacbfb8e1f065ac39f725e5109599430d53a48ebf2441e33680720e9cd2fdc5ff76c343d496c59c215e737e2644
SSDEEP 12288:SmxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:SmxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1FF552316EDEF8379EA1103B6059353980856BE6FFBC3554A2007B84B377ABA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 3891fe827ec5cd5a15f3a290f43278e5892e3240828f39d7b484393546065619
MD5 6a466f9d3e5040ed82ebc5e92652d253
SHA1 f4f5b2cc2c84ef673355c62e312fc56880721467
SHA512 424060a85f72c982f155ffeaa98c62a4d2baf5988bb086609cf9ce39101ca02886696bb374cbd906d5611a34134049e1019a767aca70416a882d276ac9177b09
SSDEEP 12288:KmxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:KmxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T14F552315EDEF8379EA1103BA059353980856BE6FFBC3554A2007B84B367BBA5500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.4MB
SHA256 ac0d3333fed7984bb0d9f04da70cde4370e93860de7a2af62b1dc17076225eed
MD5 e9588d4bdf771410b16ade50b8f88317
SHA1 324d60071b64a3fea8f430d8b988c4ac67e6a896
SHA512 e3d85d69c4b15f09cba337d829fce02af15797117511681b5c985ad19f80c1eb5dcc819e2acc8a7eca62db16d893d7472c487a70430c543dd21bb216a1887e81
SSDEEP 12288:nyPz5L89xHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:Kzy9xHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T18765120777E631F8D532823988A21601A772BC365B618A9F1360567B2F377E09D2FB71
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.5MB
SHA256 5a6f19356097c7c15b618b377bf16536f9a9a51ed3fcbbe7ffb68466656e1b7b
MD5 90f8505f9445da53d062c1f0d64107cf
SHA1 5d76b82f0a9235f49d94dd8f769cf4eb2b475fd4
SHA512 dc8ebc6b10ba9219ad30618682c603f7447db713af118207ef2f7a37572c4fa99f877fe129678c1c9a743d5163066a3586695c059368fb41da58d452c9d059c8
SSDEEP 24576:/TDaLl3z0zDzxHfJaMJWTTXPPC1X9qSH9Y6VyP:/TuLljoxHfJvYrPs9HHC
TLSH
T13D7502A5B39058F8EC27823ECD568505D6B27C5A4BB0C61F13A4365B5F333A11C2EFA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.7MB
SHA256 46446223ee27b556bcccf9fe786ea96f443da9c3dbfe3116d59c6269c2a9708c
MD5 0ba8f1bd135c165c3d447537e22b94f0
SHA1 117cc786e82cf32dd04d763bf0c3665ff9cbfa3a
SHA512 cfaad8865881c5165e74d43c5e4f4fecb70bc0f15184a9cefa59f3298757d7d58ebfc0db6483de9d2aca82e9d5f507231bc330a43523fa827f134f28b5e585c5
SSDEEP 24576:A3vd9CHKy7GZ3xHfJaMJWTTXPPC1X9qSH9Y6VyP:Kvd9CHKyaVxHfJvYrPs9HHC
TLSH
T1DE85CE90F3E810E8F0B78A3589764511DAB67C5A5B71CA8F03A4665A1F33BD18D39F32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.2MB
SHA256 54cad690ff534d76bd1c9469e2ac473a308e33895e3790f3e2b8b9c9fc07a5c3
MD5 5e8656d29001cbbcba2ceefd734c537a
SHA1 dc3e51ee96b8e6bd392c7f04b030cc1bc952272f
SHA512 7af75d7eec08f5745bf1353ce3984dd4b4a42c87aadb97bdc6d6086e4d7c80cb36a74b40e6f201937e518682c1ee8494d49a1e638409c57e4d56d7e2b8a6aadb
SSDEEP 12288:QjxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:QjxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T190552315EDEF8379EA1103BA459353980856BE6FFBC3554A2007B84B377ABA4500E8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 9.6MB
SHA256 605c024da43bb554542bd91d4d8688db6cc3b725f020e07b67c709de01a2a9c4
MD5 861dd6fa62771d9c50fa74cb94237d1a
SHA1 a1218ed98527ba4d252f01f25c3ea7238944ebd0
SHA512 4d600b8c1a3b89298cacba8549dea286e3962e44496ca9404a30ab7ef400620d780e9acacbe50f6b218726bdfddecbec0e1b16b243deea097e604a9e3d6b19db
SSDEEP 196608:sytUeAe3XKrW86kmLD0msx1WoZivT6WibBrKCZ:s0XK00msx1bZIT6Wi1nZ
TLSH
T138A6AE22B901C032E8D200B296BD5FFA993D9E341B3954D3A7D45DB95A305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-36a2600cebf1487d\RobloxPlayerBeta.dll
Size 20.7MB
SHA256 650840a8a47d32f6b58d0c8d2b53cd82c07f6153067ea81fca425995b82d56a3
MD5 6880846bde28e2d05a247fa2a2187224
SHA1 8e69b4f935cf78af99d63a10dc7b44dfcb179d2e
SHA512 66fd7997ca331a43ab40102b3fa02cec3269fdc503418cbd1b2476c8e87dde5654e075963cfa26540455a655f6ac6483c3696ab59535c6ea71b8e705757b8eed
SSDEEP 196608:Q3Nw591wKdbnHLuOixYG+YfHLfNqnKUc:gNI9P1inXfc
TLSH
T19327BF4EB8D20AE8D2725070E05F57E3EA62708C0B6D2EF746E94111363369E564AF7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.7MB
SHA256 28b5f307b606bce80782ef33cedfdc9043e4e0d507a1744ad42f6acf893422ea
MD5 34c0be616499402d69540c85de51d6c8
SHA1 9b238de0f1fe3961fe36a0f7e6df790058858120
SHA512 2cda099c637563eddd77fef7510051934f71735c872541e04d7edaf112914276084f04a50b3d1205d1a414290f9c5a5dcec8824529d2400a7c20e838bc26b262
SSDEEP 24576:+fwvUk9RX6wkyAIixHfJaMJWTTXPPC1X9qSH9Y6VyP:mMnYIixHfJvYrPs9HHC
TLSH
T15585D029EBDC44E5E177923C89B3460AF6B178691B31C2CF025A53AE0E37ED45D3A721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 8b06e2e7423ddb9974fe0005f6657da648bcd01451008727a06b87f47abf7886
MD5 c1d6d3dc8ad043ce87e716af848ec529
SHA1 7929f3c2add200cdc02d155ea79be9ca01563577
SHA512 58ceabf4e670606f9b44acec0cb406187412b99ab2c1206577245f6260c4069f9dd4d009b24183557ab70e092947300ce8d0d2af1bd6249698b67ad9282009ef
SSDEEP 49152:MYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0/xHfJvYrPs9Hi:rySzP3grExHC
TLSH
T1AD067C56A1A801D5C1B9C1B98F1BCC1BFBB134090335ABEB02E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 29433371b960c297b8fb670279acfd469c1c2abe03411e6207a0119575d5ddee
MD5 292701704d765fbbe300eceb71046367
SHA1 93cb721882566b69dec301f4351495f026a0a08a
SHA512 e9d34fd9948be55888e986edffe0c0e05862d722622b90f6fadb0e1969155d4e420a94c3c7b5badae11a07f9a4946913c6ce2ef51b1ad9d50ee2dd84eb626e09
SSDEEP 24576:F47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYBxHfJaMJWTTXPPC1X9qSH9Y6VyP:F47JUQjTirIhCnDHUPfF/PxHfJvYrPsI
TLSH
T10D65AE1DA3EC01E5E17A827885154A5AEA71782E5F32CACF1270837D6F23ED45F35B22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.4MB
SHA256 5f939998647f80e1cc2af526be2d706282d796f50051747b3ee133c8b601eb66
MD5 647f27abde699c0521ad20f09efe115e
SHA1 953be03a707cf3b4cfa9c6f85b40582b943b0d78
SHA512 6baee97e8db858ba9005cb942c162087b5cf2e7c2203b30ec680b0f65dbed13cac8c60ff1a61f7e79fbf3f4c500ee6cf7d4b4ac80c9ac60c6fe12d8d3744a32b
SSDEEP 12288:qbsfWxHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:BWxHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T1D365011AD29842E8D02E5279C7964640B3337C2997E2D3CB22C1F47E1F766D09DEAB53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 fe17ba85fbbc747051a461bc5d8308de7b94fae15e96566085e4cf87fe27acf0
MD5 65a47a90cb14cc0eb8485a948180099d
SHA1 c29c952028cf2f11a1b86a362034e7bfe06eecf8
SHA512 f59d62f0101fa292b1adaa19e390742d3471af374d519cf538a4306823e3c928a862c7aff616e14da4dad8160aed7b097e74962bad4c1714835d5fa539e9ecaf
SSDEEP 12288:H9kW2U3f56Z42oXPoN8ezpzbb/W/RMAxGIezc:H92UPs4DXPxexbO/RMAcN4
TLSH
T1B43506517666C74FC66980321E32D1CCAB707D01EE04AF0373C99B7F95B6658BAF2682
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 26df8857680c58fd326186ed386dc869360b4bfff163f33af2847ea3e2d760cd
MD5 2891adf02b225bcdce61191cfbf4def1
SHA1 5bc5eb963b9cbb44fd9855676050b4184f4ae178
SHA512 5e48c1ee14adfb5c5c4ab5140b176e963a1062c41990912055f0057b98f8fd312b370b541cd8b8640eb9bacd802051a2354c2b25e2637f2b0a1a87e68b6d1182
SSDEEP 6144:/SPxyP3VorQFqkq/LfH2VwmPhJG1yQEz+v8D9tMx7D9tMxcosiMTXs/ZXEK0Yx2D:1P3PhJG1yt+6uY4M4
TLSH
T17365EA419536E38FD1BA6032072A5B4C7BA4EC17B7496F26B3C8453ED86B715B0B93C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Roblox Player.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
Size 1KB
SHA256 53cb334dcffff3e6db0231f2d3477be49cd37d2969dd88008729325ac9a64987
MD5 71c62d52fa5fec75302e8d77e42f6ae8
SHA1 6524bbd33d6d54be64b8dcdbde3a1c53425a278a
SHA512 be225b087e536942cf2080fa8b768a1b235e14a9dec2f43b8ce4f2ab605a5b3219016b9bda1d93e8c2ce26021d2a24e3d138f4e62c6909cb0690c39555588038
TLSH
T1BE21E1684FA15717F5B346309CF12271F732FC01B6185E2E80C713890C51160E969FBE
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 4e0e753e08a137373b9a30d70ccc26942a18a30e748b46392b76bae13b130387
MD5 ab0825d1b9d8acf12be34d6785d81a07
SHA1 e98674a40a419de7e3e489040e418051c4517452
SHA512 76c4cb5f764a89fd9b7a76c11150bfcd3de7f25b3a748b93059774a60feeb8835edf070832a44f0b582c798d01f32028d106e6b29b4c761c3a108eae7473f102
TLSH
T10021EE688FA15317F5B38634ACF52672F731FC0576086D2E80C713890C90160EAA9F7E
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Studio.lnk

Path C:\Users\Admin\Desktop\Roblox Studio.lnk
Size 1KB
SHA256 5fe7d42f0b751d8ce513132a13e7934cc5b11165ba0979b20536ffd9174eabd4
MD5 d00496952e4acc8307c97eaf119783ea
SHA1 fce944a45f843e045f9abc36f03b973613b4d479
SHA512 811f726c359d60de0a192e46a3299ba7229509b61f677c7f17048d1d5bd05afe58b80a9ba8a1ef51d75cd5f45a79cbe19be0c9231c8c56b18da74b5edd041367
TLSH
T10C21C2588FA11327F1B187357CF21661D736BC06B6089D7E80C713491961110E9A8F2F
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 bfb7106a5983e0ae81224d595cc4348293c3747326ca9aef59c432c783bfa0ce
MD5 d7edd88443b04fb2d9caf281414b557d
SHA1 55e9698de455d04bfcc14618130c549141df6a2a
SHA512 c4e02b79edc9c0dd75287a13e44ecf69f2f004a3542366d7982ed60e5fb7468223ddd32c46d7b49f526aa5be2a3a57798d84bee8227d18856e5af3ac609f7898
SSDEEP 12288:tF7exHfJ27MJWGKLTXMxOBCADkzf5OBBgX9k3eh6E+QTT9dK76+ihyP9:bexHfJaMJWTTXPPC1X9qSH9Y6VyP
TLSH
T153552312EEEE8725FD3103B505979224141ABE6DAFC395CB3002B48B3636BD49D1E9B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 ab35ba0ac14d0631651c927e91670370662abcd60065d2a4f58f6362c6efa745
MD5 1bcca6c580e44704e755afbac6210144
SHA1 30d9aa4e3984cb7f15e973936c6cbcfa25fde4ef
SHA512 3a8fc1246480733b1f68f1a712a452bd3fe7f800c902373e58714ce5f6055d80a26b3c06cc47175fcc7825ae042e6783aa53a65fac6788654887243ed5591e3e
SSDEEP 24576:7gb6bmBIi49WNNFpg1rSvFv7bYoxHfJaMJWTTXPPC1X9qSH9Y6VyP:7gb4mBIBhGFBxHfJvYrPs9HHC
TLSH
T1E865AE1E22EC02F5E0F6D2B8CDAA4417D6B278161732D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.8MB
SHA256 096b807954e39676d81d67fe4452a529d184d51c56ce4daaa7fef538d955c70c
MD5 9aa39d1003bd2ac092ad2516a0d1f945
SHA1 78acca1110a12e40aa0ba485af892ac2c0f55611
SHA512 e8d2d63fc98f9734db23a653371d626173e6e43f4f1b303ecdef5e3a346eba8ece4058a82666b91f1cda93f91dc44f7f67a724d5bf98763bb75a3202450e7d93
SSDEEP 24576:tG88u8FpJqH1bzria7/mxxHfJaMJWTTXPPC1X9qSH9Y6VyP:g7ZFPqVea7/QxHfJvYrPs9HHC
TLSH
T1D885F16576E102F0D477D13889824663F6B2B8251365EFDF06A88A461F33BE54B3EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 45fb5d4bfa21ce809b4275d81475234ceb3fc84a87002c19717f29292951c7fb
MD5 e6bde94dcaf9b7d35601049b148be2a4
SHA1 08dacc29debf6e934f6c21ec23f61db29bf8c6ab
SHA512 5368e2797b8f1704dd5c9279d8a1190d6497b89e024f21bdd043efc2c2696656cab2e042bc1547193060798a29b6c94f02ab215f92cc8a909bc340987907b5f2
SSDEEP 49152:iBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjFxHfJvYrPs9HHC:tG05lO43bqgrExHC
TLSH
T16AD5CF6A62EC11F9D1BBC17CDAC6460BEBB23815033556CF02A486A91F27FF4957E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a1df11e6542b55411f36a991488a3421acde9153cf0f61e835b61f95b49a0b9d
MD5 8aa04764a999fc047f77e529037b32d4
SHA1 7cce32f286f9450e7bbe427100ad9ea5832df4c5
SHA512 1e52b29babd955d7cb16b05a3baece9051ac39089e349ea6504bf3ce496038778800ee1554ff88e10ff027934d52770fb51e199a9f38266e6294e8b53afe8244
SSDEEP 24576:8fa5POZ3dpuWVM50JicR2hG0lasx2+47eidn/xHfJaMJWTTXPPC1X9qSH9Y6VyP:ka5POZ3BJt2pasx2+mdxHfJvYrPs9HHC
TLSH
T1C265BF5EA6FC01D5D579D17DC583861AE5B1342253329BCF022182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 788f4db5ad12ef2da86299219f9294b1cf906fa962b4161984a2cf78b6814514
MD5 74bdba01c585d45ea38d2bf7167bfe1a
SHA1 1013c4f0406ab6d3b8e6c4943e70caac80aff9f4
SHA512 2e25bf2a4b660b53d0a0e33fe2833f5ca1747c840b4cd6c5abda6989abae66795e89eab0232f3edb9850cd1d21f575431239707d2008073ee97d4c6a6fd6814d
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkpxHfJaMJWTTXPPC1X9qSH9Y6VyP:pNc/zEOVHFwxHfJvYrPs9HHC
TLSH
T199858B1623E901E4F5BBE1BE89679546FA71786953308ACF0291811F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 16bc7678e4466b7b59516b1215de471c5362f2a600752ba9b47160b91ce955d6
MD5 884bdc780d249140e256b3e0e789d507
SHA1 0bade292d270af99bbf26aad7f0d991f86c974e0
SHA512 6e403d7a038d65e4d906e1ca32f75e64b18c0724bd126ac3c088ba9978e24e90baab5a3bd0fe1ee79ac06e8ce96b1941cd949919846eca1db96c9befb27f1eee
SSDEEP 24576:nTkNvNnaFeYhJNtmZBmbxHfJaMJWTTXPPC1X9qSH9Y6VyP:nTMwBtOmbxHfJvYrPs9HHC
TLSH
T15555AF2EBAF846E4D1FEC6B58D238512E6727861173293CB5290C13F1E279D89D39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 dcec0ca77a2d50bbf4efc7f3ab6767d1a1d0ad9c195fd6719f2ecb3dd11a98d4
MD5 24cb60be669a6de5206f9065eecb3ee1
SHA1 43842b763991dbc75e5d9cc732058828fcb2834e
SHA512 951dc3aa8d075ae387da92c677f250df88dbc3f7effd7cfb30fa4f1cd3770492264d76dfbbb5cc704c225ced568b596c7b263eb5ac561352744a270856417c10
SSDEEP 24576:DPUr+NQVxHfJaMJWTTXPPC1X9qSH9Y6VyP:DJQVxHfJvYrPs9HHC
TLSH
T11365F12F66ED18E5E636917D85828309E771B862175292CF0291817F1F37EE8BC3DB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 5dc111ed32bd9254f9f030368a5ccd3d1ab6b9a6c83c56bdb67b2b8e52eaa655
MD5 e61f80462e81c91f35e0a91778eec381
SHA1 240c9ddc18b749895bc2cfaec0ae57c4a93a0af6
SHA512 19edfb0fc31e6806c4a7cf23b5f23ae618ef34354c7a9f2ccc70d7664758478c2f494c28b5bae3b0a2c0c66b2892bbf195dfa6292be5744622b02479a8ab070e
SSDEEP 24576:FD3FHshBIYQgA6xHfJaMJWTTXPPC1X9qSH9Y6VyP:FDVHeBIAA6xHfJvYrPs9HHC
TLSH
T17975E13DEA9D04E4E57AC2BC86638606E67138AD032256CB0194D1BA1F7BFE46D3DF50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1340-172-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1340-174-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1340-169-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1340-162-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1340-163-0x0000000000C80000-0x0000000000CE0000-memory.dmp

Download

memory/1540-152-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1540-381-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1540-158-0x0000000000890000-0x00000000008F0000-memory.dmp

Download

memory/1540-150-0x0000000140000000-0x0000000140295000-memory.dmp

Download

memory/1840-54-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1840-44-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1840-50-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/1840-56-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/1840-43-0x0000000140000000-0x000000014022C000-memory.dmp

Download

memory/2996-58-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2996-293-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2996-76-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/2996-62-0x00000000008A0000-0x0000000000900000-memory.dmp

Download

memory/3304-120-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/3304-337-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3304-115-0x0000000000A40000-0x0000000000AA6000-memory.dmp

Download

memory/3304-114-0x0000000000400000-0x00000000005EE000-memory.dmp

Download

memory/3852-21-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3852-113-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/3852-15-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3852-22-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/3852-23-0x0000000000880000-0x00000000008E0000-memory.dmp

Download

memory/4184-137-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4184-327-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4184-138-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4184-331-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4184-144-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4832-31-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4832-30-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/4832-38-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/4832-136-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5644-332-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5644-101-0x0000000140000000-0x0000000140222000-memory.dmp

Download

memory/5644-103-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5644-109-0x0000000000C20000-0x0000000000C80000-memory.dmp

Download

memory/5648-125-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5648-124-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5648-351-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5648-131-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5648-391-0x0000000000720000-0x0000000000780000-memory.dmp

Download

memory/5648-393-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5768-395-0x0000027F57250000-0x0000027F57498000-memory.dmp

Download

memory/5920-99-0x0000000140000000-0x0000000140FF6000-memory.dmp

Download

memory/5920-405-0x0000000140000000-0x0000000140FF6000-memory.dmp

Download

memory/5920-0-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/5920-11-0x0000000140000000-0x0000000140FF6000-memory.dmp

Download

memory/5920-6-0x0000000002040000-0x00000000020A0000-memory.dmp

Download

memory/5980-186-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5980-179-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/5980-178-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/5980-386-0x0000000140000000-0x0000000140172000-memory.dmp

Download