Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
27/07/2026, 02:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
- Size 13.5MB
- Sample260727-c8rnbsvbra
- SHA256 339eea6b16d78f872f67a0c576a535657f9b480fc1cb237fe4fc03db607b4d57
- MD5 986c3b2fa70d801c9b5c65689012f7b6
- SHA1 6dddcc4aabfc521402cb5b54102a3b428ac258c8
- SHA512 4eeccdd92e47270bccfeba3e281e28c1c3f4ce55787e74e855c9b32eb45a4b5f19efad128afc0bafc2e2bbd95cc1946b78874ace4ee91d65d25970e3225170fc
- SSDEEP 196608:7oh4Fgwg1ko1mJXo/m/XB2u/jemMhNpazkwaeKNzp0y:7ftg1CJXoe/XD/j0pcKFp7
- TLSH T165E6AD6AB2B800E9D4BBD178C6565607E771B41603709BDF17A08ABA1F63BE01F7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 5 IoCs
resource yara_rule behavioral1/memory/3124-21-0x0000000140000000-0x0000000140FFB000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/files/0x0007000000024553-345.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/3124-376-0x0000000140000000-0x0000000140FFB000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/files/0x00070000000246fd-387.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral1/memory/3124-526-0x0000000140000000-0x0000000140FFB000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Executes dropped EXE 23 IoCs
pid Process 4384 alg.exe 3392 DiagnosticsHub.StandardCollector.Service.exe 2024 fxssvc.exe 5108 elevation_service.exe 2092 elevation_service.exe 4188 maintenanceservice.exe 3272 msdtc.exe 1328 OSE.EXE 4588 PerceptionSimulationService.exe 4068 perfhost.exe 1952 locator.exe 1524 SensorDataService.exe 3952 snmptrap.exe 2552 spectrum.exe 3016 ssh-agent.exe 3832 TieringEngineService.exe 2188 AgentService.exe 4488 vds.exe 956 vssvc.exe 3096 wbengine.exe 2780 WmiApSrv.exe 2456 SearchIndexer.exe 2784 RobloxPlayerBeta.exe - Loads dropped DLL 1 IoCs
pid Process 2784 RobloxPlayerBeta.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Drops file in System32 directory 31 IoCs
description ioc Process File opened for modification C:\Windows\system32\fxssvc.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SgrmBroker.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\79a11d0f905883c7.bin DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\fxssvc.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe File opened for modification C:\Windows\system32\SgrmBroker.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe DiagnosticsHub.StandardCollector.Service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\spectrum.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2784 RobloxPlayerBeta.exe 2784 RobloxPlayerBeta.exe 2784 RobloxPlayerBeta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\sounds\action_get_up.mp3 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\Fondamento-Italic.ttf 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Lobby\Buttons\scroll_left.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\MenuBar\icon_maximize.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PlayerList\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\icons\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe DiagnosticsHub.StandardCollector.Service.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\DevConsole\Maximize.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\StudioSharedUI\menu.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\localizationUIScrapingOn.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\MenuBar\icon_home.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\ImageSet\AE\img_set_1x_2.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\translateIconDark.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\DevConsole\Filter-stroke.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\icon_friendrequestsent_16.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\PlatformContent\pc\textures\water\normal_16.dds 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Settings\Radial\BottomRight.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\ic-pinpressed.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\models\CrossExpVoiceDataModelPatch\CrossExpVoiceDataModelPatch.rbxm 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\sounds\action_falling.ogg 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\ButtonRB.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\PlatformContent\pc\textures\water\normal_25.dds 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_4.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\MouseLockedCursor.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Emotes\TenFoot\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Input\Ring_padded.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\InspectMenu\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Vehicle\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\Error.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\SelfView\SelfView_icon_faceToggle_on.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DesignSystem\Thumbstick2Horizontal.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Input\AimStrafeButtonPressed.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Settings\MenuBarIcons\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VR\chat.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\AvatarToolsShared\RoundedBackgroundLeft.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PlayerList\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PurchasePrompt\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\TopBar\chatOn.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\MicDark\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\AvatarExperience\PPEWidgetBackgroundDarkTheme.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\dropdown\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\StudioSharedUI\places.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\common\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DefaultController\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\DefaultController\ButtonSelect.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\PlayStationController\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\InGameMenu\TouchControls\touch_action_rotate_camera.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\graphic\shimmer_darkTheme.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe DiagnosticsHub.StandardCollector.Service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spectrum.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 TieringEngineService.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz TieringEngineService.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-5 = "Microsoft Transliteration Engine" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000045463415721ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.snd SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" SearchIndexer.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-151 = "Outlook Data File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1133 = "Print" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9932 = "MP4 Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000002d739d16721ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" fxssvc.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-115 = "Microsoft Excel 97-2003 Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" SearchIndexer.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004997e814721ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006f1e2215721ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@windows.storage.dll,-21824 = "Camera Roll" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{1E589E9D-8A8D-46D9-A2F9-E6D4F8161EE9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efcd7615721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" SearchIndexer.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9934 = "AVCHD Video" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-103 = "Windows PowerShell Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6003 = "Windows Command Script" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe\" %1" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-ed2b47b81f08484a" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe\" %1" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-14d8b191232f4ddd" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-ed2b47b81f08484a" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Suspicious behavior: EnumeratesProcesses 45 IoCs
pid Process 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 2784 RobloxPlayerBeta.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3392 DiagnosticsHub.StandardCollector.Service.exe 3392 DiagnosticsHub.StandardCollector.Service.exe 3392 DiagnosticsHub.StandardCollector.Service.exe 3392 DiagnosticsHub.StandardCollector.Service.exe 3392 DiagnosticsHub.StandardCollector.Service.exe 3392 DiagnosticsHub.StandardCollector.Service.exe 3392 DiagnosticsHub.StandardCollector.Service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 660 Process not Found 660 Process not Found - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeAuditPrivilege 2024 fxssvc.exe Token: SeRestorePrivilege 3832 TieringEngineService.exe Token: SeManageVolumePrivilege 3832 TieringEngineService.exe Token: SeAssignPrimaryTokenPrivilege 2188 AgentService.exe Token: SeBackupPrivilege 956 vssvc.exe Token: SeRestorePrivilege 956 vssvc.exe Token: SeAuditPrivilege 956 vssvc.exe Token: SeBackupPrivilege 3096 wbengine.exe Token: SeRestorePrivilege 3096 wbengine.exe Token: SeSecurityPrivilege 3096 wbengine.exe Token: 33 2456 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 2456 SearchIndexer.exe Token: SeDebugPrivilege 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 3392 DiagnosticsHub.StandardCollector.Service.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3124 wrote to memory of 2784 3124 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 113 PID 2456 wrote to memory of 3732 2456 SearchIndexer.exe 118 PID 2456 wrote to memory of 2692 2456 SearchIndexer.exe 119 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 31242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2784
-
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
PID:4384
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵PID:1252
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2024
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5108
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:2092
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:4188
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:3272
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:1328
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:4588
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4068
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
PID:1952
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:1524
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
PID:3952
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:2552
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:3016
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵PID:3668
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3832
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
PID:4488
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:956
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3096
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
PID:2780
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2456 -
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3732
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 7842⤵
- Modifies data under HKEY_USERS
PID:2692
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 9f492928373933280f630bf6f2bc956a13f80a93a6ba6756b1f6acdbfaafe5a9
- MD5 b24428e5921cf1156b17ab228f8ec030
- SHA1 15ddcfdd365d580b56a0c59641f29cb42c625c8b
- SHA512 c3c45a416f67570d6c3686096183ff9b3131d0601f2bda5f65d41ea53e0ad585ddf1a1f8b8024355523dd7449f66a54a24fda36f91e02a5e4b322df89fafac5b
- SSDEEP 49152:Lb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnAuYtO2E8ywqev:Z3q6mjBJuFJ8yHe
- TLSH T1A6D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 b672aa6fae0e301f17ce9b7e3ede11d963e97c0ed2e45219469e34d98881eb3a
- MD5 936ebd81d0c37e193302b52e6c189d9d
- SHA1 d0241e84b75f5d5698cb911ac189489cfb2c5599
- SHA512 7ee0c96c1ca48694af2785b57939f26a1f9b6325b01d6582c6960a70d9ee451e907e192c506fc5c1b0d471d9f6c9dbd342a4f379e8430e67e7af55e07a87621a
- SSDEEP 24576:xXYfDtczAqm2kxUlYtEjedEeQ16ywqmpv:UtcauYtO2E8ywqev
- TLSH T15205012977E508F9ED67823CC8A2C512E633789547A4E7CB03E499690F332D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 8251936824206d75b8fd4e9afc2bf5b1f3cfe71aca8dbcd426bfbc439e3505bf
- MD5 73d99877435ef94e95dd18c82d901d74
- SHA1 8c300359ee69d1da0e1e07d6e45ebcd13d33b3dc
- SHA512 9995dc32478e0585a681fd7799240356a4022bcd64a7573ee1303ee6c4ca78bee6c4d424d511074d10c494e28f3d6651011a75e56b5948fd897603ed0216ca74
- SSDEEP 24576:n0Le5ji0hmxhrMdm2kxUlYtEjedEeQ16ywqmpv:nPji0AzbuYtO2E8ywqev
- TLSH T15035AE16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7E676E6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 cb705d4724ae85c28c3943656aeed0ca0031f0848bf96522a701f1b09383fe4d
- MD5 eeab1caec096e4264503155645ae30be
- SHA1 076d0a6e7ec72d24f5b114148219ba2c50e1fb4a
- SHA512 32ddd869519f6ee023b0fde5bdb33a2f452480a28b5128dd1543b08b3e4851a1d888b5a034c612e2a859e515705b70b09cb8be0451668a5f712249288004935c
- SSDEEP 24576:Oa7/ezSC6vUyD/aqgrvWj6q8wyu3m2kxUlYtEjedEeQ16ywqmpv:J/ezSC6vUzPv+HjyvuYtO2E8ywqev
- TLSH T19F755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 1d657c5bde364e653848026f6b4481a242d486fe0cf6a9220f2696bb979ac2ca
- MD5 c5614c805b879350f47083ee25f9db9d
- SHA1 23209efb16edf80e3cc93f57e0ff7aad70c67c96
- SHA512 270da723c3dcb8bb0d661cb0037dfeff9080e86cd1cbafdcb8f8a09b7e218f01ea35125ab36e11411283166ec3dfa7422a46990e15f304ae8e24a8489a74cac5
- SSDEEP 24576:oVbqPb88hv/l+B2m2kxUlYtEjedEeQ16ywqmpv:oVO88hXl+7uYtO2E8ywqev
- TLSH T1B3559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 b296cdbac0eb9fc060da94b94ab08b630d9b7b752980ead1f322084fb56e7cc3
- MD5 058d356f76069cf117863495039b4b2d
- SHA1 53ab2622563a5a78929719734cde04f77a925020
- SHA512 1f6da6820318b51ac0727a96ffef843e3ddb031b41ce2fbfcc3652442a961b70168d0e2255a5e9570a9d5173b4009879c961611433c5e629eb1fee5dc47636d8
- SSDEEP 12288:2G3pAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:2G5m2kxUlYtEjedEeQ16ywqmpv
- TLSH T10AC423C3A6253189F7655E3424FAE96312564CFA34DCD5CBCAD2B75E80BC023D2EA182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 b7e3d6ad52a0b721982a83f2a7f31f8ac905133bd15bfaa0795c9a847c73cbb3
- MD5 4106fadedb84257507c123571898e0f2
- SHA1 d91b79d787509bcf0c415249113089ef80cb5c4a
- SHA512 887e6fdc6f4d8af0511d48a3f7af0981db67d37ed68bf8ec8401214377583374be9700e4cc56551204a33e4618596dc519a903e65c6351834f8b59c920fe996c
- SSDEEP 12288:zeBNUbTVO86UmpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:zJIU+m2kxUlYtEjedEeQ16ywqmpv
- TLSH T1FE05CF7BEE28FCD2C27A8D785A91C600977278704B61A3CBD165C30EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 859c6757fc947b53eae4fa32b1191da1b43bb7304094b8837c4ecd8dadd680a1
- MD5 1f38af2835f1c4902569a713e6ff108e
- SHA1 fdc18564a31167b7ec9f8a7bdb0b4e640d342f7e
- SHA512 ee0edd208c5b9bffe98481df481ebda32a0ce2c5366c555f38a09228edf0be2cb864d3d3541699731967e34f7cfc701723bc38c6deca4da1054475cdac659bbd
- SSDEEP 49152:4QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THj:4QvGAdlCEL8c/WRNw5C6uFJ8yHe
- TLSH T1AE267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 af08a625544e494a79808796fcded524d8dc180b687459b0a1db757c24a3a705
- MD5 78c913951fd6b5b06a32ae6d45d2a0a2
- SHA1 c543676d46fa23075e6d89b94f55f040ece9ad01
- SHA512 e066b57c5ad97c0b476bd8b5195b61d68dd1158e72d0a0d0973f4143fd9604de6f226292911d7ae45aeb56a09972a8b35691d993bb9bdefbbe7c1acecf7bd7e7
- SSDEEP 12288:oAwSfxL/2Dc3mDLLmt0LDQewsAjApAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1E:NfewsAjIm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1E315E031FE74E036D3BB0DB21B36C716142D79604BA11AC3E3E89E9E59342D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 615c2cd2faa4d6018791ecdcfc185021d0fe5d6f73f5d2161ae1bb6297153b5a
- MD5 654863292683058f1cc6fce73ae51512
- SHA1 05a4ff0fab33d257f39dfcadcd5eeb1b13586401
- SHA512 9b53a0ab640d0b5a78bd8b9f9900d3f83bfb3b9c51dc1d5a5d93559f06d828dddbb35b27d04ceb214bdd89ece177529d91bc8ed3352f075a25ff41cae4801d87
- SSDEEP 196608:PUEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHS0y:PUEtQevvqc2W1cpV20I32S7
- TLSH T141474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 cfe10761194d751905cde08fd9f8174d0d6381726cb8491ad7a209b33e4e7563
- MD5 52e52908c2ff1d00fb549f2437b5b179
- SHA1 1575a49cee9bcfddb4acb08e6ab6bf14035b4ca4
- SHA512 1dcf1ff7605add0c94974558eb5f5e272fd1de5110b07e6c2394b6b9fdeb5b52fcb12e470e65acdf8c4528699373ebbb8ea8ee950a2997315d7cb2a43983c56f
- SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zruYtO2E8ywqev:7oqtVjnmuuFJ8yHe
- TLSH T15ED58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 a943e5121ef435497b3edacbf9254a04b34ba87c37dc228054a84a17710c3653
- MD5 489ea7b32019671b5163d9f3d9a232d9
- SHA1 85567d802387e04d622a587dcb24c52fef1d0a38
- SHA512 361d700bdaccd40a147f7e8223a7ddd43043c16a285ea4ceedca170760889c8d15602bb71fe56b66c8bb8ba82fae7918803977723b3495ca159795ffaae68e75
- SSDEEP 24576:lAhGL6IFoiwtA5l7S537m2kxUlYtEjedEeQ16ywqmpv:lAM5Foiq5euYtO2E8ywqev
- TLSH T19435AD81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2150D21F0E33A50DD24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 48f8fb87eae5d4641433499916a284b74822c4d9dd2a8d1635117f3ae58ba0eb
- MD5 74f4990f662f9708a39d6cfbc5772290
- SHA1 66578108b035dc8cef88877a0a186eff250c4a60
- SHA512 fd6899632fca02a6915dec26594c9b3f3c6b0bb9b4c96069bc27f90569f13d9bbb342b0dd53291f2fc9d2166ec7fa682f375832b77023aa37ae2b60f870bad6b
- SSDEEP 12288:gmw5HEjsChNEBFgl0WDm+CNpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/H:9wuROWsm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1AB05F14676A51CF9E96786388597C132F3F2BC523A24D71F07A0C65B5F37221AE2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 18445eff3ff1d31099db46b1d08564c92ead439f4cf474fe20ea723ba7d7e8c5
- MD5 083fe4d5c35058a68b7ad28f56deb78a
- SHA1 c7c3fb7531afe3ec057a1ff96cc16bf15b93ae42
- SHA512 9a36710413d99d5087c2cc212450698462629a5e902343eab06d715d103ef8f978b7826554e424b61e14d186a8750ea58d9e90c8b382f675e2203a3453e7055a
- SSDEEP 12288:KyZ1IywpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:zZuFm2kxUlYtEjedEeQ16ywqmpv
- TLSH T18BE4128633A430F9F2A3563C98F19602D37278A7337483CF46A5526E5E775D29E39322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 3855f224780a102345dd1929a84018fd74d69423a0d68794da7f4db2464d216a
- MD5 441acf408032d74d8de3eb70c0c34a4f
- SHA1 cb4eb8ffda8f3f75650eef8f8deabc3094cbdbd6
- SHA512 c8d59f10ceae3b5d7971cdfc5ee5cddd6c00fcf9cd6f70fb5f337246b2accc75ae1ed0d9a33e192e53bdbc7ee61208a7c5154c3e78ad122f74cb23d548d1a975
- SSDEEP 98304:AQRQyi36YOcPDLvw2gAf+PN3luFJ8yHe:XQyiKanX+PNQ0y
- TLSH T1E6667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 0baf434b9e15ae87fc15da5a9db2f999f65b2ea6a44649e611558181fb8d39ef
- MD5 e854c50e71b2fa4c314d918ae629c50d
- SHA1 750cd52248cb6bbc3f3836c4b69be5e60cb52275
- SHA512 3b3327e02500916633751d31f3c72daa1dc2517f9ad9c43048d19c84b511ac3dfbe781019b234b4d406fc59066e2f50fb84cbae4722fe66b0307fa277c5ce1cc
- SSDEEP 98304:oQRQyi36YOcPDLvw2gAf+PN3luFJ8yHe:/QyiKanX+PNQ0y
- TLSH T19F667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 a7c079581524b360ff31b23ad5f2deff9e29077b9e2c47611c6b0439d0862825
- MD5 fa23a71075c722cb10cb409540bc743a
- SHA1 f29e6af429c90dd5c1408ad6f3f539c5759b7fc6
- SHA512 e539eca6e94237ff858d8ea3c7cefb5e2fbdaf8f2efe37eb9fbc46b46689ac11f29cdb044326267c07f7a7d905c5fbdc4b70b45c106542f5dfe2e1df9e1cf7d8
- SSDEEP 49152:y68Qg55nhkeWu7PNU3/buYtO2E8ywqev:wthTRc/buFJ8yHe
- TLSH T1D1B55A33B2F20099D44DE1769F4A873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 7be2a1535de17825c474246c485bf60a03811ed38efb4fc31c3639ee03c2ab98
- MD5 93934da645cec550c8b8dac486c42b79
- SHA1 c291a9e445151d97d873169a805fed1ba7f1674e
- SHA512 be6cd99f8dfe72d3b332a4e7bb997205901eb15215e74e4f29e7517fdcd53bf8bf29181058b1d1d1f8a7fe90a1771a0d4b845a25706b041297429eda72817010
- SSDEEP 98304:vy5112gYy5azzVvU69nLKnhZEuFJ8yHe:iLIHRWhj0y
- TLSH T19A167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 4e67384d4a706b9fc250aa6d87c5469085f1005c5e3dc92458885331b099fc9b
- MD5 71869276c0bd8335752ab0e7f2041934
- SHA1 e2c796620e86c64d6668c16e2319d42f0bf16144
- SHA512 29959c564da531c6e50573524fe00d296fcf9cba3ea65941ff8f1dcc15f521d98afae282700612824459c9055b58a17b6bac546fd0f4eb36c2aa06286098988f
- SSDEEP 49152:1B+taZ3usBWOBr4tEGa0bqx0z+n217aau1glNuYtO2E8ywqev:7u6JmIxd2dNuFJ8yHe
- TLSH T19CD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 2b60f8808427f93e5cca795b04ff6110d7c610ad1b6e90ee37f8995e04789a5f
- MD5 6858fcf5c886df743600be22100c94d0
- SHA1 39e5f42aad4023eea82eb86fecd09e5beba0408a
- SHA512 d9d4890bb75b16af49486f136ed37d42880b66f9aca9c84d0f9c77c5e6f1199dc930e19dfae458bafa9e8f230bf03a5becfd9ed9e631540185c701febfb6f15c
- SSDEEP 49152:11hpsNoJpF1A67U44CwH7R4xBuYtO2E8ywqev:1mifPqRuuFJ8yHe
- TLSH T1A9B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 37d3e1f111ab76a5cd40347599f3e6333709b04f78357e334db45d826a02149d
- MD5 3111bcd8f3e9b3563e8af7115eba071b
- SHA1 c746a71fe623fe59b1a30aa8fa22ee8269c7b636
- SHA512 ce6306e9dd4eaeeff562f0339d4beda4d01e32d47dc2258e3ccd1af28b8a62a36e31db3214cde4801908c1515aff08dcc2b218bd54ef4b736bf7ba6765c75e37
- SSDEEP 49152:1SuZQIY0Be2KkRVtOnks6NMHqwuYtO2E8ywqev:b5dKqi61wuFJ8yHe
- TLSH T13FC5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 743a684309131f353c1b754ebb656d4d68ccdc55e94a91a47aa6d2be4c1c8300
- MD5 8b63e44fa73d29cd5049c33d7335e44c
- SHA1 eafc5e5c90fa5a13e08c33f978818f7edb04c37f
- SHA512 5dda35379f818b8c87969f00031ea2e798b55a01ab134ce73f51e121366998867a9df8514ea467f63c72674bb2119cc93e51582c15291e0c10247286cbe7eccb
- SSDEEP 49152:UhtSn8EApI0figjgiDn0AP5w9uYtO2E8ywqev:1X2iWphyuFJ8yHe
- TLSH T14D95BF13F2D901E8D05ED178C7568632EA62BC160B34B6EF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 ba2cc078630e49352e1df5475bd357a455f10965ef929cbf45e4352ed0c7fea1
- MD5 f9ac9f1e40b8b84a2132ff1b03e09f62
- SHA1 956ab9d2156aba5856e9ddb8e820615fe88ef4c4
- SHA512 f635faa3df41043648cfcb788a6de35715e50b1a38e03220577d3e72531ec65fa6679ce1e320c49b696eeab6685bd4cfa3b91fd274d1caeeff11ed6d12b22929
- SSDEEP 12288:ZPpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Zhm2kxUlYtEjedEeQ16ywqmpv
- TLSH T102C423C2A827358DF7119A3460F6E663125A1DFF75D8C1DBDBCAB21E80BD013D2DA085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 2ea5230677246f2d32f1ddcb4b2f95c31497531cf36a7421d04caf142072a8a4
- MD5 36e69c74d2fabc49cc4a906a67537a05
- SHA1 d6f106a6f736f31b1594a785617e7a5eb626986b
- SHA512 38c88464f58a804718f907827f7cdbaa53977aca1f828d1225c72d8c51b7ef25f0d7256dceac8b33d653e79c66fe73247ec0968db501f31bbf3d190875b2dc5c
- SSDEEP 12288:NkpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Nkm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1D1C423C2A8273589F7149A3460F6E663125A1DFF75D8C1DBDBCAB21E80BD027D2DA085
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 a81df02196d06b9e518c0b57dd4a44645d760b69af0712def5c648f91fa51f81
- MD5 1a861bfdcf4f655aa0f463bed60845f2
- SHA1 bc1e5cf36f706bf3aa08fbf002589fe5196431df
- SHA512 09729fe6425a9b3eaa675c97215cdcbbaf3780a58da30fdb7034876099b5e584de21c2af176c349309f4e36d81104e5301b333d7b3f86756bbdb97b89a4e74dd
- SSDEEP 12288:u+pAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:uGm2kxUlYtEjedEeQ16ywqmpv
- TLSH T167C423C2A8273589F6149A3460F6E663125A1CFF75D8D1DBDBCBB11E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 c6593be1c4d21eab69d9bbd2275c73e715fb699a8b0d61c7761407190e048ba7
- MD5 2016231425edcd8c2e1d201ce7f6fa2e
- SHA1 83cc09bd2bd8750c3482b4b86cad7aa29a232c0c
- SHA512 0723f85b0305edc8b303284abf1b7d2b140cd33994cf862776dcc060d6df3c6e7860738e4d6cc0d9a4a3dc1d51472b92f18be5e146b5f54c8c74c63d5f35fadb
- SSDEEP 12288:yVJpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:sm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1A4D42382762A31C9F521D63484F2D52393B67CFA77B4D2DFCB82660E0C79252D6B9281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 7131d47771d688e6df47e3970f4f85360fcc95a802dcdbf2c474900ca4eef38f
- MD5 afab0467d1ae65aa747eadc6f022737b
- SHA1 351aff059eaff9a2c234fbeb517ffc2b3c67668b
- SHA512 5a073995d52bc5125a17c229448540d001e1b09790752b416b65dfab7154043578e51aa980036107abf502e59fab710ef60f3681e6ef28f32b9c5e4fb3736c11
- SSDEEP 12288:ZxpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Zzm2kxUlYtEjedEeQ16ywqmpv
- TLSH T160C423C2A8273589F6149A3460F6D662125A0DFF75D8D1DBDBCBB21E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 adc548d6dda9112ae2fb7924a8e859c5efeddfbafcac991c2e1d37f2839227ff
- MD5 3b7e4c9618656ba6e653f2c7953ac99e
- SHA1 0f57a1c346936eedc15f31e21186423ccbef1ec2
- SHA512 9875ad2212d324c52338aa6c17c88f2d554927c54536e56df07c4458192807fcf5f797f742b0889902d2b656db0c75fb08a122b7e97713cde633d26d8d1ce308
- SSDEEP 12288:m4pAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:mQm2kxUlYtEjedEeQ16ywqmpv
- TLSH T15CC423C2A8273589F3159A3464F6E663121A1DFF75D8C1DBDBCAB21E80BC027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 285ff63d1f124c90bac0f1633b7f88e29600f4eb3487cde69fa65670bdc71903
- MD5 a799704a4448a132a3bd4d9666cc4f02
- SHA1 34cb9d644e4468eb17fab2fcd278ec41ba7fbece
- SHA512 be2ae0bf4de6893b2cdde8c4ccd37e1dbbf46b2dfc0e352e8046ab2e0ac8a50e5d621845338817cc6f0d9b5a85c7569a31f2f327260ce6f9c72bc2701a62137b
- SSDEEP 12288:vMpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:v8m2kxUlYtEjedEeQ16ywqmpv
- TLSH T17CC423C2A8273589F7159A3460F6E662025A1DFF75D8C1DBDBCBB21E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
- Size 9.7MB
- SHA256 0bf6d10b71b025e36af8802335cfcf5a693cb351731e6d3f56c9a9616ab2c4c9
- MD5 6a2df518995fce2ec395becd750fbb69
- SHA1 8f40283d158a0db74743755bc6e356f3de4f0e21
- SHA512 ff1c2fe1cb904a2cb0846b3e314e4f2c02aa2945b389bd94f1ac7bb7d66058d222970c7334a577430c1f2498908f50d077560c0b032bfc12958179dc3c4b8e88
- SSDEEP 196608:Lqrajgrui7KiWARoWQb5amsxUMRUFUnvTBDbBQ03O:Lm77KWiamsxbU2nvTBiQO
- TLSH T1D8A6BF22BA00C032E8D100B296BD5FFA997D5A341B3954D7A7D41DBD5A306D33B3AB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.dll
- Size 20.9MB
- SHA256 a5e1cf709a64dd3922e3d81562524bccebb9762e1c693e97f09f65ba88be6f52
- MD5 be3ef08989567375607175b90e935dd9
- SHA1 a9672e47fb68dbeafd8fdb1eb2f684616e412b8c
- SHA512 c3838706c2493c4ebc70d8b7ca89104f1cadb146f1369fa818877461f1fb4f3e15f2adf874371aa64ee1acd06e90334f1292e3c2cd71bb3e2860cd67f777ccbb
- SSDEEP 196608:uCF8Xlf9MbJSbb8p+jq5OhtPz0aXmgwCDpsyN:R+XbKJSbb8sz0aXjDpsk
- TLSH T19D27C04EF4D21AE8C0A25078E65F57E3DA32304C4A687EF787D90250363268D6659FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.5MB
- SHA256 361eecd860d7a760ac4d99b53d6de1b939bce9844eb9c23e48c0b02c4810b065
- MD5 4f4528b041e048e91f71e47010be0c0c
- SHA1 62e0e3cc5df0397ee1fdace76a41b1114a6b7e7b
- SHA512 68b392dc9b12c1108db192a3602ae0f3b360130ad7f4929b321f8563d265957f53cd5139fa66823c5241bafb5650616fddd3332c24ea0a04182fb07505946be2
- SSDEEP 24576:TcP4mcvIjkGOxhKP2l71nNKbrh/8KBtm2kxUlYtEjedEeQ16ywqmpv:oP4m4IpOO67W8K6uYtO2E8ywqev
- TLSH T12C65AE2DABDC0096D0BA913485658A4AFAB1742A2F3286CF1160933D7F77EE54F35F12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 99d481e528453627360a878d7edc5a11933aa9b8a845a3ab8a91000479877a02
- MD5 2569d4160fc2fc8a8aab269634308b49
- SHA1 ac53bbad6129d919b3814b87346dbdc5d448c797
- SHA512 6baca47c2fe0f535f7050bbf30b6cc3b0f1926f8fd7fe80086f2b12fd06b6f743429424c2c93ef26fd00b87549215bae1f4279feb651b71b64fd24dfcaf89355
- SSDEEP 12288:UpsfrpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:FFm2kxUlYtEjedEeQ16ywqmpv
- TLSH T145E4014AD25812D8D16E6239C7969A41B3333C6693E0D3CB57C0F53E0F7A2919EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
- Size 1KB
- SHA256 3ae6ba7e313779039e649fa823d603794802891310ee39e453b105e9881b3422
- MD5 c8d950ff6ae4faeeb4517cf14cc0ac85
- SHA1 ca294b8ca45d031298b94e4a109890ae4e635756
- SHA512 0562b5d34e005acbc625fab4b756439eff43f149a633df46ed5e8ce0af63613c3bda76d8a61e320324ba9f41542b4f498a4a0965c751f948d5bc613fa3869a08
- TLSH T142219E554F9A173AF5B28630A9A51291D732FD01BA5D2E3D80C527880DE110562A9F3A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Studio.lnk
- Size 1KB
- SHA256 a8e7bf8c608e4c4dd95b2e8ff0231a0c627a3ded43afba3b64e6987ec3dc5533
- MD5 b059f4dd13e84cd3d6449466880786ef
- SHA1 4c7adc9214379ba51e682e7342b6dbbddda1931c
- SHA512 a98c3830193a96936cf8341e503c310db44f5290f61c18ef812640cbc8afd47c8a3af5725ac6046e5592c73e53bfcc36aa89b2bb7d4c10f5b4043ffbdc7e94cd
- TLSH T11F217F584FA6173DF2F28734B9A157A1D733FD02FA5D6E2A40C217891DA010061A4F3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Roblox\Downloads\roblox-player\fe9e560aabed765dac1566ec69ebfeac
- Size 9.7MB
- SHA256 d3e95d7ad01a4f2180e5efffb8f873e891a498fea9b85950f886e2d25fc486ab
- MD5 fe9e560aabed765dac1566ec69ebfeac
- SHA1 7dfe4f6313725c1846510c14c43c640166f946d9
- SHA512 b0ff5017c71b924c131b0831bd441132dd42d98532eb9fdd44e863afc487d4bb0e8d40159d3bf7c3b956bd118c6098da0158b425d2e285ecdd2d228db7b182c7
- SSDEEP 196608:Qq8/3w6fRQSKSLetCd2DmsxADnsf06FVmK+3pAZBrqSX:Q9FfRQSKxDmsxA6FIK+3pAD9X
- TLSH T1D3A6AE22B900C032E8D101B2D6BD5FBA9D7D99340B3954D3A7D46DB95A305E33B39B2B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Roblox Player.lnk
- Size 1KB
- SHA256 96dfbcd91fb144c4e691d42622b325ad9c9f9c55a8cb3f66e8407dbfdb09fb9d
- MD5 8a307d6d8c478737c5ae2d9c60668a2a
- SHA1 d2b43f4fca557b00c902de8499dfd666538e0226
- SHA512 916d9969a8a38ef37c51446fc4452d400d8e5aa0a06bff3ecefd50d0fa249a83f35ffc2b0a432956dff26ce287c5330929348d05dc3e5a62e283e72aa97b5d08
- TLSH T1C0219B554FAA172AF4F2C630A9B51291E732FD01BA5D2E2D80C52748099210162A9F3A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Roblox Studio.lnk
- Size 1KB
- SHA256 27264e593b55d4623a21cee0a2e2c1480615a2b9d7e7e2104cf25634a9a6836b
- MD5 9dda027d66fed6b15933ba5fe906de31
- SHA1 655b0c7fb018838737c54e1ff9fa4ec6583e4de0
- SHA512 d21c4a5b248cd3e9f3beb48a86c019fb93299892ccb565fb0a1f4f5d245fe46ea247ec90a08d3fa7fe175a4e8c22dd6f4e4db04377ca9e04c48faa40e772b86b
- TLSH T1EF219E544FA6173DF1F28734B9A25792DB72FD02FA1D6D3A80C227891DA0100A1A5F3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 cde74f3383614e3c22b323a44c8f6f2c23fd826d90d2b72bc34ee4d210b70c24
- MD5 6c1e58cdfd15adf69a672d69da2e9b2e
- SHA1 db71615bf6dc72f068f95bf008b09d315ea9cf29
- SHA512 e84cae8198ceebaf6888034db94626f0c727a60e1dbf1e07af350fa877ec537bc64e0c526370ee79f98ff54289e3accb74b3520163aeba114d8f49107cdda601
- SSDEEP 12288:eLpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:elm2kxUlYtEjedEeQ16ywqmpv
- TLSH T167D42383A66A3549F6759E3020F6D532121F3DFA3BD8C0CBE686B25E407C063DAF9146
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.7MB
- SHA256 1ae858cd31e83f447a10931fefb1b738f6eb0d5f24b328b4135a0e3b20ed6836
- MD5 d684380b49dda3d2608d48345e55a7e3
- SHA1 3aadf3e395f2889770a6c84e16fc6ae30eacd1b1
- SHA512 0973490f7e117cd320808a0614a956eff755922cfe3329ec56a50da617e3a19b0a0134a14527ccfa566c0681d4c63ba4f2cd93a728c7d296ebcc6e052d61da48
- SSDEEP 49152:Ya0h2GEkuAe73q3pp46zwwQmuYtO2E8ywqev:Ya0hNYG4JwjuFJ8yHe
- TLSH T19C85AF1E67EC82B5D0BAD278C9A6814BE6B2B4260B3156CF1151853D3F37DE44E3EB12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
- Size 659KB
- SHA256 97bf974799396c2c5651d5aadd00700f66b1cfb42e0d8f448d5a946b7bcbfd20
- MD5 181f7a9a99508cafd5bdfc2a6972728a
- SHA1 cd6381646604557209c886e2ef042ccabab1fae9
- SHA512 d41440d09af8159e08f92f50bb790a8bcdafa4a6a55cd2d7594194e6854965dd9ab2a1d929e5d7dce00551cadfcf8dc304b6fa19a2ee31f5cb03fe5077f88092
- SSDEEP 12288:/hbHjfX0pAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:/hbHjP0m2kxUlYtEjedEeQ16ywqmpv
- TLSH T161E412AE26AD20D9F171E23C94968506C331B8762710D3EF53C2827E4F3B9E59D79B81
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\FXSSVC.exe
- Size 1.2MB
- SHA256 88570aa892cceb16fb256c9d72bdf23d9bf92b83d088e89529a362ad0da7cb8a
- MD5 0f79a47fc854ffd42aa7d44c2e33da10
- SHA1 8580034d37f4055322c6f2c224ed25f92b9cbe9e
- SHA512 455484ece1b66e92b75ab912dc4c9b40c853dcac8309aed9ed9e73abb54a197a547f6f4e51a1d481ce3060530e5751d1509f88c674776376336697868cc505f9
- SSDEEP 24576:K3YgnJcRTk4yti+R5dBR/sm2kxUlYtEjedEeQ16ywqmpv:KIgnaTk46pBR/PuYtO2E8ywqev
- TLSH T14E45BF2EF2B910B9D8A6D136450147B5FB71782D1F209ACB0170C538AF1AEE89F39F59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Locator.exe
- Size 578KB
- SHA256 51b1821d069e9ec4bcf031aac2ab7a2fc92f897927eddae72467d2d851a1bb67
- MD5 ed3e6e2f8adcd86eaa304b49f57c47e5
- SHA1 80a93a41901f9bdf38083fe686c17291e560d475
- SHA512 f4774e68057d656c1e6f0d1f65b8055b6900398bc3a7fd29874bfa6ec74b82727f6305a3341260886824139aea20e841ea894db5e10c6e96bc6258629a9932e8
- SSDEEP 12288:eXpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:eZm2kxUlYtEjedEeQ16ywqmpv
- TLSH T175C423C2A516358DF6259E3424F6D62312151DFA37D8C2CBDAC6B21E80BD0E7D6FA181
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 940KB
- SHA256 238d03663ee4d21722c457b1ab17ae2c1365456abe79cde3eec5c038bf8d1c3e
- MD5 03e92e20bd9e8fd8e99ce4477d1d745f
- SHA1 3c10cbadb0c4ae26010c0cf63c0288af9f7f4fd3
- SHA512 bd1f28f340eff35ead742f8e570afc994f58384bdbe7cb75103dfa466e9c8a0b2a88b0cc09e1a94483a5a3d4af0f6e18ad8ffbcff65bd53d35afe2de4819bbd3
- SSDEEP 12288:vObIA4LWOsvAYFT6pAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jr9:wAL3UTqm2kxUlYtEjedEeQ16ywqmpv
- TLSH T12325F145F79510F9E967D13CC8B68A12D27278AD1364E7DF03A84B691E233E28E3E711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 671KB
- SHA256 10f7dc91f86b500e65d0ce674c0fc5936bfca12c9bb9b84aff8dba903ccdbf06
- MD5 f371c91ddab7e8e38672c4846715b1df
- SHA1 868b4c13b5f3b26a4e0f32c3bf621fa206212299
- SHA512 3c39f1ae1cf2ed648e35c53f16a43de2e5997464d0400f01b8dc74d3c2a4df4944e6325eb5932af4e3ec065b805862a0a5050054ead29b3ff4a1a0670dda71c0
- SSDEEP 12288:fpFtvOGpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:5Oem2kxUlYtEjedEeQ16ywqmpv
- TLSH T15DE4125A36ED20E8F135A13C8993830AD372B8B6176193DF42D0817E4F77AF89C7A651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 343f75a40c69ee3e9bdb76be5f1adc90ff2ddf1b7a8b0c6d7ed476bf08def464
- MD5 efdf53c238f5e31bc81a2bdc0cb471c5
- SHA1 65e8703f06d392718056aaed2ab4f21193d75f30
- SHA512 93b7fe3f852902cc99269a803f3bfd0ebb07f1141523f6e54bdc485795b8270011bbec305eaf0bb4984df6dd4e9de8ba8886f4e510de819e8a4239f7c61889eb
- SSDEEP 24576:07NM9YqZqmWMUkPjZM48Mv6bEhs1m2kxUlYtEjedEeQ16ywqmpv:07cBWMpPjN8DbEh3uYtO2E8ywqev
- TLSH T1D065AE2E6BAC81D5D577D13DC9E28206F2B2B4611B318ACF5152833E6F37AE44E36721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.8MB
- SHA256 b1ddc64527fdb5c1b6a2c8beeddbed3ac246e7e0ee6b5a3e582ee07833a31e6d
- MD5 6c46893fe32e59392e3e41ae4c96547c
- SHA1 02c2c1d0c4e3685ccbc1a12dfd0176e334259c6a
- SHA512 f4ca4b94553a7e0ce0ba9462340a58830e5731c10335e9024f8284e09e3f8156e1cd9cda9288124852b5da137677cc91227f3a891ce13512d0a5159e42fa59dd
- SSDEEP 49152:hF2YuHNETovAvNYf8kmAuYtO2E8ywqev:k6BCf8kBuFJ8yHe
- TLSH T131858E6A27ED80A4E0BBD27D45B7D246FAB2B8511B3056CF0255862E1F33AF44D3D722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\Spectrum.exe
- Size 1.4MB
- SHA256 2bb57dedfcee4292866140e2369376a2bb35ca6679cf70172d649155796fc888
- MD5 310fd539873f906a867adbec20b1c6de
- SHA1 6e863692cc7af0bbb39c9819549b527d8ccbf9ef
- SHA512 0dc8cb873619487e378ae6a6a0703966ccd1845ff15d237f35b37673fa4f287e240868c7aa1fedd2091d89865e437dfc41718dc04715013b26b2277b20f879a1
- SSDEEP 24576:DAFs06+Omlf8NXEbToSm2kxUlYtEjedEeQ16ywqmpv:MFs060loXuGuYtO2E8ywqev
- TLSH T1FF65AF2F62AC00D5E07ED17D8997C91AF2B1746707255ACB0260C63E7F6BEE85E39B10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\TieringEngineService.exe
- Size 885KB
- SHA256 5f469d8b8f6d080fa421f6d793ec907c65b6f5401e88c003958b7bb822158b6c
- MD5 102da3c8a48ba7ec289d300d0617ef9b
- SHA1 32d72e1393af63c6a5307776c1c9adec92f70fa2
- SHA512 3b380a8bb0b86e00de0cf9e110bfbbeb0df49050e8b31ee13501386e8d092c2674175d7bef770ad0e23e6c937c6b386ff8a23d43c8216ee8693d80e3bf4b4e37
- SSDEEP 24576:nJnJ5D3WXTm2kxUlYtEjedEeQ16ywqmpv:nJnJ5DGXGuYtO2E8ywqev
- TLSH T19D15E12DD2A810E8E4B7C274819A5756FF72387D2F2269C718B4D5353F22EE09A79F04
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\VSSVC.exe
- Size 2.0MB
- SHA256 778dd976067bc88a2f3a45fa7dfa51c70616f289151144beca892325385d0b25
- MD5 9829ca3d2e931455a1a307cb38733d1d
- SHA1 144b78fe82e05eabe76fa962163bc8f67feacaad
- SHA512 d64e94f6808a09e086701eeeffb3ff0a84f2a535f1eb15598e8fb3f9cb5e51811c494f851c0e9d8b58b9b2d6935d39aa3469ab198d8ae5178e0efbb6fba27ced
- SSDEEP 49152:gg06DIKdwc+eQnSt65aVMuYtO2E8ywqev:BiuFJ8yHe
- TLSH T152956C06B7EA5294E8B3CAB1C962A1169B327C509B34F7DF0AC0C92E1D33BD1D935B11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\alg.exe
- Size 661KB
- SHA256 12397dfcc26ac22787e637b8132b40f9b4336392e4e886c59148d13ef33d4352
- MD5 cba2c28508f74dd92708f55840eec75e
- SHA1 3315d0435c997dc32669863230d956c18ed02ac7
- SHA512 b3b71065a136042ecb2cd7c54b428241ad00a8622881f8ee77c79a7276be42b7c6ff95f4cea0ff7965b3c5902bb4a1dd2c2980488840e1aa77d8d5356e7c447c
- SSDEEP 12288:LEP3RnNpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:QnXm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1D9E4129E27AD30D9E126913C84E1C602D372F0B52B91A3EF46D1C23E4E7B5E69E3D641
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\msdtc.exe
- Size 712KB
- SHA256 c678dabc07d1fd2dcdf9201cfe5c72de7600649d5150c62bc49e8c7eb54953e1
- MD5 531e4c7d23ae58fe4733326ff6f8667a
- SHA1 dc7bece854cc25cf9e2e9902f3349bae0aa43c87
- SHA512 402e9623f51147ada5c5754c3494d8b85c135ff81bb8b31b04ed2019bea2590427ea5ac154ac1955380542d4b15447d924da02ee7c1f1bbdf1fc4a56d86b5dc4
- SSDEEP 12288:wjkykpAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:wIykm2kxUlYtEjedEeQ16ywqmpv
- TLSH T16CF4124563983088F6B54A3898B3C2A14735BC716F24D3DF91C0F63E9E3A6E2E975742
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\snmptrap.exe
- Size 584KB
- SHA256 bf810ea84035d3b07f455ed7414883fac3030a4717c3c7dcbfaa4615c76618db
- MD5 ce5ca2c15ccf51d74331baa519e646cf
- SHA1 5671ee2bddbf9cf18bbed8b8bf69911c60c49a60
- SHA512 f6ba023a83e4dfd5a0e48cad27551d2e2f79f85cca44f95b994e860afd96dd098bbc46dffd601249c180e290fb3921022a14c04798ebe5d13acdce5cfe6fac66
- SSDEEP 12288:ey2pAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:HOm2kxUlYtEjedEeQ16ywqmpv
- TLSH T195D4238A6527318DF6119A3410F6DA62022538FA37D8E1EF95D6F23EC57D0D3D2FA181
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\vds.exe
- Size 1.3MB
- SHA256 5930ad71a55e63be32ddc9e10a9f37e14fff4b29151bc29e3646544f6dc32110
- MD5 6617620e80e2a19f639fcbdd8c2baa7a
- SHA1 28ecd149524f7bcc19e852677c1c680e1000a109
- SHA512 a635dded04a74a0f37ed6ce1e8ab85f2ac697cebcf6d730e5ca29d78321f98d28be6ab460e1216b9ae368ac000ce5f11806e68f697d22f606c6610a9b52d1d3a
- SSDEEP 24576:XQ9MxZKdcz9dw39m2kxUlYtEjedEeQ16ywqmpv:XVKZIuYtO2E8ywqev
- TLSH T13F558C2DABE9158AE177D23594A250C3A633B4311B35D6CF2448D03D4D7BEE8AE78F21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbem\WmiApSrv.exe
- Size 772KB
- SHA256 fb0de501eee41fa7cc5f6a866faba348b307c04e96c6cb142fdbfa92ef17f048
- MD5 54cbd1e4c48f1c2fae2c709490d47716
- SHA1 74c43bca8eee3728c82ebba2d9c45ec2f2e05ef8
- SHA512 4e61a6cdb732ff9357320a24b38e9e99fc2092100ab5e67b9612af88924bece20ac8cd7afbd8d044de50329a7558587c236bb2053f55568db4265e18adfbc1fd
- SSDEEP 12288:HyoKo2JRple9pApAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzD:HyocDApIm2kxUlYtEjedEeQ16ywqmpv
- TLSH T122F4E05FBB6E00A2E176813C88858745E773B0742B6293CB5691C33D8E779E9BD38B41
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\wbengine.exe
- Size 2.1MB
- SHA256 e217b042a7fff1ada4c1ad7d1b023784840edbccdb65fed305e2e95b11b53eb7
- MD5 9f6d1e456c33d1fdc8cf19ab7e612a92
- SHA1 4b823aa721e050d79c410cf0023ab854b0eb6035
- SHA512 6ae7bf485731926f4638cafe4c20e1e0c9f57f6ea8ce635540dff4c8eb71f974f7bf63422e9a2b43ae178946adbfc8ed96a002fe82871e30c9b8269e0febcebf
- SSDEEP 49152:vWcnPqQUGpuphwC0DNLDpaRFXrLuWGMK8IKLuYtO2E8ywqev:X0zuNI9uFJ8yHe
- TLSH T1E7A57B3DA2BC00A8D9AAC375C54513A6EA71742E3F2055DB01B0C57CBF2AEF19A38F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 3bb6b48fcc39c22184e9cf12a2a88eb3cf155cc996cb8144b633e28bf75d0977
- MD5 47d029e2b62a0ae26d77818b3f4bf51d
- SHA1 fc6df85308c1644d41db8a3011b634f7bd227bf3
- SHA512 0c5855e99431bde9ab9678fdcd9238fb841afa4b4891a4768c1ed35d4db1a56e62e63a09d2d1ae151e822dffbb415b36b5b6c5918eb71d1d4d2604ee40d85da8
- SSDEEP 24576:+1QT7EcpfxR+N5AWAz3ooiYzjMqbXm2kxUlYtEjedEeQ16ywqmpv:TTDxR+N5YzTBjMhuYtO2E8ywqev
- TLSH T17655B02EA7F915E9E17EC5789A23C512FA727861033193CB42A0C17E0E7B5D85E7AF10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\SgrmBroker.exe
- Size 877KB
- SHA256 484da3f93eb1cfdb85fce3724c976a99a1a422e4dcf9b5e95ee1fdd6dba54c84
- MD5 9b59571088d0f9e7d113849158018501
- SHA1 85bc9c025891bfe1c8365eaaa59c31013d62b1a3
- SHA512 3185828b1ce0dc6bac496a09c150d46cfc32d9a7ce8e62e48105b42bbe0d9378c317f4915c3dd49493adaf0505d97db3d5021372bce68cb2c34c1522baebee41
- SSDEEP 24576:zTMdOz0FFS+UmSLbm2kxUlYtEjedEeQ16ywqmpv:x0K+UmSLuuYtO2E8ywqev
- TLSH T14115F17EA36D14E4E43AC27C9653C906E67234760321A6DB06D0C17D2F6BEE47A7EB40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\msiexec.exe
- Size 635KB
- SHA256 ad0032a56990cea924b8781d412972f2a94e84cbdbd1d7e4aab05607697c5268
- MD5 d62a092d92451936898b24939492d57d
- SHA1 4c8dfe52697f19d8b49f95b4cabc6f65f83ee11a
- SHA512 bdec0d1155255634ee5706100b80b269df6e244f4f3195566cb047a535925bb574c3470c4ee1965f8c152ca3dfe9aed16864fb2de861755eb3da12aad3310319
- SSDEEP 12288:44K6pAk+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Oqm2kxUlYtEjedEeQ16ywqmpv
- TLSH T137D4224E23E830D8F532963495B682124331BCBA336492FF25D1D67E8F3A5D6D679702
- MD5 SHA1 SHA512 SSDEEP TLSH