Analysis
- max time kernel
149s - max time network
153s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
27/07/2026, 02:45
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
23 signatures
150 seconds
General
- Target 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe
- Size 13.5MB
- Sample260727-c8rnbsvbra
- SHA256 339eea6b16d78f872f67a0c576a535657f9b480fc1cb237fe4fc03db607b4d57
- MD5 986c3b2fa70d801c9b5c65689012f7b6
- SHA1 6dddcc4aabfc521402cb5b54102a3b428ac258c8
- SHA512 4eeccdd92e47270bccfeba3e281e28c1c3f4ce55787e74e855c9b32eb45a4b5f19efad128afc0bafc2e2bbd95cc1946b78874ace4ee91d65d25970e3225170fc
- SSDEEP 196608:7oh4Fgwg1ko1mJXo/m/XB2u/jemMhNpazkwaeKNzp0y:7ftg1CJXoe/XD/j0pcKFp7
- TLSH T165E6AD6AB2B800E9D4BBD178C6565607E771B41603709BDF17A08ABA1F63BE01F7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 4 IoCs
resource yara_rule behavioral2/memory/3140-12-0x0000000140000000-0x0000000140FFB000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x000d00000001c591-138.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/3140-125-0x0000000140000000-0x0000000140FFB000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/3140-411-0x0000000140000000-0x0000000140FFB000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Executes dropped EXE 13 IoCs
pid Process 4740 elevation_service.exe 1264 elevation_service.exe 5320 maintenanceservice.exe 5116 OSE.EXE 6088 PerceptionSimulationService.exe 4312 perfhost.exe 2628 ReFsDedupSvc.exe 2312 SensorDataService.exe 1200 ssh-agent.exe 1592 AgentService.exe 6036 SearchIndexer.exe 2620 RobloxPlayerBeta.exe 5552 RobloxPlayerBeta.exe - Loads dropped DLL 1 IoCs
pid Process 5552 RobloxPlayerBeta.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe - Drops file in System32 directory 58 IoCs
description ioc Process File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\bb50081783806d8d.bin elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 5552 RobloxPlayerBeta.exe 5552 RobloxPlayerBeta.exe 5552 RobloxPlayerBeta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\NotoSansBengaliUI-Regular.ttf 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\glow.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\StudioSharedUI\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\graphic\player-tile-background-dark.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\ic-back-android.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe elevation_service.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\shaders\shaders_d3d10.pack 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\common\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\option.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\PlayerList\PremiumIcon.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\icons\ic-more-builders-club.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\avatar\defaultShirt.rbxm 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\StudioSharedUI\places.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\PlayStationController\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe elevation_service.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ArrowCursor.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\particles\sparkles_color.dds 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Chat\MessageCounter.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\collapsibleArrowDown.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\PlayStationController\PS5\ButtonShare.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Input\DashedLine90.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Chat\ChatDown.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\LoadingScreen\BackgroundLight.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\PlatformContent\pc\textures\water\normal_22.dds 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\category\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\icons\ic-more-create.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\fonts\Sarpanch-Bold.ttf 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Emotes\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Emotes\Editor\Small\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\New\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\InGameMenu\TouchControls\controls_phone_portrait.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\graphic\shimmer_lightTheme.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\9-slice\tag-bubble.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Controls\XboxController\ButtonRB.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Input\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\InspectMenu\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Moments\Reactions\thumbs-up-xsmall.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaApp\ExternalSite\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\icons\ic-check.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Moments\Reactions\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Settings\LeaveGame\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\Misc\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\VoiceChat\SpeakerDark\Unmuted40.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe elevation_service.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe elevation_service.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe elevation_service.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\keytool.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\AvatarEditorImages\circle_gray4.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Slider_dn.png 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File created C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\content\textures\ui\Emotes\Editor\Large\[email protected] 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\acppage.dll,-6002 = "Windows Batch File" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-101 = "Microsoft Excel Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef3a1e0c721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-126 = "Microsoft Word Macro-Enabled Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006392860b721ddd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001f8d8d0a721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mp3 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000f9d5460c721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\SnippingTool.exe,-15052 = "Capture a portion of your screen so you can save, annotate, or share the image." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000efc1480b721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\setupapi.dll,-2000 = "Setup Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001100730a721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\authFWGP.dll,-21 = "Configure policies that provide enhanced network security for Windows computers." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs." SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007fc1100b721ddd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation" SearchProtocolHost.exe - Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-ed2b47b81f08484a" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-ed2b47b81f08484a" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe\" %1" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe\" %1" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-ed2b47b81f08484a\\RobloxPlayerBeta.exe" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-14d8b191232f4ddd" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe - Suspicious behavior: EnumeratesProcesses 38 IoCs
pid Process 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 5552 RobloxPlayerBeta.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 4740 elevation_service.exe 4740 elevation_service.exe 4740 elevation_service.exe 4740 elevation_service.exe 4740 elevation_service.exe 4740 elevation_service.exe 4740 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 808 Process not Found 808 Process not Found - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeAssignPrimaryTokenPrivilege 1592 AgentService.exe Token: 33 6036 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 6036 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 6036 SearchIndexer.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeBackupPrivilege 2628 ReFsDedupSvc.exe Token: SeRestorePrivilege 2628 ReFsDedupSvc.exe Token: SeDebugPrivilege 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe Token: SeDebugPrivilege 4740 elevation_service.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 6036 wrote to memory of 3272 6036 SearchIndexer.exe 101 PID 3140 wrote to memory of 5552 3140 2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe 105 PID 6036 wrote to memory of 1860 6036 SearchIndexer.exe 109 PID 6036 wrote to memory of 4624 6036 SearchIndexer.exe 110 PID 6036 wrote to memory of 6060 6036 SearchIndexer.exe 111 PID 6036 wrote to memory of 5416 6036 SearchIndexer.exe 116 PID 6036 wrote to memory of 2496 6036 SearchIndexer.exe 117 PID 6036 wrote to memory of 1356 6036 SearchIndexer.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_986c3b2fa70d801c9b5c65689012f7b6_cobalt-strike_coinminer_glassworm_icedid_njrat_satacom_stealc_vidar.exe"1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 31402⤵
- Executes dropped EXE
PID:2620
-
-
C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 31402⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:5552
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:1264
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:5320
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:5116
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:6088
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4312
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:2312
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:1200
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6036 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:3272
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1860
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2956 2904 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:4624
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2916 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:6060
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5416
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2956 2904 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:2496
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2916 2924 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵PID:1356
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 8665385295b16769ed14dd3048ef5d2473046225f9e92660493906b6aa81cfb4
- MD5 9a85937976bc7401636da13e7f8aaaf3
- SHA1 3911667ce98bb641304535537b60493966e329d0
- SHA512 4351dc0d9485d17fa0ea0764d555867e4234835838a148bbc7503e42ab50bb75c43276c2ba35227850ff764e562d6838b103ba083e971a2a29723dce6aaabcda
- SSDEEP 49152:jb+632BuPkFKRrdE6ohdstBhuXjfS4LWxnHuYtO2E8ywqev:B3q6mjB2uFJ8yHe
- TLSH T105D59D03F29900E9E069D178D7469133EAA2BC890B34B6DF0790B7552E7BEE49B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 bb38af6fb7ac8ced8718e019f2fe88e3910b7097d57484ce60626e6e0e1a2f55
- MD5 98a70b2d6b9b5a5f40ec136ce8481c86
- SHA1 b894583ab97f6d28f566aea8c505a89abbf42af5
- SHA512 14efc747122e6dc4a505d1a5bf2f781919681679861f40328c30a67fd900cc1c7272e16019fe47bb3952e354d9bc77026abf23c3403e81f48a92d43546fa67ce
- SSDEEP 24576:VXYfDtczA3m2kxUlYtEjedEeQ16ywqmpv:AtcluYtO2E8ywqev
- TLSH T12B05012977E508F9ED67823CC8A2C512E633789547A4E7CB03E499690F332D85E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 79eb842208b09cfa6bb632ced65d08bee6f45a5c3b15ba2d2bc95bf8c306f952
- MD5 66649c57822c36970c277497bfc123c4
- SHA1 3e13b2eb1762b89f1c67949a8707d4a1e06df402
- SHA512 7fc91ff4c2e1ac64759a3c6377a44fc79f8a75933ae18f4c7cabe991f204ff326ce0c6927ba6296a0cee70786063db636c1c3c4843522ca4c95997e97636f304
- SSDEEP 24576:I0Le5ji0hmxhrMcm2kxUlYtEjedEeQ16ywqmpv:IPji0Az0uYtO2E8ywqev
- TLSH T1F335AE16F6748335D073C0B9C5D2A69EE97230861B308ACB4286D77C7E676E6C63A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 94892d189f1a096c2ec185f8d80961fd6c9a32872a6742ab3b9c500905f4d143
- MD5 336382e0c2225cde7798c0f2f6e3b62e
- SHA1 7a8958ec53addc28373efe27e59e1ea88a03f674
- SHA512 6d9460ea41ba04c53be29143625acac0ab1b68912a0c1b158b8ab304b5bbcca5ac7be5b571df77260dedab8105424d7ac0b987c3a56b559ace86c7db125fd5ba
- SSDEEP 24576:3a7/ezSC6vUyD/aqgrvWj6q8wyuim2kxUlYtEjedEeQ16ywqmpv:6/ezSC6vUzPv+HjyIuYtO2E8ywqev
- TLSH T1CB755C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E276E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 ca8a8a1660d77c1b7414306d5254dcaf1fcfef4ae0f035e693676bf2587067a7
- MD5 a5802d68e0f84c9b6c723ba8d00ed6d6
- SHA1 b7d698b169e37260e9a4f8ae0af80e2faf03785e
- SHA512 687c4140f92287fbdeb27428645248ff693382a414a678184e703c510ac4d86db8f092d7090d110932b9b4c476220d36b6d831556e10428d2e62747965572a3d
- SSDEEP 24576:/VbqPb88hv/l+Bzm2kxUlYtEjedEeQ16ywqmpv:/VO88hXl+UuYtO2E8ywqev
- TLSH T1AF559E66F5748331D073C0BAC4D2AA9AEE3234425B31CACB1246D76C2E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 a15de811ccda18ede19ffc16f9cc015c42c4b27f49809fc34a98b48b2112091e
- MD5 85700a21f47afcd59d295c00ee081bb4
- SHA1 2ddcd918ceeaa1ff348a3796b35a0a7a414f3cc6
- SHA512 eb9d0c0d2668393c2711d90772b187c2c95a7f7e5994d91bf01c201de5edc139ff07d6f69889a8fa27739b616ea68dc15614872a3255163c3114f13dfe5ac6de
- SSDEEP 12288:fG34Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:fGIm2kxUlYtEjedEeQ16ywqmpv
- TLSH T179C423C3A6263588F7655A3424FAE97312564CFA34DCD5DBC7D2B75E80BC023D2EA182
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 d1fb8a6381d7293a59f700207d556c91208a98628ce73f615afc0c6635f16656
- MD5 a91d49175791b2a02e9f6a4b58be8ef0
- SHA1 da56032200e22146f67171d698a59fb93296fc4d
- SHA512 678c5217643c6e3458d7b2dca518a8de25bf01f7852faed5434349fe9607725392dce36264b65e87ee5cea2b3bbae323db716894af65ae62b79efc55844b8c9a
- SSDEEP 12288:ReBNUbTVO86Um4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:RJIUrm2kxUlYtEjedEeQ16ywqmpv
- TLSH T19E05DF7BEE28FCD2C27A8D785A91C600977278704B61A3CBD165C30EDE235E15E7AC25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 4e2042f267371fdd0eca7fec459330fadcd0b40ca7c1cf6d3e598f0540893896
- MD5 9ba65c2b0f202d0f4d44709ff17e5a31
- SHA1 03b57635be16059e7d620f7b6e9a8cee20c99892
- SHA512 1fe4e568689aac8116a44ef06d391c86b4fd5144832c2d96ff6b3342db7f3729910ebe907f74ee67560c9c8a445abeae79f11935dbce7588a3c404e7f7b5c1c3
- SSDEEP 49152:cQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJW9DN5J8NRV3THm:cQvGAdlCEL8c/WRNw5CFuFJ8yHe
- TLSH T1AF267C656BF880F5E0A7E138897AC5B2F7B678421D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 6ed8b56e69c8f445229581fd82f5f649626e2e6df0d3a91ad42cc4befa5c57a8
- MD5 40f20d35dc64b30c834399d962bebb3b
- SHA1 234a224565a7737eec7d0d013ac3e31efb351595
- SHA512 29073404f26029b8e8fbae60481effb3b439492a4653033c0aa1baf2949c9d0b189296a11b47111eee57556fd3923f3f75c26340c86f7779dc1ef7b1bc142007
- SSDEEP 12288:OAwSfxL/2Dc3mDLLmt0LDQewsAjA4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1E:zfewsAjZm2kxUlYtEjedEeQ16ywqmpv
- TLSH T15915E031FE74E036D3BB0DB21B36C716142D79604BA11AC3E3E89E9E49742D26376A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 4305499e089a1b17668ed313cac42d4e6430379c5faf80c7a9e881fb6c651df9
- MD5 e9f310cf6356abe16eab8b7dbe8ef3a6
- SHA1 73d4690c40903cb835c7f7a2e83853b9d8d6f7ff
- SHA512 bf282609105c6ded4a16554b6dd85ab809f5d6b32346518bc13b3d561b7582ff8e963ec3a060c8715cae76779a70ec87db329c670aca274241f07de8c5bae01e
- SSDEEP 196608:7UEtQeTbvf2zlO12sJTv6Ja1cpVLy0IldPlbuJHd0y:7UEtQevvqc2W1cpV20I32d7
- TLSH T1B2474B91BBE843E2E3A6953484B182B6FBB17C1E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 d3538551465a3426effd9b7ceeb0852459bac5afc628ec6ff09a4f13cb3072ec
- MD5 8e9a46d3dc26f732bc17fe438b1fd6b3
- SHA1 72a4d9a0d3bdd1f40c054b9845c39a0fa762e523
- SHA512 024b1b3123ceeca73366f72af16d678d395ec6f20afc38b548b39d6f7d89e948bec9c780e0bd092b02adb51d06422e9bad6e1a940e44f6ddc83e56e1747b5c04
- SSDEEP 49152:2CbRquA/m2yL5zQfFiV+XenmE3/zEuYtO2E8ywqev:7oqtVjnmJuFJ8yHe
- TLSH T173D58D0976B8C1E4D1F6C77886A2C647F37178154B34A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 a8acb6f5b797ac271153a1f07ea8d75848f6e30dd23f738793df6849ddfc49a1
- MD5 cfefff37a48478859446855e2183bf7a
- SHA1 232cfc208fc67201a3a640693579b0bf0ff46692
- SHA512 aa90c4234bb443359a315985685ea66b2b546593fd960c51265c81dd2a5732273527ec7952ad735dfaecd151d5d09ac82f0648c5c7403a53bc53a7b2c33b4300
- SSDEEP 24576:sAhGL6IFoiwtA5l7S53mm2kxUlYtEjedEeQ16ywqmpv:sAM5Foiq55uYtO2E8ywqev
- TLSH T1CA35AD81E7F915D4F5B3AA7899B69171EA76BCAA5E30C20F2150D21F0E33A50DD24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 dfedde28fe5c44c83fb5b8229967f83d7a9d421555a11d6d8731cc6d2d53673f
- MD5 d4a42e3415f06b935311aaa5afd5b4c7
- SHA1 35f69a8b62dfea8edf19fc096c1e8a68a1c21752
- SHA512 52f3487e07d082e2821b8a05fc0b25c1991e60a267c8eba2ad195fdfb3b8a84cc0902cf79658b0c0f60803af9aa0948850d68ed774df4565bdb382408cd72b54
- SSDEEP 12288:Omw5HEjsChNEBFgl0WDm+CN4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/H:HwuROWdm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1B905F14676A51CF9E96786388597C132F3F2BC523A24D71F07A0C65B5F37221AE2E720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 4e1e2a85fa7a5dea95f87504b9afa9f1706fb8768c55e8985e01dfc3e06ec682
- MD5 faf7040247ef9b04cc4772f206f35fdb
- SHA1 a8fb6fe6129c7a118b95dd80f2dd80604f795ac8
- SHA512 d69e5b34f685d6ca9770aa8c9086c2b39edfbe311f7572bd6efb4921c83e75de76a7fe546f2b376123354208723bd5ac3653a059653e64d7008115bc68cad3c9
- SSDEEP 12288:lyZ1Iyw4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:8ZuUm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1BBE4128633A430F9F2A3563C98F19602D37278A7337483CF46A5525E1E776D29E79322
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 cdf9d07aa2d48f7c7f7d76d8b3ead8916b50134189275d18b5ad3242fb9680e1
- MD5 d069b413de01f4c30c6be412652810ef
- SHA1 e95638de14ae14b2fd31c5b23e18e10c42cf6fc9
- SHA512 6055cb1736775e4b53a90d746a9ce6ba08933b51c2852ea3968bab27a2399c2979684a926b3ff124dc5c8aa30eb4857f3064b47e5a290d0695aa907d122e3135
- SSDEEP 98304:SQRQyi36YOcPDLvw2gAf+PN3CuFJ8yHe:JQyiKanX+PNH0y
- TLSH T154667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 4f9b24bff3b71b0f4669426e9f6609e47b7c7bea7ebe0a2eaadb5ef1e0a17386
- MD5 c19a801cef4d81e87b7205c4563b0be2
- SHA1 8fbadca1747e450c21d0990b291184e168bdf1c0
- SHA512 248547861d7a0f9a97c2386b0a2de95660948bec89ecdf796e7df00c42ba4868d9e78c9b6560091b9c79f0dbd63f30f1ef59fd845f18874e228104786a3431cf
- SSDEEP 98304:AQRQyi36YOcPDLvw2gAf+PN3CuFJ8yHe:XQyiKanX+PNH0y
- TLSH T1CF667C43F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 4a2411f910bcd4f8b34ed8683a30545c8a93f2561611106b142048e046506f4f
- MD5 160ed63743f531a67810fd0e98cb5569
- SHA1 e676ea5783bdfecb8300f98fd32c003e50970209
- SHA512 88a2019b9e2495cc2cf4fb0f46d446b98ac4d8e5739f0c9d5354152ce9892d33b59c19027b5bec155b6b19758ab8a12ff98482fb32d0b6304f8eb408797cf664
- SSDEEP 49152:o68Qg55nhkeWu7PNU3/0uYtO2E8ywqev:ythTRc/0uFJ8yHe
- TLSH T193B55A33B2F20099D44DE1769F4A873196D27C758FE0E3DB8551720A1BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 2bf8c4dd06311bb606d847660e3d827108774b4e9314bbe0c402bf4afc225aef
- MD5 98d6db493286572976a91521d0af1729
- SHA1 527996881e4a81ce0c6b54d5ea86a4c9bd07bf66
- SHA512 c68f25f5a9ef89b3fcfaea58bacb55eb1f3b37b622b1faf8384081e45633ce68c912dd15fb74669c3d8e7a731cbf766927d9ca4684107c3b06999c925192aa75
- SSDEEP 98304:Qy5112gYy5azzVvU69nLKnhZLuFJ8yHe:pLIHRWhE0y
- TLSH T1A2167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 0fcf5b863b7daa80ce7bdef2a29d95b29b6bdb4bcf0ee0e05fe54f3a5ddcc92d
- MD5 f0ea580dd90a3bd10b0e9613859a77af
- SHA1 4dd812829aa7164c4811488ea4947dba060826d6
- SHA512 ae94150fcbe748a02d2742086a20a72871a7fe7f793a8675ecd65e4b2e01cf85eb95b375898d3a4257f68c49c892c92580968b027fee7751da8307c840f32cb5
- SSDEEP 49152:hB+taZ3usBWOBr4tEGa0bqx0z+n217aau1glauYtO2E8ywqev:3u6JmIxd2dauFJ8yHe
- TLSH T1F9D59D13F1DA01E8D05ED578974A9233EA62BC490B34B6DF0A9073562E77EE4AB3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 b40315163fd5752679734bedbf6c6fcab79d3e67159583cb4494d768ee886a5d
- MD5 474a10c6cc98b1232e9bb19b31942055
- SHA1 de97fd487560ca5140a7f21520cd87f376fc855e
- SHA512 1384c287901bdd21f54d5ff989cfc601bd153bcf3da5e8f4baf1bbd651abeb175030877cd5084950a9c6b78c03be793264934e262f2d3e66a62ab597472fb767
- SSDEEP 49152:+1hpsNoJpF1A67U44CwH7R4xeuYtO2E8ywqev:+mifPqRJuFJ8yHe
- TLSH T1CAB5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 bdda23ab456969a3d49681aa0b694dcfcf122ad2cacb46ad8708a6f9408b72f2
- MD5 3a94ca522dcdf4230fc4d225568c52a3
- SHA1 9c184c924c10bd94f3fcd359690764a91e2b269a
- SHA512 effdd7056970e31b49dec3d9419ecb8707cdea187a64a2289fcf934f3512864fa092ef9381d804f73ee683c2540e8173725868d3e568f45455d7478f6c2ac147
- SSDEEP 49152:jSuZQIY0Be2KkRVtOnks6NMHq3uYtO2E8ywqev:B5dKqi613uFJ8yHe
- TLSH T134C5BF03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 fe365470345efdd5922f33f1df4f08a840b9121d3f5f69851a0cae79ca737e2d
- MD5 fcf0e4e30b8eeb4cb2cd518e37c6dbb7
- SHA1 9cc8c557ef8e394726a8c3aab5c8dc508e365315
- SHA512 aa3e829516e85b77e786e3feebca7953e2bb2fb4706f5db5d5a481b43a7f6e9f20af70741284e6c3539f7f9300e87f1e757c3952e584a69dd87d5a2f24938a55
- SSDEEP 49152:whtSn8EApI0figjgiDn0AP5wKuYtO2E8ywqev:hX2iWphtuFJ8yHe
- TLSH T1C195BF13F2D901E8D05ED178C7568632EA62BC160B34B6EF0A90B7561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 b6b40876a456c953577ff476113b75c233468b7733cbc761e4ab5d44063cd6c0
- MD5 18e6082c727d1ba433f709a4284d2adb
- SHA1 40ea020428e5e247bec80f363eb7798297c41a2f
- SHA512 f27d59d4a0a75dceb6abc715df044a13a7798dde76bf4b49876dc709097ddef43670144f8366bb6f5c7ae5376b36297b4b1e83b7a8d1a0953fa53f4f5be921c8
- SSDEEP 12288:aP4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:aAm2kxUlYtEjedEeQ16ywqmpv
- TLSH T166C423C2A8673589F3109A3454F6E663125A1DFF75D8C1DBDBCAB21E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 c603fc6ad2829749647844296fd40a0da874adcc961b380bf7dc2c6fd446f760
- MD5 d3ab099fc4c2f22f43082ff93828d7cb
- SHA1 93cbac5e6af30c3a15caa7b0068b916052dad007
- SHA512 b6ae447bfd7a9f4b2fb28879e3911529620594f5664b89c341b89a64f4a6d33212865f93f38c177a8eede44bc83b2c93d2e80f2b59063ae5f12c59bb59a0dfca
- SSDEEP 12288:0k4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:0Fm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1C1C423C2A8273589F3149A3464F6E663125A5DFF75D8C1DBDBCAB21E80BC027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 cf0d66e9696e176a4906224ad472af4fda5de4b04f0d65c3ca77cac9eb91b6a1
- MD5 9ee5d06b9182b138edc465d3d185138d
- SHA1 d4b9c1e3f5f8f0bfd5d78fe1a714c54410d0fbe3
- SHA512 646803e7ff5691962f56f547513249388bacfc398d6c92298621b3a67fb2b691eb0ddb4b6b4f0e109e454cedb980af1f13956a5385a70cd78a587bafb42dfa21
- SSDEEP 12288:K+4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:KDm2kxUlYtEjedEeQ16ywqmpv
- TLSH T188C423C2A8273589F3149A3464E6D6A3125A0DFF75D8D1DBDBCBB11E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 73ecc187c51121c1c2540694a0fd6ab90732a259d2bd5253bb73ee44a1494334
- MD5 49f80e98ce779841a5b9ece1750a7b0a
- SHA1 5b1b525db1a601f56d73ed65512f42e990e64a02
- SHA512 001968e28297368668872bc618e1e070904ce8a1ca34b1ec13ccf720bc102dc9445722e522e452455f0e13e293eee89e05243b2b3aefd7ee135d4360e314fc64
- SSDEEP 12288:WVJ4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:hm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1A4D42382766A30C9F521D63484F2D52393B67CFB77B4D2DFCB81650E0CB9252DAB9281
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 b9e66149fe025a0391f0f2452ecb33274872db7cd6cee7ee61c9dbb32226b5bf
- MD5 ca2034a345ad0d8077bd3c667a738546
- SHA1 dd0ba6fbcdcf893452e6c1d64008cf22fc389a4d
- SHA512 afd56b7f41c429f31d86384c4f7323f73ded047129319a5e6f243391b412612daefc1028faed86631f1e419a7d787f36b8f93372f1073f6f4c953c6691862950
- SSDEEP 12288:4x4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:4um2kxUlYtEjedEeQ16ywqmpv
- TLSH T1AAC423C2A8273589F3149A3464F6D6A3125A0DFF75D8D1DBDBCAB11E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 1deb0bafdc26bca00f30d1c73a319b598b82e365ed297f8a01906c1c9d2e5a33
- MD5 e4486eb078d9ff8f32bed13515c7386e
- SHA1 0bbd190f2c006233ed1dbb17649bbbf8baffe08a
- SHA512 e90eaba7371be8f3bda728e48e6aa7d8bf43e83b105b511059a95abda1c0c90dcc3adba7bed3a8fd890bf4f6e43ab562ecf0f9ce23680b45691608d90684980c
- SSDEEP 12288:B44Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:BRm2kxUlYtEjedEeQ16ywqmpv
- TLSH T156C423C2A8273589F3159A3464F6E663121A0DFF75D8D1DBDBCAB21E80BC027D2DA0D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 e75dfd5a9dbfafc64142292804f697be7c6ae1dce4229532d2789dfafbb793cf
- MD5 5c5e63ee2ef2ff97a79da20b0871e861
- SHA1 bc68c8d7eb1dc2afb4797ea9ec6a5e98205aec45
- SHA512 3c7401f5e678987a62f453ad7df6abbc3a4ba8b112ac1f5daa45543b40a690f69302b2cdddfe9b960b7ed802d7298b0fbee06f7d96f4f9543fd00d54d3359a29
- SSDEEP 12288:UM4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:Utm2kxUlYtEjedEeQ16ywqmpv
- TLSH T172C423C2A8273589F3159A3464E6E662025A1DFF75D8C1DBDBCBB21E80BC027D2DA0D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 f1922900018de1cdaa2cbfa470ea75430996c56b12d48cfe92fa16abf32d28c7
- MD5 be8812ad037602ca15c91c83cb764da4
- SHA1 7b84776d8d704216be1a5902ced04c13a0f27ff2
- SHA512 46248da5a5da342cc9e0fdab0acc3b95ecc2f71091122bc40870362dedd50c4acb760178bb94eeeceb2bb2313ad3d2018300c38ec4693eac19250ff908e0de6f
- SSDEEP 24576:hZM3zFVSOlm2kxUlYtEjedEeQ16ywqmpv:hZM3zfsuYtO2E8ywqev
- TLSH T1D0050295B35018F8EC63823EC8658912D2B27C6A17B0C65F03E4362B5F773A15D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 ddb93ad0ca10484c4eaa31c0a28031f06679f377c6a03ab654f5de8df561de03
- MD5 165aa067881bc4c8b77352aa30ee4063
- SHA1 f5e333e2c3eb3e9d48a8bad45f6c79c4861836ca
- SHA512 ed3a501aede407bd88daaedda2a5a19cc83dfa130bd98a2ef662fa0bdfe9fd8b93c3414e0cc908f99b8406c766884ce3051a2da3dab35af824680da8ff1b9e85
- SSDEEP 12288:Hb4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:HEm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1C1C423C2A827358DF3145A3464E6E6A2025A4DFF75D8D1DBDBCBB21E80BD027D2DA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 8d327d297fe3a3f51abbc01c94573e14ce740f5dae024adeddffcdea9dfe64e6
- MD5 047be12da60a3ef3d5bfb1cc855342cc
- SHA1 28eff9463d71981ca9d8acd1a118bfa75188dcad
- SHA512 735a362d4b40fb799a2bfd67a06dc0d384ed96b57ab15b5feb693af74550675f3e8686aea2b4ca8e0090d88cbe782141f48a91ae2f9614ba5b4d6021f89e97f1
- SSDEEP 12288:Un4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:U4m2kxUlYtEjedEeQ16ywqmpv
- TLSH T1B2C423C2A8273589F7109A3464E6E663025A5DFF75D8D1DBDBCBB20E80BC027D2DA0D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 10656199613b7a97502a92ed4018b16436db63a6cc262cb4ec3f7373fe61ed85
- MD5 7fc7898217a7e1b913789f5f9e54a26d
- SHA1 3977cbc88d0296e2b6a69d9e7fba45bff10e3fbd
- SHA512 8f5ac25203b1d5dac6fbe7d0d370b3a48894755600d6ebc8c6b5b2e28f65a6bf5036348516729799e6ed29528782767606d3c8e8026d785188397d4d24aeb93b
- SSDEEP 12288:YyPz5L8w4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:5zyJm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1EFF4124773A130FCE1368238C8A25A12F37278761764CAEF57A4477A1E372919E7E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 92c6af02051ffca9f5a6d994752f1bb0a9d41c437d4052dc76e018c9a830b796
- MD5 98ce1b26fbf624b051281088014422fe
- SHA1 e93b44093e5540f5fa5810f27a01f8a0243c393e
- SHA512 0c03853f6eabd04ba4714bcafcb4ebd53e71c2d55bfa1564c74768bfa2fa84c63520ccc9ec5f40a8e0919099cc542dd6a1023a5effa4c94d40b8ccea3354e97f
- SSDEEP 12288:Xb4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:XEm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1A0C423C2A827358DF7145A3464E6D6A2025A4DFF75D8D1DBDBCBB21E80BC027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 37e986c1c3992dcfaf27cd1be94b567fe706f327776040caa4445445fdc42b82
- MD5 bbcb9d6e349565b4cc54713d3cf99e0b
- SHA1 9f4280dc5bb971d1dff20b583c67c4d27502169a
- SHA512 3773176e929531d074967b92195074a9a4af38c6980155fc3ba328b9a366639b69ed162bdfb816f29256c9552104389b624bfe5e4be031bf63c6234bacf73679
- SSDEEP 12288:Tb4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:TEm2kxUlYtEjedEeQ16ywqmpv
- TLSH T12EC423C2A8273589F7145A3464E6D6A2025A0DFF75D8D1DBDBCBB20E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 792001e6e0c987289dac36922f8dcadfcb7a5872dfb0867e3e612ddf43f4d828
- MD5 2b830eefcfc14ee34c9256d8869953e1
- SHA1 3f5cbfab4168557423bdd76e868abe1b7ccf737a
- SHA512 be5e59acf81277efd7771e62498f852056914101490f9734e3bb6be1bca86f4698e664c822aa8fbde015343c7e025b3c6dbb6491e40b1e20076e1e02518cb0f4
- SSDEEP 12288:jyPz5L8w4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:OzyJm2kxUlYtEjedEeQ16ywqmpv
- TLSH T1E6F4124773A130FCE1368238C8A25A12F37278761764CAEF57A4477A1E372919E7E760
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 67529cb04fe9264e94c8255a59ff66401b42742bd278bf8e2458f930edf94191
- MD5 f78cc4447677943d373ca26b1e8c148d
- SHA1 750efb4fcd08607f849950a15ab9e1e5f52d4709
- SHA512 9a7386a35783d9defa1b745918f3d7b3bbae940512e01fac01dfaa7f284a4e7934e3c342852a0e8fd579f9a742d25d9a93b514a3ee5b6a007d81969d5f33fcd8
- SSDEEP 24576:lT8aLl3z0zDTm2kxUlYtEjedEeQ16ywqmpv:lT7LljVuYtO2E8ywqev
- TLSH T1CC050295B35018F8EC67813EC8658916D2B27C6A07B0C65F03E4366B4F373A15D3EB96
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 01f5982c36770ed92416bfe721e4dadead867568278a5676158d6d5a98dafeb2
- MD5 d7f302530efa6d8298b348411a415b33
- SHA1 e64a9bf1986159e8eb0571c58d8fe6305ba21f03
- SHA512 f7df772b1a2a84e3b633b8be64430aac02e6b2cbca274fbd3bb4d35f8db06eae8ae486e8da025e09ea3aec589f713c6d2f61ea797f90fb5a71b7bb1a415ebfc9
- SSDEEP 24576:F3rd9CHKy7GZvm2kxUlYtEjedEeQ16ywqmpv:lrd9CHKyasuYtO2E8ywqev
- TLSH T15625CF90F3E410E8F1B7DA3588769512DA767C9A1B70DA8F03A4661A1F337D18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 0c196e7116ad532f5a9783f4512886e49d9b4bdce9f16243f7acb75e74acb68c
- MD5 ec324f32cb02439b2701ba7e22e28783
- SHA1 df1cc4ddfa5539a02c3c37701c403a4eb3dbd734
- SHA512 da86ca6b310b0ab029adcaa2560e949fc7cf7055f5696ae65fc0ab0c16a3c1ae421f17ab5fa4226b4dcae2943d5b8710ad865f11b3cb6963858613d70864a491
- SSDEEP 12288:+e4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:+jm2kxUlYtEjedEeQ16ywqmpv
- TLSH T145C423C2A8273589F3149A3464E6D6A3125A0DFF75D8D1DBDBCAB11E80BD027D2EA0C5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 70573c095c43c231454b40bc735aa5dcc3919d1f571d2f3100ff4cfde8d5c139
- MD5 5c47c43775f1fecb74a9fc23fa99765b
- SHA1 30404aeaaf33baa2c58d7a320270e0dead8b9138
- SHA512 c215d3f46658e4de18d81890e328f57851372c6e0cbd4a6e66f3c69d92dfb9fcb72eeac40cf6187962e8218c6bbf5f7339c11dbd82d9a2c58e67ce2bb92cd303
- SSDEEP 12288:wQ4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:wpm2kxUlYtEjedEeQ16ywqmpv
- TLSH T19BC423C2A826359DF3149A3464F6DA63125A1DFF75D8C1DBDBCBB11E80BC023D2EA095
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
- Size 10.2MB
- SHA256 d7380072fea3dbc32d6a1b7ee839330ed75f3268619c198835c0e583b515e050
- MD5 b0f98b02cd7d5ecb1ecc7812faa7d7f9
- SHA1 59c74e839baf01be39b08d5e3cfe3d0b5a39193b
- SHA512 36db33f0e3a24b8cae83ebd6fa16a2d8e112fc29596049eef02f4518a06a7a52f4099bae98be08a86aef68bf277c504501911b62ce8993122d9d428c63909850
- SSDEEP 196608:Lqrajgrui7KiWARoWQb5amsxUMRUFUnvTBBbBQ03B0y:Lm77KWiamsxbU2nvTBoQB7
- TLSH T157B6BF22BA00C032E8D100B296BD5FFA997D5A341B3954D7A7D41DBD5A306D33B3AB1B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Roblox\Versions\version-ed2b47b81f08484a\RobloxPlayerBeta.dll
- Size 20.9MB
- SHA256 a5e1cf709a64dd3922e3d81562524bccebb9762e1c693e97f09f65ba88be6f52
- MD5 be3ef08989567375607175b90e935dd9
- SHA1 a9672e47fb68dbeafd8fdb1eb2f684616e412b8c
- SHA512 c3838706c2493c4ebc70d8b7ca89104f1cadb146f1369fa818877461f1fb4f3e15f2adf874371aa64ee1acd06e90334f1292e3c2cd71bb3e2860cd67f777ccbb
- SSDEEP 196608:uCF8Xlf9MbJSbb8p+jq5OhtPz0aXmgwCDpsyN:R+XbKJSbb8sz0aXjDpsk
- TLSH T19D27C04EF4D21AE8C0A25078E65F57E3DA32304C4A687EF787D90250363268D6659FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 66bd1b18324f6b4deae1fa040808cbcf9a4c9a914d8c6e44bec2649d98fb48af
- MD5 b5d24d99c9bad2a513ff546c23d26e16
- SHA1 e362b0bb8d885a25ae15c51b1a9c4ae9316e0a46
- SHA512 4342decb7ad729358e81fa23202e1fd1ebd6e43260762853355fde52f768399cfb1c52358c8141a14fbf3c30174fa94c85ac98e2f4ade2fa68f5d8936d8902f3
- SSDEEP 24576:Gfwvzk9RX6wkyAIom2kxUlYtEjedEeQ16ywqmpv:VMnYIruYtO2E8ywqev
- TLSH T14835C029EBDC04E5E177923C99B7460AF2B178691B71C2CF029A536D0E37ED49E3A710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 dae6fecddf66592d682d2dad1712db2152e9c8fa800b9ae20e96d6a3f2fcdf62
- MD5 723158452f0308ad8c3b5724659a3caa
- SHA1 e94c3f30b91b5beb9156ed471a7846bff71ac6d1
- SHA512 01b65b4d75ccd5421a16febf385513f58fb94bf9f901d4684a56984594e4f07ddb73d0cfc996ba4d6f2788202c0d4bc2d077cfa6ca902072702436aa03cce8e3
- SSDEEP 49152:RYOONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0quYtO2E8ywqev:oySzPiuFJ8yHe
- TLSH T1EB067C96A16801D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E351
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 c7b989de6c722022bc7a83ab9f8c837fcca347e8b985edcdd88866acb2d7556e
- MD5 f21fd815fa0081d2b0ba3ad5c8496edf
- SHA1 7bbf59d7c6bbf6e9ef8b2801ea464fd52026919c
- SHA512 66e1ea4e8302ba8a59762e8f5c6ac15197f801f3ab156617f14bc2c2181aa2dffd8a1c1576d599bcd92cce3de138afa739bd4aaf921476cc89dfd06fb5ed3175
- SSDEEP 24576:n47Jb1aQZRqLfOrIhnjFN8rnDHU2+fF/AYVm2kxUlYtEjedEeQ16ywqmpv:n47JUQjqirIhCnDHUPfF/auYtO2E8ywf
- TLSH T1B765AE1EA3EC01D5E1BA923885558A5AEA71742E1F31CACF1270837D6F23ED49F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 7f9bf5d64b50bd58e2223ebacd319a5cbac24f760bfa9f804ec662a5eae667b7
- MD5 26ab6c3bce09c843c8e90ed9c2989096
- SHA1 e726b183f472051e36782f9abd42863367025e98
- SHA512 e7c01ff310b5d350b624bc9a7466ab3edee10d929a78634be82457784955d1eeeceec4f51c9b2d5699d589e7b05f64a6cc6462e01db7ea25801e0b79e04879ef
- SSDEEP 12288:8psfr4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:dUm2kxUlYtEjedEeQ16ywqmpv
- TLSH T17AE4014AD25812D8D16E6239C7969A41B3333C6693E0D3CB57C0F53E0F7A2919EEA743
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
- Size 1004KB
- SHA256 e37d586ac60194a0c40426de0af08d81b4baa725f1ee912c96570b66ec9acfbf
- MD5 1f72f3336da5caae709b63422e878334
- SHA1 3116cf3e0a395e06e6f1c43678a994983eebbda3
- SHA512 41c2f8a902e1655e9715fbc596f028af512c37bd0d2097cd83286e5bd09353abac5e45c797e5e2820608faa6d9811f508f90779b2c5157a3f3303a23cd101c86
- SSDEEP 12288:nWqzU3fJiMx0SgtWY78GrFrkARFw5EhN:nW4UPMqYztBkQF3hN
- TLSH T1C325F610766BD75FC6AD40321E36D1CCAB707D01EE05AB0772C8973FC576668BAB2292
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 1.4MB
- SHA256 f631a7e74b46be9a8b98c091b5e2a52500cfcd0c597718124340355b14404325
- MD5 69a55229364cd4af0447334d8a8b75b0
- SHA1 4ec23330a179f46c4c39331dda7e67f5d8b1f226
- SHA512 90b968b0b93a8a0bc3d59a1a1ecb9b5e9b520f266e1588e7987e1db403b04423c2c4597ffd9e625a310275ea8eb4b0c31d3ae0a6e1983f0d5bd268bc59c83267
- SSDEEP 6144:L0opjMFQA2dKohgwaqOPNcbVtMxtCpTa1WcbVtMxBOdLAoGKmS/xo246KF8e:2r2sohu+QuS/3PK
- TLSH T10F65D8819537A3CFD0FB6072072A9B4DAB64EC47B3055F2673C4453AD86BB25A0B93C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Roblox\Roblox Player.lnk
- Size 1KB
- SHA256 fbb6c34fd85eab5a077e1f0892410c091beb32fc9274ac1f91a6b8b5e58f5746
- MD5 dcb00134855177ae33f9b64247951460
- SHA1 d2ec1e719a07efac685003a49005e0b2b1dfe418
- SHA512 bba1e9b56c7eb11162dad52c80946b12cc348c6d74ba8f257b369e13faae588df5b247430632596ed059a0bf37c779c33f495ba7bc61102ac6bca8215557ee76
- TLSH T17021EE158F96572AE0F38131A8B402D0EF727D01BA2C6F3E818056481CE200179E9F3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\Desktop\Roblox Player.lnk
- Size 1KB
- SHA256 47a30c2636c0c9b2fdde0435363477079a83b1796f6af58d543524c72ed5b31a
- MD5 5079c46c143fb8e5da20eca2acb2bb73
- SHA1 d256ad3d5e886e54f01024e08b527cf04e32c1f2
- SHA512 def31e59b13101b4ec36a4828892df60dd1858d314395cad04020791942ba7ddb818325303c4669b4ea28b7b367ee53659465841ccbb86dae337b5eac500d104
- TLSH T1E6218E158F96562AE4F38131A9B502D1EF7279417A2C6E3E818556481CE210179F9F3E
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 0e09114091440b10a915dd482aade7e9596c61aa149060d2b15542fee0e8e915
- MD5 f2f05699e885d7f208247379139a21ab
- SHA1 e2fa1c2c34a6bf8e654b8db59e666bd9ae94c73a
- SHA512 ad73449672a9c208b10e4eea369d88cbd5ca6862c495664c67cb050b4087eb8e6de9c2442588184fca276a1c19707d1cc5bff4661b581cc84c69ffb031c65916
- SSDEEP 12288:mM7z4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzLv:D8m2kxUlYtEjedEeQ16ywqmpv
- TLSH T149D42383A66A3949F6755A3010FAD532121E7DFA3BC8C0CBE686B25D807C0D3DEF9146
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 4cbe2f49f5d0e054a43e6c0209169de8003cb6b5f097085f8f3064bd2a2c233d
- MD5 dd68a49402c44904524a4c673f388390
- SHA1 3bbac0b7451c5b7f5f28377f82eb0d2874954c4d
- SHA512 0e0af7bab2028549a3d577ddf4af1384d0f45457f505349e135228392cf9517072ce436781ceec1b940d4926cdaf14375584a9833cfbc95b0a4ca1995222cc8b
- SSDEEP 24576:Egb6bmBIi49WNNFpg1rSvFv7bYim2kxUlYtEjedEeQ16ywqmpv:Egb4mBIBhGFAuYtO2E8ywqev
- TLSH T16D65AE1E22EC02F5E0F9D2B8DDAA4417D6B278161731D2DF1251422D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 5289aaff5f955d09ea5aa4bfda3447fba75a745a7be592fad5d7b42edb0cbf90
- MD5 5a2ea5ade6975424b0da8afcdcd44cbd
- SHA1 59c02c909b8d5703aea60ff136011083d9ec9984
- SHA512 f51f672ac868096cc49562685d59372d1795487bd537c16005febd280fb8161a81761aa7b8f8e571c5996a68a6d3a3d0fe2b8ec2709ceb15daf0c02b9fcf36c3
- SSDEEP 24576:+G88u8FpJqH1vzria7/mlm2kxUlYtEjedEeQ16ywqmpv:V7ZFPqVya7/9uYtO2E8ywqev
- TLSH T18E35016576E101F0E47BD13889824663F2B2B8251364EBDF07A88B551F33AE54B7FB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 dde1c9ab81bf439bd039b542509ae9dfa8c1d8c4baf367b901eea8f668bb1225
- MD5 cef67db759e0270a260d066d78566468
- SHA1 c0aba97bbbca914179f516cd956a30513b4fe686
- SHA512 9ebafac7abc1facc00aea9b6044228b2df13c79776fced40fb1c4b4a3f2f03780fcae31d7fd69c8d8c524fc6533641684840ebd0ce1fed3649fa394bdc4a45f3
- SSDEEP 12288:tHvUrBFrEjwaQo4Ak+8wTqbibtxd6CvAlFGEgh2l6mdedEeQ1I/yw/5CSm+jrZzD:tPUr+NQBm2kxUlYtEjedEeQ16ywqmpv
- TLSH T17105E15F62AD18E5F676E13C85828719E372B8621351D2CF02D1817E4E77AE8BD3EB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 8b5827720de294b73a5eea768088008efcc994d1caf71af07c49c126bb660b46
- MD5 f18d437ef54b348a49f09cd077f4ebba
- SHA1 da11c90e27eca175a9bb25a6b019c11eea8b839a
- SHA512 3a125c455f52d3414791985d4acc490d2977aa85120f4ef57d6a52eac98e7fe9d0c8a09bc07bd7be601aa2b2cb45cb857d776d43fba48458de16e8f615240393
- SSDEEP 49152:XBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj8uYtO2E8ywqev:IG05lO43bzuFJ8yHe
- TLSH T136D5C06A62EC11F9D1BBD17CD9C6860BEBB23825033456CF02A486A91F27FF4957E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 c69a98150a1877006637d425040f3af2b66fe0c01919a83714539ce49e262715
- MD5 adbd06871dd6781170f88f445708b263
- SHA1 70ea13e56acc2bceb75a29f34ce5128962acc27b
- SHA512 f1e8c52ef0144549d0ab0eec6ab8fbc6b0ad22ec348fd0c40db78b7b1b87e3592e3b4fe279601a037203955db128f7b001a75b431ab46c17813046b677cb7102
- SSDEEP 24576:2fa5POZ3dpyWVM50JicR2hG0lasx2+47eidnXm2kxUlYtEjedEeQ16ywqmpv:ua5POZ3lJt2pasx2+m0uYtO2E8ywqev
- TLSH T19165BF5EA6FC01D5E179D17DC583861AE5B1342653319BCF022182BE3F27EE89E39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 30868ddf5e42c5a8fc13264902b3cdad45c2eca0ecf8a8e44234c28f71009a7e
- MD5 7b9896b48d09299b7bd4beeea84ebca9
- SHA1 657de09d3c9058769972ffec8d789b34cdcaccd8
- SHA512 34d700e4e8ae48a3a2a543eb2c09c335ddca0adffb4b1c231d09339d9c26b09ab5b3b228ce8f39d9e7008df30d33df21ff044391f0ed488bf203bb008923604f
- SSDEEP 24576:xNcwHdjbyQ4nLC18lb/EOjowL7Fk9m2kxUlYtEjedEeQ16ywqmpv:xNc/zEOVHFduYtO2E8ywqev
- TLSH T1C3857B5622E901E4F1BBE1BE89779546FA71786913348ACF0291811F1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 eb6c1bce689fdb3b8edc4bc80eec051ba0e5ed5086dcdbe9274d5ecbbb7d12fa
- MD5 1f5362c3f9652ae7a613fcf9f6dc7014
- SHA1 4b5a97500d0941aa63a74bb0329c977ce0a59f9d
- SHA512 905db5086925d61f0262025ad80b6817bac529509ce24b8e48b26462fd2e148f6b903e3adae6ee15e29fb0bfa98990f6fdb5f5611ac56bab62a408ed8aa50147
- SSDEEP 24576:pzkNvNnaFeYhJNtmZBmbm2kxUlYtEjedEeQ16ywqmpv:pzMwBtOmuuYtO2E8ywqev
- TLSH T15B55AF6EB6B806E4E1FEC6748D238512E6727461173293CB5390C13F0E679D89E7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 4bfe19832779e5ecc928072d10f39d427b29a4c14ea39f76f55b7e7b3fe67e31
- MD5 6ab02eb82479c5c77f2e826de0195da3
- SHA1 8d1a5d11a575803b885d71064835090f42c05974
- SHA512 9136a3dfdd63cf859d1a1d1101690a036602ba9ab00083b71eae1d6c3f61fa8a43268e8211264ba1f2667f3401e694fbc70076d1ebc8abcf2156eb9204310065
- SSDEEP 24576:nD3FHshBIYQgAgm2kxUlYtEjedEeQ16ywqmpv:nDVHeBIAAjuYtO2E8ywqev
- TLSH T16425E17EE65C04E4E57AD17CDAA38A06E37138AD032156CB02D4C1BA5F6BEE46D3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH