Analysis
- max time kernel
148s - max time network
155s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
01/10/2026, 19:20
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
25 signatures
150 seconds
General
- Target 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
- Size 13.4MB
- Sample261001-x125baba33
- SHA256 e8ae473cb05c307a7255e36728a5cca7176328bc411e6388cd19573a98238b34
- MD5 0701689a27b762d6deeb01c3c1ae4ae7
- SHA1 97f96872ce0d3483632f96f7ab9fd5a98a0aac6d
- SHA512 db6f51c59fcb4fbd9e70e726b1eee86f6e416729820c9af3e6da2989441a796db0f595074147fbf3cb84ddd428cfc308503339e591f1f3f5040dc8242b359ef1
- SSDEEP 196608:KYY/sjthVgcTWyKlFa3mJfGTzKn5nTXzlarH:KoDVcyKlI3mBGTkTw
- TLSH T129E69D6AB2B800E8D4BBD178C6565613E7B1781603709BDF1AA086F61F63BE05F7E350
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects executables containing URLs to raw contents of a Github gist 4 IoCs
resource yara_rule behavioral2/memory/3356-8-0x0000000140000000-0x00000001414E3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/files/0x000c00000001c657-145.dat INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/3356-167-0x0000000140000000-0x00000001414E3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL behavioral2/memory/3356-442-0x0000000140000000-0x00000001414E3000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL - Executes dropped EXE 13 IoCs
pid Process 3684 elevation_service.exe 5068 elevation_service.exe 2732 maintenanceservice.exe 4292 OSE.EXE 2620 PerceptionSimulationService.exe 4484 perfhost.exe 1176 ReFsDedupSvc.exe 3156 SensorDataService.exe 2756 ssh-agent.exe 5992 AgentService.exe 4660 SearchIndexer.exe 3800 RobloxPlayerBeta.exe 1504 RobloxPlayerBeta.exe - Loads dropped DLL 1 IoCs
pid Process 1504 RobloxPlayerBeta.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe - Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: SearchIndexer.exe File opened (read-only) \??\k: SearchIndexer.exe File opened (read-only) \??\L: SearchIndexer.exe File opened (read-only) \??\S: SearchIndexer.exe File opened (read-only) \??\v: SearchIndexer.exe File opened (read-only) \??\d: SearchIndexer.exe File opened (read-only) \??\F: SearchIndexer.exe File opened (read-only) \??\H: SearchIndexer.exe File opened (read-only) \??\i: SearchIndexer.exe File opened (read-only) \??\l: SearchIndexer.exe File opened (read-only) \??\M: SearchIndexer.exe File opened (read-only) \??\n: SearchIndexer.exe File opened (read-only) \??\s: SearchIndexer.exe File opened (read-only) \??\o: SearchIndexer.exe File opened (read-only) \??\P: SearchIndexer.exe File opened (read-only) \??\b: SearchIndexer.exe File opened (read-only) \??\E: SearchIndexer.exe File opened (read-only) \??\N: SearchIndexer.exe File opened (read-only) \??\q: SearchIndexer.exe File opened (read-only) \??\R: SearchIndexer.exe File opened (read-only) \??\t: SearchIndexer.exe File opened (read-only) \??\B: SearchIndexer.exe File opened (read-only) \??\h: SearchIndexer.exe File opened (read-only) \??\O: SearchIndexer.exe File opened (read-only) \??\r: SearchIndexer.exe File opened (read-only) \??\T: SearchIndexer.exe File opened (read-only) \??\U: SearchIndexer.exe File opened (read-only) \??\X: SearchIndexer.exe \??\F:\ 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened (read-only) \??\G: SearchIndexer.exe File opened (read-only) \??\I: SearchIndexer.exe File opened (read-only) \??\K: SearchIndexer.exe File opened (read-only) \??\W: SearchIndexer.exe File opened (read-only) \??\Y: SearchIndexer.exe File opened (read-only) \??\p: SearchIndexer.exe File opened (read-only) \??\A: SearchIndexer.exe File opened (read-only) \??\j: SearchIndexer.exe File opened (read-only) \??\Q: SearchIndexer.exe File opened (read-only) \??\z: SearchIndexer.exe \??\F:\ elevation_service.exe File opened (read-only) \??\a: SearchIndexer.exe File opened (read-only) \??\D: SearchIndexer.exe File opened (read-only) \??\g: SearchIndexer.exe File opened (read-only) \??\m: SearchIndexer.exe File opened (read-only) \??\w: SearchIndexer.exe File opened (read-only) \??\y: SearchIndexer.exe File opened (read-only) \??\Z: SearchIndexer.exe File opened (read-only) \??\u: SearchIndexer.exe File opened (read-only) \??\V: SearchIndexer.exe File opened (read-only) \??\x: SearchIndexer.exe - Drops file in System32 directory 41 IoCs
description ioc Process File opened for modification C:\Windows\System32\GameInputSvc.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\AgentService.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin SensorDataService.exe File opened for modification C:\Windows\system32\dllhost.exe elevation_service.exe File opened for modification C:\Windows\system32\AgentService.exe elevation_service.exe File opened for modification C:\Windows\system32\wbengine.exe elevation_service.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe elevation_service.exe File opened for modification C:\Windows\System32\alg.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\vds.exe elevation_service.exe File opened for modification C:\Windows\System32\msdtc.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\SysWow64\perfhost.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\msiexec.exe elevation_service.exe File opened for modification C:\Windows\system32\dllhost.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db SensorDataService.exe File opened for modification C:\Windows\System32\alg.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe elevation_service.exe File opened for modification C:\Windows\System32\GameInputSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe elevation_service.exe File opened for modification C:\Windows\system32\TieringEngineService.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\wbem\WmiApSrv.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\SearchIndexer.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe elevation_service.exe File opened for modification C:\Windows\System32\snmptrap.exe elevation_service.exe File opened for modification C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\locator.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\snmptrap.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\wbengine.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\system32\vssvc.exe elevation_service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Roaming\536fbab9f1788cf2.bin elevation_service.exe File opened for modification C:\Windows\system32\msiexec.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\SensorDataService.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\OpenSSH\ssh-agent.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\vds.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\msdtc.exe elevation_service.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\System32\ReFsDedupSvc.exe elevation_service.exe File opened for modification C:\Windows\system32\locator.exe elevation_service.exe File opened for modification C:\Windows\system32\Sgrm\SgrmBroker.exe elevation_service.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs
pid Process 1504 RobloxPlayerBeta.exe 1504 RobloxPlayerBeta.exe 1504 RobloxPlayerBeta.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\fonts\BuilderSans-Medium.otf 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\icon_premium-16.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Controls\xboxRS.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE elevation_service.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\fonts\families\AmaticSC.json 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\DevConsole\Arrow.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Health-BKG-Left-Cap.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\InspectMenu\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Settings\LeaveGame\playernumber_strokeStyle.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_12.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Mozilla Firefox\updater.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\PlatformContent\pc\textures\sky\sky512_up.tex 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\Gamepad\Controller.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaChat\graphic\gr-indicator-instudio-10x10.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe elevation_service.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\particles\explosion_alpha.dds 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Controls\DesignSystem\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Input\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\VoiceChat\SpeakerDark\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\PlatformContent\pc\textures\sky\indoor512_dn.tex 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\graphic\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe elevation_service.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\LuaPackages\Packages\_Index\FoundationImages\FoundationImages\SpriteSheets\img_set_3x_9.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\graphic\CompactView_purplelayer.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaChat\9-slice\chat-bubble-self.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaChat\graphic\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe elevation_service.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\clb_robux_20.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Moments\Reactions\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\VoiceChat\SpeakerNew\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\graphic\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\icons\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaChat\icons\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\fonts\SpecialElite-Regular.ttf 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\PathEditor\Tangent_Handle_Selected.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Emotes\TenFoot\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Moments\Reactions\laugh-joy-xsmall.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\PurchasePrompt\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\configs\DateTimeLocaleConfigs\es-es.json 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\Controls\DesignSystem\ButtonControls.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\category\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\scroll-middle.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Controls\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Controls\DesignSystem\DpadUp.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\VR\VRPointerDiscRed.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\dropdown\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\ExternalSite\guilded.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\AvatarImporter\img_light_RthroNarrow.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Emotes\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\Emotes\Small\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\avatar\compositing\R15CompositLeftArmBase.mesh 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\VR\hamburger.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\PlatformContent\pc\textures\water\normal_24.dds 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\graphic\light_bg.png 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\ExtraContent\textures\ui\LuaApp\icons\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\AvatarEditorImages\Sliders\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\textures\ui\PlayerList\[email protected] 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File created C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\content\configs\DateTimeLocaleConfigs\en-gb.json 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaws.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe File opened for modification C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe elevation_service.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname elevation_service.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain elevation_service.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language perfhost.exe - Checks SCSI registry key(s) 3 TTPs 36 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C SensorDataService.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 SensorDataService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A SensorDataService.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ReFsDedupSvc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz ReFsDedupSvc.exe - Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000da4b82bda51dd01 SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E37A73F8-FB01-43DC-914E-AAEE76095AB9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009f12e32bda51dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000001b6aeb2ada51dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32820 = "Indexed Locations" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpv2\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives" SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000310b3c61da51dd01 SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList SearchProtocolHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000007625cb61da51dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m1v SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-116 = "Microsoft Excel Template" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software SearchFilterHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9910 = "Windows Media Audio/Video playlist" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently." SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpg\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.ADTS SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer SearchFilterHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show" SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2T\OpenWithList SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav SearchProtocolHost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler" SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia SearchFilterHost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000039250f2cda51dd01 SearchProtocolHost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList SearchProtocolHost.exe - Modifies registry class 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-76e1a02649ad4f35" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-02c37bc51a384b8f\\RobloxPlayerBeta.exe" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-02c37bc51a384b8f" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-02c37bc51a384b8f\\RobloxPlayerBeta.exe\" %1" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-02c37bc51a384b8f" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\roblox 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-02c37bc51a384b8f\\RobloxPlayerBeta.exe" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-02c37bc51a384b8f\\RobloxPlayerBeta.exe\" %1" 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe - Suspicious behavior: EnumeratesProcesses 40 IoCs
pid Process 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 1504 RobloxPlayerBeta.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 3684 elevation_service.exe 3684 elevation_service.exe 3684 elevation_service.exe 3684 elevation_service.exe 3684 elevation_service.exe 3684 elevation_service.exe 3684 elevation_service.exe - Suspicious behavior: LoadsDriver 2 IoCs
pid Process 812 Process not Found 812 Process not Found - Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Token: SeAssignPrimaryTokenPrivilege 5992 AgentService.exe Token: 33 4660 SearchIndexer.exe Token: SeIncBasePriorityPrivilege 4660 SearchIndexer.exe Token: SeTakeOwnershipPrivilege 4660 SearchIndexer.exe Token: SeBackupPrivilege 1176 ReFsDedupSvc.exe Token: SeRestorePrivilege 1176 ReFsDedupSvc.exe Token: SeBackupPrivilege 1176 ReFsDedupSvc.exe Token: SeRestorePrivilege 1176 ReFsDedupSvc.exe Token: SeBackupPrivilege 1176 ReFsDedupSvc.exe Token: SeRestorePrivilege 1176 ReFsDedupSvc.exe Token: SeBackupPrivilege 1176 ReFsDedupSvc.exe Token: SeRestorePrivilege 1176 ReFsDedupSvc.exe Token: SeBackupPrivilege 1176 ReFsDedupSvc.exe Token: SeRestorePrivilege 1176 ReFsDedupSvc.exe Token: SeDebugPrivilege 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Token: SeDebugPrivilege 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Token: SeDebugPrivilege 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Token: SeDebugPrivilege 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe Token: SeDebugPrivilege 3684 elevation_service.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4660 wrote to memory of 1460 4660 SearchIndexer.exe 100 PID 4660 wrote to memory of 1596 4660 SearchIndexer.exe 101 PID 3356 wrote to memory of 1504 3356 2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe 106 PID 4660 wrote to memory of 5968 4660 SearchIndexer.exe 110 PID 4660 wrote to memory of 716 4660 SearchIndexer.exe 111 PID 4660 wrote to memory of 5360 4660 SearchIndexer.exe 112 PID 4660 wrote to memory of 248 4660 SearchIndexer.exe 113 PID 4660 wrote to memory of 5180 4660 SearchIndexer.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_0701689a27b762d6deeb01c3c1ae4ae7_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"1⤵
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 33562⤵
- Executes dropped EXE
PID:3800
-
-
C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 33562⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:1504
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3684
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
- Executes dropped EXE
PID:5068
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
PID:2732
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
PID:4292
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
PID:2620
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4484
-
C:\Windows\System32\ReFsDedupSvc.exeC:\Windows\System32\ReFsDedupSvc.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:1176
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:3156
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
PID:2756
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5992
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-650287814-2715975232-1279715623-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"2⤵PID:1460
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe2_ Global\UsGthrCtrlFltPipeMssGthrPipe2 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:1596
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵
- Modifies data under HKEY_USERS
PID:5968
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2964 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:716
-
-
C:\Windows\System32\SearchProtocolHost.exe"C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
PID:5360
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2964 2984 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}2⤵
- Modifies data under HKEY_USERS
PID:248
-
-
C:\Windows\System32\SearchFilterHost.exe"C:\Windows\System32\SearchFilterHost.exe" 944 2996 2992 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}2⤵PID:5180
-
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
- Size 2.7MB
- SHA256 4458ff1f9f0c53348db33377bfdfe94bd91f6b1f22fd0e31c3df852c5ee5efa1
- MD5 457f1185d06fd3a2081e0ef05cc1ed85
- SHA1 ffa35003b7ba8deb8ecde010320b3a2539fc7aa9
- SHA512 f56a3ebea8ee31d9fb062f9fd67e4bca41cb665adfa45ac615709c48d0407f6f930aeaded4ea0b04ee5f1cccf0e0adef048026c0a83be03dcdd251e080b0d6a4
- SSDEEP 49152:Lb+632BuPkFKRrdE6ohQstBhuXjfS4LWxnoMY9/FwK2OtW:Z3q6tjBKY9SK2Os
- TLSH T16BD59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
- Size 826KB
- SHA256 2c28c743590cd7702b3b30af57967aca71103369771e4cd504555f7237f5957a
- MD5 6857885c98796b71980c1787a9c201fd
- SHA1 3fc9e744d4b415e630541ede1cfa1fe2eaab178b
- SHA512 8a952f3dfd7184da6ffca15ea676ef1c02565a2a9f53a5b4a2b6d23edb1b74797560f8949babc4243529da837c4770e5aead11e618100477d507f8ae867f2010
- SSDEEP 24576:+XYfDtczAdfkYc4R/II+zE9ENax9p5rZY:dtc+MY9/FwK2OtW
- TLSH T1F105F118B3E409F9ED67827DC8A28511E633BC5543A0E7DB03A4A9661F337E85D3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7z.exe
- Size 1.1MB
- SHA256 dbcfe8e3ac8b6e7dcb6405e7436dff8fe62174de536a81e0dba66c32847bfb97
- MD5 daa4a2e97dc8760ce4020f3a87c54975
- SHA1 7dbe7ce8cf6374dc9469e69ba950ac3cd6e4d1ce
- SHA512 7042988decbf9d537c4e1e5b84fc8bed51710e4c5095c8253e514c801097e49f397aca3972f81a511620f50a93c9d7842d0c3f6f86d3c4a8b1d6f25dde7023b9
- SSDEEP 24576:10Le5ji0hmxnrMwfkYc4R/II+zE9ENax9p5rZY:1Pji0Ax/MY9/FwK2OtW
- TLSH T1AC35AE16F6B48331D073C0B9C5D2A68EE972348657308ACB4286D77C7E67BE6853A731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zFM.exe
- Size 1.5MB
- SHA256 341849e202a745de280e970f38bcf802971e6f58bc8491e16e3f9bafe249905f
- MD5 7ed128a8ac230218d8fd049b6711de7b
- SHA1 dd8343a1b68a68c9a931899d9e8cdd966d73fb8e
- SHA512 8d271d5c1f1158b2a0111210c77c16e6daafe5123a531740ca1ad13ad8b9190ed0d93e8b2b5e384cc834d894fcd2fd84fd21d0cd71fa3ff30f45640dca7ba96b
- SSDEEP 24576:Ta7/ezSC6vUyDZaqgrvWx6q8wyuufkYc4R/II+zE9ENax9p5rZY:+/ezSC6vURPvMHjyrMY9/FwK2OtW
- TLSH T1C0756C15F5788323D0B2D0BAC5D6BA9AFE3230465B3089DB0246D76C3E277E68536739
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\7zG.exe
- Size 1.2MB
- SHA256 caca2021f63bdb355a01afd0dcd809070e1391e4b63b651910f109dfc627e86a
- MD5 6ea3fa52a9f6d25675ab9649167d977f
- SHA1 d1f88b8a646b78887474ab3cc9c0195540141d17
- SHA512 4d50053f01119ad2a718a8b8711fddd30fee2756207ab4f75293c907cb8e3ed20c586cf1664ea7e1543ab03f0fb288cdb270d3a295d36f5c44fdb8a415c056e0
- SSDEEP 24576:xVbqPb88hv/lV7hfkYc4R/II+zE9ENax9p5rZY:xVO88hXlVVMY9/FwK2OtW
- TLSH T116559E66F5B48331D073C0BAC4D2AA9AEE32344257318ACB1246D76C3E677E6D636731
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\7-Zip\Uninstall.exe
- Size 582KB
- SHA256 a51dcad6275d0de1a1ef00192e8b71cb17a6b46b5d97014f0ade4b932019cf19
- MD5 95498287231bd78a0dea01fa518dd562
- SHA1 04c71a7e960d0850d2f8619185f84c8f8533094d
- SHA512 c0081a98313fbc5aa90bd26aafb6cea015926bb1c354680515573d02255b2af1e019b9a2507cd7b327ce0f23e914292c2c262fbd8d9f434075ce149fe22e5878
- SSDEEP 12288:FGUE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:FGUfkYc4R/II+zE9ENax9p5rZY
- TLSH T1EEC42309D2E08121E7979FB584FD58A4D23BEE55F0E0A0A21943FD1658BE7B4C8FE207
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
- Size 840KB
- SHA256 5b8f5f231a8e4d24cf76df4b561c632b477f2078db10873aedddfd56e36a81a9
- MD5 e10b33cd6ce5e70e9593cf5932bcada1
- SHA1 694e8ce835facdcf2562de8125e2029cd85969cc
- SHA512 b22ee47dca0564d1a99205f5f08914cc75b3681d858107a0ae17ba243ab67ebe9736045d63b61017843c769a7199c9fd86d9a3d2fdfcea00068cce0e23ffc8e2
- SSDEEP 12288:jeBNUbTVO86UJE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:jJIUJfkYc4R/II+zE9ENax9p5rZY
- TLSH T1BC05D03BEE38ECE2C27E8DB95A918640D77278704B61A3CBD165C20EDE235E05D7AC15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
- Size 4.6MB
- SHA256 a5b746a03c7d9828119cb6961aa61537e18472096f277a636d2771b40e6c04e1
- MD5 48c592a0ab5684f7c432e2148b43fe5c
- SHA1 85bc39d47661ae1d482223fab60f4aa259114276
- SHA512 8a80078a18c88e41e008b4b7337e97e169e7d7c72f775bb6770d1f5187244f77e3a85ee4d119a05c631bac8c9b808bdfa10054236daca8341116573e2e11706e
- SSDEEP 49152:kQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJp9DN5J8NRV3THC:kQvGAdlCEL8c/pRNw5CnY9SK2Os
- TLSH T1A2267C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
- Size 910KB
- SHA256 616bdb4471515d5582c9d0428288df7597bd15ad01f94e208054eb772316d7c0
- MD5 a5c238a6bd93b6f7759e0839b8227b90
- SHA1 5be88b3b49e2348c7a26530d4dea4889219ffb0a
- SHA512 88d201b20d7d2cc69bde11e2713e3aad6589357a53a13410d5513461f499347d45b28486b37ac5cdd32607043113a399c1089a58cf688056498b02236ee573b6
- SSDEEP 12288:vAwSfxL/2Dc3xDLLmt0LDQewsAjvE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx7:4wewsAjvfkYc4R/II+zE9ENax9p5rZY
- TLSH T1E315E031FA74D032C3BB0DB61B36C716543DBE204BA119C3E3A89D9E59742E22776A17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
- Size 24.0MB
- SHA256 9635b74cdfa1bebf3671d4438737b16cd266b9292167f605884a215ded8ffacc
- MD5 5accb97922d7983977349e7fb7b41c8a
- SHA1 835547fe374a6786b2e2635d580197b33016ffc4
- SHA512 4f7bbe7c1d28c8ecbfd05dd2e0b7abd6c365e8eb1f91ed5d65c83237b9c4d57c4bbc8b768d9ff5d0c7cf53b4256aa63387b4ad1b904fb4749b5f52704ba256b4
- SSDEEP 196608:CUEtQeTbvf2zlO12sJTv6Ja1cpVLy9IldPlbuJH:CUEtQevvqc2W1cpV29I32
- TLSH T109474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
- Size 2.7MB
- SHA256 cf566230b2e0e7ffe9cdd765a872cf1001f99d4cbfe4cf8ef8cfb169e7f6d2f0
- MD5 ee3405f4e26acdbec93edb309d842f46
- SHA1 07d7760d230bcfa5324bb6597789aa049ff21256
- SHA512 3c2df57ae2657c090db84dccfe594c34b263441deab96058f38dc72c9598e351f57ee88ac80191ee4625c22d0a2b1bed81e7261f66f6a0dfde9281e8be824d35
- SSDEEP 49152:SCbRquA/m2yL5zQfFiV+XenmE3/zPMY9/FwK2OtW:3oqtVjnm7Y9SK2Os
- TLSH T12BD58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
- Size 1.1MB
- SHA256 00f63a7166b1880074cc78e8b3e0c57024241388a167ff6bc6932dc027f89ea9
- MD5 96fc1238ef2fa46f3f12dedc81811842
- SHA1 9b744f10b92067a915ab9dbc008086dee9a1ef24
- SHA512 550b7f637da7a18c5b445d87590de1b0906173ca1bd1e2fe2d1584f1df7a3aab1870245dfa308dbf118614a8551dc27104be451b6e9ab038b45ab67f7416bddc
- SSDEEP 24576:AAhGLmIFoiwtA5l7S53afkYc4R/II+zE9ENax9p5rZY:AAM1Foiq5qMY9/FwK2OtW
- TLSH T12D359D81E7F945D4F5B3AAB899B69570EA76BCAA5E30C20F2150D11F0E33E509D24B33
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
- Size 805KB
- SHA256 9cfe78c3a2ac476ad0dfa108c48b3657f456ad89ea4e242c9fde1330e8862414
- MD5 c24e533fe3b8db849e7b483058d3d49d
- SHA1 24bc844434257688a4a9854786953115f6f05a50
- SHA512 3107a2d22abae692d0bac6f08fdef3f3d433079afddcd25bee747ec2627fe1dade8d0af045e895f27cdfb031a5bee32b478c5f213f3a5f0d0aeba12e32436f3f
- SSDEEP 12288:Tmw5HEjsChNOBFgl0WDm+COE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5W:ywuXOWLfkYc4R/II+zE9ENax9p5rZY
- TLSH T1C405F14A72E40CF9EAA78639C5978535F7B2BC022620D71F1760C65B6F37361AD2DB20
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
- Size 656KB
- SHA256 9d5f7fb2d3bfc31cd3af9adbd56152dd837a012e9e98a9d90061245a090ed4e7
- MD5 b29efd592079e893f074d5b24d99447a
- SHA1 059f9d54be89737f21ef2639cefdb489215c7127
- SHA512 28df24efe7dde2d50338cf1db53fe329daf367b2383887ba5354d7b0352f2f9f45084febb79d007d6de62d91afdbe4632029f0ea860589b9a2d315caa40e2a80
- SSDEEP 12288:1bZ1IyfE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:xZuYfkYc4R/II+zE9ENax9p5rZY
- TLSH T111E4124A23E450B9E293977DC8F54A44E372BC62737043CF1621A66A2F77BE15C39722
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
- Size 6.6MB
- SHA256 e42c6eeee6c09c7b7c0a727e08c090331286d97f524da8fc9de28987d2c1f9bb
- MD5 54b9c4c55a99dca69c1e64c25c4c83ff
- SHA1 aa614453182f7de8b262ff0db4afe817058bb800
- SHA512 c095de27a5efaa9e7964847b83c99da5ff98710fda54bf30cb109caf44cdb910132a57dcfb29e0422feda28f48a706fc36dc9152fda8d439d701566f70b4c8cd
- SSDEEP 98304:rQRQyi36YOcPuLvw2gAf+PN3GY9SK2Os:aQyiKakX+PN
- TLSH T131667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
- Size 6.6MB
- SHA256 4236bee3062bca6ded298fa1bf7b005e206a50321ea02b52c732e3cf81dc7c11
- MD5 c1bbf6fef94fcd6022e56b571b2c8114
- SHA1 dadc81756998c229c514498b6d8c24f4fab56dc6
- SHA512 001d1de5f53820ce2f773e236a3698a130e3e0a86c36b6c325739a158873e5d324dc596e3a0c9e61c0cca90310f548e96fef816225bccce1ad64eb9d0b6370cb
- SSDEEP 98304:+QRQyi36YOcPuLvw2gAf+PN3GY9SK2Os:lQyiKakX+PN
- TLSH T169667C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
- Size 2.3MB
- SHA256 75b8f2ef25daa2ff8ca6e2b0199293aa0dd5ae7a6831fe1ad04482b30c7c6136
- MD5 e5e189d2b1bcbeb65623ab7c9f0be9bc
- SHA1 a4984e676ff570285ae2c619064c30bcec501993
- SHA512 c37cdd58c81c22744fa7fc392dc24dfb5238bc9f6ec67a344603d882e52ebda7ba64e1acd279a45e93c4f677864a9dc6c4cd2ecd4fabda66866a7bb28923dbd8
- SSDEEP 24576:ewvLof6SRQ+rn/fDboqxN1nnh6C7DaHGTNHu7PNU3/5W/ohL0ofkYc4R/II+zE98:o68Qg55nhxeWu7PNU3//MY9/FwK2OtW
- TLSH T138B54A33B2F600A9C44DE1769F4A873196D27C758FE0E3DB851172161BB2AD07B3A71A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
- Size 4.0MB
- SHA256 50331f77134ef83ed781f21e702675352b0193f6abd0c864506685841aea928d
- MD5 aad46329c63cedaf4d2f0c7d67d23be9
- SHA1 f7ebe5d4f41af50555c09be2ebfd3a3d6ca4ad4b
- SHA512 449ed55cc2525dea089e26e3964cb349a3f791fd20d53d279407928e78cdfbe2bf81be57557e108a30d4aeb664df5f26ce7734e854c3751f5d3e4260030424e5
- SSDEEP 98304:Hy5112gYy5azzVvD69nLKnhZxY9SK2Os:aLIH+Wh
- TLSH T153167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
- Size 2.8MB
- SHA256 95f102ef3e5ed1a605ec4168ef9185e1b6b1111da9ae78d2a002111915d3d2ac
- MD5 bb0fde8d4c24866fd975e0fc69f99e77
- SHA1 69bdb1d99099d00f405da6663f0d4895b8f141b5
- SHA512 d80c00a4b6f9da829c080311cf14f83fae153f41c44104952f31d3d3c4f4eda1b2c31d5acfa6959b03dbfed21215cccc533f9512c44831d39717dbc1dd96e327
- SSDEEP 49152:zB+taZ3usBWOBr4tEGa0bqx0z+n217aau1gltMY9/FwK2OtW:Fu6JmQxd2d+Y9SK2Os
- TLSH T1CCD59D13F1DA01E8D05ED578974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
- Size 2.2MB
- SHA256 7a63c6c61af9d689ae0acf8ad31732160dee82fe6578749371d8e74e547d7f9d
- MD5 ad1e8771362cdd8a1d4d00784c99e259
- SHA1 02a709aebd060a5292caaeab240d926064c67dac
- SHA512 cdc2951013e270fd8d7e64c007371d4fc994f066929fec0724dca4b8e1e785b1f4fc5025d445d643be4529aefbf3b06a668da05b32f64cdfebdc387a832c683e
- SSDEEP 49152:O1hpsNoJpF1A6yU44CwH7R4xpMY9/FwK2OtW:OmifPVR7Y9SK2Os
- TLSH T196B5BE13F2D901E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BBE45B3D710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
- Size 2.4MB
- SHA256 7f17d9150921bfa03e808adb1de9ff8588ef2b5817916a137f25345553826290
- MD5 1c6c6fc86d863e8890b9408858218d62
- SHA1 6204bf6cd53985a72fd203327deb0b411ca41159
- SHA512 6725be8b756dad794e7cc59c3b6f08a88528897885bcae2bb6606051abd03844ea0a7868da8dfdd0928cd0db82511bb7d3478d343d24f3305c25e532e58c81d7
- SSDEEP 49152:ZSuZQIY0Be2KIRVtOnks6NMHqYMY9/FwK2OtW:35dKOi61NY9SK2Os
- TLSH T164C5BE03F2E941E8E0BED67487669232EA72BC464B34A6DF064072591E77FE05B3D721
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
- Size 2.0MB
- SHA256 5c18ba691c24406abbb98828f77b2bb2ca337b2d161c94ad9450ed25f338b491
- MD5 f82c019bc68da533b99890012dfeecc3
- SHA1 ac521359d9e3d1c2f129e2563d83ebca562d9b8b
- SHA512 3b050fd400b38e9938643a1e093429c0223bafc8d261afe33b2d1fd5d63cea4af89cf6614fed71030b9e3f4aa1a0a19f454ab4c82496e91f06223090447867c6
- SSDEEP 49152:UhtSn8EApI0figGgiDn0AP5wdMY9/FwK2OtW:1X2i/phvY9SK2Os
- TLSH T1BF95BE13F2D901E8D05ED178C7568632EA72BC160B34B6EF0A90B6561E7BBE45B3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
- Size 581KB
- SHA256 608398e8cac47129be42b78cb7b78b0dd1abbf8117e2fffa064863992d63bbf3
- MD5 bc00706e10fc8c4dbcab5de1ee1f85ba
- SHA1 6a1a01d67f78e9482321382d901b622cec710a16
- SHA512 0a617a7bffdb89c1ab9f2af68edfb3a7a5e980fef84b2ee3a472c9bd2fba3dbf95c93ac98632096f88e451df5199e76e6e3edbea327efde2d5189b7114c08187
- SSDEEP 12288:UcE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:UcfkYc4R/II+zE9ENax9p5rZY
- TLSH T151C4230DD1E18126E3439BF5C4B91894D23FEE5AF1E060B72A47F41259BA7B418FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
- Size 581KB
- SHA256 ed576360d2f548dda4311f18da228fd82a0fa59837311cb54ec1d737c85119e6
- MD5 739a130a4b5e5cdd8ef035f8ed05f79b
- SHA1 d57594c2b746be7fc16e4e57f47f63732348deb1
- SHA512 ef16b0aebc07ed74ed9b164f2cfcefd317304b3a923ae9d2fe953e7be71c6b41906bd42b6db225b0d695be2c35a244e146877a1684c91bdbe795cded61abc378
- SSDEEP 12288:4jE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:4jfkYc4R/II+zE9ENax9p5rZY
- TLSH T191C4230DD1E18126E3439BF5C4B95894D23EEF5BF0E060B72A47F81269BA7B418FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
- Size 581KB
- SHA256 5063d5aa1282259a65499519b629c7cce7ac09f59524d9f99264b160114f7fdf
- MD5 7af73ff3a9fe8bda9e8e1efbf8edf067
- SHA1 2543fbb63e5aad4ccf1f1f69798350dd751bdc03
- SHA512 a2b09f0b0247136323c086355ec41b29b9de7d6ea774058ca55af4553d7e882008ac96b99dcf1ced0042c925191da749467ab57c0a76104f3b56cc34744175b0
- SSDEEP 12288:DxE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:DxfkYc4R/II+zE9ENax9p5rZY
- TLSH T1CEC4230DD1E58116E3839FF5C4B91894D23EEE5BF0E060B72A47F81669BA7B408FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
- Size 601KB
- SHA256 685fe996da6887d6b0c1910eb45eee39edff79db6e80e7ac992c2405a848c1e5
- MD5 42aa3cc7914e1d40b3f491c621b04866
- SHA1 08edbbd88d77bc88f3855d66a8308fa15fb19ed7
- SHA512 16248ded2364fcc84a89c9bc63049dc80693755cbab46ba9920bfaa13c46957df388a012a51454d3e75fea2b643195fdf93672b6e99610ed9efeb9cd227f3982
- SSDEEP 12288:wV6E/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:JfkYc4R/II+zE9ENax9p5rZY
- TLSH T181D42309A3E54151E693DBF9C4B64450E37AFD96F27062EF1A02B8160DB67F45CBCB02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
- Size 581KB
- SHA256 43797e907f3f1554f516c1c35c335da485bf8d7cf683c29ba1dffa759872a45b
- MD5 e4d17c611acdaabe0ba1c11b5e6c89ed
- SHA1 d5c40403761e4cf987b1a3c58760fc9635a452bf
- SHA512 08290551e17d0e92861bebcf3c15c36c8de1bba9cc8b07de2710998197045b5789208d8c0b60445fd2e994509a9c4341ec2f74a3cab5c0b327e2c3394e4c896f
- SSDEEP 12288:hyE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:hyfkYc4R/II+zE9ENax9p5rZY
- TLSH T17BC4230DE1E58126E3439BF5C4B91894D23EEF5BF0E060B72A47F41259BA7B418FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
- Size 581KB
- SHA256 933ed3d401dcfc868c5b03cb384c125ce7d34bcdec96c2c877709bca1be24da9
- MD5 4d13d32cad3ae3a3193083e0a2f0617c
- SHA1 a3fcee2bc92b256cdd296e5aa618371df993b6ca
- SHA512 7ead2bc14e103afc3b98b5591bb3dc5be524bf220c901d6cad834eebd053fb7712f8110c7a600cfb8fbff34ca2203cdb41676d407169f59189fda94303ecf7ec
- SSDEEP 12288:TXE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:TXfkYc4R/II+zE9ENax9p5rZY
- TLSH T11CC4330DD1E58126E3439BF5C4B91894D23EEF5BF0E060B72A47F81269BA7B408FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
- Size 581KB
- SHA256 b674b41025dbf71364aa843bd2824be7f6f51c723ee960807b49e744ceca6e29
- MD5 fed3c1a9095b4379aac0a171dee55b60
- SHA1 e4a20d3a5dab0ae5370a75dd8f8874cd8b5b00b7
- SHA512 56c565bf66fe8cfb75d2fee233e52ae37afd14dcce6e6145ec35d00613bd3dcd49b89d87e57ca2f9e21ff0697aff162f3d08ff5a27b8467c031abefa711c513e
- SSDEEP 12288:fbE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:fbfkYc4R/II+zE9ENax9p5rZY
- TLSH T159C4230DD1E18126E3439BF5C4A95894D23EEF5AF0F060B72A47F81269FA7B418FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\java.exe
- Size 841KB
- SHA256 344831b9b829d1a1415912e41fdcc155c01fd100e1a200a20ef955ef8f72ffb1
- MD5 4d63e0f1b090dc5e3a84929ec2e6ff86
- SHA1 5f918b71a9885630fed09e9b6a37fa83e23c40fb
- SHA512 c60e39910b4d78e7a9bfdd3a03513b0b40df9eaaa5cdfc92cdde9d8c132c6e8da977e9815dee849eab459a58d61dec763692e0f696fe60102672e27d45b474ee
- SSDEEP 24576:iZMJzFVSODfkYc4R/II+zE9ENax9p5rZY:iZMJzfHMY9/FwK2OtW
- TLSH T1DD050289B3A008F4ED63827EC9658905D2B2BC5A57B0C65F03A436275F733B11C3EB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
- Size 581KB
- SHA256 a9e42031dd79135a97f7fed2dcf4465adcb11317f02a72893233d76935c3a869
- MD5 1f5c426940def00a0f094fe306ce6360
- SHA1 11f4d444145c1759615a1eaffc555fb62efc48cf
- SHA512 e4c6b813c62813c519a22fa5d383f61d7df45dc40f1755bab80d2dd5fd85b4ff150a1f5bb7fe0d3dd9351f3736cb0d2fcf076214016978865d6c6dfb5a8da599
- SSDEEP 12288:lIE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:lIfkYc4R/II+zE9ENax9p5rZY
- TLSH T164C4230DD1E18125E3439BF5C4A95894D23EEF5BF0E060F72A47F81669BA7B408FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
- Size 581KB
- SHA256 d970c0870d981feff588b1d27427375d08209f818055cd0ccd265a8e2bad2016
- MD5 bb619b87e393d3bd1a152c9d59df8fad
- SHA1 60ba76fcc6b418363958b4eb1d5524888a3a9efc
- SHA512 6938290a9656025744a98e411714759ab4bcf617d1259b18ea6caedc09d3f5679a9776ef34f0cadb2e02a89ece60b1bfae7c001cc1951ac6fdb999769bdf3952
- SSDEEP 12288:REE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:REfkYc4R/II+zE9ENax9p5rZY
- TLSH T18BC4330DE1E18125E3439BF5C4A95894D23EEF5BF0E060F32A07F81669BA7B418FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
- Size 717KB
- SHA256 1f5948375bef19e492ba4c8e0df4bee11157f51f0b7296b73c3578e93255f829
- MD5 e4615d4347a26f30dd9d1ddcb0a50b67
- SHA1 fdba9061e1028dfff8886086e07adf1e600c98d1
- SHA512 85003b38f4afddcc9d50d735ecc51d256346241beb86c8822cc2f63e8ac9ccaa84d55736783ba1b51d196064c4ce7d646bb10c4f6878aa63dff282478d29273f
- SSDEEP 12288:LyPz5L8fE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:mzyffkYc4R/II+zE9ENax9p5rZY
- TLSH T106F4120B73E120F9D2679379C8A21901F376BC3653609AAF176066362E377E05D7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
- Size 581KB
- SHA256 341301d8a0191c55c73075a66386515423ecfa854615ea16b9f4fccdafdc23f9
- MD5 b879830c11f97489b23b381186726c6e
- SHA1 85ead7b331786a4174ed7d78b89aa6ce1adabeea
- SHA512 e2fd61783c57e9a539e758799770c12ff3eb9219d6643f7942c3d555cd88528df49775a09d164e4179a555376a07363c8304fb21cfda89b9d2a95c0ccc4b60d7
- SSDEEP 12288:2IE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:2IfkYc4R/II+zE9ENax9p5rZY
- TLSH T147C4230DE1E18125E3839BF5C4A95894D23EEF5BF0E060F32947F81659BA7B408FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
- Size 581KB
- SHA256 4ad98ffecc353a26bd4fc303fdf79bafc43bba79d0af6fe94aab4f7a7ad8ba72
- MD5 b42205e0b70f1cb880469db66c71e23d
- SHA1 226468045b75c0cdcb70cfb82650b8ffe1928960
- SHA512 622da47d8db5ea1f0b65a735cd25ef4d4b4bc00f122911defb9863318305e151d88ccb40b8ffb3578c70028e18ca3f522b4f5784674ba3cb6f56108a1f1a48a1
- SSDEEP 12288:jIE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:jIfkYc4R/II+zE9ENax9p5rZY
- TLSH T1B5C4230DE1E18125E3439BF5C4A95894D23EEF5BF0E060F72A47F81669BA7B408FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
- Size 717KB
- SHA256 781835fd688897c7d9adad211219b8dfee60715545e9fe3d60e57362d2475e54
- MD5 ff9a11692b2ea7f45eb8d75345946f08
- SHA1 2f2add4e872ab479dad5803226f5e7e928be25f1
- SHA512 af909492ef209cfa5c08b731ee2b633a96dd130a3eab0791ae9f745b003836fcf55c6d50df17e1b8543af826752f551ae967609d68abb21cfd5dce1e611c0a96
- SSDEEP 12288:oyPz5L8fE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:pzyffkYc4R/II+zE9ENax9p5rZY
- TLSH T194F4120B73E120F9D2679379C8A21901F376BC3653609AAF176066362E377E05C7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
- Size 841KB
- SHA256 1f3e057ffacad9f91eadcc9a66686855fe0588373a404b9815fc1546e371dafd
- MD5 68e17baaa724a75dc3892f5b58fdb233
- SHA1 12511f26aec4cf2d7f5d0bdb2f2767c1b9015cc8
- SHA512 4f94be656defb79547b3de5ba6ed3c36a9b68ec61e505407ab50b20d9d46e880a3108511f28fd29c244ecfff07de8d29f878068559a2091cc18b1043386b5d5f
- SSDEEP 24576:jTuaLl3z0zDBfkYc4R/II+zE9ENax9p5rZY:jTdLljuMY9/FwK2OtW
- TLSH T1EB050299B39008F8ED67827EC8658916D2B2BC5A5770C65F03A436275F733B01C3EB56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
- Size 1020KB
- SHA256 d1c3ed173a0abd97ad9ed645ad1c298d1eb2641488fd035c1115f34ecd5b63f2
- MD5 3065a20dd4309160955f3b2f314fb0c8
- SHA1 59a0f465eb66525f940febff07458b2956e95248
- SHA512 4f98674f570e4ce9b24496bfc948d5374e1ed1eb5c16ffc85e372b7c42b38854c192b154a700b2d8c19a50162d048f0e94f7b0f4622cd8e3ffdc7a02f3613d8d
- SSDEEP 24576:E3xd9CHKy7GZFfkYc4R/II+zE9ENax9p5rZY:Oxd9CHKyaHMY9/FwK2OtW
- TLSH T13725CF90F3E400E8F1B79A35C9764511DA76BC9A5B70DA8F03A4651A1F33BE18D39F22
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
- Size 581KB
- SHA256 8030d6802d4d25b03e8170fce8d01b0a23f94a00342153f59ad586cf78c7ddec
- MD5 29923f4ae73a09ee548f7b6a899892e9
- SHA1 de975dd73ddcba18eaa37d31184f78b283c6eb08
- SHA512 698d8e151d8252950354cde5fc0a47b81fc68da4405060ee668bb9b4f441516a8e3fbe0d1278208603e2236af884d18df74fcb6a229a3e2cf5fde4939e85bb25
- SSDEEP 12288:lRE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:lRfkYc4R/II+zE9ENax9p5rZY
- TLSH T1D3C4230DD1E58126E3439FF5C4A91894D23EEE5BF0E060B72A47F81269BA7B418FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
- Size 581KB
- SHA256 56489ae79c0d9191df9bc6e090d7661c6ab08d246fc051bc31755259e979b98b
- MD5 71dcba883efcbacdf141de69485033f7
- SHA1 d9661c9a00a5891bdafbd842ba6d9c51a462b466
- SHA512 3659369e195a9b4c883612280115cdb4a51ad00a7b649efa3fd5ed825378480340e25064c468f59b085defabe1b838aa995791fb9d45adc88d7683384a08cccb
- SSDEEP 12288:C/E/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:C/fkYc4R/II+zE9ENax9p5rZY
- TLSH T17AC4230DD1E18126E3479BF6C4B95894D23EEF5AF0F060B72A47F81259BA7B408FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Java\jdk-1.8\bin\jdb.exe
- Size 581KB
- SHA256 283d4eb191af3b05637083edd29bad36a1bc608a131e97caf01fedef9c3468fd
- MD5 32d9ae1f6fa934682f2ded59081b559c
- SHA1 4ef201695383c4defb8ee6d86b06c6ff346dcdcb
- SHA512 d365134ab05329a9eff726f4fa3c745188891109e2746e3a48d7f361c9741012d54a489223faff3b82d61314157674c94957a5d94233eab164654f2e3c35076d
- SSDEEP 12288:UGE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:UGfkYc4R/II+zE9ENax9p5rZY
- TLSH T11DC4330DD1E58125E3439BF5C4A91894D23EEF5BF0E060B32947F81669BE7B418FD606
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
- Size 12.8MB
- SHA256 47f69d69053f0fc544fba146153bf0d3e5eb7d9639a532957a13df085beaad84
- MD5 e10ebb14f1b1aa35c0900fe4bc70949a
- SHA1 e92c7b5bf85bf698a435fea3a4eaaf3ad1de3d64
- SHA512 59dd7b466b5d6484fe932462453db85aa88fdd182d78cdfd7801f2947b72d044ab786f7c7ee3662f9b54dae847b674e5f57d1fa7b22bd6726459beeb64f81b1a
- SSDEEP 196608:6biFxIf3VMyl7PucCerZIivezX0b5w+Qb5+xfsXO:6eofVtucCerFveIb5ssx4O
- TLSH T1D8D69D6AA2F800E8E4BBD178C6565617E7B1B41503709BDF1AA046FA1F63BE11F7E340
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Roblox\Versions\version-02c37bc51a384b8f\RobloxPlayerBeta.dll
- Size 17.2MB
- SHA256 7b8286480d78c75e0ca4e36eaf74c4e5a8b2d9db2d4234b2b9f5a1705fb23f2a
- MD5 dd05685893318edf3d8f7bb9b39f831f
- SHA1 23cfdced6326140aa0e605e368ac3b67ae4e7467
- SHA512 5e5d3bb67e01b2cd7e11adfc312c319bd5bd02ae6fcef7b3d8d491f90d9af5de09d112de2e27fbbe4659be17a6cea26fecf774771cbfce229df5dca9149d032e
- SSDEEP 98304:YnGrj7L4wvniBPxw6nvCdErtotqw4DmCKA6mklapT5bH4Rx0GxL5MgGilj9rgruD:vrBsxXBKFhm2qT5bqFL+mljhk
- TLSH T18B07BF4EF1E60694C46250B0E16F93D3E722314C4A6C2EF7C6A942613B3379E9658F6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
- Size 1.0MB
- SHA256 97f17917907d1dc537192aa38befe128a27158b74f379f766d24439909f083ec
- MD5 562858c7803dfa1585031c2969ec0243
- SHA1 9b6d861cccb5c1d3ba77012389d52e414351a870
- SHA512 bf3ce1ebf13589d56fee593a8edfe0c61a36a7436da2ee91d08b600e160e9a7228e2d4dd05b191fb43d049567cd0b918b40bed71128a130172502f3fb0df7b00
- SSDEEP 24576:CfwvOk9RX6wkyAI0fkYc4R/II+zE9ENax9p5rZY:kMnYI0MY9/FwK2OtW
- TLSH T1D235D029EBD844E5E1B7923C89B7460AF2B1BC691B31C2CF129A536D0E37EE45D39710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Defender\NisSrv.exe
- Size 3.5MB
- SHA256 78de33fc30df79567a6b11ed57b0e0979d1c0cf4438ea7c1d32f66360339097d
- MD5 b2068433d6764f720b9d0b89755fc65b
- SHA1 61104e06988690605815195f20a65693506bfce7
- SHA512 2c78454d465837df7ccde6cd87380c0c05f4d53eae5ec557be397549b3aad8fbf0a7530bbb5d1101a6fb513394a7a75289470854c4ef8fa4e68f13e46c48dfe9
- SSDEEP 49152:zYjONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK09MY9/FwK2OtW:tySzPmY9SK2Os
- TLSH T16C066C56A1A841D5C1B9C1B98B1BCC1BFBB134090335ABEB03E556935F6BAF09E3E311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Windows Media Player\wmpnetwk.exe
- Size 1.4MB
- SHA256 116cc8f3740d089a7ab0c556b3bca4804e0e90e38901adedea82b74b912d01c8
- MD5 4392abe55fc7f5d4f89770c7bf723926
- SHA1 786738f087242230da50d2f2af4a6a5a906f05a5
- SHA512 242ed94fe9bca054ec957252182683bb2f4d259a4ad136b94fb41b60087c8f5f7ff529030b95f6dca1d7897bd70a5158559af50a20a1afb61b81d3e31030cefd
- SSDEEP 24576:F47Jb1aQZRaLfOrIhnjFN8rnDHU2+fF/AYzfkYc4R/II+zE9ENax9p5rZY:F47JUQjairIhCnDHUPfF/tMY9/FwK2Os
- TLSH T12E65AE1EA3EC01E5E1BAD27885154A5AEA71782E1B31CACF1270937D6F23ED44F35B12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\dotnet\dotnet.exe
- Size 700KB
- SHA256 1953fcaee1c14bf151191ef1b3c11b339500aaba6081485511733e91b8a4213d
- MD5 074e99b421bb3d7b85f5712cacd1731d
- SHA1 0405afeb2135ce685451df806c2aa65637eb8b2a
- SHA512 d02dd0d8b069a0cc446120c4fb5b08ccf710ca2c6a866f1964d70be73ed3488951743f786b67b5833afeec29b56d4e595e398ec4721c6082ac1c253506f57651
- SSDEEP 12288:FksfYE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:VYfkYc4R/II+zE9ENax9p5rZY
- TLSH T189E4F009D29442A8D16FA279C7564A40F337BC65A3E0D3CB16C1F53E1F7A6A05CEAB03
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
- Size 4KB
- SHA256 7ebf68add11357b1b6df3960e6c2494b37554cb0a5638a4f371194efbfc98291
- MD5 776f39477a3f1b6d585dd8b0d569cbf6
- SHA1 e97c3bdafdc1d71343e4dcdb55b8c2b172844bfb
- SHA512 a3f925e9e452edfcaf775fc94e855b7da29cb915e17c788d427212ba478b2ced242a14b851c996667f9c03d4ddaae39985ec83243898e18a07c5d2e60757d888
- SSDEEP 3:OlH/lEfARk2/Azo+XqPQl3yjJ/llS3mCllltGlslslslslslsl6Ob:KW8kmg+PwOjlEmCtEEEEEEE
- TLSH T10A811256473026E0CEF6BC7044B8A3544365F362F884C79B21043012CD462494C01F3C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\Roblox Player.lnk
- Size 1KB
- SHA256 a850517dc7d9099ee45b04415e9b305bbb3605b623265035d781395f3758c838
- MD5 c44c42942b417879a64f343edd14e5fd
- SHA1 d99480a05e6c59786253d7f36b5659998daa0e31
- SHA512 6aa8e23e649baf62d73ee97a5c421ab724b19ed4c5eb8cde62f107a342498844e23ea647bf4a95ecc65ecd921b64661d7cac7b66a4750309411df08d7a819ab7
- TLSH T11021D0600FA90727F5F7873578A606C1EF327D017A1A6D2E44D52249592A110EEEEF3F
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\perfhost.exe
- Size 588KB
- SHA256 cdebb82d6c1f70db3b30e94a2b6b733f185fd79a45caa4c13aa40cac0a709d97
- MD5 bf5a12a35d11d5d78054cb643565ccb7
- SHA1 e01e5a34556faff14c3d04dd2989be9b27d4884c
- SHA512 24bb8b545e59abd74c3840c015383cf4552e1a9eab449b574852ad6cf1e43d27126c5e3a75e762b5142242d8b03cf7c664a478961dbea45f452577547550bce9
- SSDEEP 12288:pM7QE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:iQfkYc4R/II+zE9ENax9p5rZY
- TLSH T14AD42309D3E48515F7A79BF484AD4420E23FFE65B3A090E36902F41668BABF44CB9707
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\AgentService.exe
- Size 1.4MB
- SHA256 e8b9ca7048933488eab0814cbee6ab7308e75b28a5fb741a8c4dc560356fbb8b
- MD5 ec86632332aef66064553ade93376ca4
- SHA1 5d4eed3b791453c06ef7afa6dca7f1cb4a737a48
- SHA512 0b3555fb3b6590f866d30424515ae03edd9c996e39e00d201c55a06cb9bd90a55dad1cefbc9e4dc5b0a7940e25bb4037c777d4a08b83530cd40f619c084a2db0
- SSDEEP 24576:9gb6bmBIi49WNNFpg1rSvFv7bYufkYc4R/II+zE9ENax9p5rZY:9gb4mBIBhGFzMY9/FwK2OtW
- TLSH T1BC659E1E22E802F5E1FAD2B8CDAA4417D6B278165331D2DF1151423D2F3BEE89D39B52
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\OpenSSH\ssh-agent.exe
- Size 1.1MB
- SHA256 cbbef2344af6363419b17273c46d4f113276fbdc2251a926c99ed8d64b9e0821
- MD5 660c28d8cfdce476f97749b29a6a9869
- SHA1 36ad9d089df8642d233ea289f35c84e76e0b23d0
- SHA512 00e2f21326df1d6790c4211f1f2c481eb1d0c2f7f4a1d275e9bb1f7140bdc205636e33e25f513d21f59abba0cb89cea559c5423d6f04d70e4d34df67880a3ac7
- SSDEEP 24576:VG88u8FpJqH1nzria7/mDfkYc4R/II+zE9ENax9p5rZY:Y7ZFPqV6a7/mMY9/FwK2OtW
- TLSH T16135F155B3E101F0D47BD13889864663F6B2B8251364EBDF07A88A561F33BE50B7EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
- Size 804KB
- SHA256 14509ccf9b78e1c8edc8ff5fab2422d199681825a2cfe69885764f35645cd2ca
- MD5 1841e0f8fb641702bd4e50b22f86ef04
- SHA1 a7eee26685c570233b433d8e123adebd0df77078
- SHA512 8ebcfd912fb3f98feb6860b3a5b2f3983f0917f97128f0028706203c5edb2eef0edeae4371cf3bce3d352e458c9b70ec3774f376909ecd9f544145f0ee5f4d44
- SSDEEP 12288:YHvUrBFrEjwaQHE/wJSYP9dkV2R/3QXoc3Im9SBcEblrEUoJx6x9p5rZY:YPUr+NQHfkYc4R/II+zE9ENax9p5rZY
- TLSH T1E005E11F62E808E5E677E17D85868619F372B8621311A2DF02D1917E4E77EE8BC3DB10
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\ReFsDedupSvc.exe
- Size 2.6MB
- SHA256 3ca2650635ba4e70e3ff3e9761e7931182a33280b4f397e7e74c18d629ef1297
- MD5 8497e990351772018ec483e9b303959c
- SHA1 94d37e8465e507e8aa91f13cdb5d2b8989fb642b
- SHA512 4b4f9d2e6c1deedf68b07a7b6a4ebd99eaccf802295a30c8b66e1e808058f6f5a2b23b40b446d61c7dc5aa98a7ac7537a9c7089f8975f4f8569a41aabad3b5a2
- SSDEEP 49152:xBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjXMY9/FwK2OtW:SG05lO43bZY9SK2Os
- TLSH T1A2D5BF6E62EC11F9D1BBD17CC9C64A0BEBB23815033556CB02A486A91F27FF4597E312
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SearchIndexer.exe
- Size 1.4MB
- SHA256 802d30253f9b082cb94ed257d954d6dd12a6d5e0e72eebf1a09cf83a12b0b1d2
- MD5 4c870c407de1b509b0730ee545242e6b
- SHA1 ece7ae730a68589891280edc473bdf35c12a05de
- SHA512 725025d1c1c85038d87603a92accd347a06ebb3d604fe540710c59d5b778d7db14665d627558e4d31267e4245fa83c5ca7ab542340f663f79edc16e4b099337a
- SSDEEP 24576:Yfa5POZ3dpuWVM50JicR2hG0lasx2+47eidn9fkYc4R/II+zE9ENax9p5rZY:ga5POZ3hJt2pasx2+m/MY9/FwK2OtW
- TLSH T11565AF5EA2FC01D5D5BAD17DC583461AE5B1382653319ACB022182BE3F37EF89D39B21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\SensorDataService.exe
- Size 1.7MB
- SHA256 014ef4cedf70c40f6d4fe58ff1ff776869fd89a7b45af9967b39bbe346739ecf
- MD5 d98369ee7451f82405431a2f2b5a1adf
- SHA1 33069871e531a3bf59d76449adcfd22c62580676
- SHA512 f0bed13a03e68378a5dda033975bae5854840f92326c669d07ead5458099e69a18ec7073d6541f02fc0f0a0fc90acef796de11bd65e77bd77f5b2182ed547a59
- SSDEEP 24576:eNcwHdjbyQ4nLC18lb/EOjowL7FkrfkYc4R/II+zE9ENax9p5rZY:eNc/zEOVHFGMY9/FwK2OtW
- TLSH T1D7857B1623E901E4F1BBE1BE89779946FA717869533086CF0291851B1E73BF45C3AB32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\AppVClient.exe
- Size 1.3MB
- SHA256 a08565f0f9c08e19f93411c73939fae5060a2a91ae6b1582c3387e8f91012416
- MD5 5b97430abde6e9e20593e1a29a418201
- SHA1 3e1b2ffabb8ae9a172897ae847e5501e061c5bfb
- SHA512 17d39ff5887ca6861bd33d55699935f8df504f084bfaaf617a961205a1ed6ff19568584f3af8ca14fb248b4895c8c5c39b57da709c0017807c19c04512548042
- SSDEEP 24576:e3kNvNnaFeYhJNtmZBm5fkYc4R/II+zE9ENax9p5rZY:e3MwBtOm5MY9/FwK2OtW
- TLSH T1B155AF2EB6F846E4D1FAC6B5CD238512E6727861133293CB5290C13F0E679D89D7AF21
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\Sgrm\SgrmBroker.exe
- Size 964KB
- SHA256 6eab0e59df5094019305d81c774dd4d0f4e5aaf4e48bab56342cc1982ebcfaa9
- MD5 6d749ccef26d25a8d27901555b84543d
- SHA1 9af662e082c894b68e2e95e0ea6bb8eb0a198d39
- SHA512 3a8d8ce84fa4ee698843c45735db500a3a4b01477d23c9b8c835117ee24a6851cb0b83a9f716c3664c1c3f3b449c287f0f13d7c7ad3386da79d8492ea85c9a87
- SSDEEP 24576:RD3FHshBIYQgA8fkYc4R/II+zE9ENax9p5rZY:RDVHeBIAA8MY9/FwK2OtW
- TLSH T15025E12DE69C04E4E57BD2BCC6638A06E77178A9032165DB0294D1BA1F7BEE46D3DF00
- MD5 SHA1 SHA512 SSDEEP TLSH