20822c17b7dabd79ab5d77a22b0dfb983a342ba2420df14cdc678784aab6807f

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Size 13.7MB
Sample261102-28mf2szy3q
SHA256 20822c17b7dabd79ab5d77a22b0dfb983a342ba2420df14cdc678784aab6807f
MD5 c515ef01f51194639bf56383726203ef
SHA1 b0fa5639264196e6a6cc99aa213dd505db8a16e7
SHA512 fa71e2f7a97aa0e071cfbfd56474982672d38ec6bdd2cc860dc37fbce5b922919da80944c4d74f12d3236f4d823029b3e91def7e04c03d3c7da95191d055d61f
SSDEEP 196608:sGNlRA0k5a4nF9Ljyl6sqZr5LT8EI3i5pAPtGEgiQk:sY8tFol6s+r5LT8EfYngiQ
TLSH
T160E69E6AB2B800E8D4BBD178C6465617EBB1B41603709BDF1AA046F61F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Custom signature

Detects executables containing URLs to raw contents of a Github gist 4 IoCs

resource	yara_rule
behavioral2/memory/3948-12-0x0000000140000000-0x000000014115B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/files/0x000d00000001c4c2-72.dat	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3948-84-0x0000000140000000-0x000000014115B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/3948-443-0x0000000140000000-0x000000014115B000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Executes dropped EXE 13 IoCs

pid	Process
4184	elevation_service.exe
5068	elevation_service.exe
1948	maintenanceservice.exe
1436	OSE.EXE
4748	PerceptionSimulationService.exe
616	perfhost.exe
4836	ReFsDedupSvc.exe
4132	SensorDataService.exe
2496	ssh-agent.exe
4304	AgentService.exe
980	SearchIndexer.exe
2020	RobloxPlayerBeta.exe
244	RobloxPlayerBeta.exe

Loads dropped DLL 1 IoCs

pid	Process
244	RobloxPlayerBeta.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe

Drops file in System32 directory 58 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\3f73bc4fc17a6531.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 3 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
244	RobloxPlayerBeta.exe
244	RobloxPlayerBeta.exe
244	RobloxPlayerBeta.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\PlayStationController\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\PlayStationController\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\XboxController\ButtonLS.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Emotes\TenFoot\SelectedGradient.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Players\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\category\ic-popular.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\StudioSharedUI\pending_withbg.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Radial\TopRight.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\ImageSet\InGameMenu\img_set_3x_1.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\InGameMenu\game_tiles_background_desktop.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\InGameMenu\TouchControls\unequip_item.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\ic-more-groups.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sky\cloudsfb.dds	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\Thumbstick2.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\PlayerList\NewAvatarBackground.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\AvatarExperience\CenterPoint.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\advancedMove_joint.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Emotes\Large\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Menu\hoverPopupMid.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Help\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\TopBar\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\DevConsole\ArrowDown.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\scroll-bottom.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\PlayStationController\PS5\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\InspectMenu\ico_inspect.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\InGameMenu\game_tiles_background.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\category\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\pc_window_icon_128.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\sounds\action_jump.mp3	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Emotes\Large\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Menu\hoverPopupRight.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\PlayerList\Accept.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Slider\BarLeft.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Slider\BarRight.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VirtualCursor\cursorDefault.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\MenuBar\arrow_left.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\PurchasePrompt\RightButton.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Help\BButtonLight.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Settings\Radial\TopLeft.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\BuilderMono-Light.otf	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\Controls\DesignSystem\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\RedSpeakerLight\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\InGameMenu\TouchControls\controls_phone_portrait.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\ExtraContent\textures\ui\LuaApp\icons\[email protected]	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\StudioSharedUI\pending.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\textures\ui\VoiceChat\SpeakerLight\Unmuted60.png	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	elevation_service.exe
File created	C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\content\fonts\families\FredokaOne.json	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	elevation_service.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	elevation_service.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-studio\WarnOnOpen = "0"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox-player\WarnOnOpen = "0"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\roblox\WarnOnOpen = "0"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\pmcsnap.dll,-710 = "Manages local printers and remote print servers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000fb197321206bdd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000bd1202e206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wmv\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wma	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4802 = "VBScript Script File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Defragment and Optimize Drives"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\dfrgui.exe,-172 = "Optimizes files and fragments on your volumes so that your computer runs faster and more efficiently."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m3u\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000df9b2722206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-175 = "Microsoft PowerPoint Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ead5cf58206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\MdSched.exe,-4002 = "Check your computer for memory problems."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000a9414020206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10021 = "Performance Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml\OpenWithList	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000046468d22206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Taskmgr.exe,-33551 = "Manage running apps and view system performance"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.3gpp\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000773cfd58206bdd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TTS\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.au	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4803 = "VBScript Encoded Script File"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe

Modifies registry class 30 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\URL Protocol	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe\" %1"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\URL Protocol	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\RobloxStudioInstaller.exe"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command\version = "version-7062aec9dbe74b14"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\version = "version-5a21b87bbc2641cf"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\DefaultIcon	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\version = "version-5a21b87bbc2641cf"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\URL Protocol	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\DefaultIcon\ = "C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open\command	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\ = "URL: Roblox Protocol"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe\" %1"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command\ = "\"C:\\Program Files\\Roblox\\Versions\\version-5a21b87bbc2641cf\\RobloxPlayerBeta.exe\" %1"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell\open\command	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\shell	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-studio\shell\open	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox-player\ = "URL: Roblox Protocol"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\roblox\ = "URL: Roblox Protocol"	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe

Suspicious behavior: EnumeratesProcesses 40 IoCs

pid	Process
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
244	RobloxPlayerBeta.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe
4184	elevation_service.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	4304	AgentService.exe
Token: 33	980	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	980	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	980	SearchIndexer.exe
Token: SeBackupPrivilege	4836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4836	ReFsDedupSvc.exe
Token: SeBackupPrivilege	4836	ReFsDedupSvc.exe
Token: SeRestorePrivilege	4836	ReFsDedupSvc.exe
Token: SeDebugPrivilege	3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
Token: SeDebugPrivilege	4184	elevation_service.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 5588	980	SearchIndexer.exe	100
PID 980 wrote to memory of 2288	980	SearchIndexer.exe	101
PID 3948 wrote to memory of 244	3948	2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe	106
PID 980 wrote to memory of 3936	980	SearchIndexer.exe	110
PID 980 wrote to memory of 620	980	SearchIndexer.exe	111
PID 980 wrote to memory of 4304	980	SearchIndexer.exe	112
PID 980 wrote to memory of 3268	980	SearchIndexer.exe	115
PID 980 wrote to memory of 2604	980	SearchIndexer.exe	116
PID 980 wrote to memory of 4776	980	SearchIndexer.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_c515ef01f51194639bf56383726203ef_cobalt-strike_coinminer_glassworm_icedid_njrat_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3948
  2⤵
  - Executes dropped EXE
  PID:2020
- C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe
  "C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 3948
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:5068

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:1948

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:1436

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4748

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:616

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:4836

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4132

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:2496

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4304

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5588
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:2288
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10003_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-4280978039-528710165-233981602-10003 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:3936
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2988 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:620
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4304
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3268
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2996 2988 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:2604
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2944 2936 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Debugger Evasion

T1622

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 39499231e6ef025808996a4410c23e013930d0585fc00ae3be9d4118b5d89563
MD5 53bc732f4c19da06c5c3f94d1d39c7cd
SHA1 562df83a5d26883385c2237057c3618e12cf29a5
SHA512 7fb2a49f0f187285d3e3f7bd79259031b536a0d23cb7ee8d02579dfcf9d383f782340dc0a0d4108e7ae2112c5f0b85c5def5764541eb4cea58d5091a2b471946
SSDEEP 49152:pb+632BuPkFKRrdE6ohmstBhuXjfS4LWxnd7TLednOWy6:/3q6HjB0LeRk
TLSH
T120D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.7MB
SHA256 a587af42b468c471eca7427e461757783481cfe9510c23a1180fa2a47daaa6e4
MD5 a5222a4438e58e8347abf560829539ee
SHA1 812ef68dd3b3c823e633ffb23a5fb30bea815e93
SHA512 ff9c0ed189216590f3299adc3c4da6840bf0d856782cbfd55f6aad6a4d60e73f15cf7fdf34643de8cf355a963f398afc733d98b28b2ac498453eeb9c59cdc1b8
SSDEEP 12288:A1XLsswWkxy2lRq2czAe5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvp:WXYfDtczAe7TTzucS+VednOi33Dpg6
TLSH
T1FA85F128B7E408F9ED67813DC8A1C511D633BC8547A0E79B03E4996A5F232E85E3EF51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 2.0MB
SHA256 7d06e5834acf97aa23f85299903785c45a417c61440c98772a4349bf698c6e2f
MD5 b2ecc07850f672f6088a7b11592d4271
SHA1 2c78f5f996b6fe3405dd8a91e5c1d29a9aaab1df
SHA512 77b74fd45f396b22d1a53bd12d8265e4b5c54c2db46099da599f59793a50954aff2195a561157c4ce5c854d4aed3fa6b6ef4e87d16167689abfb28348f68c44c
SSDEEP 24576:70Le5ji0hmx3rMF7TTzucS+VednOi33Dpg6:7Pji0AZE7TLednOWy6
TLSH
T1E3A5AE15F6788331D073C0B9C5D2A69AE97130865B308ACB4286D77C7F67BE6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 317100455d1cfd9c1910dcf1b88dabede7e5ba5aab6b07cef28367426e9f2419
MD5 162450b0a8d637723d3248d92635f917
SHA1 951bb8ff7fee11df25461e819ef5e2ed24c1d3a1
SHA512 5ebd3e70f8cfc034a0f97351cd04da9ec458ffcc2923ef272cfcb7a2398373f02ac0e01d5547f23af8982edae5882ce797cee651d59273ea34df615889987fdc
SSDEEP 24576:ya7/ezSC6vUyD/aqgrvWE6q8wyuv7TTzucS+VednOi33Dpg6:V/ezSC6vUzPvxHjyA7TLednOWy6
TLSH
T1B2756C15F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E68536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 d1d88cb3dbc886003c3fe67ba663bb03d1ea0d5831b82659825e8ff0671961a9
MD5 35c3628d565f76ad8b937d9cec0e1f1d
SHA1 94c96e5296cb39b2ceb7a85b92207075f0b3f7b4
SHA512 dfba7a5fd8114f3f9a3cc55fc7c0e39bb21297e240913a921a8e86c252a472ef25196891ce6396fd019e1189160008b3ee875a4e93dbfbb2376327bda02e987f
SSDEEP 24576:ZVbqPb88hv/l+6i7TTzucS+VednOi33Dpg6:ZVO88hXl+B7TLednOWy6
TLSH
T1C1559E66F5748321D073C0BAC4D2AA9AEE3234425B31CACB1246D76C3E677E6D636731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.5MB
SHA256 5ba1fd60b1f7e6e8cef6c86bd6d0d83d956eac2a16000ab0c1c8b0e3934ec1ba
MD5 05aedc49338e313ccdf028809a551f82
SHA1 49a65fd55d8ec9363d9eda9ad73723c7c4178868
SHA512 d39d8a7ad750ab93f639a63a501a359e852360d31252df9572719dce63489cf8eec49c0e717edbeddcc2829bc24d07afad76885554373adc29c9512cd121f8f0
SSDEEP 12288:dX55Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:dX57TTzucS+VednOi33Dpg6
TLSH
T1F6652308E7DC68C5F3B749371814D4E28135DC8DCA94E6638D837E4EE8750F8696AE8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.7MB
SHA256 757ebbbe94bf5fc2d36c1e974ac154b01f97a4e5f7fa78318f6aa0c297ce007f
MD5 e15f27b29b5592380e10ccf0cfbed157
SHA1 6dda017727f0ead1c78380fec709ecdcb1db6749
SHA512 bdff2a35a042919c5731244c25b2b4fe9371038316f44150e4eca3aea3573890903e85cd5a89136688193d902357797a97bf7bac39ed7a02e79f2cdce2105613
SSDEEP 12288:weBNUbTVO86UK5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:wJIUK7TTzucS+VednOi33Dpg6
TLSH
T15A85CF2BEE28FCD2C27A8DB95A51C640D77278704F61A3CBD165830EDE235E05E7AC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 e711094653e3793dba0a01510a26c5ce2245b84c91f34b8d6f10e9c6afcc755d
MD5 5e7a80b2e85c83d664daff19d8494418
SHA1 67b005f7fc3d637509523ae20badde780d3b092f
SHA512 12e5d6912362e797bce125aff5b3caf74cc5034bf6976d8705cc624cdd5a7205482e816ce055f16a7d0b795bc921e2bb1c842d213c46a278c605765d05f95777
SSDEEP 49152:lQIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJy9DN5J8NRV3TH7:lQvGAdlCEL8c/yRNw5CvLeRk
TLSH
T1EF266C656BF880F5E0A7E178897AC5B2F7B678420D31EB4F0291C66F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.8MB
SHA256 fa11e7cbb1b6582aac377df3698bcf0e73599f404321d135d4b654f0cb62d1ac
MD5 c355753370247256e44b64a8806b45b8
SHA1 b415f508027c22983a7095c836da8c74a9f60b6c
SHA512 3f94077a407cc53b906641cbff85a06c471e982207f31978e45e53fb228b84459ea588b177dc5b553f95c3831add6503d4beb9b19e4726b6da3bdbfeda943447
SSDEEP 12288:2AwSfxL/2Dc3BDLLmt0LDQewsAjU5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGa:LkewsAjU7TTzucS+VednOi33Dpg6
TLSH
T18295E030FA74E436C3BB0DB61B25C716543CB9604B511AC3E3E89E9E99702E22776E17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 23e6b46a792d59565492e1ab67a50f6f730bc0607acf0d43120e41e89e117a88
MD5 fb16819b230b2be9815f929bb5d30cf9
SHA1 2ab14ae467d1ce9e9f324f1af92a9afd47458af8
SHA512 0218cdeba9a76a8771c8e99be8dd768884d4385b9da33075c04e4192f15d4d545f8d3521cf259e1a4d9206f04cfa7510ec737010095a4de56674f0dad4561148
SSDEEP 196608:JUEtQeTbvf2zlO12sJTv6Ja1cpVLyEIldPlbuJHWQk:JUEtQevvqc2W1cpV2EI32WQ
TLSH
T14D474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 d8c0328bf0175cd9bde9d07ffd2339bda346bd9be8f72c79b9d1262522c48bb5
MD5 f91cc4f2a6fece87071151c1740a1cc4
SHA1 9a940d38c9f1fcfb2cc429de8a8aa48ebcffc5a6
SHA512 823bfb22f659e5d6fb9c7beea0d92ebf95ca84c2d71254e8aa1849bea159e33650ff07ef16098fb62bbe4167322e1107892ec0a4d34aebf8800ab394d1235d25
SSDEEP 49152:MCbRquA/m2yL5zTfFiV+XenmE3/z07TLednOWy6:loquVjnmzLeRk
TLSH
T159D58D0976B8C1E4D1F6C77886A2C647F37178154B31A7EF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 3e0bed022f81153427661a9eb7558fc42f6e8a7a5c895ece53805b0abc3a8fc0
MD5 b916a8004a17a70d05042f3ab7a6dd7d
SHA1 9c4ec4ead5f3cee935e642f592fe7273b9dbaa47
SHA512 19bd92a0bec3c9eab9631a8c3e3a8b231ba9cd5ed497f80879741e81112154846278712e2b2dc090ea5d6ac3b6f4c1fbce212952f1afadb892565da34fbfa202
SSDEEP 24576:0AhGLJIFoiwtA5l7S5377TTzucS+VednOi33Dpg6:0AMyFoiq5r7TLednOWy6
TLSH
T11635AD80E7F955D4F5B3AA7899B68171EA76BCAA5E30C20F2150D11F1E33E909D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.7MB
SHA256 3c72a7d7b384893fd6f1c56b1bc13b644a1d58bf279a038fcae1be08a0bb832d
MD5 4db318a156ef0b97f21c02e2c3f6fb76
SHA1 e4a2e2b0b2c015ef3c51628c89b792ae0b0b51d8
SHA512 22833ae82d36aeea4ff2019eca6b65ed1d79540e414b8891f2194c4526e981daf2bfef094352726afdfd8d996c036a1dc4d83dad23ca1e82922017e77db6b664
SSDEEP 12288:gmw5HEjsChNzBFgl0WDm+CP5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZN:9wuSOWg7TTzucS+VednOi33Dpg6
TLSH
T10D85F14977E81CF9E5A785398557C132E7B2BC062A21DB1F07A0C65B6F332617D2EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.5MB
SHA256 8b9465dd3de7a09fa3962164cba7263e7612da044ba8e5d8469d161c8fa116a2
MD5 2023add4f1f0a9b0b676e13a809ab680
SHA1 7197020a312bff11c1630c2d7a1f0f262c359ac9
SHA512 68d9f8a2b5019c1161f8dfbae8a1dbf5f3d0a40365f82d047ba7024d15b18fbee7376dea200cb7e765e3a97beed845ff6d6a81f64f1450124fc5abc9c1fc9702
SSDEEP 12288:7jZ1Iyk5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:HZut7TTzucS+VednOi33Dpg6
TLSH
T1D575124D33E830F9E2A7853E8CA08591C371BC46577193CF0662565E6F73AE52D3AB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 f7f4b76ab888fc0ce13f467435b23f4a66cff91126f8d9145867fa80bb3a7c94
MD5 c958fe89f2525c646b7f8d8b65418e89
SHA1 9965b77dd53eda819f66c9a8141d4f5c9af6afd3
SHA512 7c70763de481197aed5f5cbfd57d0c4550b5060de21d60034c5593a34fbf16400e9e5a698cdb89f0f2c223aae1a59bc6ed6196ea6dbe18726716072f851df8d0
SSDEEP 49152:9j8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:UQRQyi36YOcPQLvw2gAf+PN3QLeRk
TLSH
T168666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 633ef55c7dc3e25957f630041bcbbc5f1d2a284e89835627e3a1f8a927bf86b1
MD5 233474633a4dc8f557ee281deecd0004
SHA1 32bbb13102f2869fef3631ee006ab63b4a457058
SHA512 c4dad06a8b1a3959d4f5af0cc72e49ed1e983256f2d5c371baa9c2ca072aa99b3ac55a9dd0476563090664afb9d45bf30f6dc9a6b887b1fb45a7771b5a3f0cce
SSDEEP 49152:Bj8dh0WHt5BUp3DJf5SUYLoDpgLjSTYlQcGeMAaLSF259ruMHwpXMi4FqJLd23U3:IQRQyi36YOcPQLvw2gAf+PN3QLeRk
TLSH
T1E3666C03F3B501E8E05ED974CF3956229B757C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 57efcf405bd20f2079917b02b3e065ae8f02c3cd1597f51e75726ba0ab3da947
MD5 2158bdde6057719755715383ba4682fd
SHA1 9f096103eac23e1f39c7ddfd4bc16085b19a07aa
SHA512 bde1f7934f5f895a44db31af3bd8225b18f631f09918e35892a5df6792b8c8a79606d5ebbaa1efd65a7b962ed988fab30949be36120e075c8c37d879669447ed
SSDEEP 24576:WwvLof6SRQ+rn/fDboqxN1nnh6S7DaHGTNHu7PNU3/5W/ohL0d7TTzucS+VednOa:A68Qg55nhheWu7PNU3/E7TLednOWy6
TLSH
T128B54933B2F60099C44DD1769F4A873196E27C758FE0E3DB8551720A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 4afa9c0848c14afb7a1aecfa1930ad92c14d5ff581c792f9f8d39fa4bc0b9d9b
MD5 f0c60dc207b78071146e0609b38ac70b
SHA1 1b70eba2971f5cbd8249f65750db1a91eae1d7ab
SHA512 11ecf9bf0912fab811a531ed07d5d242dd7051b0981714d6c170de7bc09b2adf3222f935dcb5ea4eaae831457f197bb1d02c83ea9a4a6c18ce18ec5d91cca085
SSDEEP 49152:z3aPC0pEnRdp5x0JcB12Mnc0YyNH7W9H1zzVRlbUN3Oh6tznm2FQ/nho2qkrk99B:my5112gYy5azzVvL69nLKnhZRLeRk
TLSH
T1A0167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 02115edf805a227b803d672612b64018bfe47d7e38168ac150921da04f343b24
MD5 2a84d22bedb906d9338fa195dcc5da9b
SHA1 0b00d34870969cb42d53d0394e3bb490ce8390bd
SHA512 1655d76268d0606bcc188276e25b69cb8cdb0c8990f4930d8c67ec8099725072fe5b51347f5e60f6d6d414a716a8bb83e77d801de75b3685403fbc891cebc53f
SSDEEP 49152:sB+taZ3usBWOBr4tEGT0bqx0z+n217aau1glO7TLednOWy6:mu6JmVxd2dYLeRk
TLSH
T1A1D59D13F1D901E8D06ED479974A9233EA62BC490B34B6EF0A9073562E77EE46B3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 7f2951963c7e715214ad748e4c21d41078fa2de5c9e19c1f4af74a169262d4ca
MD5 361ad4a716519d898cc7076edc7723df
SHA1 866c96a283c51b4ec4676d7b2bee6b71b71c4495
SHA512 c7cccbcbf5f45f51454d8316a2261e2473e4a44119223944377356acee4aaf862b67bd8f20c1aaa95dfcc7349d9f78d2e337c751dc14c6669a0ad965699fca1f
SSDEEP 49152:Q1hpsNoJpF1A6UU44CwH7R4xq7TLednOWy6:QmifPbRzLeRk
TLSH
T103B5BE13F2D900E8D06EC17987569232EA72BC460B34B6DF0A90B7961F7BAE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 d1758e9f041d9152cfc0427e07a9c8c961266bff0da900d203ece25104f4a352
MD5 e3908762aa2f80ae930eceb4afd9cd44
SHA1 48a0cef16952dea6e0dcb49f83b6fab705040fe6
SHA512 da8e82ec1ecd064bc97229d37de856ae59f9e0e5f880db82b7cf64c449a45de531843425a9e27cbddbae88ffc8a72f937457a29fe40e60eea436f0c52aaaba25
SSDEEP 49152:TSuZQIY0Be2KRRVtOnks6NMHqt7TLednOWy6:R5dKTi619LeRk
TLSH
T13FC5BF03F2E941E8E0BED6748B659232EA72BC464B34A6DF064072591E77FE05B3D721
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 5a44dc5fcc9aa25e005bc9de493cd35f1283f18bdeb264daf49b0bc18727e5fe
MD5 05f79b32061ebe398f2a727aa4c7dd0e
SHA1 5009f7c630f4d9d1424a90e642f886511a1ab59b
SHA512 cf5c920310e2ada423abc2b22c42ab8b72957a7300007980aa316324a2aa6da38e9bdbca58f2edf5bde80bfeaa4bc62fa6687a5bbc9215ab32ef60bbbfef82fd
SSDEEP 49152:phtSn8EApI0figngiDn0AP5we7TLednOWy6:YX2iyphHLeRk
TLSH
T10A95BE13F2D900E8D05ED179C7468632EA62BC060B35A6EF0A90B7561F7BBE45B3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.5MB
SHA256 873c8a1392723e7c5db18ebe89b467f6968752638329c6202f501725cbd57569
MD5 407640aae013c00476b5b28320af20f6
SHA1 bee537f4dce3f43d960a2162d2c3960d7ead9751
SHA512 36aa8da7babc572a4ba312570aed96c1140f1c65ae1ac39dc39d74b74a2393ae5976ff5b8b8785e18cd7458e83362918db6ede22e3cde8506857168302a7cc73
SSDEEP 12288:xB5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:xB7TTzucS+VednOi33Dpg6
TLSH
T10365234CE5DC58C6F26689774800C0E1C134DC8EDB95A1679E83690EFEB25F4396EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.5MB
SHA256 e94d2fa1578991e9b3a2493f538860bd3353a433f5bd8d3f6997fde35929e757
MD5 c4263df7921ad2a01b4ff977f4733d04
SHA1 c0afc3cd6ac6c9abd8eaee1f82e5dbb1abeb336b
SHA512 a6c690c0f8e067ff5163ea98443861c7edc9e95aea7c85da3716ca820430a31a3ec1845bde39f8a2bae51f73d91263239ee2fb4c6d6b9dc16bfd3903d45f120a
SSDEEP 12288:145Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1M:147TTzucS+VednOi33Dpg6M
TLSH
T10465234CE5DC58C6F26689771804C0E1C134DC8FDB91E1A79E83690EFAB15F8396EE89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.5MB
SHA256 32283c032a7051fa206c021e484980caaf621515a6f1fd1d433a73eaf18f2c53
MD5 f9409df2c56dcf73e4bf78d07362b524
SHA1 1b6782ecfb4f3cf840ef415287bb95f6cd962659
SHA512 492ed75ce211347795f5ec31a9e992fd801f6ed7772cba648acef64bafd21f3e9401b7d6b7ad0344e02121fa3ec9e1a7c2a65a878bc9b41e37b2ebdabb1861fb
SSDEEP 12288:aS5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:aS7TTzucS+VednOi33Dpg6
TLSH
T19765230CE5DC58C6F26689771804C0E1C134DC8FDB95A1A79E83690EFA725F8396EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.5MB
SHA256 f4743b33a00df3cda779bf0f96fbab5a523e38b757220f0cff895dd5dd71efa6
MD5 42ef0a33b9f112b3e56eff70065a5b2b
SHA1 bc4f66a1c7250fcbcf8d3fd3bea92d422b809670
SHA512 24c35f56b29d6eaa52c7fae6430bdbf0f5793fbf47d3ce4d2ce54f358b9e717ebf87caccb2dfe1c3164ce9b982774f6bf76c88d7fc4c18fe7894b437985e7d52
SSDEEP 12288:0Vb5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:G7TTzucS+VednOi33Dpg6
TLSH
T111752348A7EC54C5E176C57B881080E1C275FC8ED771A7AF8A43194E9EB22F42D39F89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.5MB
SHA256 0bad7bd26c43e9a8ab0def7cc115cec4d40de75281ab089f9133322000adb269
MD5 3c227b04a3698356bfa3682919907055
SHA1 d301b4488c82c7f60fb96e2e67ece75f0e606762
SHA512 d676b0c09416cab9591d47092b39f58eb72f4d83a6edf8cc446f8104cc617a08c8f9185cee31ea50b3e8936b61836b4cec788c5b1274c7082986b964ac29f235
SSDEEP 12288:0T5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:0T7TTzucS+VednOi33Dpg6
TLSH
T16C65230CE5DC58C6F26689771804C0E1C134DC8FDA95E1A79E83690EEE725F8396EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.5MB
SHA256 7aedeb67ae0ae186ec8c7dbe40114dd1e12a98e82aefb8c65d168f98a5d7ffa5
MD5 bb10e6794d5479d2b956bbd8feb85148
SHA1 ed86c9d90868ae86141918074d2b671055d91956
SHA512 e40add570a7724e7123ad8358a5e9efebc62381c67bc2fd7ecd5de72fb78a2523ee06765690a1901b235bc28fa2b3a75daf20a9f62f813c929683af713fcb53a
SSDEEP 12288:F85Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:F87TTzucS+VednOi33Dpg6
TLSH
T11565234CE5DC58C6F26689771800C0E1C134DC8FDB95A2A79E83690EFAB15F4396EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.5MB
SHA256 6d8e40930a023867b18075966065b0ea965490fe99a11a5c45093d4eb68ce2a7
MD5 68247b220eea90877a6642ffe8c2902d
SHA1 34101958f7bbafa66ac35fc2f5e2a7fe901aae17
SHA512 1ac4684f279e0f266d878e95ee79daae409dfbe328bcdd69e242d37ae7dfd07bdd35b3be819289160a49537c5174b823a2a9671d2b09caebb1b93de9e2fcb382
SSDEEP 12288:RQ5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:RQ7TTzucS+VednOi33Dpg6
TLSH
T1C465234CE5DC58C6F26689771804C0E1C134DC8FDA95E2679E83690EFAB25F4392EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.7MB
SHA256 c5321524184ee6001abc2f21c936d10be2148f71924d9ad78cdde9d102e53ead
MD5 c5174768b4046134f8c6ac65c063ec14
SHA1 6fb5ba683d0ca7f4a64b55960d695d9eb5510240
SHA512 7866f80212d16dd13a32aafd5e5160a72d306a31ee006827bd085f9475c8198960f3157fa8b0c97e2a0986bedf810a9c474a71090f17f976237b84dee4e79ff2
SSDEEP 12288:uiZwbHzzFEoS2cPvyY5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:RZMTzFVSOY7TTzucS+VednOi33Dpg6
TLSH
T16B85F194B39018F8EC67813EC8158952D2B2BC5A4B60C65F07E5362B5F733A11C3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.5MB
SHA256 3582d145295cb0e86b0405e1296d6862f7b958ea8ffa911eb5eb9fec1f16a71d
MD5 ffec14e07368347dd8dfaa509d9321eb
SHA1 669ec26b249c53a1fd1a68b7a83ddb556e8097c4
SHA512 6c61b9067df38c574aac20d0ed2bb6792947fa4da855b982e182fd0ea91154796e2fe3a3756d72213429922384414adc5ba5d681c45b1772c58c2ceea83ac5b3
SSDEEP 12288:k95Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:k97TTzucS+VednOi33Dpg6
TLSH
T14965234CE5DC58C5F266897B1804C0E1C138DC8FD691E1A79E83690EFA725F8396EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.5MB
SHA256 33d218cd92d2bde26c2dbe5b76a16dca04e65eefb98f2dd283ec4acb0fc73104
MD5 5aec7524159f0e86d8afe9a3f5a08429
SHA1 c732f0cb4190c7df2fb7567979ad62c60040c590
SHA512 dc94f5745b3f7ed32f8e5988018f2a27078f59963d0a0605941f59c9a535d0558058743d035f6034f7808e31e2a356b32f353f1a9993b714cae11fa809d0e683
SSDEEP 12288:AJ5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:AJ7TTzucS+VednOi33Dpg6
TLSH
T12665234CE5DC58C5F26689771804C0E1C138DC8FD691E2A79E83690EFA715F4396EE89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.6MB
SHA256 162fe3c354af58aba4643133294bbf9c2977ca29820cc087c65b0e1c1176bc91
MD5 ec198c15ab2d2ebcdad41b51a23386b8
SHA1 e7ffefa458a5e73f839164b3317e83d11d108e08
SHA512 35d7dfb1e6c9e4e84a89274c434ebc11cfa1ecac583ae3cc71ad1a762d5fac863308102fb2a30985f992e817d96e08c3eb52bf80a036cc401f86e8756524700c
SSDEEP 12288:eyPz5L8k5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:Dzyk7TTzucS+VednOi33Dpg6
TLSH
T17B75120B73A430E9E177823988515952E371BC7647609AAF57A1077A6F332F06E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.5MB
SHA256 43a19319be65015411c52251a2475df132adaa370d654f87852ab866b4313b69
MD5 7b17f91032db96c1213a59c09b568e41
SHA1 1baeaac61601b652f9650fea3205c3dec05fd832
SHA512 07bd8416c50809f9dbd874f59fda1ad94f3cfc4181a8e752f72e8f18c6c8e648984bba6cb5581e0152a2224e0a6025c979d95a5cd054a255e4337b3eb8b7bedc
SSDEEP 12288:l95Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:l97TTzucS+VednOi33Dpg6
TLSH
T1E465234CE5DC58C5F266897B1804C0E1C138DC8FD691E1A79D83690EFA724F8396EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.5MB
SHA256 703f6292fd8bff7818a9a0f6b3b782fb42eb0b3fc9e524c197bd93767b7a6ff1
MD5 fa0fdac8e8a1cf32dcd161e4b7c2da1e
SHA1 2e86d668994d98b4d27903b30c483ac412b025ff
SHA512 be73c2c8ca6dd30a81d0d9794227fc2e206a5b2bc2a1e923e7ef66af6b35edabdc7b146af50a8505c02210f9bf1c568ae0184a3f980b0388fa9d04ee8df2a99c
SSDEEP 12288:795Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:797TTzucS+VednOi33Dpg6
TLSH
T1EE65234CE5DC58C5F266897B1804C0E1C138DC8FD695E1A79D83690EFA724F8396EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.6MB
SHA256 c0b7c0061030357bbf15378ab41a01b84bada338ee16c8894b21b03669fdeccf
MD5 313492131cf62551dfb18f9b615833b0
SHA1 c5db9efe48ecb64539aec7526e1f383184bda58d
SHA512 5321dc243fbbd16c950fdfa8bbf5f51e7b57c0c656eb87e38ece3578fb9f49cf136dfd9654843a8617575c7e53bb4de7a8b4ff8b862df3c7d0fe3745e8784419
SSDEEP 12288:jyPz5L8k5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:Ozyk7TTzucS+VednOi33Dpg6
TLSH
T1F275120B73A430E9E177823988515952E371BC7647609AAF57A1077A6F332F06E3EF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.7MB
SHA256 84e94835d79b371e34347347440234a07b57f7343a0664d34a7481958c493a42
MD5 d8b166defc2b4af2b7319a7803be60b7
SHA1 99fe386012ab4a1bd0d27c4178be129835a86beb
SHA512 5ba7d90323a8cc4bb72c19cb6e98c47e228806bdb6d91d323da644d83d2ec58760a26d7c7b44afc178c989f5ce1337d29c24a705a685c1ed1c1c15be6cd2623d
SSDEEP 24576:cTIaLl3z0zDC7TTzucS+VednOi33Dpg6:cT/Lljv7TLednOWy6
TLSH
T15585F198B39018F8EC67853ECC158956C2B2BC5A4760C65F07A5366B5F333A11C3EF9A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaws.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaws.exe
Size 1.9MB
SHA256 da72b54681e64a064034553c07d69f17b7f8457643a153262f5f9b9aa6acad4f
MD5 10431aff96b616ee34e90d628eb42fb7
SHA1 47f99f6c9ec74f9d8b1133a0d822776e4523e484
SHA512 2b334c1e90865d74f5f68427b61f384b0d99fc9b31f111e2f142d4d0ad2c886158a46e47eec2aba9c0f4d994f1fbf47c63327cb23f96b40c3008a476706a253b
SSDEEP 24576:L35d9CHKy7GZm7TTzucS+VednOi33Dpg6:r5d9CHKyaM7TLednOWy6
TLSH
T11B95CF90F3E814E8F1B78A358D758511CA767C9A5B71DE8F03A4261A1F336E18D39F22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jcmd.exe

Path C:\Program Files\Java\jdk-1.8\bin\jcmd.exe
Size 1.5MB
SHA256 11bfcc937312b92549afd21066b474bca67e087f983bcfa57a23c5ae027314b3
MD5 fbcd4034be12a2af78f75bbc78b7eb0a
SHA1 54de342b069aaf82cb12cd91ee23b795a6bae608
SHA512 e9086885329acee0c442939aaa6c48f50bcaa2e27f638d68b92d746b698659b5b1b05ac84540c92fc0be0ffa5f5522e84b340642e8538be845b2b4b69779d5ae
SSDEEP 12288:jy5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:jy7TTzucS+VednOi33Dpg6
TLSH
T1AF65230CE5DC58C6F26589771804C0E1C134DC8FDA95E1A79E83690EEE725F8396EEC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jconsole.exe

Path C:\Program Files\Java\jdk-1.8\bin\jconsole.exe
Size 1.5MB
SHA256 9fb0bf0def505f93b219e22cf7611ed871ed2ed0d560490bc5ad711a45f49136
MD5 97a4590e71c92cce42f5e276c2567724
SHA1 a82f937a9f47544eb799ff2310c66062799f59db
SHA512 dd09b2b59e8b8ac1f0ad7153fdf216843dbb896463978eb724238a1e197a7f2ba593a94fa26f44fc3efc63036321f28fccb961d880536b8886468e68eeff0b66
SSDEEP 12288:iE5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:iE7TTzucS+VednOi33Dpg6
TLSH
T1E665234CE5DC58C6F26689771814C0E1C134DC8ED691E2A79EC36D0EEEB24F4396EE89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxStudioInstaller.exe

Path C:\Program Files\Roblox\Versions\RobloxStudioInstaller.exe
Size 13.7MB
SHA256 8ebb04af6e3a99aad5ec70da8a8c9c6687cc06f6312ddcdf93c6839b396ebad9
MD5 f7a9a0baa6a95e8c16bb48f31eb0617f
SHA1 23d8d7d3174470852113d0c24e41d9d90152a46a
SHA512 3008a7442a79323d9936fb8c4290a48fe339967b9011dcdb0e9a21fcd08c39825f1beb9ab1cf6e5e2f9c825578b2902f3ee48cedcd26f2d34ee9ac258767f00e
SSDEEP 196608:jVhIFplZ45+y23Ftw2xYxKDi3zA3/4rsm5p/FMrp/2IuQk:jVs1F/YxKDozA3/4VdMrp/duQ
TLSH
T1B3E6AE6AB2B800E8D4BBD178C6565613EBB1B45603709BDF1BA046F61F67BE05E3E340
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RobloxPlayerBeta.dll

Path C:\Program Files\Roblox\Versions\version-5a21b87bbc2641cf\RobloxPlayerBeta.dll
Size 16.9MB
SHA256 b5e81e0cf070efa2ee8024bcd180156a5bdaddc56d0d1f4a9bc620b8753761de
MD5 980b49493bad518eef7e0c1ef65b031e
SHA1 ee5d01897c67d557c4552b3731a1c74cbcd1350d
SHA512 453218cdafb5ad9d8c506ebb80e46fbfdb359daf750f1c21383fc037cd43c5dc87732eba294ca17c63f46bcb9d5dc9ff22a60d9dd894e1cf088c1979da3120aa
SSDEEP 196608:blIMWAqLfs3M0aicICjqSiy788hVQcRO8wYXGK:K5L03Hajriy7nhVi8uK
TLSH
T11107C04EF4D616E4C5635070D26F56E3EB21309C4A682FF79A9502203A6378E3A19F7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.9MB
SHA256 28e646decfb2d90ee928502e8e69c6225d3a7b14ff34ff359d19c300b13a4f4d
MD5 213887fb3f809d5845f7b832b86775c4
SHA1 05f60a6ca98d89d10f56e14c91304b1b62584a76
SHA512 35c00c9c3bdae02a171cccf7def74c9f889d0d1cdbf899059c67f2e4b3c8990d27be12aa7ad6beb0e6b0b187b4d7e0cefe0e1c00caf5ff329d22e80fdcf477a8
SSDEEP 24576:wfwvTk9RX6wkyAIZ7TTzucS+VednOi33Dpg6:jMnYIZ7TLednOWy6
TLSH
T1AC95DF29EBDC44D5E1B7823D99B7464AF2B178591B31C2CF029A536E0E33EE46D3A710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 98c6b9b837277eb5441b5032858f3c28d7662a378dca2c56fa8484923ce15268
MD5 ab35a4b5e458c5994592d1ad56082d8c
SHA1 e8dffe3d222b8c59271f2d87cb100b5f23ee6374
SHA512 09da2c10e287ff861e6c6f6dd056929b8313c9ebe96c242d9bd864ef76013ab0548c6c826114b5d04f7b9390d96b3312a42dedbc91e154a5d9f2912141942f4b
SSDEEP 49152:GYZONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0+7TLednOWy6:4ySzPwLeRk
TLSH
T1C4066C56A1A801D5C1B9C1B98F1BCC1BFB7134090335ABEB02E556935F6BAF0AE3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 d1c9431e5ef1c0ca9d804827c165da6350fbd9fa0d99b7214b7a4a04368d1006
MD5 9e0fedadae9b455f24d396f9d3ee8e4f
SHA1 0fd7468fe4b948a3531a5e6a57ba48a4b0141a3c
SHA512 9aabed98589f12c42f316d60c0545caa52f6e3154b935f720b68f39feb9fae127db63f2b26da46c011dde6cdd314d7e8cfc237c32c5b4019a5ad7687aee194a7
SSDEEP 24576:+47Jb1aQZR1LfOrIhnjFN8rnDHU2+fF/AYo7TTzucS+VednOi33Dpg6:+47JUQj1irIhCnDHUPfF/O7TLednOWy6
TLSH
T193659D1DA3EC01D5E1BA827885158A5AEA71782E5B31CACF12B0837D6F23ED45F35F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.6MB
SHA256 6e58e0721940ea6c34bd89c23635f34260bec47367db58d70bd1ab94d1bc4fd6
MD5 42c72c004c8ea8ab05c8351272bdb22a
SHA1 289a75b34add1567ad20d1a3c8634992bec5b096
SHA512 715838e9fb3c4a26281295084920552c6425aef9efd9191fbad2448617bdc5c71b7d8b95eee682670e40b7629752441d6e8d56440b8b9710387e9af66387feaa
SSDEEP 12288:Mzsft5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:Lt7TTzucS+VednOi33Dpg6
TLSH
T1D775F009D29801D8D06E917ACB158681F3337C5987E1E3CB56C1F93E1F766A06DEAB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1020KB
SHA256 d8048414a253d9d2e8d791b8ed7b4ba104959a998342a677484d687cdd9ae297
MD5 b2608b8ac56c63f733475d1a30c024e5
SHA1 5836c93c56c5b505b3e08c69134f3c07b6388289
SHA512 bc54478706970fd8dc367bbebcf5f775afe2ae360e54d8e0f28ffee41c2f4b2ae27c37a65e85b262ed88a960489290e065bafea6eb84b9c7735c25ba4ddf6970
SSDEEP 12288:y9CCPU3fKiuGaccwx6XOD3YvS4TiDUGKfoxQaRMeLX38:yC0UPKHGacB6XY3Ya4OZKfJaRMiH
TLSH
T1872507017666DB4FC66940321E37D5CCAB707D01EE04AB0373C99B3FD576A59BAB2282
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 9227483d7b4579eb49575ca8333d17c8b05f39cf1230e083cac49f7d53dec0cd
MD5 1abff4f8b647502c5426c489e130a904
SHA1 27f4159cba540df1a51035a71adb92ba3e532987
SHA512 9d458250aa27e68596ead7fec259b3e54cff69ed0d2ced8fc70ea9655647661ed51306d14ef340a51c76e94abcf70e9190c71f135f36b7ab4f9acf7a73fefcfe
SSDEEP 24576:8eTqgbBFwGKtvU654np8CmlerQ/Fy4FybXmlerQgFyBmlSrQtFyUEmlBFyl9I8ow:8eTqg9FwGKtvU654np8CmlerQ/Fy4Fyu
TLSH
T16D65D8416437A78FD1B76031072B5B4C6B68ED07B7496F26B3C9553EC82BB12A0B93C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RBX694708764F8249A79382CF6689DC54DB

Path C:\Users\Admin\AppData\Local\Temp\Roblox\http\RBX694708764F8249A79382CF6689DC54DB
Size 64B
SHA256 da14afbaf3c199357f90860dc8e4bc7a96a6d8b480f31e3645b765b5184374b4
MD5 4656530f401ba1a5ac28aef86425edbb
SHA1 418cef173e65a8b21ffdf98960ef24ca7ca2e2aa
SHA512 d004ff825d0d0e00e0b4a4060ec965371d5e7da474ea626023aa68d3e034326831bd11e9753340dd7434ed37f015b8b2d052ba33601c0c2173abe74aa182923e
TLSH
T105A002B42F909570AD5308786A3829E841091BA0DE1572169E42630B09AB231C20F2ED
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Player.lnk

Path C:\Users\Admin\Desktop\Roblox Player.lnk
Size 1KB
SHA256 a1ba9786b9538c486e6d30836d880a2b92afb4d6607eec407096fa7ec1e12547
MD5 def05efb0b79ef1ab8949c0b84f1ac8d
SHA1 5c054f870c92b34e1ebf820b83ba3dc50501e8b2
SHA512 e8120a3257a6f2bb776fdc56a6d79920e9c71b3eb5293c799627848abd1c2a23743ca6e7608817f767b3a2334b73352c94c6caf54038d64328030490d9afdead
TLSH
T1292111710FA95316F1B392356AB146B1F7313C41BA888E2E81C513490DA1150B958F2F
MD5 SHA1 SHA512 TLSH

Submit Download

Roblox Studio.lnk

Path C:\Users\Admin\Desktop\Roblox Studio.lnk
Size 1KB
SHA256 41508d3ff69250499a08411b891ebee692d64afd33cbba34ce3096bd2ba2eac6
MD5 8651bdedc81a1f5fdc0aa70d5bce7b50
SHA1 0f3e74e41947bd8c9d055c7c88674f6a0d6ce0e3
SHA512 7ef386deebdfa30221dacdcffedcd40839f33ce09c2ebbb1786092a2094c5d5fe8268e42ed29b9a4ae007f37536579904d9eccd61ec2f63bc59f3649d4e6492a
TLSH
T1282125210EB11725F1B3973A797246B6D7367C02EA485F2A81C1074A0DB21506998F1F
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.5MB
SHA256 da60a5fb707c8303c560375244350a51c38e2d1777a573700e67263365d2a5ab
MD5 d5a8916390f61bb4dca71c3b2e6d59e3
SHA1 35d1b3194a94105122ea4507534942fe67bdd354
SHA512 b6fcd4ddf9136cb763ecc7094de51564f2ca5c44fdf0814c3c9beb02b9f9abc529cad5d937714941f1a169202bd7684cf12c0e7cd5c5f7bf73dd2633f62055d9
SSDEEP 12288:qO7l5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:Nl7TTzucS+VednOi33Dpg6
TLSH
T1CB752308E7DC9C86F17689761818C0B18239FC8D8F50E1E7A9436A4EE9715F42D7AF4A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 260f74596b42aa7be111cc4036d676b4ed2d184a19efd3c4324f27b23a39e874
MD5 881696a19e362734543dc78ee0bc059b
SHA1 51f0325bccdb6a4101252ecd0e1edca8e1a68b0d
SHA512 cf5386621787bc654cb937a8284ad757afa2d1ef0492bfa1456e22ac117f762a5f997c59a4f6b99b6d09b0688354d51eeda69aee47be032f47c848bb40bdfb78
SSDEEP 24576:Ygb6bmBIi49WNNFpg1rSvFv7bYv7TTzucS+VednOi33Dpg6:Ygb4mBIBhGFo7TLednOWy6
TLSH
T13265AE1E22EC02F5E0FAD2B8DDAA4417D6B278160731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 2.0MB
SHA256 55fc2bac8f300e2d6e5b72069a0911aebb4f094cae52ba6b0eabad11bb8f312f
MD5 72f845d3289a10b02d13415b07fe97d5
SHA1 59a774bc4b63913fdbd14df7db5dcef2d6489c1c
SHA512 3a43576e8342f5d8cb517e4df37b35f542da2b04c4cdc6996da95c0fa694c345fe2cdd315bd4f1f2d665ef3fb28a2f3c336ebdd420c92d433f9aae40d658ce38
SSDEEP 24576:SG88u8FpJqH1kzria7/mY7TTzucS+VednOi33Dpg6:J7ZFPqVza7/H7TLednOWy6
TLSH
T130A5F155B7E401F1D47BD138894246A3F6B2B8150364EBDF0BA88B561F23AE50B7EF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.7MB
SHA256 c9d53e64ab6b1c6291aa25a7c4c92fb6b12a7604046854bdf2936344bf973642
MD5 3d7def2a8e9425ec7391fc34c6f00ef0
SHA1 e7e9298ad5e98b0fa1eb28494bc0acd35076f50d
SHA512 1a04385b703eb98de8184efae9e943fa24e667da27be84ddcffadeaeff1cb671ca976b878d02a601a35f4f6997b528967bd37d6ac71a77677b97657f761b0223
SSDEEP 12288:1HvUrBFrEjwaQM5Y20m4qaAHg4ste1ZhSZctEs1VJcdpCW3vGi3oqZ9xvgs1:1PUr+NQM7TTzucS+VednOi33Dpg6
TLSH
T11185E11E62EC18D5E676E17D89428619E371B8560712E2CF02E1817E5F63EE8BD3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 cd4a8ec79b8acb95c51d05cc2d9595b67981bb8e334865326a368143661be5df
MD5 0261ffb128d2d9f9879a080d2ff4467d
SHA1 58865ccdd448d54b08903bd1fba92728ca2aeced
SHA512 2dd906ed02fc74c01828e68b7c5af5110e66c4ce3f7defbdb2fcfdf0fd7357ca14797cca4f884d920a7bf1b33e53ec9bd71f3d58530e398189d1e0152f7800f7
SSDEEP 49152:1BCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAj87TLednOWy6:+G05lO43bpLeRk
TLSH
T189D5BF6E62EC11F9D1BBC17CD9C6860BEBB23815033556CB02A486A91F27FF4697E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a1c68b0e2e7fe2f4f50d07768094f3fceef37a4bd24a7abfd4f18a78e45a67ab
MD5 a9d10913ab380e3fb159b9506ee06e9a
SHA1 3f9dbdfb6bd6e193ebcb2ee9433ea9ea718708cf
SHA512 c8cce8b752583fb109a9aa77bcf5c08bc3623e026ef0b1b25f75c25914520a2901e780468c8bbb75675c0e2d0ba3eb63d7092d739150876c4075c61ffb0542e4
SSDEEP 24576:Rfa5POZ3dpFWVM50JicR2hG0lasx2+47eidn+7TTzucS+VednOi33Dpg6:xa5POZ3+Jt2pasx2+mE7TLednOWy6
TLSH
T10765AF5DA6FC01D5E1B9D17DC583861AE5B1342653319BCB022182BE3F27EF89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 a4e1a523419c2dd6a763a642b3c8ee4d0ec17ad2b6673557440db08c0b583a22
MD5 d28953b6f945d91af2f0199946f9679a
SHA1 fc139d30db34bd18e595bcd727673c45186ce13c
SHA512 af6fc54e09258487406b3fdecf1e01a7e9658c24e1e495610bd25966349b1198537445ad7b6cfa4c8722f04b5a2ab52c41a0ec4124d835310c8b2418d324d609
SSDEEP 24576:5NcwHdjbyQ4nLC18lb/EOjowL7FkA7TTzucS+VednOi33Dpg6:5Nc/zEOVHFn7TLednOWy6
TLSH
T1BE857B1623E901E4F1BBE1BE89679546FA717869533086CF0291851F1E73BF46C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 a1dd323c7614f42bf206d4c8ddc8759fc1d3c160f386fe3c15ca332a0190c6a7
MD5 e9034c6b1cf67a927eb271c9a1ba5738
SHA1 e0b7a50c919eea827c6aa11c1fd57128b957b5b6
SHA512 f977204954e0510b36ae27737b80b67fa46fc2910b79a2c4958cacd0a38351762e5b67b4aa16614f847d0b507e2864939b2495b076d106bd14cf91aec6fea9ec
SSDEEP 24576:V8kNvNnaFeYhJNtmZBma7TTzucS+VednOi33Dpg6:V8MwBtOma7TLednOWy6
TLSH
T16155AF2EBAF845E4E1FEC6B58D238512E6727851073293CB5290C13F4E679D89D3AF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.8MB
SHA256 e8153fb67a9e9703561fc91a18090958037f64dd5ea09c73a6041519eb9968a1
MD5 3e10c64d7e4d6601e9d33627d8834936
SHA1 ecdb9cb9fdd060c44c4a2a7b9b3055b7494e7061
SHA512 c0eebd6d7cf344af5178a9877bfcd7526723d8698dd52222006df43929d42c0884ce0d37b713f80d0be1f55dfec34bc3aad7366955a44c78fc14a86496a96548
SSDEEP 24576:VD3FHshBIYQgAh7TTzucS+VednOi33Dpg6:VDVHeBIAAh7TLednOWy6
TLSH
T18595E12DE69C04E4E57BC1BC9A538506E37178AD032266DB06D181BA5F6BEE43D3EF40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/616-315-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/616-98-0x0000000000400000-0x000000000057F000-memory.dmp

Download

memory/980-160-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/980-167-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/980-378-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/980-161-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/1436-267-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1436-60-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1436-59-0x0000000140000000-0x00000001401B7000-memory.dmp

Download

memory/1436-77-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/1948-55-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/1948-57-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1948-42-0x0000000140000000-0x00000001401BD000-memory.dmp

Download

memory/1948-45-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/1948-51-0x00000000023A0000-0x0000000002400000-memory.dmp

Download

memory/2496-357-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/2496-136-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2496-130-0x0000000000D00000-0x0000000000D60000-memory.dmp

Download

memory/2496-128-0x0000000140000000-0x0000000140226000-memory.dmp

Download

memory/3948-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/3948-84-0x0000000140000000-0x000000014115B000-memory.dmp

Download

memory/3948-443-0x0000000140000000-0x000000014115B000-memory.dmp

Download

memory/3948-12-0x0000000140000000-0x000000014115B000-memory.dmp

Download

memory/3948-6-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/4132-284-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4132-116-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4132-123-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4132-117-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4132-273-0x0000000000780000-0x00000000007E0000-memory.dmp

Download

memory/4184-23-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4184-14-0x00000000007B0000-0x0000000000810000-memory.dmp

Download

memory/4184-101-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4184-22-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/4304-158-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4304-143-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4304-155-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4304-149-0x0000000000CD0000-0x0000000000D30000-memory.dmp

Download

memory/4304-142-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/4748-95-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4748-85-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4748-308-0x0000000140000000-0x00000001401B2000-memory.dmp

Download

memory/4748-91-0x0000000000C10000-0x0000000000C70000-memory.dmp

Download

memory/4836-103-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4836-102-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4836-109-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/4836-391-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4836-331-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/4836-389-0x0000000000730000-0x0000000000790000-memory.dmp

Download

memory/5068-141-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/5068-35-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5068-36-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5068-29-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/5068-28-0x0000000140000000-0x00000001402D4000-memory.dmp

Download