CoolClient goopdate Run key persistence via Sang.exe/defender.exe

Duo Tech@duotech

•updated Aug 14, 2026•0•0•2

Detects creation of the 'goopdate' Run-key value pointing to Sang.exe/defender.exe with the 'work' argument and a %programdata% path, used by CoolClient for persistence.