9f31e75e95af940530e7dbbe21dc33399279d0367c70b10e9e162f03fbbe0c0f

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
Size 7.0MB
Sample260801-mk5v6axycs
SHA256 9f31e75e95af940530e7dbbe21dc33399279d0367c70b10e9e162f03fbbe0c0f
MD5 c6853278d3667c4a44c8979e2c66f797
SHA1 ae257112a23b722fea6231515a44a8b391d5ae43
SHA512 014c97b6fe8e4881b08462e07a47b8919156f75a1491d0d656bd7d10578b8e1226f0fa19fd1c7e985b48d6435f4c7dd34dbcf82bde47dbeaf1692a431851e859
SSDEEP 98304:nPxxnjPSKMJtXQFVOJ7hNJtQ5KQItojGatD527BWG:ZxjIJtXqMJ7PJtQ5rItEVQBWG
TLSH
T15D768D5BA3A401ECE4A7D138CA569613D7B2BC1113719BCF16E06A6B1F73AE05E3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 11 IoCs

pid	Process
5940	elevation_service.exe
1944	elevation_service.exe
5840	maintenanceservice.exe
2092	OSE.EXE
4148	PerceptionSimulationService.exe
5372	perfhost.exe
5512	ReFsDedupSvc.exe
4580	SensorDataService.exe
5316	ssh-agent.exe
1296	AgentService.exe
3116	SearchIndexer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 41 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Caches\cversions.3.db	SensorDataService.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\msiexec.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\msiexec.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\ReFsDedupSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\1033\StructuredQuerySchema.bin	SensorDataService.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\vssvc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\System32\alg.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\alg.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\System32\vds.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\7e251cc15387db0e.bin	elevation_service.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\locator.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\AgentService.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\wbengine.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\GameInputSvc.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\dllhost.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\locator.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\Sgrm\SgrmBroker.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Windows\System32\msdtc.exe	elevation_service.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	elevation_service.exe
File opened for modification	C:\Windows\System32\vds.exe	elevation_service.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javacpl.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jcmd.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jstat.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Eula.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	elevation_service.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jjs.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\native2ascii.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\private_browsing.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox.exe	elevation_service.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe	elevation_service.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javah.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\servertool.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jp2launcher.exe	elevation_service.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Internet Explorer\iediagcmd.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	elevation_service.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_1182730388\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_1182730388\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_1182730388\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_10452974\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_10452974\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_10452974\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_10452974\_metadata\verified_contents.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4620_10452974\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ReFsDedupSvc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ReFsDedupSvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-2 = "Microsoft Script Detection"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mpa\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-202 = "Schedule computer tasks to run automatically."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\RecoveryDrive.exe,-600 = "Create a recovery drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Wdc.dll,-10025 = "Diagnose performance issues and collect performance data."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-101 = "Event Viewer"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Filemgmt.dll,-602 = "Starts, stops, and configures Windows services."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\RecoveryDrive.exe,-500 = "Recovery Drive"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\psr.exe,-1701 = "Steps Recorder"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5985FC23-2588-4D9A-B38B-7E7AFFAB3155} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000064c3465ea121dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.M2V\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mov\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.AAC\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\mycomput.dll,-112 = "Manages disks and provides access to other tools to manage local and remote computers."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-16 = "Registry Editor"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\iscsicpl.dll,-5002 = "Connect to remote iSCSI targets and configure connection settings."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000000377131aa121dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.m4v	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.wav	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-142 = "Microsoft OneNote Table Of Contents"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-7 = "Microsoft Devanagari to Latin Transliteration"	SearchIndexer.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\cabview.dll,-20 = "Cabinet File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@searchfolder.dll,-32822 = "Everywhere"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\searchfolder.dll,-9023 = "Saved Search"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-102 = "Microsoft Excel Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-178 = "OpenDocument Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration"	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration"	SearchIndexer.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004ea7341aa121dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\System32\psr.exe,-1702 = "Capture steps with screenshots to save or share."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	SearchFilterHost.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
5940	elevation_service.exe
5940	elevation_service.exe
5940	elevation_service.exe
5940	elevation_service.exe
5940	elevation_service.exe
5940	elevation_service.exe
5940	elevation_service.exe
5916	msedgewebview2.exe
5916	msedgewebview2.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4620	msedgewebview2.exe
4620	msedgewebview2.exe
4620	msedgewebview2.exe
4620	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
Token: SeAssignPrimaryTokenPrivilege	1296	AgentService.exe
Token: 33	3116	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	3116	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	3116	SearchIndexer.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeBackupPrivilege	5512	ReFsDedupSvc.exe
Token: SeRestorePrivilege	5512	ReFsDedupSvc.exe
Token: SeDebugPrivilege	1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
Token: SeDebugPrivilege	1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
Token: SeDebugPrivilege	1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
Token: SeDebugPrivilege	1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
Token: SeDebugPrivilege	5940	elevation_service.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 4620	1852	2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe	90
PID 4620 wrote to memory of 4132	4620	msedgewebview2.exe	91
PID 4620 wrote to memory of 6084	4620	msedgewebview2.exe	102
PID 4620 wrote to memory of 6084	4620	msedgewebview2.exe	102
PID 4620 wrote to memory of 6084	4620	msedgewebview2.exe	102
PID 4620 wrote to memory of 6084	4620	msedgewebview2.exe	102
PID 4620 wrote to memory of 680	4620	msedgewebview2.exe	103
PID 4620 wrote to memory of 1896	4620	msedgewebview2.exe	104
PID 4620 wrote to memory of 1896	4620	msedgewebview2.exe	104
PID 4620 wrote to memory of 1896	4620	msedgewebview2.exe	104
PID 4620 wrote to memory of 1968	4620	msedgewebview2.exe	105
PID 4620 wrote to memory of 1968	4620	msedgewebview2.exe	105
PID 4620 wrote to memory of 1968	4620	msedgewebview2.exe	105
PID 4620 wrote to memory of 1968	4620	msedgewebview2.exe	105
PID 4620 wrote to memory of 1968	4620	msedgewebview2.exe	105
PID 4620 wrote to memory of 2432	4620	msedgewebview2.exe	106
PID 4620 wrote to memory of 2432	4620	msedgewebview2.exe	106
PID 4620 wrote to memory of 2432	4620	msedgewebview2.exe	106
PID 4620 wrote to memory of 2432	4620	msedgewebview2.exe	106
PID 4620 wrote to memory of 2432	4620	msedgewebview2.exe	106
PID 4620 wrote to memory of 3224	4620	msedgewebview2.exe	107
PID 4620 wrote to memory of 3224	4620	msedgewebview2.exe	107
PID 4620 wrote to memory of 3224	4620	msedgewebview2.exe	107
PID 4620 wrote to memory of 3224	4620	msedgewebview2.exe	107
PID 4620 wrote to memory of 3224	4620	msedgewebview2.exe	107
PID 4620 wrote to memory of 1812	4620	msedgewebview2.exe	108
PID 4620 wrote to memory of 1812	4620	msedgewebview2.exe	108
PID 4620 wrote to memory of 1812	4620	msedgewebview2.exe	108
PID 4620 wrote to memory of 1812	4620	msedgewebview2.exe	108
PID 4620 wrote to memory of 1812	4620	msedgewebview2.exe	108
PID 3116 wrote to memory of 3040	3116	SearchIndexer.exe	109
PID 3116 wrote to memory of 4820	3116	SearchIndexer.exe	110
PID 3116 wrote to memory of 5932	3116	SearchIndexer.exe	111
PID 3116 wrote to memory of 1268	3116	SearchIndexer.exe	112
PID 4620 wrote to memory of 5780	4620	msedgewebview2.exe	116
PID 4620 wrote to memory of 5780	4620	msedgewebview2.exe	116
PID 4620 wrote to memory of 5780	4620	msedgewebview2.exe	116
PID 4620 wrote to memory of 5916	4620	msedgewebview2.exe	117
PID 3116 wrote to memory of 1284	3116	SearchIndexer.exe	118
PID 4620 wrote to memory of 700	4620	msedgewebview2.exe	119
PID 4620 wrote to memory of 700	4620	msedgewebview2.exe	119
PID 4620 wrote to memory of 700	4620	msedgewebview2.exe	119
PID 3116 wrote to memory of 6044	3116	SearchIndexer.exe	120
PID 3116 wrote to memory of 3212	3116	SearchIndexer.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe"
1⤵
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1852.6060.2253444736384868779 /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView /prefetch:4 /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x140,0x16c,0x7ffa0b375fd8,0x7ffa0b375fe4,0x7ffa0b375ff0
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1928 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a
    3⤵
    PID:6084
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2208 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2472 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a
    3⤵
    PID:1896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3352 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a /prefetch:1
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3700 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a /prefetch:1
    3⤵
    PID:2432
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4028 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4224 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a /prefetch:1
    3⤵
    PID:1812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a
    3⤵
    PID:5780
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=5188 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView" --webview-exe-name=2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=5316 --field-trial-handle=1932,i,5621950069130376202,929441901644927973,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:4407dc6a0a34f3cbec478848331323017f17c54a
    3⤵
    PID:700

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:1944

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:5840

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2092

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:4148

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:5372

C:\Windows\System32\ReFsDedupSvc.exe
C:\Windows\System32\ReFsDedupSvc.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:5512

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Checks SCSI registry key(s)
PID:4580

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:5316

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:3040
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-3986082593-3624157295-3514260330-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4820
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:5932
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:1268
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:1284
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2832 2856 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  PID:6044
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 944 2872 2900 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
Size 2.7MB
SHA256 cf76859e54498cb54c0163b98e5d86497a60c3a6e43e1826e94e8b9066332e07
MD5 e57598ba0e787d9fd9fb6137bc0426b8
SHA1 393c79bd038c56fceb49063fde76f394bf5ebe37
SHA512 a971cd09b38469537b47d38129b1c89461dc666d2b4c8c57c3bdd838ee268f67083dc06de55479f7d3c8db476ab7bd822592f69f979796944e5cb73529c746b0
SSDEEP 49152:Sb+632BuPkFKRrdE6ohvstBhuXjfS4LWxn9Dmg27RnWGj:03q6sjBGD527BWG
TLSH
T1E7D59D03F2D900E9E06AD178D7469133E9A2BC890B34B6DF0790B6562E7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.4MB
SHA256 aa53fcfdab04e9221f6dfd6097840b766a21397181a6de69702ff9024ebdd832
MD5 82a61110b5e58bd0750fce5b0fe4fbdc
SHA1 54ef17b0f74cc35946c673b68e2fbe5012a7af26
SHA512 26f62780ff0b2bb68ef3f6af1249b85dd6ea6ebfabebbc55dae63e3c0e1ce62209d3a95575c47ceb475639d576d53f9b64db9e06cd12c0e7e8a0269601a2f781
SSDEEP 24576:hXYfDtczAOsqjnhMgeiCl7G0nehbGZpbD:ktcjDmg27RnWGj
TLSH
T13565F129A3D408F9EC67817CC9A2C516EA337C554760E68B03E4997A5F332D84E3EB52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7z.exe

Path C:\Program Files\7-Zip\7z.exe
Size 1.7MB
SHA256 4a38440d83ed90af1c60897c6f29fd01c584255f7a019b1c77ac2bc60bd1f75c
MD5 bd01e3969622f61e3f959e89679fb43f
SHA1 4d781ca0d8e2fcb7794d4a7fc3f914969e26d93d
SHA512 39b791626ad24017c50673354df8ca17ec08b12ddec3b2aa3d468483f7b9c01e691a7ada36b70fd970edd5a181f424110f9fc0fd6a4e884f92903fcbb1647930
SSDEEP 24576:M0Le5ji0hmxxrMBsqjnhMgeiCl7G0nehbGZpbD:MPji0AjkDmg27RnWGj
TLSH
T142859E26F6748335D073C0B9C5D2A68EED7230865B3089CB4286D77C7E676E6863A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zFM.exe

Path C:\Program Files\7-Zip\7zFM.exe
Size 1.5MB
SHA256 4194e0c978005d8f8eff06e0d56d1daf5ad48dc40e00cb24525ede8593408876
MD5 f35a0ae6196338fa1d24fe8e4c4d7e6e
SHA1 cea1fa4577433764f3a6bee7295d7f8e581d0be1
SHA512 f31db9141c21523345441806ed804dac0781a763522bb6149d11ce81ea298dd07ca50ff34fb01db896f8358e2ac17e53ece066873d4021328ec8ac55f8039d89
SSDEEP 24576:na7/ezSC6vUyD/aqgrvWn6q8wyuPsqjnhMgeiCl7G0nehbGZpbD:q/ezSC6vUzPveHjygDmg27RnWGj
TLSH
T19C755C25F5788323D0B2D0BAC5D6BA9AFE7230465B3089CB0246D76C3E277E58536739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7zG.exe

Path C:\Program Files\7-Zip\7zG.exe
Size 1.2MB
SHA256 18efe7d232383cf0fa5dedbeae87fcef2ab3d6e18b9e98613889e10b31c5dd5d
MD5 b068c82712d5bc372e2d5bf92f5e603a
SHA1 ea6a808ad9587475c256582951c4496a9760ad3a
SHA512 514b7aab025e480dd282960695f18edd94c16b047592d4200449a239e6153127927f46920bd81fdc5963e38e8c338a88c24762969430dbaaad16d67d2a04404e
SSDEEP 24576:IVbqPb88hv/l+YSsqjnhMgeiCl7G0nehbGZpbD:IVO88hXl+7Dmg27RnWGj
TLSH
T1FF559E66F5748331D073C0BAC5D2AA9AEE3234425B318ACB1246D76C3E677E5C63A731
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Uninstall.exe

Path C:\Program Files\7-Zip\Uninstall.exe
Size 1.2MB
SHA256 6bdc2a3e580914e65e580c91879c257a17d907ac70e331c6b1787f5c51bb35d8
MD5 6f7cfd7e200ba60f2b59d90dc28534ed
SHA1 651a3bf575d4d8ee7ed945e3bc4490fa8c23dbb0
SHA512 5d348c9e7459b853bcfaea40fe040ad8e40fd00893f7a4da9249b25d496b7cb7f247754deb13d1d84a3ad316bbaeca05b0b0eb2abf80c075a58eeb3a18306eea
SSDEEP 12288:mLVXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:mLVsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B64523BF864C50DAEB7608B5C3E9F51EAC137E56982008436AA37CFDE5B5458CB39023
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVShNotify.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe
Size 1.4MB
SHA256 ac05c51ba5360ff856fbcf39b30eeaade75c9c20fa2201937d8d9de7d4db0590
MD5 6ff65330b6c71eda30391f56086892d7
SHA1 19a7e17abb6b29300f5ff64540d954fbb8b7440e
SHA512 d6bb86adc4d16e06591553b8a62c2e63473337fe877af3eb73b78a15260c3f7fc5cde83a45ae722e7fa8de22d19a3b31dbc40a319e8222dd0109b9de51009779
SSDEEP 12288:UeBNUbTVO86UaXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:UJIUasqjnhMgeiCl7G0nehbGZpbD
TLSH
T16B65CF7BEE28FCD2C27A8DB95791C600E76278314F2193CBE165824EDE235E44E79C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IntegratedOffice.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe
Size 4.6MB
SHA256 c345bca4caf6077f253fa9d3f8f9536750e78435e9f4f72cdab6f530bad01ff5
MD5 a75f40c9d8593833d2bc545aafb07106
SHA1 d8bc477cf534ed65a01a2c10f2bd85d5e7fbe104
SHA512 107b1e9b0d2ea867709fd8e0315b18a8b67289098d4c67ddf3e09a00bc198f2eb300510057210208cef6795766ad435265341b2a7f93a803eea420a945629462
SSDEEP 49152:3QIlquu1Gn1jKm4ptlQzJWwbwLqd3ZrzsTfov3/euNw5TScWwJD9DN5J8NRV3TH9:3QvGAdlCEL8c/DRNw5CDD527BWG
TLSH
T1C7266C656BF880F5E0A7E178897AC572F7B678420D31EB4F0291CA6F2F336904D29725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MavInject32.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe
Size 1.5MB
SHA256 509a86c7e55ab9727a8ebe92d0592f96b54e672d70717c8a46850fef2beac71d
MD5 dbbdb2b7565849e42fc1d09b96d5d737
SHA1 278ef9bd213b0e4836c063f2c999c25c76a7f115
SHA512 dfeb063e9bc8ae2feb081365ae75185762479c812fc89e2eeb36d319190c7063e9f8cf4f52bcc09317236873edae1c1784a78cd2cdbedd14b9df0b5808b2208f
SSDEEP 12288:YAwSfxL/2Dc3RDLLmt0LDQewsAjIXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkj:90ewsAjIsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A75E031FA74E036C77B0DB60B36D71A182D7A204F6119C3E3E89D9E99702D12776A27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OfficeC2RClient.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe
Size 24.0MB
SHA256 7640ab661bcf7ff3d2c26ebea352a91b2260ea6b96df29820b00976f53ee872e
MD5 7187bf40cfb141131a63a73c01293b3d
SHA1 4d6954e6dd7b80fa4c4d24996607b4244a60f4a7
SHA512 a4ac024da529e56312c6142a9be150a32579dddddbd9850afae3cfec895434a21499508bd787e52aa24c998ddebb9b91b893e2ce12bbf7d9fa0ba020e693876f
SSDEEP 196608:vUEtQeTbvf2zlO12sJTv6Ja1cpVLytIldPlbuJHcVQBWG:vUEtQevvqc2W1cpV2tI32jB
TLSH
T13E474B91BBE843E2E3A6953485B182B6FBB17C0E1F35A33B1179F21E1E376905D19321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appvcleaner.exe

Path C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe
Size 2.7MB
SHA256 261d50c01f0f11d4255f805d1bb9a20ae4a73317703aad64e6acf930af33782f
MD5 283f7d4730060d67d89c2429eeadab10
SHA1 29cccd0dd0c133a2a5e4b2ed36a1adcdcceab618
SHA512 62c0c1276f52fca7bd222cbae7ef46ca9f50acc11fbd542dd551936817d39eb7e9488eca624df5c786594325bef4200d2ec9e624b30b2f17718e5fcf4d92daac
SSDEEP 49152:dCbRquA/m2yL5zTfFiV+XenmE3/zUDmg27RnWGj:aoquVjnm/D527BWG
TLSH
T140D58D1976B8C1E4D1F6C77886A2C647F37178154B309BEF4266461E2E33AE58E3E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LICLUA.EXE

Path C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE
Size 1.1MB
SHA256 2b215330f955177d6f2c17b713e2a73721aace6ca97da4122278af916bb0d108
MD5 436074884599349d68b1c4ddb5b03a2d
SHA1 705b5f1488e57c013809fe77631f4c3be2345f38
SHA512 da4de2a4a70db40d9e8bb5464178e60debb8fe97b1c818941ec4f35a0d8b49be31a1ec54d2e5330220ea60242b52c4a1b438031d18ba2520f11d9d98ae644655
SSDEEP 24576:9AhGL3IFoiwtA5l7S53rsqjnhMgeiCl7G0nehbGZpbD:9AMUFoiq5PDmg27RnWGj
TLSH
T1FF359D81E7F951D4F5B3AAB899B69171E976BCAA5E30C20F2160D11F1E33E409D24B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.4MB
SHA256 5a53e8c1ea053e2053740d7be301d17a6cda9148d6ede660bb66914b51d2a820
MD5 450d9809d206578b42e7f0660a907625
SHA1 d776f476e28bf72f383a2fc1fb8824daef023134
SHA512 e8ff9c394d4a0292817b8f35fd355126757752fda579f889d8528993b9498a8c021cd6ec64e70880215ffc4dbe667ca62cb15d5bb2122c6f040aefc0a1134544
SSDEEP 12288:1mw5HEjsChNVBFgl0WDm+CvXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83LW:wwu4OWksqjnhMgeiCl7G0nehbGZpbD
TLSH
T1E365F15A72A80CF9E9674539C697D136F7B3BC122A20D71F1760C65B6F33260AE2D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VSTOInstaller.exe

Path C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe
Size 1.3MB
SHA256 f7719edf106abf5166754821f5a14964cd32c49ea6dd7b36bc14c858a0f12c81
MD5 dabc9778dd8516d3d12d227055c58ebb
SHA1 b68a51dd0ba57c9ede7a7b5e2293554bfd96b84d
SHA512 2487a1b4bc4eebac121415b5f7d0a429978db94cdd937456dd4bc7f44e58cd545995724f8ee15e0e13ec29600aab21e4b8a0c511a7485575a2848f04472dbead
SSDEEP 12288:MeZ1IyYXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:VZuJsqjnhMgeiCl7G0nehbGZpbD
TLSH
T17E5512AA239820FAE163417CC5E5D609E7337C62673003CF16625AAA6F739C44E39733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrmstp.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
Size 6.6MB
SHA256 7b2938aea474c9a669fbea9c73d3b2d3491418b252c265b6f876c0f6d4a8c6e9
MD5 92eeea6d905de826d0b4fafd11b0bf1f
SHA1 32bbb5eb56146956c905171c41d046773e64cd0f
SHA512 0a890b4056abdcb94cb401ecc670c76a9b9a4d07ba46d8cf44a8c480cb49f3962d96457462d2ad964ff10c8fafaaabc78812b817bc31239437c5c6802193cc0f
SSDEEP 98304:5QRQyi36YOcPbLvw2gAf+PN3aD527BWG:wQyiKa/X+PNKVQBWG
TLSH
T112667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
Size 6.6MB
SHA256 d832826d7f1756205769bb75ec42a6dadc49a00a4d190ab699d3816c6898bf5d
MD5 5b53c14e08f91ea8f33efe92e62a30c8
SHA1 412d15e97d406403ff62e3b1ccacd7fa6926da33
SHA512 02a5fa11be6be22cd2a8ebb2d4b21640bec985d21aa4f12929d6c35ee7b1a092fff60d51fa956d96fef8b9bad38d38f4c79d53dad62bb6aadb39718915e4c70f
SSDEEP 98304:7QRQyi36YOcPbLvw2gAf+PN3aD527BWG:KQyiKa/X+PNKVQBWG
TLSH
T17A667C13F3B501E8E05ED974CF3956229B357C4A8BB092EF259436E11A72ED47B38B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_pwa_launcher.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe
Size 2.3MB
SHA256 42adacc3d6bb2fc52712cade007d9880d2f9f767d19573747742380f085d8af7
MD5 13b01712e61e8999655c20b79d39e587
SHA1 bd6f497534ff1abd5f12a8e2ca6085cad2486e60
SHA512 c6a27517dd29eb004d5fd8c852d232f70cc4917a7c65bb53720c3a79717b32e4e7dc02c2a53a394b30a28126db00a1c3157f33a5557f95cf40acfb2e27bcd2d6
SSDEEP 24576:0wvLof6SRQ+rn/fDboqxN1nnh6r7DaHGTNHu7PNU3/5W/ohL05sqjnhMgeiCl7Ge:668Qg55nhceWu7PNU3/kDmg27RnWGj
TLSH
T110B55933B2F60099C44DE1769F4A873196D27C758FE0E3DB8511721A1BB2AD07B3A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevated_tracing_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevated_tracing_service.exe
Size 4.0MB
SHA256 be987ac791cf2caefa0c14d4351f2eaf68adeb5c9f5a11ec31f17ff596c1c83b
MD5 d585d7fd242ccdb0fa8ea76d1b1bae00
SHA1 2e5e379970ce1f0f08e14de6a53c44651ecb2d77
SHA512 e8efe704726091957f34ea7468e2b83200e5f796ebe111331081d31365ea9f2d865b519e3c0de69e8f83f50927135c2b56bb8069da12b892d64a87822fe9bcc3
SSDEEP 98304:Yy5112gYy5azzVvt69nLKnhZJD527BWG:xLIHEWhnVQBWG
TLSH
T107167B13F29900E8D05DD1B9874A9232EA72BC474B35A6DF0A5077522F7BEE46B3D720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
Size 2.8MB
SHA256 150725fb07246e8ebf3ec8df8d86fe9163b36ecbf048934ce05c2fc0990ae2c4
MD5 c9c40731f5879ae7a5d83ca0e222b17f
SHA1 ed636cb07eaa447ab750769add6df1dc334e9c90
SHA512 bf0bc780df13885d841fdc7314ea8c85e35db1d12b0d4ee8678c4eb6f05267fd6076aa6e94d58648ce4fac9d4638ec9272130bc0aaf32a9fbd50ca05f73d8193
SSDEEP 49152:8B+taZ3usBWOBr4tEGL0bqx0z+n217aau1glSDmg27RnWGj:Wu6Jmdxd2dSD527BWG
TLSH
T19DD59D13F1DA01E8D06ED478974A9233E962BC490B34B6EF0A9073562E77EE46B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

notification_helper.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\notification_helper.exe
Size 2.2MB
SHA256 af6af750bf40c6cac49fb4391e36efb3fde18d6b25e1613d59f2512ab9de198e
MD5 a6ae4c94f9993afa0ee63e9cecf217ca
SHA1 2283a38f0e584e00e49fd89b1fa6e8b16de4f23f
SHA512 2b363c46cb912766c147edda94618e784a7d6a1bd9d74a7d53610b8bd1aa0ec62fa33221018e1d1e83a16654695dbf6da0d571c06909076a0198bbf94c701547
SSDEEP 49152:91hpsNoJpF1A63U44CwH7R4xODmg27RnWGj:9mifPWR/D527BWG
TLSH
T1A6B5BE13F2D801E8D06ED17887569232EA62BC460B34B6DF0A90B7961F7BEE45B3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

os_update_handler.exe

Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe
Size 2.4MB
SHA256 bafc44f849153fe62bad58140dff780d5d0c17ca0285f06f2a4d154df82baf80
MD5 f2f0be419837c8acbedc7009abb4320e
SHA1 5250469a5f8afecf52ea1923f432452fbfaf11f4
SHA512 b31f6fe56d4fad8e50b355157d52b94227b7a8217c54bd684e379bbe48ffd9c3c2ec3b297092445882aeed198c6c54713942ee101e1d207069db838967790487
SSDEEP 49152:sSuZQIY0Be2KcRVtOnks6NMHqNDmg27RnWGj:O5dKii61ND527BWG
TLSH
T18AC5BE13F2E940E8E0BED67487669236EA72BC464B34A6DF064072591E77FE05B3D321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

chrome_proxy.exe

Path C:\Program Files\Google\Chrome\Application\chrome_proxy.exe
Size 2.0MB
SHA256 ac515b2b4f77e6318ac225e170f1245dc8c1326c8e25ea2269f8d04c7358b6ab
MD5 450a0bc6e9857f5ad8c6c1a95546d486
SHA1 f1b8c393097be2b6f58c50f15c9c3a990757a406
SHA512 19c6421106639405fde53936e902b8d26b39e7c23af3ee1eb353bbba3b920ee871debbf55d960f1e156df4c23960ba40b333005f4fa682cfc45a9fd95ed0f05b
SSDEEP 49152:KhtSn8EApI0fig3giDn0AP5wiDmg27RnWGj:rX2imphLD527BWG
TLSH
T19695BE13F2D901E8D05ED178C7568632E962BC160B34AAEF0A90B7561F7BBE45B3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

appletviewer.exe

Path C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe
Size 1.2MB
SHA256 263af706d623c2f5b782d5fd9f0c6aa2de64aa44b498e0584179ae1d0e77f818
MD5 ac9c3c045ee03cdcfdb50e5eb821814d
SHA1 165b2e55f35ffb53b8fe938fe74bc98fd28795b4
SHA512 7ee53f110363ef53777c1d3046cee9748d2bd8559c71a41cd7d1e0dd78160703dc5299421c0a8d1f687d8e6158f24cf8ea9d7f71f9985059c1bc124a09b1c484
SSDEEP 12288:hdXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:hdsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12F4523BE965C41CAE52648B5C3E5F10DAC073E5BE92004937A977CBAFBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extcheck.exe

Path C:\Program Files\Java\jdk-1.8\bin\extcheck.exe
Size 1.2MB
SHA256 2f87cac5de85a1687d04280df002dc4341bc42fa99b9ccf175539378009c7a74
MD5 1dc1a1ab1823b58b679f5ca4ede59b40
SHA1 db9cbb87fe4a0f00b01b939f2f776819e8983475
SHA512 77ae75e5c14f35f5dfc4598e18ec1bcb358c3bc67f8eef5092308b4fb82f35a87e3a054fab1d2300d4a643891c7e3a82574ed8b97e9a10e733d11ca4951c22dd
SSDEEP 12288:V8Xc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:V8sqjnhMgeiCl7G0nehbGZpbD
TLSH
T17B4523BE965C41CBE52648B5C3E5F14DAC073E5BE92004837AA77CBAFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idlj.exe

Path C:\Program Files\Java\jdk-1.8\bin\idlj.exe
Size 1.2MB
SHA256 a49794cb33e0775acd3a5bef2d2faef317593562cf355f01b8aad584ed95820e
MD5 b41f9a57e946a09ffc811390ab50e56d
SHA1 9b643d0e590cc4a58f7eb0fb82355d31e8fc5bf6
SHA512 d1315783b4d82ef285018666512d309aeccaa685c765c602a375b13722be3b366fbae4266e5cae7c4de21dc30bfe8bc5f43c99c6958062a4e796f9ea2a3f23e9
SSDEEP 12288:JCXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JCsqjnhMgeiCl7G0nehbGZpbD
TLSH
T13A4523BE965C41CAE52648B5C3E5F14DAC073E5BE9200483BA9B7CBDFBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jabswitch.exe

Path C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe
Size 1.2MB
SHA256 06cc70380a4a215723107f5c9cf0432ee2713bd5b5e484004569b401d5a932db
MD5 bc0c92ef88a1fd67bbc56f23b6f22184
SHA1 6589de357282adeed46eec3205dc5e2b5816d6ef
SHA512 83bc2efd86b02d674db278edabdda54a31e7309606f3ed405b8509decca7130a545a67444e251c43eafe566b4f194d759d4e7ec434daa6290dc59d7448e92456
SSDEEP 12288:UVLXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2sqjnhMgeiCl7G0nehbGZpbD
TLSH
T13F45236B675C00CAD83285B5C2F5E11DE8237D56EB3005DB6B532CAE9FB16944F38A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jar.exe

Path C:\Program Files\Java\jdk-1.8\bin\jar.exe
Size 1.2MB
SHA256 96047383bad737e4cc51d62cae84060132b6ee7cfff3254b9c729b22daf35fd6
MD5 0cab983f433ad1701d2c17b924ecbd65
SHA1 14dd14191049c54fad5d9f7eb8cabccee6ac7504
SHA512 21906b7bce1d91c2b5a334cca9cc17151850bf0c687c98fa975b87f80dfc69c2718347302c45ae5ccf833f5468cbbcb5de348296c602783c79588249fe8ed9a0
SSDEEP 12288:4DXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:4DsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1244523BE965C41CAE52648B5C3E6F14DAC073E5BE92004837A9B7CBDFBF14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jarsigner.exe

Path C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe
Size 1.2MB
SHA256 9ce4fdc74e7551373118ab954cf13f2bcda913f74ae14ada3e79c7d2182cadd3
MD5 bd9a44d9046d0ea1c3d83428e0aef2f0
SHA1 173bce29c7130357e22477b755d91aeb77b76e35
SHA512 f81894fff43158f94a5e15be395c74f2cd44c33552704b8a2a102baf34b1c4c9010f40d67ac0c1b7bd5ca4abeed493592f1329f9a84857ef38fc73bde030f689
SSDEEP 12288:7wXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:7wsqjnhMgeiCl7G0nehbGZpbD
TLSH
T11F4523BE965C41CAE52648B5C3E5F14DAC073E6BE92004837A977CBAFBF14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java-rmi.exe

Path C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe
Size 1.2MB
SHA256 ec8f9bd52ec158ae6a67635b40687d6a9f65f3a5881e08edeb675b0848c02d7e
MD5 c8cc220cf38d6fd6cc19464f60c6cb99
SHA1 4db394ea9a3ff2b843f149a1ee418c21ea89801e
SHA512 72348315a82ad06e4457afa42d3438696251b0ebb1bef9066dd575d54ff61d3af416534d0f94e805ee31385d9208af8448950b3ca0fc668488d82246c0d71212
SSDEEP 12288:uUXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:uUsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1DE4523BE965C41CAE52644B5C3E5F11DAC073E6BE92004837A97BCB9FBF14684B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Java\jdk-1.8\bin\java.exe
Size 1.4MB
SHA256 77ab8584bf61df8ab97418b0c7cc30fe12ea0cbd01926bd9d3ae789c63086682
MD5 73d6509d8b9e3ae765aee8ea19eac53a
SHA1 f9b7ec47a9f6abe7ed74e240eb80af2798dec958
SHA512 f036a7da889302c7679d808b00d3c03e8b1af55d0c366296921171f1d4026faa478602779e7e3f868141a7852f4320c917edebf79d6a10f093683f7694c6a649
SSDEEP 24576:eZMRzFVSOcsqjnhMgeiCl7G0nehbGZpbD:eZMRzf8Dmg27RnWGj
TLSH
T11F6501A9B35018F8EC63813EC965D90AD5B37C5A0B70C61F13A5366A5F733A00D3EB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javac.exe

Path C:\Program Files\Java\jdk-1.8\bin\javac.exe
Size 1.2MB
SHA256 fb7d86439f57dcd226eee0fcd92f077843dc79dd9c53b4b37162a7c2bcd4cbd9
MD5 f9006c6a7d660b96fe67533763b2e69f
SHA1 ee43b7df9dc914f09f11bac1cbd963dde6edfdc2
SHA512 22dc0151369062aa2529d33d92b3853de6fdfef81c6280382b8bcbfa9096d25de35d24c59f5c152dd0ffc265a5cb9181ff6f18a8673a5a6c0cd9061e8a2806ec
SSDEEP 12288:0ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:0ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T15F4523BE965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B3C426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javadoc.exe

Path C:\Program Files\Java\jdk-1.8\bin\javadoc.exe
Size 1.2MB
SHA256 e2de5dc64150cad9274c8142883a395976ae4c60238fc324f5021330cfbca1ba
MD5 38f6cf270080071f7351c2c5f2d75aba
SHA1 5e4a5a3285d6f3fcff2211ca54fd7160d461462a
SHA512 c3d4f6847bf40790d058485831e267ca5bc17b5c572f83f6168d936aec83568b85e974e447e6dd2813aebe8e000a87f735dae5ae4fe32d434efc24c86b3086bc
SSDEEP 12288:JlXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:JlsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1364523BF965C41CAE52648B5C3E5F11DAC073E6BE92004837A9B7CB9FBB14584B38427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javafxpackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe
Size 1.3MB
SHA256 6de208f550fb2d8ab2007fa0a3c96a2e8b97180a1a3396ded1d80d4490f8e5a4
MD5 2c7234d4c8d4c2c52e4cf3ffa83a7a67
SHA1 ff91bd45395cb37943050209f0435f47fe67f51d
SHA512 6507a4ce1f36f38696d7da433872dbcda17e1b5cd03226d0ad08d7220d2b44890a9cacc22016035636575e710bf4df72bceea4a6d0ce62e1302bab790057b3b6
SSDEEP 12288:XyPz5L8YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:azyYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1BB55125B73A530F9D1378138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javah.exe

Path C:\Program Files\Java\jdk-1.8\bin\javah.exe
Size 1.2MB
SHA256 349abdec47a43901a28c9a829a2a6e5d2706c63acb88a3c8d643aee56dc53027
MD5 69e6a849a1fcd7000889290be0e87047
SHA1 be73e8113fa26c2ca6603b0ef8ebe1aa91aadf79
SHA512 e77cde63d1a7533efb3f97f3dc5798ff3bdfeab94f345e9a5363c40ff125d1d8f74ea4823963a12df74092352dafe0cd69e0684521e5e0043d517a53dbe0abdb
SSDEEP 12288:OZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:OZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A84523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javap.exe

Path C:\Program Files\Java\jdk-1.8\bin\javap.exe
Size 1.2MB
SHA256 e85b94c78695b3877ae369cc88a4499ae6da41fc17437a908171de8b4f862b60
MD5 8d6af090869ac5df2359d6ea2a186613
SHA1 4fe69bd800dc29f86424104417ba05100ae17af8
SHA512 4449928a510eb5c0849a3a4681297cbfaddb3fb4833a930f658ee23fddd338bbb1c6d44c095174a50ba73f92820386afc67a1d7d3f68b3f6cbd9efda449f7b68
SSDEEP 12288:5ZXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:5ZsqjnhMgeiCl7G0nehbGZpbD
TLSH
T12E4523BF965C41CAE52608B5C3E5F15DAC073E5BE9200483BA9B7CBDFBB14584B38426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javapackager.exe

Path C:\Program Files\Java\jdk-1.8\bin\javapackager.exe
Size 1.3MB
SHA256 1a09c9600a1b53d826d39f156cb44050cc6121bd35a0f1994a4440f5710463db
MD5 1d76e5d474290e924fa5cc39ae0d8d3b
SHA1 45f5da7056e8f2831a4570ed5528203f2c8301fa
SHA512 ca3f1c74aab8573da5bc8348e92b431a5b13033b5bc9295c8929b0b51a6b2982948e4bd7a583ea9cc11b6a012eeb360bb1330e68026e50b8781a8983bfd647ed
SSDEEP 12288:wyPz5L8YXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:BzyYsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1B355125B73A530F9D1368138C5A29A06F7337C3647204A9F17A516BA6F736908E3EB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

javaw.exe

Path C:\Program Files\Java\jdk-1.8\bin\javaw.exe
Size 1.4MB
SHA256 4259d356c117106189bf0af60c0367a3698c4f281aed8f06e579428997e9f478
MD5 b6d08602622aa4183329eb64d252498f
SHA1 94d968a61bebdf0ef7ef1f1d6e2a64c6e153ae10
SHA512 5e37dc0da3b86581ca67cb488e04870a798e04ab63bf6c7908032fea91edc89ce98bc012b6f7d66aa1ee63a0ee490543f63ff9408789181ac39973b1d615b0b2
SSDEEP 24576:sTDaLl3z0zDysqjnhMgeiCl7G0nehbGZpbD:sTuLljzDmg27RnWGj
TLSH
T1906501A9B35018F8EC67813EC965D90AD5B37C5A0B70C61F13A43A6A5F733A00D3DB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MsSense.exe

Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
Size 1.6MB
SHA256 390edfc2d68e4f52e1e819200f8ad1ac44716b054c1e98f9c671a77bf88b69d8
MD5 3786ca712f03c74682ea40b7c6e78098
SHA1 94dca846cc8b17c915a32d6bb2c5830847e29df0
SHA512 884a667f744ffe093cd5f5a19047e40fcb47450a177e014b3ee5ce11b51e1ecd28dde578af7e70e9bf3c456d9829373a5b018d7b7469561ecf74adc32e96cf53
SSDEEP 24576:FfwvUk9RX6wkyAI1sqjnhMgeiCl7G0nehbGZpbD:3MnYIpDmg27RnWGj
TLSH
T19385D029EBDC04E5E177913C89B7860AF6B178691B31C6CF129A53AD0E33ED45E39720
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NisSrv.exe

Path C:\Program Files\Windows Defender\NisSrv.exe
Size 3.5MB
SHA256 e9f6482e05549579102b3e4d662793155fe3f5c20416b157906c1acb296b7807
MD5 b29201bfd2d640db0a6979af4d45c783
SHA1 4d75f0fe5dcaf3904f1383c0129605893dbdae4f
SHA512 f5b6fcab32d51afed3bed72e69732dd921768872820aee145adcd44218a659acf5049e9cbd2436b6b4e618e18a0d53cb8cb84775c3625f7957c78cff0e21960a
SSDEEP 49152:mYWONpsyk1C7pu2fFg4vAwnsSrxFnJMKEyBrHgoSrU/PRGrGxK0CDmg27RnWGj:lySzP6D527BWG
TLSH
T181066C97A1A801D5C1B9C1B98B1BCC1BFA7134090335ABEB03E556935F6BAF09E3E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmpnetwk.exe

Path C:\Program Files\Windows Media Player\wmpnetwk.exe
Size 1.4MB
SHA256 fa5a6bda3b0b75d4aa070f37d1f7d7e35cf9aacce2f5d2b002b7a2103b8d7686
MD5 d80b52353cebc1b953426d54e1b0e378
SHA1 618008b9718e0664b138df19710b54c8dd35cbdb
SHA512 d8d4af121f220dc3115ccd65f506b557fd7aa502263122cc81c23148994e08a32347dc27c51ef24ff46daea788cc1621ee6e04a026f4a560173b494f91585bde
SSDEEP 24576:o47Jb1aQZRTLfOrIhnjFN8rnDHU2+fF/AYssqjnhMgeiCl7G0nehbGZpbD:o47JUQjTirIhCnDHUPfF/SDmg27RnWGj
TLSH
T17365AE1EA3EC01D5E1BA927885558A1AEA71782E1F31CACF1270837D6F63ED44F35B12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dotnet.exe

Path C:\Program Files\dotnet\dotnet.exe
Size 1.3MB
SHA256 de60ce3d0eb0b5b0c868918c1aa1b51847cb5421d04a47cb286bd68f250c7305
MD5 36ba8d538e19c57ba92a7bef0339d775
SHA1 8ba6f57283e36497c0e5298a741bd1e20f8c0f88
SHA512 227d78c61aac58286fd097a3867f2e8d1c0443d8596cc6f40ca036818db170d02f5b0e015038b2e9bcf388b8e0823981678381d70969a9672bc8ccaa8faa6eaf
SSDEEP 12288:jbsfJXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:2JsqjnhMgeiCl7G0nehbGZpbD
TLSH
T10555015AD29802D8C06E6179C3969605F7333C2687E093CB67D1F87E1F766908EF9A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
Size 1.1MB
SHA256 42f2627d07ec11414ace8d5c02e76dd87fe0e21999318fb76ebe58ef2cbec7c5
MD5 b0bda130037bb689c8d157652ec25a4c
SHA1 214ea4d6f856b0fc9452a04ec83581d520ed90a3
SHA512 65e7745c1987180d95291931a8d9b188e6f6a90544398cc2c76685590d35d5f48964f0bc22465da40882a31d2cbacf2f9a49966a2d3fa9a999ea4f4a8a946fa0
SSDEEP 12288:0ebPRU3fLaFoQ954rXzW6hyX+eEVSSsZIHf3MgR:0ebpUPLwoU5IXVyXFEVl2IHf3Mg
TLSH
T149350641766BD78FC6A980321E36D6CCA7607D01EE05AF0773C8873F9576668BAF1281
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows.db-wal

Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
Size 1.4MB
SHA256 c9decd6bd3167152451545b1e7d77b43da092b7152451df15f5a6a52f93087d4
MD5 cb654d2360b97248181e076bc3ee760a
SHA1 462da1ff835f5752ba9d22fe83db05ede4969ca7
SHA512 2ad15595208ced3208465a0daeac43185faa35395bf1bf6f0d9dd88dfa674d63cfbbeaa66e3974327badabf1bab098791ebed4a07984b05c77808a7ea6fc6e31
SSDEEP 12288:JpkxCkDr4zdLkbhJ2hvJmUPcX5hMEcshEBAu9Zhbb08kYQVjbR:JpkxVzbhklI0gfMEcshSN+vdd
TLSH
T18565284065B7E35FCDAE9033523296CDBBA46C06B7453F0533448A389866A7EF5E23D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a90e080b41d098846eddc08b9b043bd6ae281c6338f6efc3e4f1a8d49335b2bb
MD5 a977b6c00797c8049cd7db01a5b29b01
SHA1 e5a0f2a12977859621ef86c1a00016b2f4aca465
SHA512 7d8e52e92c82f4f6b38ea188de047f8c75dc48260345f58da2bde883736fe4de7580eb76ddaf39a3f09ffbaf684b8ad95086d5aaea68ff8a38361814361bcf76
TLSH
T1A3D0121232824534C01030730012650A1640C71B414A8000543CC65D6B140F40A035C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ecb274b5ac633e4dd0fe1cadd8355ecc4f8cc30b79d2e23e6049282ac7c76cdf
MD5 96e2d9aed68a56be299eba6965804b53
SHA1 db84afee68bb21641b977e51d24e354414f1590c
SHA512 70dabff0313f2c4efa8d32a1f3d49b4448914f9b5c77aaa024ece31f2b2ee8a56bb78eeb0945938fa83c646d75abfbf1300bb50bae36d903b0d3d788297cf8d5
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

0a397235-11b0-45a2-afa9-15132c4f411d.tmp

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\0a397235-11b0-45a2-afa9-15132c4f411d.tmp
Size 6KB
SHA256 a59900f1a562b5b34b857babecfc1f9a99265663f78ab90453df22b6fbce12bf
MD5 4fdcd9a56ccc3f71626988b60234abbf
SHA1 154a5d72a4794cb99b8eb71240d930672ad3c730
SHA512 481156c151308d98bf398b805b074d8a6d9a4b53ee8da6eb695c9b5c0f6857a2a5b1462fabd5bd25c7b258b31f29eccfc3713c2c133a9ced90387173a075e952
SSDEEP 96:st1b/dJ5Rh+U5Ob9RkCo5h16Ze21s7/x+6Mhmuecl2p3MkknG/f3eJK+gAU28XMz:st1jr5R0vXoV21sV+FR2p3wof3n3G6K
TLSH
T1DDD1A7525E68797B4CC7E219BA25BB16D3F5A03260D11E58EBF8862C08EB5DC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Cache\Cache_Data\f_000001
Size 263KB
SHA256 7ef65350cc7174c56eb6913e820f55c313d9ab9f4f19eb19cbe10ce43b2fc9ee
MD5 a0e674346e43e7bd03ac736a3ae0c204
SHA1 18658844d9a22fa2f03da27de845c617a6fb340c
SHA512 75b8c49ef51d343c86871a88d6f785dedb6ebc4aac421192f3b30424afdbbddfb414812e1285d673bdca7c15b320e01eef0839e27e4db3bc4f441620bf12ea3f
SSDEEP 6144:VyXfve1dQFdlBg6KKmZ89r/XQ1hnau5JF7M83kr243VzeFQ:VQ3e6d3j3n9M1Mu5Qx2CzeFQ
TLSH
T13D4423441A2F9914C3F31E2ED7681AFEAA1AE254B9FA15AB73835C435953B3F3C6C401
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 d614f5a8cc6b195a377e4103dbc2e47c39b359548324f12affcd5ab3fe1ebca3
MD5 779e6affa47ecb19e704f8d6aa0658e7
SHA1 9b521e239a334689bc139d07e41ab76a23d25b0c
SHA512 190eb1aea071fb4f58877b79c14b7d259ca4513c7cb3bbb948060d6194c76375b1b619d64808b13d8466dfde91efa42ff9add0cf99cc4a22761168f43b6ccb6d
TLSH
T1F4D0121E4009230AE3682276F4E38860F1BC080B8C8F2FC3E0A910398C8B3CCAE02559
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59677a.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59677a.TMP
Size 48B
SHA256 10ef25ac33c0d7e715097bf42a916f480c5d6a576aa90de9df56b62484900571
MD5 3af01c616b691467308d680e5896f2c6
SHA1 fca97fd2d8ba0022f58c430ebc3c1c4194efdab0
SHA512 df91fb3967b3e0c012467fe7aac5e5537587bf3114ff1808b9c7f1a54384979b2d30505a3181b6eab21ab5110ee4bd2d98b24ba190edbb0c0781da575196adc0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 54ded8fef9f0f6799570d2b28067d769c0775f39781ae684ef33732ede1761ba
MD5 4a7f47829261ad69079bb2ff8d284eaf
SHA1 1186e87ed0b4ee099514aaae2f1b25b1549e019e
SHA512 f8f57970085c2377fd6cebd0f403e92c650b27f859adf1257c27e9256312a4ed9bd73e2fd411d16b6f3426158d46c83262887f05e9129b510de6b837b27b3b65
TLSH
T186516DB782E4872ECD5102F55B287A1BCF3D0935036C29A685D5BF8B93D50B2D38068A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2aab.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Network\Network Persistent State~RFe5a2aab.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Preferences
Size 6KB
SHA256 6212a624dc7e697be7053c4e19f3207efcedb653806305d899851bd59f349965
MD5 048f57269c9089b254fed4e37e813fef
SHA1 a38f9248c2c861c5b24937f570df2deb75445b7f
SHA512 dd31d46430e838e65f11d6dc33da445b147f4b2caffa0ce8c892d21af4840d1f6ce1ea87c8a2dfdbd69096ebde558e8bc39210f0b9525b98776f68e18e0867d3
SSDEEP 96:st1b/dJ5Rh+bG5Ob9RkCo5h16Ze21s7/x+6Mhmuecl2p3MkknG/f3eJK+gA9C28U:st1jr5R0dXoV21sV+FR2p3wof3nvG6K
TLSH
T159D1A7525E64697B4CC7E219BA25BB16D3F5A03260D11E58EBF84A2C04EB5DC6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Service Worker\CacheStorage\ef62a532400b79419a0c9c8e8ba0ef0af1bff6c5\a52ec414-a99e-4806-8061-9a928b370802\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Service Worker\CacheStorage\ef62a532400b79419a0c9c8e8ba0ef0af1bff6c5\a52ec414-a99e-4806-8061-9a928b370802\index-dir\temp-index
Size 792B
SHA256 09a893c2f24af647b83bafa2117c383a02953ceaec28da199c6ed12496cbe753
MD5 3d55ecca5041604b76f87a8353175033
SHA1 b699037853e16a4df2443fde22a4ac1eace1e2c7
SHA512 aa0559180e54b645a41d55d3624d84d61329d8c11f3dc48dc23713dd794fc5cd3074612d16f2590f867ad9d7d78b98fbfd98ae5308da7b692168d0bb5e995428
TLSH
T18801056D483D30DEDD24427CA567147572709EBA3D1003C2625315BCA04FE88C58074A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59710f.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Service Worker\CacheStorage\ef62a532400b79419a0c9c8e8ba0ef0af1bff6c5\a52ec414-a99e-4806-8061-9a928b370802\index-dir\the-real-index~RFe59710f.TMP
Size 48B
SHA256 4310e9eb8e4fed217220bd71521551ff2c0557c33cf4bfaabe38de6ca40a9b1f
MD5 19fd5d2b9222563905cdfcb893c47c1d
SHA1 6a97e493bba8b4e4ccda641733ce52c56ae32067
SHA512 e26882e98e477fd6cd480eb9074acfc1a9a01f884586383691e014cb1372adccc6cd6cae75afe804d232b8c4e9c8d85e6d9880d83fd9a350fa711c52724c55be
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Service Worker\CacheStorage\ef62a532400b79419a0c9c8e8ba0ef0af1bff6c5\index.txt
Size 190B
SHA256 4f6481db2981f5c556fb1906ff2b241d0687d4e5bb07fc3d2b4fb242c24485c9
MD5 dcfe4c2c5293ed3c8a24d8a4b91db8c9
SHA1 36d594d250938ab18ab18593046049907eca03bc
SHA512 281cdad4da93ae6221f3dc87146f3ab38c146146035951a60729e94427aa99dbc47ad7644b01c2dd2ce8d4266244de0d5409b10fb03705361826b3798b9e1348
TLSH
T1E0C0127F2567C7262F300FD49116675C48C549EE6680D646D7B713A709D803A0033646
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59714e.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Service Worker\CacheStorage\ef62a532400b79419a0c9c8e8ba0ef0af1bff6c5\index.txt~RFe59714e.TMP
Size 194B
SHA256 7d3b8533de1a7fed2fe14f19014c097201eaa1628721f56f01a4c19e3ed85a37
MD5 1b7580ed03845505c5a843e27ead4c28
SHA1 2c3144b37708d8366334b2ffd4fbb07de50b61fc
SHA512 97325829c42a9704f7121e7e42fe9dac119ba02060e6f0288761560d945fad29b481a5578e8886deaaba560253111ac339ee8d40d0e2b3e11936644f3bbb8093
TLSH
T148C0127F25A7C7262F200FD59115A75C44C50DDE6A80C641D7B732A719F403A1073642
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 cb614158ca195efc01120dd8bc53856098f723e121b31317af0e5a6971b6ef81
MD5 3ff7f3c7f0ca757ef00b05e2769d1e2f
SHA1 f8c69183b633c26ed13d229e51b7a483391bb337
SHA512 fe358d9eb98b1670468928b680bc6af69bf7763d7664c7ca94c50931738972a6451c17726e38e04c7974771ec20603ca569ca8e83b485fe027c3d39b3da07e44
TLSH
T1A0B02223E0020AA2C08C03F22BA2088C33B0CF3AEB82C3C3C2A00F2ACC022008A03000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596325.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596325.TMP
Size 48B
SHA256 e593f32f5e12a15f92f62a4e93f5e2f2471ab7c13aa461e950e794d38c50fa0f
MD5 2aa43e9c620d5edd349bc2588b934765
SHA1 34fca44afdd22ddcf70351510152add64d0c767d
SHA512 7dc51d39a8f5e34ce4158078d13a79ded27666a8020649bc4e44b9f3812fabbcdf729745437ccdba291a6a9968a0a61aa3bf5bbc5bce7919df7b90bbd759d428
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Local State
Size 15KB
SHA256 3aacfb1c43ab0c5c90646ae07786b92c64755883d045258a8192fb7de6efcaaa
MD5 0d43e32c2056ad1b0c8084d45f6cac37
SHA1 1ec468a67c8b160f12450cc4e90752e689b3f068
SHA512 e3cd5914f7c3a6dc9fe9f82e0c12cd4783c2caf1728ba51fff72d62f201b0c8e459fdb4cb9a41d70851e6d166b495ad0d5e4f12c09a7735f41cd2e1d01df8a63
SSDEEP 384:v+aQikB+z/xvxjg/qhEwNBSodAsLT8AVdpu9+m9zw:+/UxvxjgC+oNf8Uu4mFw
TLSH
T19A72AE2799787E2796F3EA15795D1B4BCBB894B250C16EB84EFC6F0D06C72D80302C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Local State
Size 2KB
SHA256 f525175b8bf44a7a4d533f7469a875fdabbbe375baed123b85ee879d3fa77250
MD5 31c33bb21391df1b985986c19ee678de
SHA1 ac28638a640439387421f7658cde16d11fc0429b
SHA512 1c743a33afa9d13301ac3622795633ab600af54b4c2a9b2bd02be2d2a144f38322d748274f506001f290fb664c66fb89c6ee0c5aad3224362237fd98fde738ad
TLSH
T1D35197737920AB3B86E3965479077F238B75A0B19A621F108ADC1F0C01DA65C1702C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Local State
Size 3KB
SHA256 e7eb650a41c4df77fb5e5d5cfeee0f2792f4ef3de3e823406a61d10abd09ece3
MD5 77bac6ad01f8c55e1118b7880a5a799d
SHA1 425015b3774eb20f71898aac52c80d2649c0ae8a
SHA512 8083b1de54ddfc57da179195d6e19c8a54b2f40b5b2f6f73b307ba3f85b587e92aa4552c1764ce09168e33536bb82f4cb165a4c64cdadc24fd823fa084666359
TLSH
T1536184736970E93B4EE3DA15B9863B16A7B59033D9912F64CAEC1F0C01D769C1342C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe590797.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_c6853278d3667c4a44c8979e2c66f797_amadey_blankgrabber_coinminer_glassworm_icedid_lost-door\EBWebView\Local State~RFe590797.TMP
Size 1KB
SHA256 b614e825c9edc936521d5f680232299b74e7b940bd96e7e905b9ad55fe775ba9
MD5 b8fcc1dc4c59d9f07b056479838fd2da
SHA1 1835aef8314ad9b3f4ab85862f34c108d9600b87
SHA512 39a112406f6a71783240f3ba34cf5996c556dd276c446a561e1cefaaf47cf044c3430a2874958ba3432e3a6f94049e59949d274825feb35ffd9a45b9ee6dd3aa
TLSH
T1E42168F3F9709B365D92765632077B575F31607641608F0059DC4F5C06D658C5A2AC3B
MD5 SHA1 SHA512 TLSH

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.2MB
SHA256 203042219488cb5093d9d72a682b0cd477a9a0e2c98f4e0cadd0a48bde7a9536
MD5 cc888a581e848a896643d17933b5ca81
SHA1 efc5b18df0d3276c7bcf93fb5a4f138e4ecba330
SHA512 3a1e9bc1bf4c339768eb7262e37636db223fafb7aa46c82998ee0d00ed1d4aec2f4888e4cc38a3dc19453584986c9fd89e5e4106b4d2ffb302acab5233b03af7
SSDEEP 12288:W07hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:vhsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A445237AD34C518AF83605B482EAE12D681B7E669F1044C3BA5778FDF6B18C88F38517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.4MB
SHA256 7f7b8c83250ea54ef39e1eda3375e16d571ba4ab6f6182d05d6dfda878321df8
MD5 45da11193fa5ecf475cbed83830eb947
SHA1 d0360ab06d95b1fa6380be95d4703811dac099a6
SHA512 046028d544767ae703a19f4092ab22a927386ea59dce351332002b664975cb44cba7f9222ef93c5c79b91718eba8114d3f337f11afc32ed1d5df8a66f3142be6
SSDEEP 24576:tgb6bmBIi49WNNFpg1rSvFv7bYPsqjnhMgeiCl7G0nehbGZpbD:tgb4mBIBhGFYDmg27RnWGj
TLSH
T1AD659E1E22EC02F5E0FAD2B8CDAA4417D6B278161731D2DF1151426D2F3BEE89D39B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 a0dfe42d3d7df13eccdfe9f40cb42911105f16a2bc6d74b00a1a395f8347252f
MD5 f8c3348f9a2b0d74bb9bf41cde613b74
SHA1 d7a2812ea4a6339636f832836c7f8b6c8ab148a4
SHA512 0c0e43b60e828005aca1771fbf99b4b61eb805e6c1bc726ba90522d805693c41985e77ff9791bb40870c89139b80e0cfc68dd8e8443ca7f56e86327759988be6
SSDEEP 24576:4G88u8FpJqH1bzria7/mcsqjnhMgeiCl7G0nehbGZpbD:77ZFPqVea7/7Dmg27RnWGj
TLSH
T10085016577E401F1D47BD138CA868667F5B2B8250324EFDF07A88A551F23AE44B3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.4MB
SHA256 c970a26d091fe269966bade7ad66c3a5685582e826851c3ba897d69d703ae3b8
MD5 e29f0e0218f95368ec07de1aa75f5471
SHA1 20f6bf608e99de3c35e716440c8304d123c31d93
SHA512 35bfd3be01975b141dc6287d68ce91be32db1ad1832289bce3a05a0bc4305adbadf44b0376379f6ef75f9d44b8985e920c48ad4fb369ac17692388bf8db21830
SSDEEP 12288:KHvUrBFrEjwaQAXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DB9:KPUr+NQAsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1F165F12F22AC18E5E676A17DC682C70DF6727862171192CF02E1817E5F63DE8AD3DB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReFsDedupSvc.exe

Path C:\Windows\System32\ReFsDedupSvc.exe
Size 2.6MB
SHA256 680a0285659ac276e6aaafddca4e7c2c63f531b1c23ed2b4149894e06acbf54d
MD5 548c4ca819ca838847853474df3fbf71
SHA1 9fd3fc084c402aadc796cbc8c5fd0405e17092fe
SHA512 ea8af0df15e05cc8aaa671670f8258d7aff6d1b154474c94c6d4c107d4e33fbf2762265ff9f747514720cdf34ae03ba86b6ed2fa5e58626c8fb396066f8ca49e
SSDEEP 49152:cBCKAFbhMY4eGe+GbXzJc1tKFblwzh4Sd4fIzX7dTtbebAjsDmg27RnWGj:/G05lO43bRD527BWG
TLSH
T12CD5B06E62EC11F9D1BBD17CCAC6860BEBB23815033556CB02A486A91F27FF4557E312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 66e253a467be03de84047a2f66cbf44143eeb67e82c0fd3162f5214e141344de
MD5 ea5fe17d8f949453d7be0f9a30191097
SHA1 a3ab066075b12a91886f5c1e8deebdc6f5d580fc
SHA512 899f2228dc83c45a3c508cd9f4938216260f3db81a650a6c19e8264ad5843e07c274672598cd65dcaeadbd63013952d0e84c690d2c6b1a186c27e2dc0c9b2e75
SSDEEP 24576:Lfa5POZ3dpuWVM50JicR2hG0lasx2+47eidnusqjnhMgeiCl7G0nehbGZpbD:Ta5POZ3BJt2pasx2+mkDmg27RnWGj
TLSH
T16365BF5EA3FC01D5D579D17DC583861AF5B2342253319ACB122182BE3F27EE89E39B21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.7MB
SHA256 28ea6abd2a0027a6192c3365af6e462861d278fd1079ec6f59ed4678dbcdeaea
MD5 494c8bc5b7e96c1d74177931d316038c
SHA1 a9a07275dfd1d6f3f1ca3b8da6ae2161a3791623
SHA512 e9edb93e3d72514bca99f93945047ee1e52c210f7c12e9e55235dc5864fb0464c1df6e2d92b3a4fa86dc84b976f05d4d0928e6901a832db2322f89bb0609a73a
SSDEEP 24576:pNcwHdjbyQ4nLC18lb/EOjowL7FkEsqjnhMgeiCl7G0nehbGZpbD:pNc/zEOVHFbDmg27RnWGj
TLSH
T10D857B2623E901E4E1BBE1BE89779546FA71786553308ACF0291851F1E73BF45C3AB32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AppVClient.exe

Path C:\Windows\system32\AppVClient.exe
Size 1.3MB
SHA256 c3c7eda7ecb8566e4f3e828c8d0170d01395ab381bdf7eceb4b254d1fcc22ca3
MD5 5cf4045eed96b2d1ebabeb779f1a3c96
SHA1 119b7d65a8a57ff1e11a39694ea87f2d0e3ed65c
SHA512 3a811bfabb425bb83afca1cf2e20896e4c8fe0e70233785b396e4866e63d85e93e27a4444460bfab6c42104fea4d8da062a30ea4fa12d32e613f642d9252de3b
SSDEEP 24576:1TkNvNnaFeYhJNtmZBmqsqjnhMgeiCl7G0nehbGZpbD:1TMwBtOm+Dmg27RnWGj
TLSH
T1CC55AF6EB6B806E4D1FEC6B4CD238516EA727861073252CB5390C13F5E679D88E39F21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SgrmBroker.exe

Path C:\Windows\system32\Sgrm\SgrmBroker.exe
Size 1.6MB
SHA256 8f90c5ab1014cb7a7eb0816c4caad73d952e476529a47b9fba0297b1c19bdad6
MD5 9cb7b98ad188ce39dc0e8a52a17460f8
SHA1 4cdea79c9dd859254a0ae2a90014954e64df72be
SHA512 2283f946b6c5728eee3946937aafe9eeb18de03d57d3204a2aec76c1bbb44b40536ddcc3d887980e7ed4415ab725be6c04a15a97a03f25a3c14474ae0e20fda8
SSDEEP 24576:OD3FHshBIYQgA9sqjnhMgeiCl7G0nehbGZpbD:ODVHeBIAAhDmg27RnWGj
TLSH
T18875E17EE69C00E4E57BC1BCC6A3C606E67238A9032155CB12D581BA5F6BEE46D3DF10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-177-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1296-175-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1296-170-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1296-164-0x00000000006B0000-0x0000000000710000-memory.dmp

Download

memory/1296-163-0x0000000140000000-0x0000000140168000-memory.dmp

Download

memory/1852-0-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1852-320-0x00000000028D0000-0x00000000028FD000-memory.dmp

Download

memory/1852-6-0x0000000140000000-0x000000014070D000-memory.dmp

Download

memory/1852-293-0x0000000005B10000-0x0000000005B3D000-memory.dmp

Download

memory/1852-9-0x0000000002070000-0x00000000020D0000-memory.dmp

Download

memory/1852-220-0x00000000055B0000-0x00000000055DD000-memory.dmp

Download

memory/1852-37-0x0000000180000000-0x000000018002D000-memory.dmp

Download

memory/1852-124-0x0000000140000000-0x000000014070D000-memory.dmp

Download

memory/1944-314-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1944-72-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1944-65-0x0000000140000000-0x00000001402D4000-memory.dmp

Download

memory/1944-66-0x00000000006E0000-0x0000000000740000-memory.dmp

Download

memory/1968-231-0x00007FFA2CD20000-0x00007FFA2CD21000-memory.dmp

Download

memory/2092-105-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2092-99-0x00000000009A0000-0x0000000000A00000-memory.dmp

Download

memory/2092-98-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/2092-495-0x0000000140000000-0x000000014020E000-memory.dmp

Download

memory/3116-186-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/3116-179-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3116-704-0x0000000140000000-0x0000000140172000-memory.dmp

Download

memory/3116-180-0x0000000000620000-0x0000000000680000-memory.dmp

Download

memory/4148-109-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4148-566-0x0000000140000000-0x000000014020A000-memory.dmp

Download

memory/4148-111-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4148-117-0x0000000000810000-0x0000000000870000-memory.dmp

Download

memory/4580-688-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4580-138-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4580-137-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-144-0x0000000000860000-0x00000000008C0000-memory.dmp

Download

memory/4580-681-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4580-690-0x0000000140000000-0x00000001401BA000-memory.dmp

Download

memory/4620-756-0x0000011BA1180000-0x0000011BA1197000-memory.dmp

Download

memory/5316-691-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5316-149-0x0000000140000000-0x000000014027D000-memory.dmp

Download

memory/5316-151-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5316-157-0x0000000000D20000-0x0000000000D80000-memory.dmp

Download

memory/5372-606-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5372-121-0x0000000000400000-0x00000000005D6000-memory.dmp

Download

memory/5512-131-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-125-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5512-755-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5512-753-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5512-132-0x0000000000760000-0x00000000007C0000-memory.dmp

Download

memory/5512-633-0x0000000140000000-0x00000001402C9000-memory.dmp

Download

memory/5780-842-0x00007FFA2C7B0000-0x00007FFA2C7B1000-memory.dmp

Download

memory/5780-841-0x00007FFA2C7A0000-0x00007FFA2C7A1000-memory.dmp

Download

memory/5840-89-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5840-83-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/5840-76-0x0000000140000000-0x0000000140214000-memory.dmp

Download

memory/5840-77-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/5840-87-0x00000000017B0000-0x0000000001810000-memory.dmp

Download

memory/5916-876-0x000001ECD0FD0000-0x000001ECD0FD1000-memory.dmp

Download

memory/5916-867-0x000001ECD0FD0000-0x000001ECD0FD1000-memory.dmp

Download

memory/5916-869-0x000001ECD0FD0000-0x000001ECD0FD1000-memory.dmp

Download

memory/5916-875-0x000001ECD0FD0000-0x000001ECD0FD1000-memory.dmp

Download

memory/5916-878-0x000001ECD0FD0000-0x000001ECD0FD1000-memory.dmp

Download

memory/5916-874-0x000001ECD0FD0000-0x000001ECD0FD1000-memory.dmp

Download

memory/5916-877-0x000001ECD0FD0000-0x000001ECD0FD1000-memory.dmp

Download

memory/5916-873-0x000001ECD0FD0000-0x000001ECD0FD1000-memory.dmp

Download

memory/5940-48-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5940-162-0x0000000140000000-0x00000001402E9000-memory.dmp

Download

memory/5940-55-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/5940-49-0x0000000000E70000-0x0000000000ED0000-memory.dmp

Download

memory/6084-309-0x00007FFA2CD20000-0x00007FFA2CD21000-memory.dmp

Download