4dc82438a60c719266b4bdadf1c5e9a78061fda5da646951ff337a282627d68c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 16:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
Size 15.4MB
Sample260422-tk9mnse18x
SHA256 4dc82438a60c719266b4bdadf1c5e9a78061fda5da646951ff337a282627d68c
MD5 520c9cbd017340c699653b629d296154
SHA1 e26667b5b03493e5ecef1beca2587dd763f687b8
SHA512 1a2bae71f0eb502815926220be5f2e7ea95e4a72a26d4fae384b8be2ec02d55257e3f9b0c0006d0e6b1a3ea6878b02ab2533d8d3090fb1699351ddde80f5514c
SSDEEP 196608:++SvC0zh4VlFTGG1uzAPDndJ2VK75eACndJ2:+hC0zh4NQYndMK9eACnd
TLSH
T13CF66C17E86545E9C4A9D134CA629213BB717C894F3023D72B90F7282F77BD0AEBA750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 63 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_713395009\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_699154740\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_699154740\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1625575950\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_699154740\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_713395009\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1625575950\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1625575950\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1539129220\hyph-la.hyb	msedgewebview2.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1068	PowerShell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134213488522067332"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\yoki	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\yoki\ = "URL:Yoki Protocol"	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\yoki\URL Protocol	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\yoki\shell\open\command	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\yoki\shell	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
Key created	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\yoki\shell\open	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714754311-527593155-1440850301-1000_Classes\yoki\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\" \"%1\""	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1068	PowerShell.exe
1068	PowerShell.exe
1596	msedgewebview2.exe
1596	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3888	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1068	PowerShell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3888	4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe	84
PID 3888 wrote to memory of 1524	3888	msedgewebview2.exe	85
PID 3888 wrote to memory of 4144	3888	msedgewebview2.exe	86
PID 3888 wrote to memory of 4144	3888	msedgewebview2.exe	86
PID 3888 wrote to memory of 4144	3888	msedgewebview2.exe	86
PID 3888 wrote to memory of 3112	3888	msedgewebview2.exe	87
PID 3888 wrote to memory of 2328	3888	msedgewebview2.exe	88
PID 3888 wrote to memory of 2328	3888	msedgewebview2.exe	88
PID 3888 wrote to memory of 2168	3888	msedgewebview2.exe	89
PID 3888 wrote to memory of 2168	3888	msedgewebview2.exe	89
PID 3888 wrote to memory of 2168	3888	msedgewebview2.exe	89
PID 4696 wrote to memory of 1068	4696	2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe	90
PID 3888 wrote to memory of 796	3888	msedgewebview2.exe	107
PID 3888 wrote to memory of 796	3888	msedgewebview2.exe	107
PID 3888 wrote to memory of 4956	3888	msedgewebview2.exe	108
PID 3888 wrote to memory of 4956	3888	msedgewebview2.exe	108
PID 3888 wrote to memory of 1744	3888	msedgewebview2.exe	109
PID 3888 wrote to memory of 1744	3888	msedgewebview2.exe	109
PID 3888 wrote to memory of 1596	3888	msedgewebview2.exe	110
PID 3888 wrote to memory of 204	3888	msedgewebview2.exe	111
PID 3888 wrote to memory of 204	3888	msedgewebview2.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=4696.536.6498963427716608684
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3888
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffef3e8b078,0x7ffef3e8b084,0x7ffef3e8b090
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1744,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1712 /prefetch:2
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2032,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:3
    3⤵
    PID:3112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2336,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:8
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3616,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4416,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:8
    3⤵
    PID:796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4428,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
    3⤵
    PID:4956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4420,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    PID:1744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4524,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1596
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView" --webview-exe-name=2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe --webview-exe-version=1.0.6.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4048,i,2108816772960393678,15162810136336847316,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:8
    3⤵
    PID:204
- C:\Windows\System32\WindowsPowerShell\v1.0\PowerShell.exe
  PowerShell -NoProfile -Command "Get-StartApps | ForEach-Object { $_.Name + '|' + $_.AppID }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3888_1625575950\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3888_699154740\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3888_699154740\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping3888_713395009\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_jtohfqc4.w0r.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jtohfqc4.w0r.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cb79c058ca8e518be7f9a0e3270b498b3c219cef0b48841127b4b0dfb0ffb5ac
MD5 d16fc69cda20cdf599efe1312e856303
SHA1 9d5a68f2b4b884ffc25601b5db40cda3d8794f51
SHA512 d06e7e626bfc2328c9c4e52f6a243dcc4ab9fbfe91490786f6606d128b0d0a8fa50cba4eb70f2740fa13635fb45737ba060c0a264410b6b69e222bfe5e7061f7
TLSH
T1C8D0122F3623093CC01130730002A10C0401C50B400980485838861D2A449900A07497
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3075c83438101dded4c375bcd53f612543377ff183462c2c24fe8d2870cd3df5
MD5 b37ff1bb3324d0f7dcb654f005cddee6
SHA1 79694ef0a24e9a31466d2937d999c8656a53f583
SHA512 721423c6eb67c773e7d607a56f3f816c521f64ad00faa2e4744c6f9f2550342bc1724d87ba27165e0f6b00a5eef29902ac00f235bf931de7cdc4277425a5bdbc
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 8295ebc91b361d5afb317cc1471e5f3df334b9b181c183d42aba079523b51489
MD5 0ce5409d4f9da309a2526a53f0b8e985
SHA1 b4f28d334d3e6b92b451708e7aceb79f47e1c139
SHA512 634505844972f5c3af24efe632889c1a4f09a6d267b9fbf36651aa707cb4e5152be70c93a752a690b04ba80ac16007e0f5d6ff88260bd4a3ce3e7b05d5fd8a61
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 0467178bcc1472544a982910e02732e83f16accbf3584a0c85ea29208429f91f
MD5 84fc92dccaa40dcc07951bfa61442a69
SHA1 0f8f8ba6b66add339793993814c0d730781d40f2
SHA512 46822afc3c5d2fae021c4491ec8a8ad1342bd77a1e39f3a29d446953d4a14dd747008945f445225289098e7a5aee8604d0fca203b96dbc789a8e8ffd4cfdd6f8
TLSH
T1CAB0222CCA2FC003C22C03B0B8FC0C8038303C2E8A8B03C280C2023E8F2A3C0C080803
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\DawnGraphiteCache\index
Size 256KB
SHA256 3b47b3500845458886d8caf01fa3c1c4cfd5e452ff12c62dfa9ed1febdc59d59
MD5 415188e84cd85943cb7335f5b246bda9
SHA1 2af940bdef41211103de09c2d887169dd4ad8a0b
SHA512 0314442fed02c4e316918bd3efd6a6a7e669c110cf38aae007c7bcf21abefbea041c983dd08966268ea5d08ef6d4b93e088df7c56b8119910bf2a17c72ffa315
SSDEEP 3:LstlNllkll/l6LKl/l:LsX3lEtd
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59ab88.TMP

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Network\Network Persistent State~RFe59ab88.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 91eb51ade1b13b1192784f5ac05df7527b577f2d752085552b00a7a9a4638d47
MD5 c59929adb3d86a05ac3ef9610c0f3d9a
SHA1 509b341ecc0cd7baeae6d95e9fc987d5a8808909
SHA512 afe8254a4f7a3d7418ec7f6a9d1b94260eb20aae7afc40e14f02c5c880b5d6c0372e4f15046fed9876e08b35a900c1e597a49a446ed332c0d96a5e0f32e7501a
SSDEEP 96:st605dBPSm+rb9YffOZ8i0vhEekcmm/7qx+WVHMSm+uecSsL1idQj++gneMOB:st60d7fGZ8pakT/S+WiQsLwdXFeMC
TLSH
T10FE1B8036E68A977ACC7F6597A35FB12E2F5102262D50E58EFFC871C04E66CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe592512.TMP

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Preferences~RFe592512.TMP
Size 6KB
SHA256 54badfa59be0520315578daf2db008f294359ebb1eca4c38258e1d89201ab9e2
MD5 01d08b465c39d480a9fda63d67e7e011
SHA1 4b31ff3eea65939e75f1bd0e7b464308d2eb7a65
SHA512 8a8097dcbbc7bbe720284b0a7045b939d2203293de9389b6d6635e41255ac7e012385cb910fc854b4a95b49539362f07322b3aef1786cd978d0f4de35d3f560d
SSDEEP 96:st605dBPSm+rb9RffOZ8i0vhEekcmm/7qx+WVHMSm+uecSsL1idQj++ghKeMEB:st60dmfGZ8pakT/S+WiQsLwdXSeM8
TLSH
T19FD1C8036E68A9775CC7E2597A36FB12E2F5102262D50E59EFFC861C08E66CC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Local State
Size 1KB
SHA256 31317b017d4e0228050dbece3ec4670835d2c8119b28244e6b3796ef51bbe4b4
MD5 67775f4a0ce66ecc172f1ea902c029ff
SHA1 7f856b6eacfb70f1ea5908d06689249a4b88d49f
SHA512 91b77a5cc4903065db2ee73a1e7e88c2fe97067c4df19c764dc1851a82c5441aa46371e2cf79a757011af45852e415bd8841faf6a78edb900f53b74935353450
TLSH
T19831A7B7A494AB32BCA252D5B247BF936D30007AC3805F8891DD470C02EBADC9726C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Local State
Size 2KB
SHA256 bde6dadbd9ad004bff023e7859cec723655697321bb7ecba0427e1bc24e17a26
MD5 5a6873c708e3d6b27ce4a799576cd2cb
SHA1 c6575136527f88e0c6a12c5be5cfb57a36797b3b
SHA512 8cedc02c2fc032f8c71098fe6959eb3910bd898402f0ab4b2d528cce64715188e5293231b6b5267b9828f8c0bbf07b1a1f5e5ddf18bee056adf0161d90fe5519
TLSH
T1FF51C5736808D737A9B386D8B94A7F63993550B5D7912F9599DD0B0C01EB69C2302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Local State
Size 3KB
SHA256 8b271416af8e328a4936baefc1dc696b2352ba56216111e1014bb0f5e521da6b
MD5 98b20dd9c116e216a26eb36fbaed4a27
SHA1 673bafe78c80dcf241fb011f5e519cd5558bebb7
SHA512 b7150096ddec835444c77612d23a971066083c7522ff414508d136dd43a60813be7877caa3bf5bfc0999f80704f716e84cbe4579587476b4bcfc55afadf10117
TLSH
T1C971A46B6964E6275EF39A84B9863B12B6B55137D2C53F99C9EC0F0C01EB3D81302C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Local State
Size 15KB
SHA256 bc11e8c80e4e1a9dc5110f64ab062a7de5df19dd7c671e4faec7835fe1cbce10
MD5 1986a613ebf33e870b5358c7ce843123
SHA1 e67928c3d58d4c0293d12641f2fd11c541d45c31
SHA512 7f2a4aad11790dfd7b6829c590778d06051864631b94e7db36faf60c083e4bc22ff063413e615292415c26d1d05f90042750fcd62a6202ae2c7e300a0f33c00b
SSDEEP 384:zIfRE5BdEZfr0kuh9Rt/nP9yxNbXlm30ohTPOxkQK:QRkurqhNsrM3TtO6QK
TLSH
T1E972BF234A759D272CE7824A39095B03A5B5805EA6D23ED8BCDD1F0D0BDBBD90393C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe588538.TMP

Path C:\Users\Admin\AppData\Roaming\2026-04-22_520c9cbd017340c699653b629d296154_coinminer_dosia_glassworm_icedid_luca-stealer_poet-rat_quasar-rat_vidar.exe\EBWebView\Local State~RFe588538.TMP
Size 1KB
SHA256 7eb8c04430e2a115c6654bc39f0ba714659c256021b2e3b025651c4def343424
MD5 1c78178ad914fe0fe25650e680c97744
SHA1 c6d7b29d4fab4915cf88bc8aca05b092ef154363
SHA512 3de7f83083c2881acdd8bdb62a70d2342c2509cefbb3b79cb90e589dec04b99e2ba2c920395185fd3dca3467fd1c8c2cba05018b46ddcf521db48ee43853be92
TLSH
T1E12165BB9494A772B95145E5F213FB862D70407AC3445F8991DD430806EB9DC8726C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/204-608-0x000001C93AD00000-0x000001C93AD30000-memory.dmp

Download

memory/796-374-0x000001B417F10000-0x000001B417F40000-memory.dmp

Download

memory/1068-212-0x000001DCE8FE0000-0x000001DCE8FEC000-memory.dmp

Download

memory/1068-195-0x000001DCE9740000-0x000001DCE9762000-memory.dmp

Download

memory/1068-209-0x000001DCE99C0000-0x000001DCE99CA000-memory.dmp

Download

memory/1596-543-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-550-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-542-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-544-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-549-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-552-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-548-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-551-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-554-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1596-553-0x000001EC27D30000-0x000001EC27D31000-memory.dmp

Download

memory/1744-533-0x0000028602DD0000-0x0000028602E00000-memory.dmp

Download

memory/2168-262-0x0000029561CD0000-0x0000029561D9D000-memory.dmp

Download

memory/2168-143-0x00007FFF0F190000-0x00007FFF0F191000-memory.dmp

Download

memory/2328-259-0x000002448DBD0000-0x000002448DC00000-memory.dmp

Download

memory/2328-56-0x00007FFF0E710000-0x00007FFF0E711000-memory.dmp

Download

memory/2328-57-0x00007FFF0EC70000-0x00007FFF0EC71000-memory.dmp

Download

memory/3112-258-0x000001C5AB590000-0x000001C5AB598000-memory.dmp

Download

memory/3888-241-0x0000016665C20000-0x0000016665C47000-memory.dmp

Download

memory/3888-242-0x0000016665E50000-0x0000016665E8B000-memory.dmp

Download

memory/3888-239-0x000001665DFF0000-0x000001665DFF8000-memory.dmp

Download

memory/3888-238-0x000001665BDF0000-0x000001665BDFC000-memory.dmp

Download

memory/3888-237-0x000001665BDB0000-0x000001665BDDC000-memory.dmp

Download

memory/3888-240-0x0000016665020000-0x0000016665492000-memory.dmp

Download

memory/4144-247-0x0000026C9F8D0000-0x0000026C9F99D000-memory.dmp

Download

memory/4144-34-0x00007FFF0F190000-0x00007FFF0F191000-memory.dmp

Download

memory/4696-404-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-236-0x000001D8EA050000-0x000001D8EA4C2000-memory.dmp

Download

memory/4696-509-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-497-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-349-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-417-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-337-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-1-0x000001D8E7E90000-0x000001D8E7EB8000-memory.dmp

Download

memory/4696-265-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-534-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-235-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-285-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-567-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-579-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-297-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4696-325-0x00007FF63FE50000-0x00007FF640E15000-memory.dmp

Download

memory/4956-484-0x000001B4B7F50000-0x000001B4B7F80000-memory.dmp

Download