fa7a9d6cdb54e99c29457a6f3a5eeab2d1d478bf195c0b396612b59c4a2f7df7

Analysis

max time kernel
150s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 11:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 27.9MB
Sample260714-nc8grady4x
SHA256 fa7a9d6cdb54e99c29457a6f3a5eeab2d1d478bf195c0b396612b59c4a2f7df7
MD5 4d52c4cd82f6273f44f411e0137eaa83
SHA1 fd4c472be6332a86493f71c00b95835a37df312e
SHA512 e82a66803838b4d94aadc9d1673e28ed4f79ba058b1425a27925ef6b138ed7b9fb6a1743a11495587f3c4c1ce03814acb593a1b79a29ae14ea391cbb55b48a61
SSDEEP 393216:2b4i2oqafNO0DMcfNFYD/CxnEinFc5/DXtc3diOp/kjPrwNJg0VcxLn1+GOaO4xD:28OfAx
TLSH
T1C6574B63F8A259A4C4EAC174C736416BFB613C2D0B7823E71690B3205F3BBE09AB5755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_836389598\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_836389598\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_1169567352\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_836389598\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1498763460\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_961739596\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1498763460\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1787989645\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1498763460\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1498763460\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_325272782\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1787989645\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1787989645\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1787989645\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1787989645\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_961739596\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_836389598\llm_user_input_extractor_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3088_1169567352\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2484_1511407949\model.markov	msedgewebview2.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285013991273520"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{8FB54F0B-A3EA-4A62-8E8A-5FA410E2330F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1232	msedgewebview2.exe
1232	msedgewebview2.exe
2796	msedge.exe
2796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2484	msedgewebview2.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 2484	4144	2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	87
PID 2484 wrote to memory of 604	2484	msedgewebview2.exe	88
PID 2484 wrote to memory of 2056	2484	msedgewebview2.exe	89
PID 2484 wrote to memory of 2056	2484	msedgewebview2.exe	89
PID 2484 wrote to memory of 2056	2484	msedgewebview2.exe	89
PID 2484 wrote to memory of 2056	2484	msedgewebview2.exe	89
PID 2484 wrote to memory of 2556	2484	msedgewebview2.exe	90
PID 2484 wrote to memory of 4484	2484	msedgewebview2.exe	91
PID 2484 wrote to memory of 4484	2484	msedgewebview2.exe	91
PID 2484 wrote to memory of 4484	2484	msedgewebview2.exe	91
PID 2484 wrote to memory of 2120	2484	msedgewebview2.exe	92
PID 2484 wrote to memory of 2120	2484	msedgewebview2.exe	92
PID 2484 wrote to memory of 2120	2484	msedgewebview2.exe	92
PID 2484 wrote to memory of 2120	2484	msedgewebview2.exe	92
PID 2484 wrote to memory of 2120	2484	msedgewebview2.exe	92
PID 4144 wrote to memory of 3088	4144	2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	93
PID 3088 wrote to memory of 5952	3088	msedge.exe	94
PID 3088 wrote to memory of 2668	3088	msedge.exe	95
PID 3088 wrote to memory of 4756	3088	msedge.exe	96
PID 3088 wrote to memory of 2668	3088	msedge.exe	95
PID 3088 wrote to memory of 2668	3088	msedge.exe	95
PID 3088 wrote to memory of 6080	3088	msedge.exe	97
PID 3088 wrote to memory of 6080	3088	msedge.exe	97
PID 3088 wrote to memory of 1084	3088	msedge.exe	99
PID 3088 wrote to memory of 1084	3088	msedge.exe	99
PID 3088 wrote to memory of 1084	3088	msedge.exe	99
PID 3088 wrote to memory of 3812	3088	msedge.exe	100
PID 3088 wrote to memory of 3812	3088	msedge.exe	100
PID 3088 wrote to memory of 3812	3088	msedge.exe	100
PID 3088 wrote to memory of 3488	3088	msedge.exe	101
PID 3088 wrote to memory of 3488	3088	msedge.exe	101
PID 3088 wrote to memory of 3488	3088	msedge.exe	101
PID 3088 wrote to memory of 4596	3088	msedge.exe	102
PID 3088 wrote to memory of 4596	3088	msedge.exe	102
PID 3088 wrote to memory of 4596	3088	msedge.exe	102
PID 3088 wrote to memory of 2748	3088	msedge.exe	103
PID 3088 wrote to memory of 2748	3088	msedge.exe	103
PID 3088 wrote to memory of 2748	3088	msedge.exe	103
PID 3088 wrote to memory of 1928	3088	msedge.exe	104
PID 3088 wrote to memory of 1928	3088	msedge.exe	104
PID 3088 wrote to memory of 3292	3088	msedge.exe	106
PID 3088 wrote to memory of 3292	3088	msedge.exe	106
PID 3088 wrote to memory of 3292	3088	msedge.exe	106
PID 3088 wrote to memory of 3288	3088	msedge.exe	107
PID 3088 wrote to memory of 4512	3088	msedge.exe	108
PID 3088 wrote to memory of 3288	3088	msedge.exe	107
PID 3088 wrote to memory of 4512	3088	msedge.exe	108
PID 3088 wrote to memory of 5252	3088	msedge.exe	110
PID 3088 wrote to memory of 2608	3088	msedge.exe	111
PID 3088 wrote to memory of 2608	3088	msedge.exe	111
PID 3088 wrote to memory of 2860	3088	msedge.exe	114
PID 3088 wrote to memory of 2860	3088	msedge.exe	114
PID 3088 wrote to memory of 3044	3088	msedge.exe	115
PID 3088 wrote to memory of 3044	3088	msedge.exe	115
PID 3088 wrote to memory of 3044	3088	msedge.exe	115
PID 3088 wrote to memory of 5800	3088	msedge.exe	117
PID 3088 wrote to memory of 4860	3088	msedge.exe	118
PID 3088 wrote to memory of 4848	3088	msedge.exe	119
PID 3088 wrote to memory of 4420	3088	msedge.exe	120
PID 3088 wrote to memory of 4420	3088	msedge.exe	120
PID 3088 wrote to memory of 4420	3088	msedge.exe	120
PID 3088 wrote to memory of 1720	3088	msedge.exe	123
PID 3088 wrote to memory of 1720	3088	msedge.exe	123
PID 3088 wrote to memory of 6004	3088	msedge.exe	125

C:\Users\Admin\AppData\Local\Temp\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4144.3164.13927317044272522578 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView /prefetch:4 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x120,0x7ff83ec75fd8,0x7ff83ec75fe4,0x7ff83ec75ff0
    3⤵
    PID:604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1768 --field-trial-handle=1772,i,15777033503130367125,6661627895930672056,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad
    3⤵
    PID:2056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2188 --field-trial-handle=1772,i,15777033503130367125,6661627895930672056,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2432 --field-trial-handle=1772,i,15777033503130367125,6661627895930672056,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad
    3⤵
    PID:4484
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1772,i,15777033503130367125,6661627895930672056,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad /prefetch:1
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4528 --field-trial-handle=1772,i,15777033503130367125,6661627895930672056,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1772,i,15777033503130367125,6661627895930672056,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4520 --field-trial-handle=1772,i,15777033503130367125,6661627895930672056,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1232
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4344 --field-trial-handle=1772,i,15777033503130367125,6661627895930672056,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:81c8909ff635fd538756d9310b661c39b67b9fad
    3⤵
    PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/yilkima
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x394,0x7ff83cb3c188,0x7ff83cb3c194,0x7ff83cb3c1a0
    3⤵
    PID:5952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,15053433721840856430,6947998207976651410,262144 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
    3⤵
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,12422773491285502831,306454541043773927,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,9221060124151948581,5875613127784442445,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
    3⤵
    PID:6080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,11917629026021803217,6952691715299233842,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
    3⤵
    PID:1084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,11116425566449717813,4834421947981014388,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
    3⤵
    PID:3812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,11450338924220167794,9618198716959497531,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,614799036386736160,2339358751095875775,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5320,i,12468262449131373756,6948273859726573711,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:2748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,1540113351436739676,1247133321650088174,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5388,i,16093801137228520925,9637398290513849395,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,16147658585968048099,6971158260080445302,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:14
    3⤵
    PID:3288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,7141911182109824272,14127254407151013448,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:14
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,6163045843491421494,16439155153221835130,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,6163045843491421494,16439155153221835130,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,16567054632776468751,8171563659580721258,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:14
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,13236341913104938578,12866314544892360079,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6380,i,4976084426152903553,6695157287655631310,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,4327866377795635815,3691108442049485540,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
    3⤵
    PID:5800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,2440931348867049962,7871585454395359375,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,721264700891067953,4425916743730324226,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5556,i,15099100317157612859,6629308153741684796,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
    3⤵
    PID:4420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,8973372680990237077,9771709392765448092,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9293838920864858938,5436215532650909345,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
    3⤵
    PID:6004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,11419794370087568370,11474561295711600873,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5420,i,15548594253575272264,17607545393261440754,2097152 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:1
    3⤵
    PID:908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,13628617350713947332,15525845276037419190,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6728,i,9481300266961378134,5252403962939724521,262144 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:10
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,3342954398749619644,5223689435332087012,524288 --field-trial-handle=2356,i,11145764366495711652,7086577920023985109,262144 --variations-seed-version --mojo-platform-channel-handle=3348 /prefetch:14
    3⤵
    PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5188d3f74db3dc0e8154224e1989dcd211c5fe0ac1a88a63f1d1aa4b04a35a42
MD5 56d9cb866d93eafc772972916085424e
SHA1 9b305f25dbe37af6c336ff545573685a5982fe42
SHA512 dec654e66c02562ab2fe139960b58f00a317e726b875a389136b816a3943501001e9b824fd77c74f34181d25f2812841d623914d27406c8ebc3c0b29cb333daf
TLSH
T1C861F7A3936325D1E72B6472E3F1980937F8A05B81AB2E0343C25D38080AF4CD5DF267
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b164.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b164.TMP
Size 3KB
SHA256 c0e041fefeb7266b14cf4f18418feabaa0115153b99d0337906c86b7560790a9
MD5 2a34305ee62f1bf286e5f106209f9fe0
SHA1 151c5a120e9dce940a6a13899aca6536343bec4b
SHA512 a221ddfc99a5a929cbf30b9ff05963aabfc4f203bb2b07963e48ba666a0029d846818b68c94c9b3a260eb30d331ffd08ebbe070271d04d955b9748f425efd056
TLSH
T17561E7A3836725D1E76BA472E3F0980937F8A44B81AB2E0343D25D78180AF4CD5DF267
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

652ff797-1eb9-4536-b508-49950b74421e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\652ff797-1eb9-4536-b508-49950b74421e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 eb631348edbb3337fd6c1ede13181702c24b5d7f0ed073eff2bf284f10c620cc
MD5 6b746e795bee03327caa90e0c7fceaaa
SHA1 b377411ebb3b8b77523186f4f6be2818fad927e4
SHA512 653b47d03f3e2769592fa9657b99ed21fc278be474f56d5271fb1a0eefe570fbc18158276c9c816bdb32c9c51cf6b6650e1e7b4e45e8b1500e6116fe27534998
TLSH
T19151CFF7C7E8862DC91196F0AB147E2BCE1D0914432C3D5AC9E4AF5BA3E2871E14295F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4d0f70c315190275edda23e49f7506486bf5a871b290197549b6ac6c80fa1779
MD5 c984d92a535fb53dadf1d7540d7972dc
SHA1 f4304eaf3d1ddf1c885d656cb3686d0276a86510
SHA512 e962c46231dfc1e8d8ea98e3891626b0db08e15ed109555ac784bd5098f869f4744491f2936532cbb6ff4ed253cda8687e507ee9a3b3dd4b477b922110b97826
SSDEEP 192:sxRaREyM/jK1Ml8wCx/ffsZ/aSZI3Z5gAzoD8p81/g6+WNIYCyuOtGiIgtJ:sxRaW8x/ffsha0CWAM/5IQl3
TLSH
T13A52DA166A34597BDCDBD20DFA517F93D6F85473A2901E44AAFCDA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d51d689d28e64b0c4cd399f5877ac928be5ffc0448b9c29dae1aa20429215c13
MD5 f9e0ab91d23aecd2971c4dd7526a9c69
SHA1 c9814b8fc6d6af9eedcaaad6903fa1498d2bbe64
SHA512 71da0192313e12e7b850cf05867c9449857339e63b63cbe5b7b9b2c2e0e54a33c70586f92379e2af36ea3c4aef053c6de546bfae9ac4c23a9a6450a975401af9
SSDEEP 192:sxRZREyM/jK1Ml8UQpCx/ffsz/MSZI3Z5gAzoD8pm1/g6+WNIYC3uOtGiIgDRJ:sxRZWqQx/ffs7M0CWA6/5I/lP
TLSH
T1BB62C816AA24597BDCDBD60DBA51BF93D6F8547392901E44AAFCCB0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 80fdb34f5e273926b755478e86534b5fca0a3b6da89f70e9cfbabfb966dd8c70
MD5 1fe4ede68983615c883d40addc5c3bcb
SHA1 aec85ff506910ff9baa7e621bc19b2da2b6986c5
SHA512 894aeab19badd26342c8379303d943b20653ab13fb58d0e858e77884abc57e70832accc560fea0175f7478f1072db675b38aa7bc11c2db28fcf6349e31e3e507
SSDEEP 192:sxRZREyM/jK1Ml8wCx/ffsz/aSZI3Z5gAzoD8p81/g6+WNIYCyuOtGiIgDbJ:sxRZW8x/ffs7a0CWAM/5IQlB
TLSH
T1F262DA166A34597BDCDBD20DFA517F93D6F85473A2901E44AAFC9A0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 234906c08c36ee757d04d9139b5bd4806f89598f5ca5bed70c8fe4068df84ad1
MD5 ae3335e6c497ba2a49a3b9cb9c0cf4eb
SHA1 333c4be2d07192dda634693aaafeb9422bda98cc
SHA512 bd48d45fff82549f98e0d4790d97dc5a222420e14c260100b50e8a7ea90c45b2a9a9b566a51443f2122b81ceb19dd25761a849bbab59f9be8400398ac0ed2750
SSDEEP 768:j/8vNN7pLuL7tQWgQ+fB+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVeQMQqq9rovC:j/8vN7E7tQWgQ+fB+u1jaBQMVq26
TLSH
T148E2FB7B680CCB7E4F804E9CEC29BD9AADE801CF5698CD5447EA840C03C57EB561A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4c4c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4c4c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f993d3354c5830e5f801d73e9f138d9c496a131405a1f73f82eb198611c15b7f
MD5 9c9af5157c8105e6a01fd18bee957526
SHA1 30e731a9dfdfc04a92a61df1d49b4d38b8451e67
SHA512 9911eb7de21fdffb58a58d9be1500e9e010d9851e0d2c0c5a101741a5b444756f0313e794a04554c83aa850b3dfa03087665c36087418a1deec4506d15f72911
SSDEEP 768:wj+9F3a+vsZ1Ip8+p3bd66j+4BRv86aLIW+Xb9Mg:P9F3aB1W8+p3Z6n4y6b+g
TLSH
T120F2AE72ECA9DD238CE6C744B2873B87AFF411A396C01D98D9DD6B0D458726D170782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6bd98e04f2e17535be85ea51a4a02405d80b16e1d5005e2cdca2620f2c7611cb
MD5 1216255f4da60604be4b31a42823ceb5
SHA1 bc93d9d6166834647bca0247d8406eedd5a0ded1
SHA512 91f2bbb6679ca20ebfacbed3c211168fb3610e73e3ddf6a91cdef07b053fe0add18be3e9e84880cd277fd0aa3aa93ce8466c2c4b10835a55e5813caa0ab3d8f5
SSDEEP 768:Irv+4UNbdD3jcZZNp8+p3bd66j+4BRv86aLIio2bwCl1:Ibsbp38ZL8+p3Z6n4y60ww
TLSH
T18503BF73F99899339CF6C644B2467B437FF851A396C10AC4E5DD2B4E419A29E230BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2f9fba62527c2460675173569bb8a4e7eff0bb2e5c02dddb23834ebc5a028a5e
MD5 29323b06e837c31fa15926870d578677
SHA1 4e109fcd20aa76aebb1f69047591cb586b6b4f23
SHA512 d7bad0995d6292b316955489a1d20711fd49dc0d7d3cf5e8ddcf22dda034a8cd2c16cb08bd7120b4ee07cd5da7b8b0d0a8e5c0b67d5477486714044ace7282e7
SSDEEP 768:Fj+9F35+vsZ1Ip8+p3bd66j+4BRv86aLIW+Xb9Mg:w9F35B1W8+p3Z6n4y6b+g
TLSH
T1E3F2AF72EC69DD238CE6CB45B2873B87AFF411A396C01D98D9DD6B0D058726D1B0782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 24a5efa40602b502ab35294c22b1abf130bea48b935aac9a46be43f16db6b925
MD5 7bcbf3dfe75a76d5f25c074bb5393c60
SHA1 f9be66016622e3f46b13d9b8da3d4c0e039285fd
SHA512 6aba98440828fbcb28a60096f44147ab3b5e9244949c797a2da25d0a3188655a0a31299ce6fd9f187a648216ff1cfdeec956e6069344dbec25a818ff7233197b
SSDEEP 768:tF1j+9B36wgK+vbwFp8+p3bd66j+4BRv86aLIW+Xb9Mg:k9B3zbT8+p3Z6n4y6b+g
TLSH
T1F2038E76DC95CE37ACE28B85B7463B87EEF411A385C85DD8D9C86E4D008729D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 bed50333a1b38e2dbaf5a09fe2df7fb841683ee48ad01ed883695e46f7083a8c
MD5 a80331bdae0fbfb4146c72b850ce6c30
SHA1 cc1419a7c9080b1b418b58fbc1f22adfccf21a03
SHA512 f393f1aea05170fcc94a41b2597cbc385ea3660f82c465c11d3303ce05f6af1a26a16f82bc65b8e5e1603d65969a80110e6c8d6c1798dde5da5bc9775b916447
SSDEEP 768:brv+4UNbdD3M+vsZ1np8+p3bd66j+4BRv86aLIW+Xb9M9:bbsbp3MB1p8+p3Z6n4y6b+9
TLSH
T12F13BE72E869DD339CF6C644B1873A937FF821A395C00A98E9C96B0D45961AD270B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 492B
SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
MD5 2012d4de563c653f56f62ccbf46db598
SHA1 fb24881003593f1ceb79019e52ce5ee9e94c889c
SHA512 c03d6584395c1c97c75af7dc6df57df358d3957035521bb6833c538679683aebe0410bb12586472b84dc98111e703984dd37868464fa9c66fdafb423e763b555
TLSH
T10CF00E829C3E25C086E90F7FE44725F840C46517B0883879088DE9D8813A40F11414BE
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
MD5 551baa462724351873ccd655a8b64ea3
SHA1 ce2be3c6d77008467bc61ac14822065cf2376630
SHA512 8de58d8e979531498751d7416c6b10671da1b048181a23081fc15e7aca69a96a93676b3bf01415c3b5f8d1973511e5823b0f11cacddfc3e5d01e82cefedff632
TLSH
T163D095C34D7D12C14FD50F7BD087ACF80480540DE55C2A7A044CD8C04115C1B75C142F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
MD5 2a1939fc3b2926cf2b82fae71c5f6bee
SHA1 3f9d6974ce660bbc0c85f3d9741b734cfd466fac
SHA512 cceb75873ca288bfcb71f5d74fec5ad8ca61807ec55369055f4fbd095fd904097c974102d3296db3a1aa949c6edc5abd1a7c320e53daaf947ee61c28f5659707
TLSH
T1A3E068C29D7D26C196E60F7FD04B69F844C4580AF048697A088DE8C8913A94B258287E
MD5 SHA1 SHA512 TLSH

Submit Download

48904e12-57fc-49a4-bca2-3fd63b6a24da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\48904e12-57fc-49a4-bca2-3fd63b6a24da.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3088_242998533\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 def1c7647ca73526b83881ee5d5fb274ce1d6d2b03f3a242a7823633b35335e4
MD5 d2b3acc5158826a5a1d6cbfa17518547
SHA1 25e3de4a341f034dd3594506a9e309e76da40961
SHA512 f650df8030f7c1971dd432938200a46005cd630eed6cc2b4d168bdf611ccbe8efc7097b7d7267106a7985e507e057fe441fd85a0173c57fb6d5f33aaf74a1e87
TLSH
T1F4D0241373410734C110303310F37F0D0C00D11F4005C110543CD55DDF044501F17C41
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b70f00487bdd9e8c15d6fae4537198266bd55761302ac5038860892d097a1496
MD5 cd82cba659388ae70c0118e3708fe177
SHA1 a904306427551e51f705e02c0afdbb1ef99cfa1c
SHA512 5a77afefd2dfa1e425d4acd98317da9200588582223074fb505d35cbd19499fa89e1cdefa0c199f65a24ad48e257c1fa9b673f73e2fff3f9f4eb457780da3dcc
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 c4f520aafef2dd97ace0f7579f7f106355fb34aee4a4af16642862ee51cf8b39
MD5 59161e2dc991b3bc11f0ad30d892eb20
SHA1 7da19180e513de741fe4633751f14d0c58beab3f
SHA512 c7ae263db1b944a01c0b184895753e4e99150d301cc52ce027b374e8eb72169bebd1fd4fdb76b7bf7544e50014a52104a5cde441f7968dd77ac1225426afdc3e
TLSH
T107B0113032028002C22AA332A0CA8E8838320C3202030A80C28023F0CB22BA28003202
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab1b.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59ab1b.TMP
Size 48B
SHA256 0d5f93afb2a688f1ccdfb3241ec80152adec908578c1ac66a7a8b457381c4c52
MD5 19209dd71572b48731bb430b3b6e4b9a
SHA1 0af8e73b9958dfe184084d16dd9892b6123d0c34
SHA512 6278647e9143390da18ef741b62e47bb1df95a5a85e2edcdcbf2df74d3cf0f80940db5511422a29c38e2eccef5000cb30eda288bd2be94d9dbcad4448471bbcf
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a809b.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\Network Persistent State~RFe5a809b.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 17f5e71eb9bacb32857985cccd5c7973468ef4ea291249874900d87c7c2b3cd9
MD5 1e365432570661791000648880cdcd72
SHA1 8d630003b05e327d42b572a4dfbe4945be37787e
SHA512 8eebe9669b6aabcd254bea1965f14221a77a2688bf68f76f839e8c25762a35de954c1dc749dff3ae9e98b18da7934a5f162ba4db6b72281d4c4cef614071164a
SSDEEP 96:sto/dQpx4Gpb9Akgo5h16Z5his7/x+6MhmuecShokZ1ejegK+gyt/f28XM1C7K:stMmgvoKYsV+F2+kZQj8MG6K
TLSH
T146D1A5025E24A97F8CC7E519BF257A53E2FA607261E51E48EBFC461C04DB6DC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b780c984-7845-45a1-b22d-2110be0d7a64.tmp

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\b780c984-7845-45a1-b22d-2110be0d7a64.tmp
Size 6KB
SHA256 4d4790903bb8c48ddeb6855b4a842c37b0dc05d55769e9e98be6afea4fd2f634
MD5 c23e2d010e97a8347dbf3fd9891924ef
SHA1 146e9c555605b3804071ab239a5fb8fd8fc8786d
SHA512 e0e594b468a14874ecfaf203200828c6c7ac2d03e2349e23e1f3cdd7487dd3637b216ca88a11d43ad7d85fb188dc9da1963ed0af5b5c32d568a0e86c6dda866f
SSDEEP 96:sto/dQpxxpb9Akgo5h16Z5his7/x+6MhmuecShokZ1ejegK+gycGf28XM1C7K:stMmmvoKYsV+F2+kZQj8gG6K
TLSH
T1A9D1B6025E24A97F8CC7F519BB25BA53E2F6607261E11E48EBF8461C04DB6CC6317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 15KB
SHA256 b36496e8318703f5530f5e4ed1009d3f3bac7a7d8efc6188009bc402be4981f8
MD5 4e99cde00264a438791096773d5b8859
SHA1 c81aeac38722a08d4b81168d67eaecb9e1c93492
SHA512 9fa57faec718c2ee32813a35d714941fd67f5be439938276e91b02c499b134d50883ad262d035792f086f00eee9093cfa6245c20e8702a2a377b690e894cf130
SSDEEP 384:Ysrv+89zHqlDNP9oid6NBSVdPFOoisdMNQ:Drv+4UNbdjt0oisCNQ
TLSH
T16C72AF33A938A677DDF39904F486BA077BB85097A6C24E74D9AC1B4C81CB4C92307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 2KB
SHA256 fd42441fa498a598fe76ed6cc81640a1b285e15dcee63493c5ef751b4b1b6959
MD5 510cd6cb2868e6bb2f2bac7ee6908fae
SHA1 05dd824b479b0f9f56cecaa42b39a7e5272de5e0
SHA512 ac9000952a77efbd9a2252e56ec834069740c9e83e5b0e101773deaf351c8015b2cd7d525129b7ffeccc1d76e73bf52b09ce5da56a6084ef811c0abe96578d5f
TLSH
T17351B5737D50AA7BD9E38A047D46BF93CE7540A5AA522F10AAEC0B0841D798C1757C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 aeb168ba66295f6d59cb92b47a4f15f4910d69f76aea6a152cb4346ddb3d410e
MD5 6566e09202186c803aa4b970466787d6
SHA1 8cd88731186c7cfaf0821d182a791c9d82bfa1ff
SHA512 f66884d91de4b1391ed002685d509c114baf975a6726060055db1590aa9c0a48d69c844b2244537d35c3e86d93f6d00c1fb88ccb7d893fbdd3d991970628fcce
TLSH
T13C71B47B69A0A96B99E3DA04BC867F46ABA14066E9913F54DAEC0F0C01D768C1353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe595932.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-14_4d52c4cd82f6273f44f411e0137eaa83_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State~RFe595932.TMP
Size 1KB
SHA256 992711be0d8590e531b84d94d0f4a4893db73f9b184eed810727e330aefe6f43
MD5 c14e45963142c39e72eb804346ebe664
SHA1 483b953ab1ccdba255b84116d99a36969e2c26db
SHA512 064f86b62ecd4fbb85b9d61ab00a31f7eebb6f3d33cc770efeb0459a891ad1cd0d0dbdd6b9f087cd5504f7dd6a223332c8f6a1956f8a01abb3ca0aa4e22c2266
TLSH
T1783177B6E9A05E76BDC39A053902FECB8E6100A992414E0466EC471D52D798C5A7B837
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1232-623-0x0000025DF3850000-0x0000025DF3851000-memory.dmp

Download

memory/1232-619-0x0000025DF3850000-0x0000025DF3851000-memory.dmp

Download

memory/1232-626-0x0000025DF3850000-0x0000025DF3851000-memory.dmp

Download

memory/1232-628-0x0000025DF3850000-0x0000025DF3851000-memory.dmp

Download

memory/1232-627-0x0000025DF3850000-0x0000025DF3851000-memory.dmp

Download

memory/1232-625-0x0000025DF3850000-0x0000025DF3851000-memory.dmp

Download

memory/1232-624-0x0000025DF3850000-0x0000025DF3851000-memory.dmp

Download

memory/1232-617-0x0000025DF3850000-0x0000025DF3851000-memory.dmp

Download

memory/2056-24-0x00007FF860290000-0x00007FF860291000-memory.dmp

Download

memory/2120-112-0x00007FF860290000-0x00007FF860291000-memory.dmp

Download

memory/3044-506-0x00007FF860DC0000-0x00007FF860DC1000-memory.dmp

Download

memory/3044-507-0x00007FF8610F0000-0x00007FF8610F1000-memory.dmp

Download