24336cb9952f7abd4b9763ea59a2bb98f4ad85c74962eb82cedb11bcbce16ac7

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Size 20.6MB
Sample260717-csfwwsds6x
SHA256 24336cb9952f7abd4b9763ea59a2bb98f4ad85c74962eb82cedb11bcbce16ac7
MD5 facd964473e6bfc3ac93b925b8f7f99e
SHA1 122414f2b2984634278467777f66dec37c25c0a1
SHA512 52b32d042f5dbcfa1f62031d61612a3f1100fd67e87723006669cbc246b4bb3ad5ea91bab8776928f2a0d8cc02ea46256b722f9045a7dedcbe40870ce642abcc
SSDEEP 196608:r8RtGGLoOKskYY7kDXyQ2Z5O5nS3qlfe5bzKPDSqDPWkGfBWF:rEtGi3okevZ5Ox9W5bzKPDSW3Gf0F
TLSH
T17A27CE87FD52A4E9D4AB81308C7B662277363C448F6563D31B64EA203EB3BD4AC76750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_200739660\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1359276506\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1359276506\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1359276506\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1359276506\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_1359276506\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_564723167\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_200739660\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_200739660\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_564723167\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5252_564723167\protocols.json	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1896	msedgewebview2.exe
1896	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5252	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 5252	4864	2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe	89
PID 5252 wrote to memory of 4132	5252	msedgewebview2.exe	90
PID 5252 wrote to memory of 3860	5252	msedgewebview2.exe	91
PID 5252 wrote to memory of 3860	5252	msedgewebview2.exe	91
PID 5252 wrote to memory of 3860	5252	msedgewebview2.exe	91
PID 5252 wrote to memory of 3860	5252	msedgewebview2.exe	91
PID 5252 wrote to memory of 5388	5252	msedgewebview2.exe	92
PID 5252 wrote to memory of 3132	5252	msedgewebview2.exe	93
PID 5252 wrote to memory of 3132	5252	msedgewebview2.exe	93
PID 5252 wrote to memory of 3132	5252	msedgewebview2.exe	93
PID 5252 wrote to memory of 2608	5252	msedgewebview2.exe	94
PID 5252 wrote to memory of 2608	5252	msedgewebview2.exe	94
PID 5252 wrote to memory of 2608	5252	msedgewebview2.exe	94
PID 5252 wrote to memory of 2608	5252	msedgewebview2.exe	94
PID 5252 wrote to memory of 2608	5252	msedgewebview2.exe	94
PID 5252 wrote to memory of 3704	5252	msedgewebview2.exe	98
PID 5252 wrote to memory of 3704	5252	msedgewebview2.exe	98
PID 5252 wrote to memory of 3704	5252	msedgewebview2.exe	98
PID 5252 wrote to memory of 700	5252	msedgewebview2.exe	99
PID 5252 wrote to memory of 700	5252	msedgewebview2.exe	99
PID 5252 wrote to memory of 700	5252	msedgewebview2.exe	99
PID 5252 wrote to memory of 1896	5252	msedgewebview2.exe	100
PID 5252 wrote to memory of 2988	5252	msedgewebview2.exe	101
PID 5252 wrote to memory of 2988	5252	msedgewebview2.exe	101
PID 5252 wrote to memory of 2988	5252	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4864.4464.16022821700038510915 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView /prefetch:4 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff99f8a5fd8,0x7ff99f8a5fe4,0x7ff99f8a5ff0
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1760 --field-trial-handle=1764,i,11887250830148990760,12767036742647097009,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c
    3⤵
    PID:3860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2124 --field-trial-handle=1764,i,11887250830148990760,12767036742647097009,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2396 --field-trial-handle=1764,i,11887250830148990760,12767036742647097009,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3528 --field-trial-handle=1764,i,11887250830148990760,12767036742647097009,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c /prefetch:1
    3⤵
    PID:2608
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1764,i,11887250830148990760,12767036742647097009,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4628 --field-trial-handle=1764,i,11887250830148990760,12767036742647097009,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4592 --field-trial-handle=1764,i,11887250830148990760,12767036742647097009,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1896
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4536 --field-trial-handle=1764,i,11887250830148990760,12767036742647097009,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:d4f21be113cbfa69f6bbd570d810c2258e69ab3c
    3⤵
    PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 25a54c2a68f9368eaeabc6043caf4d55f103cea3de89f116e6b34986281c1173
MD5 25301ae42da95d8b8518efd59f672f15
SHA1 3eba906c0199272c542e1354d14e84b312748211
SHA512 df7ee15eb5ba663f07069419a3784c719a5f4747b3ce0a1324e6ebe89a2dff4bc13c965d0e75de696402e8835aab4aefbe9e959d4a13188ebdfcb8e5d1eb7be9
TLSH
T1B2D0122233020238C0103437554261180401D12F410550425C288A3E3B244904902451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c5f03b6d721a3ec8af4fbc75142089fc1e595af8fb73f856ebb4da68945124f4
MD5 121827e7d84c2055b98a68fe7454359f
SHA1 9fb48c09d2e9ff9f99f49b44b32e6497d74cf1aa
SHA512 00b9d464c95feebd48342491a37009a33a1f8d89a65020156225cff808cb033fb079a1fc8da90221721aa88403617f2f2cdd96c8c1b18a72538019099d8febe1
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 603d8162dc3ff55f81266e6ffe9df3605d296ddae2731f781cab5075759e0624
MD5 809c8ade090d6ba1f32957bbecbfdd75
SHA1 8a3a0e74fa61e353b6539cb7908d0bc40737d1b4
SHA512 c5db361b2df24769310a72223e7a4e70828db19e00a1234ca9b93c076cc5fcd5e24d72130ac60f2bfb575c93d6a28abf6893d2ff0d33bde895b588068c55a101
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 1ad4bde38033ac3b5205e21ccfa3d4a769d5879b7eb0a1de58549e7e1cd12779
MD5 90ddc25359ceb48522884297337ff154
SHA1 76628ae2897471e45a9001e99efa4deb1b48b697
SHA512 54a7b90f389c64945410f394cbd83c1556960c32b3a8940663b385850add2e22c88cdffa5a0f410aeab7bf55e28825e07b42a11508cd88e12b1dcff92e786fb4
TLSH
T150C0921803658DCED22617F9B4C16894B9F3CC3A84074E4B41589225ED9D7A0A307280
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 0b0821ec8dc4e6c6c5e838cbe15348d9b49b65fdb19b44ea08015a824d67b2ee
MD5 acfde226f4f9f8892acec55756d1c41a
SHA1 67e5820d161b09bc871b1342eb598e5bafe9a5bf
SHA512 b5af892aa89d9995d3b5ea81cd1d12f7c85205da5c25bbf509c1a59b7ce269d25741226a70b46f9b10af9c95d0c9201e6a2889e7364f9a62c2c8399664a32188
TLSH
T15B312FB2C3E4C63E885162E467247D27CD2E151952243E27CDDAFBEA5FE1471D710A0E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a31a0.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Network\Network Persistent State~RFe5a31a0.TMP
Size 59B
SHA256 c257f929cff0e4380bf08d9f36f310753f7b1ccb5cb2ab811b52760dd8cb9572
MD5 78bfcecb05ed1904edce3b60cb5c7e62
SHA1 bf77a7461de9d41d12aa88fba056ba758793d9ce
SHA512 2420dff6eb853f5e1856cdab99561a896ea0743fcff3e04b37cb87eddf063770608a30c6ffb0319e5d353b0132c5f8135b7082488e425666b2c22b753a6a4d73
TLSH
T1D2A0026ADA612D881B4A839026187553807B0445130982FDE43877A841561AE582C865
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 e2dcdbeee1eb226d2430e6b9954e7e4d265b741fa2b9eddeb8f1e73a343c539d
MD5 ef5144bf0476238d97e29e2e5cd785e8
SHA1 a0d9045e6f11c18179e9e3a8d0c021d586900036
SHA512 678bdf18be3a8e2719b3f15f3d2881f53eb31fbc440754ab41e7d4fc17cb6687ec13d51b505e9c916bf3d7d8be767d3b10d8f455729c1628f0e1959d78580a41
SSDEEP 96:sts/dzKQG0Lb9ak7o5h16Z5bs7/x+6MhmuecS8i1ejeHK+gN928XM1C7K:stgpUkoKbsV+F28iQjRb9G6K
TLSH
T111D1B8025E28787B4CC7E519BE297A57E2F5647166D51F48EBFC461C08DB6DC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 210a8ff886826a5a804ab574eec86a58575b5982a594b98e2b8af4119aade3df
MD5 b5584ca2380e2a834645a6fbc449f1a8
SHA1 8862a18842f6f7ec3193954426d82201fab375c5
SHA512 7b1ef00a74d6ce8759626827e645cb6b9b9999c18bb96978519844535193d95392394f50c4533423188b2439f2813e5c68626077b8c4e0037ebefca40605b9db
SSDEEP 96:sts/dzK50Lb9ak7o5h16Z5bs7/x+6MhmuecS8i1ejeHK+g228XM1C7K:stgpekoKbsV+F28iQjRsG6K
TLSH
T1BFD1B7025E28787B4CC6E509BE29BA47E2F6643172D51E48EBF8461C08DB6DC230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe598294.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Preferences~RFe598294.TMP
Size 5KB
SHA256 414143ff4afd50f12a887caf3cb0cab2061df00ae46fc064146ea2d7dff18738
MD5 2222a821b374f27dd0df4bab30a5cefc
SHA1 36ca7bf454a4c908cf9511e22d2b1589b4c449f1
SHA512 61eb82b9f739780e71796eeba1ab9abe8ab363407e5f8ab8a902e04b566f41344e614656683dcaa7e0f756c9d8b6276713fdfda3c443ad90d555f44b0e0fe8da
SSDEEP 96:rs/dzK50Lb9akfdo616Z5bs7/x+6MhmuecS8i1ejeHK+g228XM1C7K:rgpeYo7bsV+F28iQjRsG6K
TLSH
T159C196025E28797F4CC6E509BE297A47E2F66431B6D91E49EBF8461C08DB6DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State
Size 2KB
SHA256 cae2424884a032014fb5d6cd4cfad9b17b9100e566f5cfe6cc191c1b02144fd0
MD5 c5be98c63d3d3104962ed852acc6843d
SHA1 b846933e760d208938905109830f4ff3190db5e5
SHA512 78a6825f3af01eb035013954ab786592fac4af19aef9a70d2bdfbf23b00603912c79599af7c478f025e012714f4d0b885d0aae961b28b554605bc168a590b68c
TLSH
T14351957398546B37A9E28A057D4A7B63CF7980B6AB422F50ABED0B0D00DB65C1717C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 fe184a1fa9e329ffff9e8563c01e59ffc11d91d4cd5a8908a0d77f917bccfe2f
MD5 928591b6f0b829d61e22d8ff32108b5e
SHA1 30dcf6fdb1a702d79d50e3609165fe6e93af6421
SHA512 1ec0c5a2e5c4fa7031a9d51862749caeb3525055277086fc077536f47bb8c6da6c2189433bd4b6e02f83a153a13ab0246a40279356d5c57cc8e915cc836c4335
TLSH
T13F71947799A4A9375DE29A057C853B17EBA58077E6867F94DAEC0F0D00DB3981313C13
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 32fca4ce7f657e7516f4051e7b096be4c5d80a4cf5dc07365afb0350ec69b744
MD5 ad5dfc1b3e0d5bcaba63e824a68842e0
SHA1 cf31d79162cec0835bcb755f8705f16661a30f35
SHA512 5e2de62f6a3cc7552bacede1aca94340200961dffe36fcf1ff99b22ee74b8d2e9424e25d5b4e1db63074e79567369894e9a94a4685372512a1d7e956dfd349fd
TLSH
T17B81833799A4A9375DF6D9057C8A3B17EBA58077A6867F98DAEC0F0D01DB3980313813
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State
Size 15KB
SHA256 5f314ccd6e56bc870bdb58f96be20ee18d1030886deddfb0f8787e2fe147d443
MD5 48dc23616500f11fdce364bffbc9d9e1
SHA1 c0fee5f4bb8540c8a1860ee1c1962d69dba8ffd9
SHA512 52e3a79c411d0a9394b31fdc2e332c64f1ac9cdbc1df267fcdc21aac2f0393f3765806a0051554a36e505d3793f5bfcfdaeb6beed335fc15b0fe094929a6f3c4
SSDEEP 384:wsrv+89zHqlDNP9oid6NBSLfwVf+cOY4Ng:7rv+4UNbdtYEI4Ng
TLSH
T17072AE33A57CB637ADF38504B8867A077FB854A796C30BA0E9991B8E05DE1C92317D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe591bbc.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-17_facd964473e6bfc3ac93b925b8f7f99e_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State~RFe591bbc.TMP
Size 1KB
SHA256 815de7bbd2424ab2a482ae017944f86c26d2b19bb74028b0b7f6441bdf07a282
MD5 eacff1bd66b3c05c8a8290e08d6a106e
SHA1 80b054ee033d2fd6a1980280d8fd4a944861477f
SHA512 5e277fb00e024147b5f3ffe87dea6c1aedfb9e6360cb448d606dcd7b8981039fe0fb8512840dbffc1b9e702ad72d188ce289b58e9a7a87dcf44880b12e75bf49
TLSH
T1813176B3C5D01B33BD8696463945BA97DFA080BB53024F04BAEE870D04DB15C5B2BC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1896-326-0x000001B4ABD00000-0x000001B4ABD01000-memory.dmp

Download

memory/1896-335-0x000001B4ABD00000-0x000001B4ABD01000-memory.dmp

Download

memory/1896-332-0x000001B4ABD00000-0x000001B4ABD01000-memory.dmp

Download

memory/1896-336-0x000001B4ABD00000-0x000001B4ABD01000-memory.dmp

Download

memory/1896-328-0x000001B4ABD00000-0x000001B4ABD01000-memory.dmp

Download

memory/1896-334-0x000001B4ABD00000-0x000001B4ABD01000-memory.dmp

Download

memory/1896-333-0x000001B4ABD00000-0x000001B4ABD01000-memory.dmp

Download

memory/1896-337-0x000001B4ABD00000-0x000001B4ABD01000-memory.dmp

Download

memory/2608-112-0x00007FF9C1060000-0x00007FF9C1061000-memory.dmp

Download

memory/2608-183-0x0000028EE9770000-0x0000028EE9AEC000-memory.dmp

Download

memory/3704-270-0x00007FF9C0550000-0x00007FF9C0551000-memory.dmp

Download

memory/3704-271-0x00007FF9C1490000-0x00007FF9C1491000-memory.dmp

Download

memory/3860-182-0x000002B6E2000000-0x000002B6E237C000-memory.dmp

Download

memory/3860-19-0x00007FF9C1060000-0x00007FF9C1061000-memory.dmp

Download