29c3fb0ca27343f9a3d5af71c9145e9ccf1a2df2954d489c8e04c12f93ed4eb1

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 12.3MB
Sample260718-ev67zaf15r
SHA256 29c3fb0ca27343f9a3d5af71c9145e9ccf1a2df2954d489c8e04c12f93ed4eb1
MD5 37a329a1e4c0a8e2850c2b065ea5ae11
SHA1 8896e1546fd1f18503cddc206bc7070d94a89b47
SHA512 a7799dee74451fca7d771b6bcf19920a2ce4b90e8f8e4c2bd7e59adcaab5c6a12497c6b0c6c12f8c34dd31a37af5df5a037d5ba9857e0ce04d0b2c58058ac803
SSDEEP 98304:eCDFQcXZdiJbyMSOEPIi+lpTrLA00I2DHZx4FF8GXEn:NOyZdY5EQi+Xoj5D5jJn
TLSH
T125D65A57ECA554E8C1AEC2348A7652627B717C890F3123C72BA4B6283F77BD06DB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_1961795706\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_1430907973\metadata.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_1430907973\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_1430907973\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_1961795706\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_1430907973\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3668_678491267\manifest.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1936	msedgewebview2.exe
1936	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3668	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 3668	2580	2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 3668 wrote to memory of 992	3668	msedgewebview2.exe	90
PID 3668 wrote to memory of 3440	3668	msedgewebview2.exe	91
PID 3668 wrote to memory of 3440	3668	msedgewebview2.exe	91
PID 3668 wrote to memory of 3440	3668	msedgewebview2.exe	91
PID 3668 wrote to memory of 3440	3668	msedgewebview2.exe	91
PID 3668 wrote to memory of 5020	3668	msedgewebview2.exe	92
PID 3668 wrote to memory of 120	3668	msedgewebview2.exe	93
PID 3668 wrote to memory of 120	3668	msedgewebview2.exe	93
PID 3668 wrote to memory of 120	3668	msedgewebview2.exe	93
PID 3668 wrote to memory of 5404	3668	msedgewebview2.exe	94
PID 3668 wrote to memory of 5404	3668	msedgewebview2.exe	94
PID 3668 wrote to memory of 5404	3668	msedgewebview2.exe	94
PID 3668 wrote to memory of 5404	3668	msedgewebview2.exe	94
PID 3668 wrote to memory of 5404	3668	msedgewebview2.exe	94
PID 3668 wrote to memory of 5356	3668	msedgewebview2.exe	98
PID 3668 wrote to memory of 5356	3668	msedgewebview2.exe	98
PID 3668 wrote to memory of 5356	3668	msedgewebview2.exe	98
PID 3668 wrote to memory of 4572	3668	msedgewebview2.exe	99
PID 3668 wrote to memory of 4572	3668	msedgewebview2.exe	99
PID 3668 wrote to memory of 4572	3668	msedgewebview2.exe	99
PID 3668 wrote to memory of 1936	3668	msedgewebview2.exe	100
PID 3668 wrote to memory of 4344	3668	msedgewebview2.exe	101
PID 3668 wrote to memory of 4344	3668	msedgewebview2.exe	101
PID 3668 wrote to memory of 4344	3668	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=2580.3384.11041261022002137905 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView /prefetch:4 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7fff24955fd8,0x7fff24955fe4,0x7fff24955ff0
    3⤵
    PID:992
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1788 --field-trial-handle=1796,i,5340851328277493639,18411969919927307773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2236 --field-trial-handle=1796,i,5340851328277493639,18411969919927307773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0
    3⤵
    PID:5020
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2244 --field-trial-handle=1796,i,5340851328277493639,18411969919927307773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0
    3⤵
    PID:120
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3504 --field-trial-handle=1796,i,5340851328277493639,18411969919927307773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0 /prefetch:1
    3⤵
    PID:5404
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4064 --field-trial-handle=1796,i,5340851328277493639,18411969919927307773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0
    3⤵
    PID:5356
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2056 --field-trial-handle=1796,i,5340851328277493639,18411969919927307773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0
    3⤵
    PID:4572
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4616 --field-trial-handle=1796,i,5340851328277493639,18411969919927307773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4376 --field-trial-handle=1796,i,5340851328277493639,18411969919927307773,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:533bbf53e2b1aa638a8c21fd794710213d79c0a0
    3⤵
    PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1ac88bd5c8ad4f1a1778d949a4d1c8c8e6c60a51f857b4d8f4260116dd026617
MD5 2d22b7883f76fdcef07476bd05341015
SHA1 23ae168bcccb53595d8d52b59509c70ac078065d
SHA512 3f0cd952c97cb817f4e09f2bc9bc1da7f9d408689afe907f48d49e89e3b1213ae1655abb90ebaadf4f1283d983601476f99994f2c057f979089b3f6e000326be
TLSH
T11CD012667B414A38C01035331413620C0600F20B80854050A83C851E6A044600903491
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 88705573cda01e846a16f6766acbea4980f5f91dd86ce7566b71e46be9539d1d
MD5 156cf3a2beeb101751f714cfdc607adf
SHA1 47d4a2c796d09197784e0df5f214f78aa40ff2f1
SHA512 8393422b9e1edab2f73289ef960542182edc9c31351a5ad7235dc25ff4387ca8ea552a4118098664356de8905ea69b468f9c964874dcbb204a705d2198961f14
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 ed0cc166b91aed4dc547df606065f0de568da0533bbcd24be158af318dbe1fbe
MD5 ce220911b79f09790298c03a14aebfb6
SHA1 b3fb2ddd420f6beb00625ed08d9be1cc18ef2d36
SHA512 c71797bfcfa065e82d3dc1754e1a181ad76cea6e8c7b9169ccdfdb8ff3ef7256fb9387cea72c5dddb3be25ce7a4b22d6756a1c391ef9e88c8d750fb20afd2431
TLSH
T11AB0023061053E63CF3413F672CE41953EB98F365BD7491744D741B5AB25FF18161504
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cbf1.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59cbf1.TMP
Size 48B
SHA256 437e9b351c92371ba6f1c774b970263b938c6269bc6bc687e134690d24ecc10e
MD5 7e4aa5cbaa9a41c619f9ccc1ce128543
SHA1 8f3ff39e1f736001f74f2ae0cd327ff3a10d865d
SHA512 1e6be5f3f9ced94b796a31b5e8f2626bfd9060a12f0ed37fab0440792e98fa15e5198ec4abc6f17411459048a86f50e32de640deb63b4135dbe3e335fead9099
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5aa0c5.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\Network Persistent State~RFe5aa0c5.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 4c534e09317743653419640888ba6526983b755141b977583a8f7968bc3f1f15
MD5 d4f39e01c49e5232d43e17c642c612b4
SHA1 c8722dc64363e545ce028d34c52209d0bd8c64ee
SHA512 783bdd321186da6eef7a6b8390ed36a16afcd4396a86054eea9f715e25cff6a57590323baffdf7899bd0f6ce668f1c32a534c880bae0a4343ce759cb9ac63a0a
SSDEEP 96:std/dzB7Gib9GkOo5h16Z5Xs7/x+6MhmuecSD31ejeJK+gFt28XM1C7K:sthpCtoKXsV+F2D3Qj7DtG6K
TLSH
T138D1A8075E24A87B4CC7E119BA79BB57E2F9607261D61E48EBFC461C08DB9CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

e4ebff18-736c-4a22-a04d-045afbb65ea0.tmp

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\e4ebff18-736c-4a22-a04d-045afbb65ea0.tmp
Size 6KB
SHA256 1b703302145ac38b4270e093af09f472861d0d521074078ecc9e61becb173752
MD5 e0d16fbfe4cae2cd14f860e141d2fbbb
SHA1 fc6dc7be85b4d139dc53216ac08e26c7fe708539
SHA512 0a89dc4c83eb8821beb24880bede455c89f029d8c318aad5f02da8ad80a0e02b29525d8019d67b06de2334bc5369be90bad5c0a68cf18324375370a7aa227342
SSDEEP 96:std/dzB0ib9GkOo5h16Z5Xs7/x+6MhmuecSD31ejeJK+gC28XM1C7K:sthpMtoKXsV+F2D3Qj7cG6K
TLSH
T169D1A8075E24A87B4CC6E109BA79BB56E2F5603271D61D58E7FC461C08DB5CD230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 2KB
SHA256 2158cda314745e1f266c5f84ddbca1b3e7a969662c344091cd0d838af1dee1d6
MD5 52020f38a176a925cc295e9fd9e06ccc
SHA1 13b0c6a5c85578345c5f59eb3bd376e3fa5fdd83
SHA512 38d431fb90a86a5c7cfba2f4680d3c878b9ce78ca582c5e9fdb7c1044d1333dd825cd931624c79267128030fcd33067278023d9729d7fc8b14c9b01e567add02
TLSH
T1AE517137AE509A7698F3460579863F97CF7461A9AB531F60E6CC1B0C01CA84C2343C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 15KB
SHA256 f629d53b24bb37df762f2fc71edd19beaa90433674553cf890f40afd079180ce
MD5 7fc2179f509a3cd592cec72e4eaa69cb
SHA1 13eeb7661a8f9e5669d660afe4076826ce6c0157
SHA512 10bc777433e299a7e4679fbedda6e5fc9324ab5f77597f58e385a6c3777f873aa0505577cfc0d103550d054b6c0aa4195b83a3e607bd8b7f912b8406f5562900
SSDEEP 384:Usrv+89zHqlDNP9oid6NBSMwR3X+3eYN3:frv+4UNbdDRH+3XN3
TLSH
T15572AE37E67C96339DB38409B48A2E0B7F78619662C30AA0EA995F4D41CA4D92307D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 e3c116c603bdead450354628a07dcd6c7bd1c87e7f359e960d9cb57592595cdd
MD5 8e6f76ee737d6cb99cdd3ff46972ae94
SHA1 c7cd5d0407ad66ab8acca754c4074c41db4de179
SHA512 25f92b36c6eb671e0f086cb759d31da60a41fcdbf7bc69a3784e070e0742ff8403534196a36e85bcf58ce0c7d9ce00e2d50d7d92e6b7572a1315fc37ffff05fe
TLSH
T1C771747BA9A0D97749F3850578823F4BABA4516AA6922FA4D6EC1F0C01C76881353C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5979ab.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-17_37a329a1e4c0a8e2850c2b065ea5ae11_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State~RFe5979ab.TMP
Size 1KB
SHA256 30ddbbd8ac9628e10471f008a8778f2b399fb4043cacac1d694c2e3c3a8e0cf4
MD5 05f8d8b3ac1828060632c907fa43fa60
SHA1 7b74b5d3a09fa730ff1e5ea909f5c9b11d19639b
SHA512 7b326402df590b736d408e4c18eaa8b8e0be18a6a50266b7d02cde09cde5a8abed2bce89e6086222b9a3772fd7284a2f627e76d87f3e6347ea2a01f3851e6926
TLSH
T1EA3174B7EEA44A72ACE3510631827ECB9F6011AE93134F44B2CC6B0C02DB84D536BC36
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1936-316-0x000001F1CB980000-0x000001F1CB981000-memory.dmp

Download

memory/1936-320-0x000001F1CB980000-0x000001F1CB981000-memory.dmp

Download

memory/1936-322-0x000001F1CB980000-0x000001F1CB981000-memory.dmp

Download

memory/1936-321-0x000001F1CB980000-0x000001F1CB981000-memory.dmp

Download

memory/1936-314-0x000001F1CB980000-0x000001F1CB981000-memory.dmp

Download

memory/1936-325-0x000001F1CB980000-0x000001F1CB981000-memory.dmp

Download

memory/1936-323-0x000001F1CB980000-0x000001F1CB981000-memory.dmp

Download

memory/1936-324-0x000001F1CB980000-0x000001F1CB981000-memory.dmp

Download

memory/3440-196-0x000001F2C4F20000-0x000001F2C4FC9000-memory.dmp

Download

memory/3440-348-0x000001F2C4F20000-0x000001F2C4FC9000-memory.dmp

Download

memory/3440-26-0x00007FFF453C0000-0x00007FFF453C1000-memory.dmp

Download

memory/3440-184-0x000001F2C4F20000-0x000001F2C4FC9000-memory.dmp

Download

memory/3440-178-0x000001F2C4F20000-0x000001F2C4FC9000-memory.dmp

Download

memory/5356-240-0x00007FFF45590000-0x00007FFF45591000-memory.dmp

Download

memory/5356-239-0x00007FFF47340000-0x00007FFF47341000-memory.dmp

Download

memory/5404-227-0x0000024A7E660000-0x0000024A7E709000-memory.dmp

Download

memory/5404-179-0x0000024A7E660000-0x0000024A7E709000-memory.dmp

Download

memory/5404-109-0x00007FFF453C0000-0x00007FFF453C1000-memory.dmp

Download