a0de4a7a28c9e0bd0f5ae53f06710bb492ec3870117d39fae1c9e3a20e54a388

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 22:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 55.0MB
Sample260719-2ddwesd18k
SHA256 a0de4a7a28c9e0bd0f5ae53f06710bb492ec3870117d39fae1c9e3a20e54a388
MD5 604f0fff18f8d32c7a43426e3d89c1b1
SHA1 baca722256a036d6c66e62dcaab514816a6d2256
SHA512 abe33af9f82e54cc47f6b18d95a853ec9dbe47af989579eac8719adc05facdbde328a11f9af81dda6da4567878f6352a89f0ec36ed71ab1429d7d07e9a18567f
SSDEEP 393216:tYFCHZBMUm7W66Lq346MzRl/d68oL2xbBZI6zdav2mGdD:tYFCHjMUm7W6jpgvd6JLaI6zdauD
TLSH
T11DC73A53E8921695C6AEC574D672853BFB61384D073813E706E0F3202F36BE09AF6B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery trojan

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1784795852\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1141323886\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1141323886\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1141323886\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1141323886\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1141323886\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1660123718\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1660123718\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1784795852\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1784795852\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1141323886\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1660123718\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1660123718\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2216_1660123718\manifest.fingerprint	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
700	ipconfig.exe
2880	ipconfig.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2532	msedgewebview2.exe
2532	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2216	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 412 wrote to memory of 2216	412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 2216 wrote to memory of 5384	2216	msedgewebview2.exe	90
PID 2216 wrote to memory of 1900	2216	msedgewebview2.exe	91
PID 2216 wrote to memory of 1900	2216	msedgewebview2.exe	91
PID 2216 wrote to memory of 1900	2216	msedgewebview2.exe	91
PID 2216 wrote to memory of 1900	2216	msedgewebview2.exe	91
PID 2216 wrote to memory of 3712	2216	msedgewebview2.exe	92
PID 2216 wrote to memory of 3028	2216	msedgewebview2.exe	93
PID 2216 wrote to memory of 3028	2216	msedgewebview2.exe	93
PID 2216 wrote to memory of 3028	2216	msedgewebview2.exe	93
PID 2216 wrote to memory of 5736	2216	msedgewebview2.exe	94
PID 2216 wrote to memory of 5736	2216	msedgewebview2.exe	94
PID 2216 wrote to memory of 5736	2216	msedgewebview2.exe	94
PID 2216 wrote to memory of 5736	2216	msedgewebview2.exe	94
PID 2216 wrote to memory of 5736	2216	msedgewebview2.exe	94
PID 412 wrote to memory of 700	412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 412 wrote to memory of 2880	412	2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	97
PID 2216 wrote to memory of 5060	2216	msedgewebview2.exe	102
PID 2216 wrote to memory of 5060	2216	msedgewebview2.exe	102
PID 2216 wrote to memory of 5060	2216	msedgewebview2.exe	102
PID 2216 wrote to memory of 2972	2216	msedgewebview2.exe	103
PID 2216 wrote to memory of 2972	2216	msedgewebview2.exe	103
PID 2216 wrote to memory of 2972	2216	msedgewebview2.exe	103
PID 2216 wrote to memory of 2532	2216	msedgewebview2.exe	104
PID 2216 wrote to memory of 2452	2216	msedgewebview2.exe	105
PID 2216 wrote to memory of 2452	2216	msedgewebview2.exe	105
PID 2216 wrote to memory of 2452	2216	msedgewebview2.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=412.3536.2518079018906934061 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView /prefetch:4 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffc46035fd8,0x7ffc46035fe4,0x7ffc46035ff0
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,15777879230316252311,16858505039030693167,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2136 --field-trial-handle=1756,i,15777879230316252311,16858505039030693167,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2304 --field-trial-handle=1756,i,15777879230316252311,16858505039030693167,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3540 --field-trial-handle=1756,i,15777879230316252311,16858505039030693167,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16 /prefetch:1
    3⤵
    PID:5736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4408 --field-trial-handle=1756,i,15777879230316252311,16858505039030693167,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4408 --field-trial-handle=1756,i,15777879230316252311,16858505039030693167,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4692 --field-trial-handle=1756,i,15777879230316252311,16858505039030693167,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2532
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.24.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1052 --field-trial-handle=1756,i,15777879230316252311,16858505039030693167,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:cd13195108b3ea2141313fc714362ef8455c4e16
    3⤵
    PID:2452
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:700
- C:\Windows\system32\ipconfig.exe
  ipconfig /flushdns
  2⤵
  - Gathers network information
  PID:2880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

app.json

Path C:\Users\Admin\.devhub\config\app.json
Size 226B
SHA256 e9aab1dbd50021ab46d44d369c8441f0dd7428820c51bd44e4b7208ae5a0be01
MD5 98c025946b2f5d658440b60d129ab813
SHA1 120c9a1611be5580ab491cb700100c0ff351f500
SHA512 ab2f5b94e9201b923d53e94a2c0585ea9f0db8a2333b3b63c8351652c93c072e46dc443a8e8f0765297c388ca2150fd6fb601c6e086aa67a57e8711e2fc0ef64
TLSH
T18CD0C990C6328AFE0DD5492C986EC347C7E4AF694AEE3C46E1DF2508231C7B628B0DD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 5535c94fd114cb5c42c23f89d64d97cf0222add86c5466819e43b5ec33728598
MD5 276d32cca629f8e0e87f662d18cceeab
SHA1 523dda24f5f792ae08877497b54de713f158ab85
SHA512 dc70b9d14c42f10e7f3ffcb07007aea1d1b814ec2b97380a458d4b83ec4ecf3759414549049a348bf67c52fb3add8840c78e13c4694e5f0edb7a47c116144604
TLSH
T1E8D0121777114234C4203033112373490900C11B810580455428999D1E544A02E03451
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3958209e075af86863cc8cdb98c9c67a3814734adea59eab0bed2be8c7c9b4cc
MD5 77aeeaf9a17522800103ac73a59644d3
SHA1 8e5055e6f25e6749a48ce73baadb7b262fe5e232
SHA512 090f8b24b9018fb4b68597bc53895bd5aefd382aea718623c74618b363c59725b9bb602fcd9bbdd0d744546e1dc5eb92bc1e1547b2b87376d1a91f10087a9687
TLSH
T139D00455D7144100C4503031513153510704C41041015145011014CC0CD15513D03114
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

99d0458a-caf5-49c3-927a-df4292161ae5.tmp

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\99d0458a-caf5-49c3-927a-df4292161ae5.tmp
Size 6KB
SHA256 ca9167c7d3da82f956e17a48c4cfdc4515070feee3ce048700e26819c68a7329
MD5 f345c1616a255e30cae78b8583b1d040
SHA1 bc24385f4d5defe33326fed44b8bf78845b881f8
SHA512 03ba6b2224bcb5452c1eee6d6dec79d6c9d45211225cbd9330ff8072fd9ab06cdcfc512d4e18b15ce4135517c8502c3d1533c65824451f55cc4c1477e72d9f98
SSDEEP 96:st8/dkqjtab9kYkfo5h16Z56s7/x+6MhmuecSma1ejerK+gMIkV28XM1C7K:stw6M2moK6sV+F2maQjlQVG6K
TLSH
T19DD196426E246D7B4CC6E619BB39BA47E2F9607261D52D58EBF8461C08DA6CC2317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 636b295eab6a483a862cadc9af8a4f1977da573291c4ac8a7bf7ef2478056712
MD5 947175ec9d6bcb6b7ef0baaa05343e03
SHA1 2455949f5408321c5fce7176ce0419edede3279b
SHA512 5d4b964d8f60871791b7b5dbd8489f8de2e047385ba3263acb3e624eda61d00822103b7b6ac3340d9022e459e310fb1d3d6988241dbfaee59b2f605c4bb82a6e
TLSH
T18DB00259D3994076E2B90771A4C3559D3273EC384727C91E50D6857A9F2D7C9CD09380
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599e88.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe599e88.TMP
Size 48B
SHA256 ab53d0eaa94653a1bb357ed0da891a863b618963317d347801dd27042b25d64c
MD5 0afb18a82104c194672c715c2b311e5f
SHA1 2bd9b0ac386e56948ba1e4d0a6e5ed76a3a367c6
SHA512 8fc1a8dc4f27b62b5a16427a6a65f7d3b393c362747c025cbc82b215f0a48bd40e47fda8b681721ba64f1e3976594922a03ec60f21fee966bdf92f42b14d1bf4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8473.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\Network Persistent State~RFe5a8473.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 d01a89880471243cb067fbf15f300803c9ac95ea0ee3924f859551cfd3e03d4b
MD5 bce65a2219f118396e1188cc17177e97
SHA1 0cfea01b6561651788b078ce95fa3abb47586c42
SHA512 83682b477eea17038c6807242aa2e22ad6429cb2b93a9d3dff69cc5310428bcab87082d7cfd25bc0308f383ebc257df4ac4c120f16afd67cee19108b0620a407
SSDEEP 96:st8/dkqCGtab9kYkfo5h16Z56s7/x+6MhmuecSma1ejerK+gMfxJ28XM1C7K:stw6W2moK6sV+F2maQjlYG6K
TLSH
T17ED1A7426E246D7B4CC6E619BB397A47E2F5607261D52E5CEBFC461C08DA6CC2317C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 b7899f229ecdf2840c2def20a4757e247fa0b19d243bf4c4031603f30ce27433
MD5 9c3e2c1444bf0b4bf7f9d15ac5cc1774
SHA1 9c8b53476883a5568dc8ca675ab1e542765f7a63
SHA512 036cb4223881896eab3548b8c915d77d7b4d7e215076b09f846f4a2af2023d20d90b23524866a278370f10226a606fa51dd7eeb264e7be3b2c589e897cd3a0f9
TLSH
T1188198B75C64A97B5EE39605798A3B57B7B050279A867F98D7EC0F0C01D72881353C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 14KB
SHA256 19dd35befcb272a6eff6a2305e23b7a8ad94c064cb4d28cc5e9d887015cb434b
MD5 6f145aebc2c488c39f93f33bf1662ff6
SHA1 14389da6da97744a9622df5050e656c12e65a96a
SHA512 0cf9cbd43eb99236e8be986e228e235bd2a9961bae7d6cec8fdab5fa4b0d84ab3d16ae80007a5856fd419c0cb86643299e179f1beffc5b1808330cc784f6e556
SSDEEP 192:gsrSABD6KZenoX+pshLTGbdna37W6h6DWYP9E4Y53yJGPa/a7vnNBSqGSBeoDUDs:gsrv+89zHqlDNP9oid6NBS0RwQWNk
TLSH
T14662BF73A83CA2379EF29904B48B7E0B7FB8606756C34BA8D5980B8D41DB0C92317D53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 2KB
SHA256 950aaefcaa06484640b2f6aa011c7443ca0a7ee63b87ea46288393fe6ecc107d
MD5 57f5d4d78dcb61f1376be888df07a578
SHA1 eec4ee9d29991e65c03dd7d7b1e2c5cb7e8fd59e
SHA512 7184f5f76f62ce2109e2b33d49bf43d7c640f4f44e6dfa6e24c0bccbaec229358e5c230dcff69ab786dbf0dc7bd431d26819df994c197004644822881b1b6ed2
TLSH
T1895184B36C14AA7A9AE25705798A7E67EA719066AB571F58ABDC0B0C00D714C1307C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 f388df8600462357cec6abc83095bcc56772063ee6fbbcb2e43d30defeb31006
MD5 f8b7252bdea501c8bd8e3861c835ae18
SHA1 f684516987fb487f68cf196e0044e651610bea2a
SHA512 cb17429b4345f805f9c24bbd0cadd9e9a6c0f38643541e602f325988b976c32d0515f650303445f5fed7ddcc68c7f5feda3f60de48ac00b4f1568b4bd29b4752
TLSH
T12C7198B76C64E97B5EE39B05788A3B57B7A15027AA867F58D6EC0F0C01D72881353C22
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe594c80.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-19_604f0fff18f8d32c7a43426e3d89c1b1_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State~RFe594c80.TMP
Size 1KB
SHA256 c218205d1b7a9bec8737168484a94818537b6b2fae75023b5a31d90881d9d009
MD5 f135ddcc12c8f0a9b4fa71adf36154bd
SHA1 c4e39c6b5c776336fdecb6d5874d3b88da636f13
SHA512 3006621f617228a86fbb38ba54b966ab2d1539622c124faac84b10c99a5a5f5db3fafa1e45011933f43b587ce5cc504af3ea29e52283a78b1eb57188563ee6b4
TLSH
T1703162F2AC905E76AEC26706358ABA9BBE70402B53538E0CB6DD4A0D11EA04C562FC31
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 f48838a19df7233468dc8dd93eb076d39f64ca07b4bec777fdee7ee40cae5d8c
MD5 f30e7e59611b8f47a88c87dae8318f90
SHA1 125f18dd5b48cf6af6e20f8aa314e6817f709569
SHA512 43d6990a0029c67d8d1bda59b41c7b780e922bba0f488b2ffdc9f97a1815a40ee6057f8e89506efe278f894cbd8cd82cc9c93006340c2ca873564ee7afd6a8a5
TLSH
T18F219D2605C5926C2AF241D6061BB82ED32FF0DB1B3B9D9D398D015E7FA27285322641
MD5 SHA1 SHA512 TLSH

Submit Download

hosts

Path C:\Windows\system32\drivers\etc\hosts
Size 1KB
SHA256 3188c96ecc55a7c812c3f3cd989a874b1409b447f069b3932c4a8cd902c804fd
MD5 2c01f9d7f8b5085d51d33ec98c9cc3da
SHA1 3a2ca23475b7d63849fd52b79a2a42d5d52ff9dc
SHA512 6e378a1eb7182d29c39516e3fa61f2e8643fac3c9d5ede3bb9717bbd2ab4c3163be511f2e881dce43e56d30305b5fb37a15933e380cfe1ddb8eceb1e12fc79a9
TLSH
T114219029058582FC1BB241D60617BC3E932FF0DF3B3B8D993A8D065E7BA2A14132260D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1900-49-0x00007FFC67840000-0x00007FFC67841000-memory.dmp

Download

memory/1900-209-0x00000160C4E20000-0x00000160C4FE3000-memory.dmp

Download

memory/2532-330-0x0000025B04600000-0x0000025B04601000-memory.dmp

Download

memory/2532-321-0x0000025B04600000-0x0000025B04601000-memory.dmp

Download

memory/2532-323-0x0000025B04600000-0x0000025B04601000-memory.dmp

Download

memory/2532-328-0x0000025B04600000-0x0000025B04601000-memory.dmp

Download

memory/2532-332-0x0000025B04600000-0x0000025B04601000-memory.dmp

Download

memory/2532-331-0x0000025B04600000-0x0000025B04601000-memory.dmp

Download

memory/2532-329-0x0000025B04600000-0x0000025B04601000-memory.dmp

Download

memory/2532-327-0x0000025B04600000-0x0000025B04601000-memory.dmp

Download

memory/5060-263-0x00007FFC67A10000-0x00007FFC67A11000-memory.dmp

Download

memory/5060-264-0x00007FFC66A10000-0x00007FFC66A11000-memory.dmp

Download

memory/5736-110-0x00007FFC67840000-0x00007FFC67841000-memory.dmp

Download