0a47fed677380f1e71c7bb98eebe29e66bb745c05fd15bee02cbd74f854efe6e

Analysis

max time kernel
151s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 23.8MB
Sample260728-arablseb82
SHA256 0a47fed677380f1e71c7bb98eebe29e66bb745c05fd15bee02cbd74f854efe6e
MD5 1d0d0db8fa5f2f5bc2326c28c7e30c5d
SHA1 7075034f021dbd8c7240aa0808169e4c0adef9b2
SHA512 3277cd80b52e8d91fb672eb2129c4434d73cd48b99743b6d44af8ea2d062c4db7ac72db9fdd4566c36cec19cf426f1e7652da99115e221df3605c38885e6e898
SSDEEP 196608:LHv51lMBt3DwOmjm+bXmOQckZdp7jvSDQgHfDMY1X/m:LPxktcOH+zmRVZ/Jgrx9m
TLSH
T1DF477C07E96544E5C0AED035C666A222BF713C894B3063D71F65BA243FB7BD09EBA350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation spyware trojan

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
17	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5076_438403119\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5076_438403119\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5076_438403119\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5076_438403119\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5076_438403119\LICENSE	msedgewebview2.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}\LocalServer32	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\TcNo Account Switcher\CustomActivator = "{8f88ede1-6055-46ce-ae95-2b04e8ccf8a5}"	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{8f88ede1-6055-46ce-ae95-2b04e8ccf8a5}\LocalServer32	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{8f88ede1-6055-46ce-ae95-2b04e8ccf8a5}	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\TcNo Account Switcher\IconUri = "C:\\Users\\Admin\\AppData\\Local\\Temp\\TcNo Account Switcher{8f88ede1-6055-46ce-ae95-2b04e8ccf8a5}.png"	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{0F82E845-CB89-4039-BDBF-67CA33254C76}	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\TcNo Account Switcher	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\CLSID\{8f88ede1-6055-46ce-ae95-2b04e8ccf8a5}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\" %1"	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\AppUserModelId\TcNo Account Switcher\DisplayName = "TcNo Account Switcher"	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5004	msedgewebview2.exe
5004	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5076	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5040	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
5040	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
5040	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5040	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
5040	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
5040	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 5076	5040	2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 5076 wrote to memory of 5092	5076	msedgewebview2.exe	90
PID 5076 wrote to memory of 5224	5076	msedgewebview2.exe	91
PID 5076 wrote to memory of 5224	5076	msedgewebview2.exe	91
PID 5076 wrote to memory of 5224	5076	msedgewebview2.exe	91
PID 5076 wrote to memory of 5224	5076	msedgewebview2.exe	91
PID 5076 wrote to memory of 4752	5076	msedgewebview2.exe	92
PID 5076 wrote to memory of 744	5076	msedgewebview2.exe	93
PID 5076 wrote to memory of 744	5076	msedgewebview2.exe	93
PID 5076 wrote to memory of 744	5076	msedgewebview2.exe	93
PID 5076 wrote to memory of 4516	5076	msedgewebview2.exe	94
PID 5076 wrote to memory of 4516	5076	msedgewebview2.exe	94
PID 5076 wrote to memory of 4516	5076	msedgewebview2.exe	94
PID 5076 wrote to memory of 4516	5076	msedgewebview2.exe	94
PID 5076 wrote to memory of 4516	5076	msedgewebview2.exe	94
PID 5076 wrote to memory of 5004	5076	msedgewebview2.exe	98
PID 5076 wrote to memory of 1272	5076	msedgewebview2.exe	99
PID 5076 wrote to memory of 1272	5076	msedgewebview2.exe	99
PID 5076 wrote to memory of 1272	5076	msedgewebview2.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies registry class
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=4.0.4.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --disable-gpu-shader-disk-cache --disk-cache-size=1048576 --enable-features=MojoIpcz --media-cache-size=1048576 --mojo-named-platform-channel-pipe=5040.1572.12343159142082018746 /pfhostedapp:1e398a6299ed6fc3fd681bfdde37f385811ac52e
  2⤵
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView" /prefetch:4 /pfhostedapp:1e398a6299ed6fc3fd681bfdde37f385811ac52e --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8eac55fd8,0x7ff8eac55fe4,0x7ff8eac55ff0
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView" --webview-exe-name=2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=4.0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1752 --field-trial-handle=1756,i,2369417313293690529,12703373016632241404,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:1e398a6299ed6fc3fd681bfdde37f385811ac52e
    3⤵
    PID:5224
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView" --webview-exe-name=2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=4.0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1940 --field-trial-handle=1756,i,2369417313293690529,12703373016632241404,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:1e398a6299ed6fc3fd681bfdde37f385811ac52e
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView" --webview-exe-name=2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=4.0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2152 --field-trial-handle=1756,i,2369417313293690529,12703373016632241404,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:1e398a6299ed6fc3fd681bfdde37f385811ac52e
    3⤵
    PID:744
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView" --webview-exe-name=2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=4.0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3400 --field-trial-handle=1756,i,2369417313293690529,12703373016632241404,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:1e398a6299ed6fc3fd681bfdde37f385811ac52e /prefetch:1
    3⤵
    PID:4516
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView" --webview-exe-name=2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=4.0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoABAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=828 --field-trial-handle=1756,i,2369417313293690529,12703373016632241404,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:1e398a6299ed6fc3fd681bfdde37f385811ac52e
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView" --webview-exe-name=2026-07-27_1d0d0db8fa5f2f5bc2326c28c7e30c5d_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=4.0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4412 --field-trial-handle=1756,i,2369417313293690529,12703373016632241404,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:1e398a6299ed6fc3fd681bfdde37f385811ac52e
    3⤵
    PID:1272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Platforms.json

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\Platforms.json
Size 34KB
SHA256 dc77f9bf564bef9913a4711106fa9ef5b0fb8e65ede8ce0709ff78c179359703
MD5 c56c4f7b773f73c64dc3941dcfd50c4a
SHA1 b40aa4525a9d755824b7b1e75aff0ec6aa95143f
SHA512 b82a797956c67a19cff5e215fd73a94a6560bc6f7f12b635c5b1f30ca49940c07dd069e3ee7ff2037422c02b8f3164f03b920b73e0afa4b84cdc4344a3ec3b27
SSDEEP 768:l+Qgu9lPl9FPV9d2PHhPx9mc6UBjhgeQ1Q8yQ0xFcQ1QVqXQ275EvmevRv7vJS:9gi5lTVD2PHtxYc6UBlgfK8D0HZKJ27P
TLSH
T129F28617C297DD12067A1668B09DEFAAF329436F01C94E6B797D640E1FBC40E25DC88D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamSettings.json

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\Settings\SteamSettings.json
Size 771B
SHA256 fa092aeb64519367afdd5b0eb90ef9d6b31d17b821b53f6f4d6f73ad3d7c07e6
MD5 bbd206988f5786e83b01a76382783395
SHA1 24b91142065d7c4d280efa348c046e0b37b4fdba
SHA512 e5ccde22b6ce956317ce0d56a84900e6e4ce0ceebc3d3ff78ee11dfd0b5a5fd052f45179c7ea9fa039fc8efebfa46f4cf5ddddbae772b01db632a5604125f448
TLSH
T1C401D4179C2850BE04EE50B4ADADB74B0F628E6F50293D68A74318044B0DB6B34B34E5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4b2aae079f3155f073079f6dea808c362d3715549bbadd4c8df4fc29155a934d
MD5 c38d8ad881447059ec65fa187692ad45
SHA1 f856f092a07b3a6f51f814c6172b1c301dcb2e41
SHA512 ba189606a6dbe2aa504e72cf41e8b7fd05d186256c6c5bd4c7b48f44d218802abf0f221af1d241cb298617094973739e90371f145abe3794311877519d222604
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7abdc6209f7879abc92bc3d254fd651365a89e8357e5da24d1b0adf75fbcb59a
MD5 bf50fb7eab29e2fdc1cda30132fd4cd4
SHA1 baf28519cc35dd940f2d75f186b98ab81a75e25c
SHA512 587aa3544c491b8c1f658d9541e7ca3260fc6784cdb2332c5d344264e27cf5fc0caf352a34e0ab6309ebfc10b946dda74a14f7dfa7b5a49e5472318ce1f6a31a
TLSH
T13AD012123A91433CC01020330102F1091400D70F8105804094388D2D1F052641903451
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1307ef60-31a3-47e7-bbe9-ff94649ae48e.tmp

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\1307ef60-31a3-47e7-bbe9-ff94649ae48e.tmp
Size 6KB
SHA256 902e16f006da27c6d20ee6970b853a3b190617bcd589ded1f0438c519ec58ffa
MD5 7a5aa43e7e74080ff07e4c7cd1174918
SHA1 7f67997d9c934665f358d430cc29b1654f728d0e
SHA512 254c393ea42a068094976e83b5451f341623eb00802b8fd4120166cad4d6a3ed21ac084c55a009712fb176f1c45f691a37024de5d69eaec9d6d5f73cacfd8f4c
SSDEEP 96:stgXd4O8VFHb9POk6o5h16Z5zss7/x+6MhmuecSziHM1ejeAK+gxKp28XM1C7K:stcye/oKzssV+F2ziHMQj42pG6K
TLSH
T10ED1A6065E28697B4CC6E119BA39BE13E2F9603271951E58EBFC461C14EB5CC7303D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 3b5c512da51253b5b96f9f95a59467138da3ecab81d6446a0d5acff1de42b6c4
MD5 b85c23c487afa36cb26cb7039dd66a9e
SHA1 499ecdecaa089bcc9c4438e4f5f0799fac5cf9a3
SHA512 0d14d1749da3d8d6a587338a2442f27e29abb2476a5b536ce8e5a513f864dedee8b682af263dfd6fb03e7ddf2d5efd47dd0985fbaf35be95f9ac93d40bccc8b9
TLSH
T1BFE05E0A33411136D75E3A3284C9155477FF35FA980F1DC3614300FA5B07395F2E1101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 70c5efa280d6afd403f06e59f35efa97c45e6e8e98d98546a22a389c8e537658
MD5 02e87ef72d2c32f90de66b6d89d7749e
SHA1 267fe5f53791cfc22ca9b1b91d0cd0595bbf84b3
SHA512 b4d202c054895c7971203f4e0f03b6171d9a61d66600044ed106af31ef91f8d72499303118dce6041d065e2954ef76ad6d3bc79fcb1bd595dcfa7813dfe1dd13
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\Extension Scripts\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f5ef.TMP

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\Network\Network Persistent State~RFe59f5ef.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Default\Preferences
Size 6KB
SHA256 1a85ece4abf3380608cd24a1d1e156c3ef75ae043bc83af1e51a18c94894ed7a
MD5 61c43c999422a827ffd5d68b900b2df7
SHA1 b441a33afd558117ef9b73089b09adae2422c1fe
SHA512 b2731217eb94aaff38fc0234b8b31ca1cba9053aa81eb0c81d1e526c8461bbb135dc9c83c93ef105db09755341a11e8adb4ccf684cfababe5b1d0fcc154b30ad
SSDEEP 96:stgXd4O88GFHb9POk6o5h16Z5zss7/x+6MhmuecSziHM1ejeAK+gxKJ28XM1C7K:stcy0/oKzssV+F2ziHMQj42JG6K
TLSH
T14CD1A5065E28697B8CC6E519BA39BE13E2F9603271951E58EBFC461C14EB6CC7303D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Local State
Size 15KB
SHA256 247f13192caff3eae0f6bbfb0e9fdf48de35b2be9ba35d03a8b0c0a562ad7781
MD5 12b5d8f2fb348de179858ee0a8e9c6db
SHA1 b467bc05f77961f2cce176b6e09c00a53ce8648f
SHA512 e1d50a086a9d68baef0f3466724432c8fb5ea431eb1be8dab7648ad5581c0f95113e4dd0f7aec34f20f5be399d91fe242a2c3f7e0f27544a859095e45028eba8
SSDEEP 384:++aQikB+z/xvxjg/qhEhNBS9M2G2IFisdp9zZ:J/UxvxjgC+2oFisHFZ
TLSH
T18F72AE2B64393D2395F6EA057D4D1B4FABBD9872E1C16EB84AED5F0807872D81342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Local State
Size 2KB
SHA256 58ec27ead41c5cfa2103b2535320c843b7d42a8943887c3a16f9d6c98078b522
MD5 3b683e0b2adf3e24fb4906fb26950c88
SHA1 30b1b06450fe452ab57285edb989f5f4b5a532ba
SHA512 a04b19714a6c3dd6e8a81fcc24cc935dadaa4f4249ff57efd2352f94a621c9215305374c108a32c3b7925b167d7e374b1e75e213ce265aeab2563d3b14030df0
TLSH
T16F51613378259A3385E24658798A3F275E7E9062FB522F549BDD0B0C02C659C2342C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Local State
Size 3KB
SHA256 c0c3123d1f2b9b38197bb6a5f2026b9937fb1e69fefbfe11dce859d4c7125ad2
MD5 3f738d0327d33ec0d42c867309fdf57a
SHA1 4d2d17e071a3177b537548cf3fa8928b61a82873
SHA512 a5bbba31a8b4060b50c8a0c313b63ef21be83c057a6d27dcd8efaf38de1d7049261a3d21ab91dfb1bf91f3b69c8dfe1cdd5101acff2a626e6804ca1064f6ec6b
TLSH
T1BE616837697595374DF29A1579863B167BBA5023F6953F98DAEC0F0C01C728C2342C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58ce96.TMP

Path C:\Users\Admin\AppData\Roaming\TcNo Account Switcher\WebViewCache\EBWebView\Local State~RFe58ce96.TMP
Size 1KB
SHA256 dfe70d932c97c5785e077209cfa4afc4783b82cc2c00f7b7251c8844f446f451
MD5 555b1d10acd337ff61f301ec3c5a79b8
SHA1 5991adbf8746f0182e3470173989db6d76cedc8e
SHA512 d44edb92927a565c8f847573fd9046873c0d5730f42bb8123188cd510276e4b9d9b686a2a370facd0b5d962608ab7c59805843d94f0190a9e4affdb979cc89d7
TLSH
T1B5214077E0698A33A8A12256314A7B5B2D3A1027F3104F04ABDE4B1C128218C662AC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1272-281-0x00007FF90A9D0000-0x00007FF90A9D1000-memory.dmp

Download

memory/1272-282-0x00007FF909580000-0x00007FF909581000-memory.dmp

Download

memory/4516-97-0x00007FF90A800000-0x00007FF90A801000-memory.dmp

Download

memory/5004-271-0x0000024EE0A50000-0x0000024EE0A51000-memory.dmp

Download

memory/5004-266-0x0000024EE0A50000-0x0000024EE0A51000-memory.dmp

Download

memory/5004-264-0x0000024EE0A50000-0x0000024EE0A51000-memory.dmp

Download

memory/5004-273-0x0000024EE0A50000-0x0000024EE0A51000-memory.dmp

Download

memory/5004-275-0x0000024EE0A50000-0x0000024EE0A51000-memory.dmp

Download

memory/5004-274-0x0000024EE0A50000-0x0000024EE0A51000-memory.dmp

Download

memory/5004-272-0x0000024EE0A50000-0x0000024EE0A51000-memory.dmp

Download

memory/5004-270-0x0000024EE0A50000-0x0000024EE0A51000-memory.dmp

Download

memory/5224-202-0x000001CC80BE0000-0x000001CC80DA3000-memory.dmp

Download

memory/5224-197-0x000001CC80BE0000-0x000001CC80DA3000-memory.dmp

Download

memory/5224-31-0x00007FF90A800000-0x00007FF90A801000-memory.dmp

Download