1c8fb246c77a21a94e84eab7fb81886294c5c19d7aec740ad1ae184ce23079de

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 03:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Size 28.2MB
Sample260801-d2ekvsxanf
SHA256 1c8fb246c77a21a94e84eab7fb81886294c5c19d7aec740ad1ae184ce23079de
MD5 39fe52076534ac8834c1b6a195922be0
SHA1 f67f5e51b199032fffb12cdfe9b454fbcc7b6d42
SHA512 c2bdfffdfa59c6d6ef48fad56989adc79958233bbe4e3fbc3eaa2e805f516c955f6bb26f4f3f190dcc2c0bda147ba51290fb3c86a357cc9dcb4b53ef11bbf551
SSDEEP 196608:Q47Bj/xKQVvzwRJsaU5Qf3rvMccPJUwo/GHDF+WctWV6UFrq7p3wx8FOU3REQ6aw:QXQV05vtrGA13g
TLSH
T15F577D17EA650AE5C8ADC0788976420377703C8F4B3067D33B5CA9642F7ABD8AD7A354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5236	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 0f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\47BEABC922EAE80E78783462A79F45C254FDE68B\Blob = 19000000010000001000000021d008b47b7a2a81c8435903ded424c90f00000001000000200000003560e45b41e46b8f36537025d1d5bc02d9652a10645b0eff69e8b6a52191f335090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000005200000047006f00200044006100640064007900200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020001320200047003200000053000000010000002500000030233021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c062000000010000002000000045140b3247eb9cc8c5b4f0d7b53091f73292089e6e5a63e2749dd3aca9198eda7f0000000100000016000000301406082b0601050507030306082b060105050703041400000001000000140000003a9a8507106728b6eff6bd05416e20c194da0fde1d000000010000001000000070253fbcbde32a014d38c1993098ad997e00000001000000080000000080826f22e7dc0103000000010000001400000047beabc922eae80e78783462a79f45c254fde68b2000000001000000c9030000308203c5308202ada003020102020100300d06092a864886f70d01010b0500308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308183310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c65311a3018060355040a1311476f44616464792e636f6d2c20496e632e3131302f06035504031328476f20446164647920526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100bf716208f1fa5934f71bc918a3f7804958e9228313a6c52043013b84f1e685499f27eaf6841b4ea0b4db7098c73201b1053e074eeef4fa4f2f593022e7ab19566be28007fcf316758039517be5f935b6744ea98d8213e4b63fa90383faa2be8a156a7fde0bc3b6191405caeac3a804943b467c320df3006622c88d696d368c1118b7d3b21c60b438fa028cced3dd4607de0a3eeb5d7cc87cfbb02b53a4926269512505611a44818c2ca9439623dfac3a819a0e29c51ca9e95d1eb69e9e300a39cef18880fb4b5dcc32ec85624325340256270191b43b702a3f6eb1e89c88017d9fd4f9db536d609dbf2ce758abb85f46fccec41b033c09eb49315c6946b3e0470203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604143a9a8507106728b6eff6bd05416e20c194da0fde300d06092a864886f70d01010b0500038201010099db5d79d5f99759670361f17e3b0631752da1208e4f6587b4f7a69cbcd8e92fd0db5aeecf748c73b43842da057bf80275b8fda5b1d7aef6d7de13cb53107e8a46d197fab72e2b11ab90b02780f9e89f5ae9379fabe4df6cb385179d3dd9244f799135d65f04eb8083ab9a022db510f4d890c7047340ed7225a0a99fec9eab68129957c68f123a09a4bd44fd061537c19be432a3ed38e8d864f32c7e14fc02ea9fcdff076817db2290382d7a8dd154f169e35f33ca7a3d7b0ae3ca7f5f39e5e275bac5761833ce2cf02f4cadf7b1e7ce4fa8c49b4a5406c57f7dd5080fe21cfe7e17b8ac5ef6d416b243090c4df6a76bb4998465ca7a88e2e244be5cf7ea1cf5	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 6b0000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab50f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa40b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d002000470032000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab51400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191831d000000010000001000000052135310639a10f77f886b229b9f7afc7f000000010000000c000000300a06082b060105050703037e00000001000000080000000080c82b6886d701030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f19000000010000001000000014d4b19434670e6dc091d154abb20edc2000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\925A8F8D2C6D04E0665F596AFF22D863E8256F3F\Blob = 5c00000001000000040000000008000019000000010000001000000014d4b19434670e6dc091d154abb20edc030000000100000014000000925a8f8d2c6d04e0665f596aff22d863e8256f3f7e00000001000000080000000080c82b6886d7017f000000010000000c000000300a06082b060105050703031d000000010000001000000052135310639a10f77f886b229b9f7afc1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183620000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab553000000010000002500000030233021060b6086480186fd6e0107180330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b000000010000006200000041006d0061007a006f006e00200053006500720076006900630065007300200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020002d002d0020004700320000000f00000001000000200000001504593902ec8a0bab29f03bf35c3058b5fd1807a74dab92cb61ed4a9908afa46b0000000100000020000000568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab52000000001000000f3030000308203ef308202d7a003020102020100300d06092a864886f70d01010b0500308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d204732301e170d3039303930313030303030305a170d3337313233313233353935395a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183300d06092a864886f70d01010b050003820101004b36a6847769dd3b199f6723086f0e61c9fd84dc5fd83681cdd81b412d9f60ddc71a68d9d16e86e18823cf13de43cfe234b3049d1f29d5bff85ec8d5c1bdee926f3274f291822fbd82427aad2ab7207d4dbc7a5512c215eabdf76a952e6c749fcf1cb4f2c501a385d0723ead73ab0b9b750c6d45b78e94ac9637b5a0d08f15470ee3e883dd8ffdef410177cc27a9628533f23708ef71cf7706dec8191d8840cf7d461dff1ec7e1ceff23dbc6fa8d554ea902e74711463ef4fdbd7b2926bba961623728b62d2af6108664c970a7d2adb7297079ea3cda63259ffd68b730ec70fb758ab76d6067b21ec8b9e9d8a86f028b670d4d265771da20fcc14a508db128ba	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3784	msedgewebview2.exe
3784	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1692	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5236	tasklist.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 1692	5020	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	89
PID 1692 wrote to memory of 2688	1692	msedgewebview2.exe	90
PID 1692 wrote to memory of 5200	1692	msedgewebview2.exe	91
PID 1692 wrote to memory of 5200	1692	msedgewebview2.exe	91
PID 1692 wrote to memory of 5200	1692	msedgewebview2.exe	91
PID 1692 wrote to memory of 5200	1692	msedgewebview2.exe	91
PID 1692 wrote to memory of 2848	1692	msedgewebview2.exe	92
PID 1692 wrote to memory of 4164	1692	msedgewebview2.exe	93
PID 1692 wrote to memory of 4164	1692	msedgewebview2.exe	93
PID 1692 wrote to memory of 4164	1692	msedgewebview2.exe	93
PID 1692 wrote to memory of 988	1692	msedgewebview2.exe	94
PID 1692 wrote to memory of 988	1692	msedgewebview2.exe	94
PID 1692 wrote to memory of 988	1692	msedgewebview2.exe	94
PID 1692 wrote to memory of 988	1692	msedgewebview2.exe	94
PID 1692 wrote to memory of 988	1692	msedgewebview2.exe	94
PID 5020 wrote to memory of 5236	5020	2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe	95
PID 1692 wrote to memory of 3784	1692	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe"
1⤵
- Checks whether UAC is enabled
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5020.2136.2943155572099710841 /pfhostedapp:85235ef8cf8771ebf8067d19109ef7d599c443e9
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView /prefetch:4 /pfhostedapp:85235ef8cf8771ebf8067d19109ef7d599c443e9 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x110,0x7ffb73b15fd8,0x7ffb73b15fe4,0x7ffb73b15ff0
    3⤵
    PID:2688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1784 --field-trial-handle=1788,i,2309900431602308032,12301264360726384210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:85235ef8cf8771ebf8067d19109ef7d599c443e9
    3⤵
    PID:5200
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2044 --field-trial-handle=1788,i,2309900431602308032,12301264360726384210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:85235ef8cf8771ebf8067d19109ef7d599c443e9
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2432 --field-trial-handle=1788,i,2309900431602308032,12301264360726384210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:85235ef8cf8771ebf8067d19109ef7d599c443e9
    3⤵
    PID:4164
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3528 --field-trial-handle=1788,i,2309900431602308032,12301264360726384210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:85235ef8cf8771ebf8067d19109ef7d599c443e9 /prefetch:1
    3⤵
    PID:988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView" --webview-exe-name=2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=832 --field-trial-handle=1788,i,2309900431602308032,12301264360726384210,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:85235ef8cf8771ebf8067d19109ef7d599c443e9
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3784
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 ce69aca36f7d41b17bd9456e6aa00bb580518d681440489124940cd11c7e1287
MD5 0281dd0b38ad074f3939bb38162aa2e5
SHA1 c38bdf6e46c77582d6024bc5ccfe64c7b15ac9b1
SHA512 a6441d640c3238b593238a7b12ab1e4ebc0368cb8a15cb26a80fe161cd7ce12dbb6b33ae61c73ced4fe3bdf2ee7367811b66788d391af8384ee366d7b41fad7b
TLSH
T166D0123E33010574C020217310436A1C1841C50B4007E001542CD56D1B048642A46441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7667b58c4d813f10b11c671a429a805369c5b7973b4d85e0891fdfb4b65114b5
MD5 de64d8bf6af62a9e324bc26a176a0b88
SHA1 e07151f03957b984baf8d6983447775d43be8979
SHA512 b9140b1bf9f1c99e8c91e2fdf45c6f2a1e6dbdbd187570c28950ed15a22d64be5f0924f0e2b998f17621d11226dbb805da1d25c5dc15c7c0de5c3f9e47a58547
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 6d0187892244ffaa41195819063a3fae7595c014193c66ae72bc985ceeb796bf
MD5 b8828c74664206ce3ccae937ceddb8ec
SHA1 1265d7ba0212f4b41ce080c658b15661491be1a4
SHA512 0becf3abf394f4eef5f5cd576c1ea62bb8037a3e41377b3edb2c1d416bf8571b623fac3448955ac83880e5a5b3194f3b44fc7ae6186b5e715dd15f5b69044ed0
TLSH
T1BAB00213CF2984BAC3644B7478D741F036724D37526F0ED684A7437ADFBB384412A520
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596d76.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe596d76.TMP
Size 48B
SHA256 7ade903704392a419ed2d40adedc86e7c4e4453c146144186501cf7eeb907786
MD5 550e545a2467db67c40a1fd8a19a2264
SHA1 0e8f764f7f5231f11c19ec5be749963061475a24
SHA512 f381cfd7997bcf174213ca2f349a4d45623b7c736fa7881b6fc91377183c949a1b9b1fa9aa398a97cc6fc959af9837c647ac7a4938d4b128d93b77bc16520dfe
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 2898efac857d1521927667cd459daee9d58b2d11a069586af4bd215c655687e7
MD5 60259f8e1a71eb1239ec199e4454076a
SHA1 8e37ea1672b3b96d8f1dab3b0c0e6095574130dc
SHA512 deb39393c15084474c9ce192cebd10dfba2c3a965f6f67c73239ff7d985edba9d47a49732e1e56706fbff47daeb9175ff450e6b7fd1009ad9629efa77f73c616
TLSH
T17E016BB2C2D8C67D884113E466247867CD2E151912282967CDEAEBEA6BE1071D61054E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a2e83.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\Network Persistent State~RFe5a2e83.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

a988ebd1-4d80-4ac0-bff5-83047342b3b6.tmp

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Network\a988ebd1-4d80-4ac0-bff5-83047342b3b6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 b6011f94f3a998198a27585f5fca86ffe747765b3d4e4dfda29c0815bbf71310
MD5 7b036b3b15a09580112a7a4f81e3cf41
SHA1 49c8558efeb162a1afb92d5862eeb0628fef06ad
SHA512 06ee6edf6406652eedad16b492570ea641ab5bf83b9975ceff2ea7b60db664a66a647b8dccee182fbb8d65532fb93d0dbef239f243a29dcfd5567db38792c5e8
SSDEEP 96:stV/dZa2vGCb9pkio5h16Z5ss7/x+6MhmuecScWQ21ejekK+grjf28XM1C7K:stJykBoKssV+F2cWQ2QjkFfG6K
TLSH
T1D9D1A7065E34B87B4CC7E119BA6DBA07E3F5607261D11E58EBF8862C09DB6CC231790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ba2f97c5-93ad-4c68-b0b4-b9b2a4d1ea52.tmp

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Default\ba2f97c5-93ad-4c68-b0b4-b9b2a4d1ea52.tmp
Size 6KB
SHA256 54ccb25b62cdcfde646c335cde596a4ed6af4f59b48c0646d7b5eae8c07c172e
MD5 c0d91569ac9bef92e4fc0385fb128e3e
SHA1 229ad3918dfaf6a649bef285895423a53dd2f0e3
SHA512 75060b34c09cf2adec8249b2a7dd7d6c9c63ffec2ec0c2b78bea56fd88a27e3571e5234b6b0e011bd6f7a22e5e5826fa4d6509e66cd9615f69210ceea6e47a8e
SSDEEP 96:stV/dZa2YCb9pkio5h16Z5ss7/x+6MhmuecScWQ21ejekK+grj928XM1C7K:stJySBoKssV+F2cWQ2QjkF9G6K
TLSH
T19AD1A5055E34B97B4CC7E219BA6DBA07E2F5607261D11E58EBF8862C09DB6CC331790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 2KB
SHA256 9523289a170fc02c327d823d5bbee05a042e4d2529cbba860834fcfa86929aeb
MD5 c6032df01733ec59fd99b5c792f27afb
SHA1 426336df2ef919efccb055feb405db7090c3af92
SHA512 c41a8f80c7ad08d400a6fccfb3464eea54c32f6f0744da676aa7a69fb2d2a01e0e0bfda98800c6eaf615f45c122370e3e901cd911177baa290c989c8699645da
TLSH
T14F51A873BD34AA3789E29A087D8F3F169EB550639A912F2197EC5F0D019B25C2302C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 aec6d3c28d14446769333ed78800f0311e762e5951e094aa33d207403830fc33
MD5 3ee2644ef58efa17a78fba024748e140
SHA1 a06d1e0eec5829580008191b18049c0c5cb87844
SHA512 5b8b6a5beceac3fcdbc6764c81e4ba7b314767a298bb939ec8339a968c3fb7fef417c971d93880edbd5344483287f302f43588eb6317428f2b27ef137dc509a1
TLSH
T1A1616377A974A9374DE29A04B9CE3B1ABBA55023E5913F65D6EC1F0D02973882342C26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State
Size 15KB
SHA256 1fe07a764a636e29531a7f35e8dccc4cb10e09eb22eb5d05f69ffdc96ac4de09
MD5 a7a04f439a6852a4c4be7ec8d446805e
SHA1 3a237da2190afda710e027308e4f904c86ec7223
SHA512 18cd6db6663a01b694ab4fb668430006a42317d142eb0ccba7a369d0a1fbc45d438cbed313b58be886b8f5995078ee745392fb8a07ff40165d23882d1b150a22
SSDEEP 384:2+aQikB+z/xvxjg/qhEwNBS19hRlAVdp9T9zE:B/UxvxjgC+bvlUJFE
TLSH
T164729E2B94796D23A5F3FA04799E1B8FDBF8847291C16D784EBD9F0D07872941342C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5913ec.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-01_39fe52076534ac8834c1b6a195922be0_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch.exe\EBWebView\Local State~RFe5913ec.TMP
Size 1KB
SHA256 4b4a40a3ff7417c3c2efea1cf4ef0291499c4579fd9b3b8d12b7e4108566178b
MD5 909f00f72ded6a10cf0d4422e943aedf
SHA1 3889de9badc35efef5c3df4998f272f75fbe5249
SHA512 b44aa92c15d3f0fa31847830b30b091169a41ff5e1d9aea370184b6a1f43c5ce3f3dc590d48b869e2140433f89eda5fca6af57093011c193c17ea9f6a123eb04
TLSH
T1992165B3E9784B33ACC2B745368F7E5B6EB0103782508E0066DC8B1D025B14D752AD32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/988-112-0x00007FFB959E0000-0x00007FFB959E1000-memory.dmp

Download

memory/3784-283-0x000001EE20730000-0x000001EE20731000-memory.dmp

Download

memory/3784-285-0x000001EE20730000-0x000001EE20731000-memory.dmp

Download

memory/3784-294-0x000001EE20730000-0x000001EE20731000-memory.dmp

Download

memory/3784-293-0x000001EE20730000-0x000001EE20731000-memory.dmp

Download

memory/3784-292-0x000001EE20730000-0x000001EE20731000-memory.dmp

Download

memory/3784-291-0x000001EE20730000-0x000001EE20731000-memory.dmp

Download

memory/3784-290-0x000001EE20730000-0x000001EE20731000-memory.dmp

Download

memory/3784-289-0x000001EE20730000-0x000001EE20731000-memory.dmp

Download

memory/5200-26-0x00007FFB959E0000-0x00007FFB959E1000-memory.dmp

Download