9671df2e121d838df41ecfd2230729fa4bf86851ada139621b7ef384a27197e0

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 08:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe
Size 17.6MB
Sample260808-jyflmsbq8v
SHA256 9671df2e121d838df41ecfd2230729fa4bf86851ada139621b7ef384a27197e0
MD5 1c5af9c1af89a24664a35aa78fd71895
SHA1 a7f195811066b362095202159a315fd02c3e711b
SHA512 f2e92cbaf317089aa54343b3cc26be66cf138b9a9ea1c05bd43a9ae08451414ca64c5f2d74d2f326c66183c9d5c939c8812d1be519782258b13ec9a06e70a0a6
SSDEEP 196608:xSbgefawB06sCNYBIX6EOQEnsLCSnqVd:x6gefPaIDOQE8NqV
TLSH
T1C5173963E8922AD8C4EAC1708672413BBB613C495B7853E71790F7201F36BD0EEB6795
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2527679\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2527679\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2527679\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2527679\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2527679\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_2527679\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1884_358925411\male_names.txt	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2792	msedgewebview2.exe
2792	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1884	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4376 wrote to memory of 1884	4376	2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe	89
PID 1884 wrote to memory of 5064	1884	msedgewebview2.exe	90
PID 1884 wrote to memory of 3464	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 3464	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 3464	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 3464	1884	msedgewebview2.exe	91
PID 1884 wrote to memory of 5920	1884	msedgewebview2.exe	92
PID 1884 wrote to memory of 4700	1884	msedgewebview2.exe	93
PID 1884 wrote to memory of 4700	1884	msedgewebview2.exe	93
PID 1884 wrote to memory of 4700	1884	msedgewebview2.exe	93
PID 1884 wrote to memory of 5456	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 5456	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 5456	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 5456	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 5456	1884	msedgewebview2.exe	94
PID 1884 wrote to memory of 5756	1884	msedgewebview2.exe	95
PID 1884 wrote to memory of 5756	1884	msedgewebview2.exe	95
PID 1884 wrote to memory of 5756	1884	msedgewebview2.exe	95
PID 1884 wrote to memory of 1168	1884	msedgewebview2.exe	99
PID 1884 wrote to memory of 1168	1884	msedgewebview2.exe	99
PID 1884 wrote to memory of 1168	1884	msedgewebview2.exe	99
PID 1884 wrote to memory of 2792	1884	msedgewebview2.exe	100
PID 1884 wrote to memory of 3272	1884	msedgewebview2.exe	101
PID 1884 wrote to memory of 3272	1884	msedgewebview2.exe	101
PID 1884 wrote to memory of 3272	1884	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4376.4176.16784650404991202107 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView /prefetch:4 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x104,0x7ffb19685fd8,0x7ffb19685fe4,0x7ffb19685ff0
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1408 --field-trial-handle=1688,i,13097744801121589805,5745686350786884670,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2140 --field-trial-handle=1688,i,13097744801121589805,5745686350786884670,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f
    3⤵
    PID:5920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2388 --field-trial-handle=1688,i,13097744801121589805,5745686350786884670,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1688,i,13097744801121589805,5745686350786884670,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f /prefetch:1
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=1688,i,13097744801121589805,5745686350786884670,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f
    3⤵
    PID:5756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4724 --field-trial-handle=1688,i,13097744801121589805,5745686350786884670,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f
    3⤵
    PID:1168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4832 --field-trial-handle=1688,i,13097744801121589805,5745686350786884670,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2792
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView" --webview-exe-name=2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe --webview-exe-version=2.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4788 --field-trial-handle=1688,i,13097744801121589805,5745686350786884670,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:afec04564349c3c0f88458286eec572fbd98491f
    3⤵
    PID:3272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1efa2ee076b22cfe4041975a467065059df4d03d01bf3a227a896f346edc7d16
MD5 e43c904be086fd6ded6bfdaca041827b
SHA1 719b24a8c8adfb6fb459e51e02cbcfa4b08e6860
SHA512 a26b8efe2b609045432ac7c7827671ef3b0ce0555d7f772b7119269bf580b3acda99d2d2254702589c162af8694b5820c8aa5251b98a5f27310f613265333135
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cb2aa60f822ddfa66238e5bc85eb74538194e85bdb665ef0e8a6f1e848120a37
MD5 25160ee25068186f9f9f3292fd713da2
SHA1 35149125b601016d0d12fa1b74f4cdc848387291
SHA512 0ed16c55b89f3df6e0156378be122baebbf707fde09080f7a890643bf381e3388e1979863ba4935b96127514052808c75f4fce5b975eae5f09296e23f32dd6bf
TLSH
T1A1D0121672510134C02020B300536F081410D50B500540015829851D7A350E01D1244A
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1c44dc93-83fc-4665-bc11-03f0ee204574.tmp

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\1c44dc93-83fc-4665-bc11-03f0ee204574.tmp
Size 6KB
SHA256 65d449f62220358de1d157f444131fe6bdf1e83e59dbf006dfa27b575d80ed36
MD5 f512f15f7189330ca34f602db1cf0c9e
SHA1 3d238630385f9ec2e1e6b15fab70b56cd3e4277c
SHA512 bd1a8e1194402c60a4fdd63671012fce4a04bcd36a2e35ac8f4bd3dbad5eafcc38ab4698bfb7996d1794b24b4a42769bee63c089a7af6ffdb1a3bbc5b18a1cb1
SSDEEP 96:stlJ/dzHmifb9akMo5h16Zdxs7/x+6Mhmuecz1r1eje3K+ghK28XM1C7K:st/pyvoKxsV+Fv1rQjBDKG6K
TLSH
T193D1A6016E68B97F4CC6F509BE39BA03E2F5607264D21E58E7F8562C18EA6CC6307C07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 db855a3c0cd349678417da287c65537e9996927db519370e3d02eeee540f1a95
MD5 8b8d0a6e2742068d23fc93a432c34cb7
SHA1 33611c644a02cbb2d855754142a6cacab3da1def
SHA512 6e6b4045c292c8c2ebfd10b21b5a33b607a5dd245f994a96c33b2828632c5383ee7f585e22b481066a41d78ff8258d2be6abb7177e90c0c644c89c2690e0fc41
TLSH
T171B011A200002002C3C0B3BC20C202023AB00C280A830A80C282CE38AA20B022A80C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5930ab.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5930ab.TMP
Size 48B
SHA256 b67821f5a913cb11959054db848be69159f547fd43b08686160f8fb130b1a465
MD5 164b628d2e6e67ce68b4f08587ba2da7
SHA1 72dc0c0f2afd66a3159c0717c576f822e778ff0a
SHA512 e5fcfba83a2f696768e67d4ad7088f4466a7c430a5e6c037227060d2a32c0d70957149c52bf9f3d7f49ec368f9c70bd5d36b09145bf7be52de38900f9fe2de5f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\Network\Network Persistent State
Size 1KB
SHA256 46d26b1c9a0d97ed4959eeb8f7252e5ffbba8e160dea88646af630792d42af52
MD5 cb2a8287b3a36989ceb15dafb8dbb9a8
SHA1 92a13b03b4cefa31a332f311f7eaac076b3faa7c
SHA512 8b306f79e3523013326d04e6c1934a371f10fb58a0d76e912b2edbdf8b45f816efd34de4a109506bdee2a5f93f368cad0eac5a4141597f75c0815a62cd800849
TLSH
T172419EB7C7DC426E896112F477297A1BCD2E060A522C3E0AC8D4EBDF67E1470F25098E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59f2d2.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\Network\Network Persistent State~RFe59f2d2.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 7ac93b95dbe48202a092a8bf3bd7379630f87d72fa820b854aab654c7b84705c
MD5 5d7e21f67e0ac289193723d24beaf9dd
SHA1 25d0114f945ab04de30524db1d8f101736e18525
SHA512 45bf839c55d1ac82d66bd0ebe68a3a47760fa7d513a09adbfc4b8cf7f6d7d81d8b5416e41a1ecef5e639ceb66c3527e730ffd4ffd1da752069de99baece63221
SSDEEP 96:stlJ/dzHdGifb9akMo5h16Zdxs7/x+6Mhmuecz1r1eje3K+ghX28XM1C7K:st/pgvoKxsV+Fv1rQjBDXG6K
TLSH
T1C8D195016E68797F4CC6F509BE39BA13E2F5607161D12E58E7FC562C18EA6DC6307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Local State
Size 2KB
SHA256 c0b419caad0153167b71c0cd6ac7add5e460c632df9f0550726801216693efcc
MD5 6a61902a8f5ae710b1ff07014900e341
SHA1 f47bc268042ed841d47a124be94c83c0d512fc8e
SHA512 66a48290f5b8a35a3192175d4420f8846613ae161a388ca82f8c1bf40a4a2be5a7fa4fb7c160d2f4ae4f1bd2f0dfb258f522cf21fdb946876373a468b1811d0b
TLSH
T1765165327C24AB378AE2661CBC8A7F139E75A061AA521FA4D7DD0B1C01D754C2342C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Local State
Size 3KB
SHA256 03ed48f766f80e2b6d5d2b3de42e764e52ac29105bc72dc509cf51bebf9af61e
MD5 4d5ceab2a336a70277880c244b39b89d
SHA1 cdec51773cb72f913b54988dea40854268cd47aa
SHA512 73a8c4b114c12f24342029b6ec03e450163c48900eff2011f4f98c367c6f07ab6fa9425ed9cfbc1d5c9fadc084fd669d2d9050e6ec7e5ff01a1d7e4d67556efa
TLSH
T1676169366D74E9374EE2AA18BC863B16BBA55033E5913FA5D6EC0F1C01D728C1352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Local State
Size 15KB
SHA256 ce1605dbecfab377ca8fb4e7693489fb95e854eb7d3d40198555c9282cd735b2
MD5 16fce98db9648e79786dd905b91143c9
SHA1 ef94ce86ebc3f284201dc25de702075b80d1776d
SHA512 aa3ef88f40f3027910627bb3ef1707950f58311c3b4ea34c9be07348f5315aad03a5d701ba6933c7eff384b68651d1379298373554f021c3f814260439fdc415
SSDEEP 384:L+aQikB+z/xvxjg/qhEwNBSWyXHyM3eS7e9zC:q/UxvxjgC+t3yw/7eFC
TLSH
T1E572AF2B5C787E2796F2FA14794D574BCFB8947294C22AF84EBD5F0A16C33D80342816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58ddd8.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-08_1c5af9c1af89a24664a35aa78fd71895_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat_snatch_vidar.exe\EBWebView\Local State~RFe58ddd8.TMP
Size 1KB
SHA256 4f5c7ce37a0a5d62f07ff4cef78580c81d03b8c7d8d70eb7bbd048b2aa0b34d8
MD5 1e20c31d0f936f6c72b4ae802a294445
SHA1 678c717ce322612eac3570c937efc3bf56d61112
SHA512 db60a644cc234775af4a40aeae78c5dac1f104fe2ba027371c63b5335571d38928a88f41b0d627d5f13de8a90981f38ee249fb328f17f79e0d648a5bc4b63116
TLSH
T115216572EC24AB326D91321D7586BB471E61607642114E44A3DD0F2C16E318CA53BC33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1168-257-0x00007FFB39DB0000-0x00007FFB39DB1000-memory.dmp

Download

memory/1168-258-0x00007FFB3A4F0000-0x00007FFB3A4F1000-memory.dmp

Download

memory/2792-297-0x0000024884600000-0x0000024884601000-memory.dmp

Download

memory/2792-296-0x0000024884600000-0x0000024884601000-memory.dmp

Download

memory/2792-295-0x0000024884600000-0x0000024884601000-memory.dmp

Download

memory/2792-294-0x0000024884600000-0x0000024884601000-memory.dmp

Download

memory/2792-293-0x0000024884600000-0x0000024884601000-memory.dmp

Download

memory/2792-292-0x0000024884600000-0x0000024884601000-memory.dmp

Download

memory/2792-288-0x0000024884600000-0x0000024884601000-memory.dmp

Download

memory/2792-286-0x0000024884600000-0x0000024884601000-memory.dmp

Download

memory/3464-44-0x00007FFB3B210000-0x00007FFB3B211000-memory.dmp

Download

memory/4376-0-0x000002665FA40000-0x000002665FA68000-memory.dmp

Download

memory/5456-111-0x00007FFB3B210000-0x00007FFB3B211000-memory.dmp

Download