65b0ee67d1dda870ef1a6d5a59ff6fcc5ded41b527917cb2e3da9b210098425a

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/08/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Size 23.7MB
Sample260824-a2pt2sbr4x
SHA256 65b0ee67d1dda870ef1a6d5a59ff6fcc5ded41b527917cb2e3da9b210098425a
MD5 b358d9251d18df77d1270afb925cf38f
SHA1 098b055ac42579d0abb4f7801a549849744d59eb
SHA512 0814553b86e4db7abd009893fb9db1fefee588b1ae75149754fec694a2003636b3e944806f4e1bcfc679094a164ad1735ff7764dbf2192c38c6e57e5e9b803f9
SSDEEP 393216:urU4lTkt2Z5OQ9T6+Qz/zB3H6Gf0tGFe+jMJG7UbJV:urU4Bkt2Z5OYTIV
TLSH
T11D47AD47FDA268EAE4AB8130897B5122BB363C448F2563C35B50E6603FB7BD49C76354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3768	7zr.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_6242028\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_1691280117\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_1691280117\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_6242028\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_1691280117\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_1691280117\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_1691280117\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_1691280117\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4492_6242028\manifest.json	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7zr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies system certificate store 2 TTPs 19 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 6b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72800f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e261400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 5c0000000100000004000000000800000f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b031400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183180000000100000010000000fd960962ac6938e0d4b0769aa1a64e260300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72806b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac99619000000010000001000000014d4b19434670e6dc091d154abb20edc200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 180000000100000010000000fd960962ac6938e0d4b0769aa1a64e2619000000010000001000000014d4b19434670e6dc091d154abb20edc6b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191830f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b035c000000010000000400000000080000200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 6b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf15761419000000010000001000000076935b5c5a037216daaf8aac76df42c12000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 5c00000001000000040000008001000019000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df06b00000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a2000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 5c000000010000000400000000080000190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6506b00000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6582000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72801400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191836b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b0319000000010000001000000014d4b19434670e6dc091d154abb20edc5c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e26200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 1400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183180000000100000010000000fd960962ac6938e0d4b0769aa1a64e265c00000001000000040000000008000019000000010000001000000014d4b19434670e6dc091d154abb20edc0f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b036b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab7280200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 0f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b031400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf2119183180000000100000010000000fd960962ac6938e0d4b0769aa1a64e265c00000001000000040000000008000019000000010000001000000014d4b19434670e6dc091d154abb20edc0300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72806b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280\Blob = 19000000010000001000000014d4b19434670e6dc091d154abb20edc6b000000010000002000000028689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac9960300000001000000140000009e99a48a9960b14926bb7f3b02e22da2b0ab72805c000000010000000400000000080000180000000100000010000000fd960962ac6938e0d4b0769aa1a64e261400000001000000140000009c5f00dfaa01d7302b3888a2b86d4a9cf21191830f00000001000000200000008408d5e5010ab8da67eb33a7d79ace944dd0ac103ae6ead3ff30dec571066b03200000000100000079040000308204753082035da003020102020900a70e4a4c3482b77f300d06092a864886f70d01010b05003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3039303930323030303030305a170d3334303632383137333931365a308198310b30090603550406130255533110300e060355040813074172697a6f6e61311330110603550407130a53636f74747364616c6531253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e313b303906035504031332537461726669656c6420536572766963657320526f6f7420436572746966696361746520417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100d50c3ac42af94ee2f5be19975f8e8853b11f3fcbcf9f20136d293ac80f7d3cf76b763863d93660a89b5e5c0080b22f597ff687f9254386e7691b529a90e171e3d82d0d4e6ff6c849d9b6f31a56ae2bb67414ebcffb26e31aba1d962e6a3b5894894756ff25a093705383da847414c3679e04683adf8e405a1d4a4ecf43913be756d60070cb52ee7b7dae3ae7bc31f945f6c260cf1359022b80cc3447dfb9de90656d02cf2c91a6a6e7de8518497c664ea33a6da9b5ee342eba0d03b833df47ebb16b8d25d99bce81d1454632967087de020e494385b66c73bb64ea6141acc9d454df872fc722b226cc9f5954689ffcbe2a2fc4551c75406017850255398b7f050203010001a381f03081ed300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e041604149c5f00dfaa01d7302b3888a2b86d4a9cf2119183301f0603551d23041830168014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7304f06082b0601050507010104433041301c06082b060105050730018610687474703a2f2f6f2e7373322e75732f302106082b060105050730028615687474703a2f2f782e7373322e75732f782e63657230260603551d1f041f301d301ba019a0178615687474703a2f2f732e7373322e75732f722e63726c30110603551d20040a300830060604551d2000300d06092a864886f70d01010b05000382010100231de38a57ca7de917794cf11e55fdcc536e3e470fdfc655f2b20436ed801f53c45d34286bbec755fc67eacb3f7f90b233cd1b58108202f8f82ff51360d405cef18108c1dda775974f18b96ddef7939108ba7e402cedc1eabb769e3306771d0d087f53dd1b64ab8227f169d54d5eaef4a1c375a758442df23c7098acba69b695777f0f315e2cfca0873a4769f0795ff41454a4955e1178126027ce9fc277ff2353775dbaffea59e7dbcfaf9296ef249a35107a9c91c60e7d99f63f19dff57254e115a907597b83bf522e468cb20064761c48d3d879e86e56ccae2c0390d7193899e4ca09195bff0796b0a87f3449df56a9f7b05fed33ed8c47b730035df4038c	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a7e00000001000000080000000080826f22e7dc011d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e77f0000000100000016000000301406082b0601050507030306082b060105050703046200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\SystemCertificates\CA\Certificates\9E99A48A9960B14926BB7F3B02E22DA2B0AB7280	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 6b00000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6580f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb6587f0000000100000016000000301406082b0601050507030306082b06010505070304140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d777e00000001000000080000000080826f22e7dc01030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a190000000100000010000000fd960962ac6938e0d4b0769aa1a64e262000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c10f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2644	msedgewebview2.exe
2644	msedgewebview2.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4492	msedgewebview2.exe
4492	msedgewebview2.exe
4492	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3768	7zr.exe
Token: 35	3768	7zr.exe
Token: SeSecurityPrivilege	3768	7zr.exe
Token: SeSecurityPrivilege	3768	7zr.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4056 wrote to memory of 4492	4056	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe	89
PID 4492 wrote to memory of 4476	4492	msedgewebview2.exe	90
PID 4492 wrote to memory of 4872	4492	msedgewebview2.exe	91
PID 4492 wrote to memory of 4872	4492	msedgewebview2.exe	91
PID 4492 wrote to memory of 4872	4492	msedgewebview2.exe	91
PID 4492 wrote to memory of 4872	4492	msedgewebview2.exe	91
PID 4492 wrote to memory of 3304	4492	msedgewebview2.exe	92
PID 4492 wrote to memory of 4328	4492	msedgewebview2.exe	93
PID 4492 wrote to memory of 4328	4492	msedgewebview2.exe	93
PID 4492 wrote to memory of 4328	4492	msedgewebview2.exe	93
PID 4492 wrote to memory of 5776	4492	msedgewebview2.exe	94
PID 4492 wrote to memory of 5776	4492	msedgewebview2.exe	94
PID 4492 wrote to memory of 5776	4492	msedgewebview2.exe	94
PID 4492 wrote to memory of 5776	4492	msedgewebview2.exe	94
PID 4492 wrote to memory of 5776	4492	msedgewebview2.exe	94
PID 4492 wrote to memory of 5260	4492	msedgewebview2.exe	95
PID 4492 wrote to memory of 5260	4492	msedgewebview2.exe	95
PID 4492 wrote to memory of 5260	4492	msedgewebview2.exe	95
PID 4492 wrote to memory of 5260	4492	msedgewebview2.exe	95
PID 4492 wrote to memory of 5260	4492	msedgewebview2.exe	95
PID 4492 wrote to memory of 936	4492	msedgewebview2.exe	96
PID 4492 wrote to memory of 936	4492	msedgewebview2.exe	96
PID 4492 wrote to memory of 936	4492	msedgewebview2.exe	96
PID 4492 wrote to memory of 936	4492	msedgewebview2.exe	96
PID 4492 wrote to memory of 936	4492	msedgewebview2.exe	96
PID 4056 wrote to memory of 3768	4056	2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe	97
PID 4492 wrote to memory of 1476	4492	msedgewebview2.exe	102
PID 4492 wrote to memory of 1476	4492	msedgewebview2.exe	102
PID 4492 wrote to memory of 1476	4492	msedgewebview2.exe	102
PID 4492 wrote to memory of 3168	4492	msedgewebview2.exe	103
PID 4492 wrote to memory of 3168	4492	msedgewebview2.exe	103
PID 4492 wrote to memory of 3168	4492	msedgewebview2.exe	103
PID 4492 wrote to memory of 2644	4492	msedgewebview2.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4056
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4056.2584.14305666039622419468 /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView /prefetch:4 /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff8bafa5fd8,0x7ff8bafa5fe4,0x7ff8bafa5ff0
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1880 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1932 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac
    3⤵
    PID:3304
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3544 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac /prefetch:1
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4140 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=4284 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac /prefetch:1
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4668 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac
    3⤵
    PID:1476
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4684 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac
    3⤵
    PID:3168
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView" --webview-exe-name=2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4708 --field-trial-handle=1888,i,12931773911025016483,9200353321462538947,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:4a5f3103d77c1531bdf3a4b647b14df1fe8088ac
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2644
- C:\Users\Admin\AppData\Local\zstream\mpv\7zr.exe
  C:\Users\Admin\AppData\Local\zstream\mpv\7zr.exe x -y -oC:\Users\Admin\AppData\Local\zstream\mpv C:\Users\Admin\AppData\Local\zstream\mpv\mpv.7z mpv.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DABA17F5E36CBE65640DD2FE24F104E7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABA17F5E36CBE65640DD2FE24F104E7
Size 1KB
SHA256 28689b30e4c306aab53b027b29e36ad6dd1dcf4b953994482ca84bdc1ecac996
MD5 c6150925cfea5941ddc7ff2a0a506692
SHA1 9e99a48a9960b14926bb7f3b02e22da2b0ab7280
SHA512 b3bd41385d72148e03f453e76a45fcd2111a22eff3c7f1e78e41f6744735444e058144ed68af88654ee62b0f117949f35739daad6ad765b8cde1cff92ed2d00c
TLSH
T11621A7910F157601BE87AC8803D6C62B2F3071C0ECAE1408D9738562F5F03E47A9E20C
MD5 SHA1 SHA512 TLSH

Submit Download

DABA17F5E36CBE65640DD2FE24F104E7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABA17F5E36CBE65640DD2FE24F104E7
Size 276B
SHA256 8042c426adbfa9ae88817b628df6bf4c00d06711b9387d645cbf9c9c45069662
MD5 9edd63cb940ef7c2237a4dc924e21106
SHA1 2661ecbc70c081e5e8928ac766c6298beb60ff7e
SHA512 e49fa3707f542f1faebc7e569702d568d49a5fd43a68a91d513764d24b0a0872a58f198f4b110876692b131da97554212c0d2d3fc74fdde09eebcbe5e16e9ad1
TLSH
T1AFD0C9289AB90339F23BCBBC04A20B05DE626145A417C35807F7168DA969F847C25E2B
MD5 SHA1 SHA512 TLSH

Submit Download

7zr.exe

Path C:\Users\Admin\AppData\Local\zstream\mpv\7zr.exe
Size 588KB
SHA256 56b8cc9f4971cef253644fafe54063ed7fdca551d4dee0f8c6baa81b855acd72
MD5 45cd4a4950b0256680e6379ddf26ab07
SHA1 4cf35a364fd6599ba9e1ae3c321cd7bc17cc836b
SHA512 dfdcf16edb65baddd43181c9481a2c9453b0c678a6825108c2ab4cb30de34497c5fda5639721b3ced9cb4b98744fb6dab7314bd49685385c365425b721b19279
SSDEEP 12288:+ZklB0ws0Ljq0dfaq2mItbTYDMgWsg+Nz6MCKJVPDh7LGdB6MW:++n0APfB27NcQ56NuM9JVPDFSB6MW
TLSH
T1A9D48D173AF5C07ED25215318B1D6BF590FA83640F3248C763809E6D2B789E6D63B93A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mpv.7z

Path C:\Users\Admin\AppData\Local\zstream\mpv\mpv.7z
Size 31.1MB
SHA256 03ff9318f36654ff2f889d556cefc619f9da44f50ae16c362a7c4928b828f409
MD5 4f419b8294e1adbcf83e11e93233cdca
SHA1 1e766c3eb489203343d5a858242ff13f7c9745b1
SHA512 46960438cebedcdcd65b9ad11f994504e558c03648529f208bb63e987aead8c62c75e9c9bcdd2199a0926b0fb6af90a686520f0782a867f16a80e875cfa6166a
SSDEEP 786432:MrUngMeoaPLteEzvQXNQB4AQfnc6xqTyXF8n7Wk:MrirKLtvkQmncyqOI7X
TLSH
T18767330421B7C491FAA492E680A9D1EF14565E7324C5CFC7957F828A13BF0A8B54BEE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8902f728ae2ab537790342014f50dc1e62e320890818609d487b51176bd00e81
MD5 57565c75465036e57457522f4021da92
SHA1 e56ebcdd4c8c5b6b59160f0e13a5106cf60ccccb
SHA512 4d8cbdb2c73f87eaa5565b53ec788cdbb9e636f9fe4fe82a847b07150cf0643ce6c17fb79aaf0e37a29da2ef35c8568a8278317a4469a90c930892001c44ebf9
TLSH
T190D0123A32024235C41020370413A14C1450C50B400EC0006428961D1E144600D06C42
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 42d33c5502e76efa496bb6b34481115bd1fa56723fe38be0e6d6ebb6444d5665
MD5 bd1be3bc53b762bac707ad0f97e5f0ee
SHA1 706cf869cb2e02e5e5b3d5430313528fa9596617
SHA512 4b68755df517397034e41f84af5fa86a09c86aa710de37ebb661982af8f902d1df060ce58a949d36771560f8b3a9df91b64602ccaa11042332ce8ceadb39cd6c
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 66ddf8502ed759f5bef6c3a7efd650d30e18a0ca69591fbdea902cdabb2e93f3
MD5 d5e7f7cedc7ce6a68105c97a12dfa52b
SHA1 3f379b665ed48ae52c86211d672ac1aaaa259843
SHA512 5c867ea668c6039072b0539f88da43c7fd6ba211fee1afee4bcea4b1b3c8fa414ee4c95cff9ef037b2d0b003a5041813c7e62209ffc44a351fc4eb39598038c3
TLSH
T137C02B50660DD074CB010F73E0D551993030D854CB83CF03B0A70738C3D4780086B30E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59be84.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59be84.TMP
Size 48B
SHA256 00d81ac1c4088e7ae4af0768c5a2caacbcc795077655432d143a55eae74f89b7
MD5 d7088bf57123fb5aa0bc30133d15fee3
SHA1 2cb472f74ec647e1816e4fd7c6425d6583383e5e
SHA512 56d1b9d802c3d62bc3a9169a51fc438293c0a335b056a333b1cfeebab88927be536291910c724844b4b02dd01c87f6c0b79c934209ac8947f5f1c9edb0970ddf
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Network\Network Persistent State
Size 2KB
SHA256 dc3e26c4ea05447ee8ef39cc75c89ed1b362a68d4abf89a6d8bc8be55381ecf6
MD5 ad003617cf17fdf23024791c7a081354
SHA1 012b52f41336a35cb74c5d8a681d7d67b7d09682
SHA512 975a2fe50867d81d26414491d4139b1db95509ce1c73e24ce8f7e698e45e070d509216505bf379b5d15e818b1c0ecead7fb138976d1d29cb357f7224e44122d4
TLSH
T138415DB2C2F4C73E855163E46B247D27CD2E1519422839278DE7FBAA6FE10B1D710A0E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a8251.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Network\Network Persistent State~RFe5a8251.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 a5d9ce240db73c56d8d13e03d192d8c46d52fe1e7153b69dc67284c08617f8db
MD5 4ae99eb5fc6fd93822111b60c0f00a44
SHA1 498fe7b86b337382f5542d14d7d4e48fd407524c
SHA512 40f2b1a7fb18bee3fe7c73368a455c43373be8f0e92fd81269653ac0cf0eaef2851b01e51b9e18a15ee87cb7c5e662b0aae4dc4ba231cd70bcba4be7eaf4b331
SSDEEP 96:st9/dzJwThpGzb9mkwo5h16Z5Xs7/x+6MhmuecS4E1ejeJK+gLX228XM1C7K:stBpJkzoKXsV+F24EQjL9X2G6K
TLSH
T14CD194415E287C7B8CC6E159FA29BA03E3F6607264D51E58EBF8862C04DB6DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 2557b0d0224ec28f6632db4adbdc513cc855946569599fd78ae81fb3716710c2
MD5 d5d43eecdca457cb2482f4e2bada7a18
SHA1 396ed5dd55a5bcfcdc28e582a2a87d772423e960
SHA512 d28a036e46572fd2c04313206e1cce23219991dfb3f00d24e75ab3dd7436c9aa4255229a00804b1e8817ec6d539ad626b32c3056144f7b30c6ec55399c5f514c
SSDEEP 96:st9/dzJwThSzb9mkwo5h16Z5Xs7/x+6MhmuecS4E1ejeJK+gcP28XM1C7K:stBpJ6zoKXsV+F24EQjLyPG6K
TLSH
T1ABD196415E287D7B8CC6E149FA29BA03E3F6607264D51D58EBF8862C04DB6DD6307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59f795.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Preferences~RFe59f795.TMP
Size 5KB
SHA256 f8cda03bf7558c1664c255a85ede7e3bcea17e5b646b435a5e4b1b0b48fd329d
MD5 0416aeb07e647155eafe277281730a2c
SHA1 9f6502342c3f34f50baabdc310515bb8ffb3ac01
SHA512 282bc891e02fdf1cf469c1c56accd684c606afa6e09bcdc8adff483457e46cd131f17e48d8e1af6aa190435a391a9da3e9563fcd2033e99bd0fb3aec59d836b6
SSDEEP 96:r9/dzJwThSzb9mkKdo616Z5Xs7/x+6MhmuecS4E1ejeJK+gH28XM1C7K:rBpJ69o7XsV+F24EQjLBG6K
TLSH
T185C1A5415A287D7B8CC6F149FA29BA07D3F6507165D52D58EBF8862C04DB6CD630BC0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 0f726e652fb76f0bb7fc555a0453a1c0fbfcd00c75fa389f3a1f3debbf34140d
MD5 62d83935afc9c32683316ac90685105f
SHA1 f5558d2cce8c6827da1207a6b59c8868e7e914fe
SHA512 41f2ff7262a7b6e302c97ca7a1918bfa3c6d27f2a8e03d9c9fbc9a0ad99137bf54cb89abc72d4554f28c3fabf238bf83dd46182f57bf1e35750cc69541c26a04
TLSH
T15F716236A974AD2B9DF2D644B9863B07ABB55063E9D63F98DAEC0F0C01D73890346C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State
Size 2KB
SHA256 d41f773bac10a4623462b5640d48e44466857fca4419a5c63021faaa80b01f80
MD5 b4eb3ec532369f4e6aa543acb6ef8497
SHA1 5cab3d12ceb6a55e0aeb9278ae9f8ae4af3b1cd7
SHA512 db9ba101317e55a0f75b53d8eb78b68712793dbfaf68f80f895819a8cfb5aa06de506ef3b6c478048ec63ba680b3a0a51f5aacc8cac4a9836eb4d17b84601ebf
TLSH
T1FC519473A814AE37D9B25648BD463F13CF7650E2AE922F509AEC0B1C01D724D1346C77
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State
Size 3KB
SHA256 cb3960937ab045c0b1ed1d0d50dcf37d79aea34e06b5eff30dd3d10d6f93c879
MD5 4c07df331a108bed8de4018576b05c89
SHA1 d2a85b8da2b566cab584091fb260f3e3f565dd19
SHA512 d06487d441b6123577e4595046340fe3d742acb683b3e76d4411aa5b876b6f06f033adf37020371c7a30505e4f292ef9cb486d7d0badd57d56d1538a43ccc98b
TLSH
T1C0618377A874AD3B9DF29A44B9862B07EBA65063E9D23F94D6EC0F0C01D73881342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State
Size 15KB
SHA256 8d8d983164a95f10ea8eab3fae102b11d4705ec0b93ad54c7c5b768d0ed731e9
MD5 177fea8f42230563e5f5f4f8c3354f94
SHA1 17dcb3a8c5421ac36a3f855e60ef4c299eeb298d
SHA512 381924d58fcfc213d84c21164cb92afe0a7adb7f47727743290bf1e8bffba6c46bd5babee48be55e19191463fc2dc0413172d0e46717ab7ca5c6d353ac813e18
SSDEEP 384:d+aQikB+z/xvxjg/qhEwNBSAmC68+TAVdp7k9zQ:o/UxvxjgC+wYTUwFQ
TLSH
T1DA729F2794797E27E5F3FA04795D074BCBB584B254C16EA84EBD5F0D06C73980346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe595990.TMP

Path C:\Users\Admin\AppData\Roaming\2026-08-23_b358d9251d18df77d1270afb925cf38f_akira_amadey_coinminer_dosia_glassworm_poet-rat_quasar-rat_rusty-stealer_snatch.exe\EBWebView\Local State~RFe595990.TMP
Size 1KB
SHA256 c8546a2763773e12a648c6b3b1726661bdd5a39d40f34fe4ec84abfc0e5814fb
MD5 a0b05ecf7b976d2a5c0b22eb3aa54263
SHA1 8700068c8c5849402b74c5e7f1b2f274f0aa6861
SHA512 c1bab50747cceacb237ca007279b213f8a91d789896a8f38e75e8ab8b6f40c17e9b5d599ce7bbbe21aa50c2d1f0fd669febeb6148f3f731546b6bd5eef9f4a52
TLSH
T1572165B3D4245F77FC9162857242AA07CE7100A7C6524F4465DD4B1C02E728D862FC37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1476-310-0x00007FF8D9B00000-0x00007FF8D9B01000-memory.dmp

Download

memory/1476-311-0x00007FF8D9D00000-0x00007FF8D9D01000-memory.dmp

Download

memory/2644-359-0x000001CF6F650000-0x000001CF6F651000-memory.dmp

Download

memory/2644-339-0x000001CF6F650000-0x000001CF6F651000-memory.dmp

Download

memory/2644-356-0x000001CF6F650000-0x000001CF6F651000-memory.dmp

Download

memory/2644-358-0x000001CF6F650000-0x000001CF6F651000-memory.dmp

Download

memory/2644-357-0x000001CF6F650000-0x000001CF6F651000-memory.dmp

Download

memory/2644-355-0x000001CF6F650000-0x000001CF6F651000-memory.dmp

Download

memory/2644-354-0x000001CF6F650000-0x000001CF6F651000-memory.dmp

Download

memory/2644-341-0x000001CF6F650000-0x000001CF6F651000-memory.dmp

Download

memory/4872-26-0x00007FF8D9B00000-0x00007FF8D9B01000-memory.dmp

Download

memory/5776-102-0x00007FF8D9B00000-0x00007FF8D9B01000-memory.dmp

Download