Overview

overview

7

Static

static

3

2026-06-04..._p.exe

windows10-2004-x64

7

2026-06-04..._p.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    141s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    04/06/2026, 16:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
  • Size 34.6MB
  • Sample260604-txadcaay8y
  • SHA256 a727b07a550778d0d8897c152d522f4fb59e5267f38c0718f5e8585f47328f7f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryexecutionspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Start PowerShell.

    execution
  • Drops file in Windows directory 61 IoCs
  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies system certificate store 2 TTPs 1 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 51 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies trusted root certificate store through registry
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\system32\route.exe
      route print 0.0.0.0
      2⤵
        PID:3812
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -Command "Start-Process -NoNewWindow -FilePath 'C:\Users\Admin\AppData\Local\Temp\_haruhost-data\hh_watcher.exe' -ArgumentList 'C:\Users\Admin\AppData\Local\Temp\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe'"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1212
      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=2388.2724.264987426437692146
        2⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of WriteProcessMemory
        PID:2148
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x88,0x7ff9b9e0b078,0x7ff9b9e0b084,0x7ff9b9e0b090
          3⤵
            PID:1696
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1668,i,17528635783780753323,17177923799209871118,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
            3⤵
              PID:1280
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2024,i,17528635783780753323,17177923799209871118,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:11
              3⤵
                PID:4420
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2280,i,17528635783780753323,17177923799209871118,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1688 /prefetch:13
                3⤵
                  PID:3064
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3568,i,17528635783780753323,17177923799209871118,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                  3⤵
                    PID:1432
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2212,i,17528635783780753323,17177923799209871118,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:14
                    3⤵
                      PID:3836
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=764,i,17528635783780753323,17177923799209871118,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:14
                      3⤵
                        PID:3668
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=3796,i,17528635783780753323,17177923799209871118,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:10
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3468
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView" --webview-exe-name=2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe --webview-exe-version=0.0.167 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4056,i,17528635783780753323,17177923799209871118,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:14
                        3⤵
                          PID:3812
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -Command "Start-Process -NoNewWindow -FilePath 'C:\Users\Admin\AppData\Local\Temp\_haruhost-data\hh_watcher.exe' -ArgumentList 'C:\Users\Admin\AppData\Local\Temp\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe'"
                        2⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1968
                        • C:\Users\Admin\AppData\Local\Temp\_haruhost-data\hh_watcher.exe
                          "C:\Users\Admin\AppData\Local\Temp\_haruhost-data\hh_watcher.exe" C:\Users\Admin\AppData\Local\Temp\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe
                          3⤵
                          • Executes dropped EXE
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1276
                      • C:\Windows\system32\route.exe
                        route print 0.0.0.0
                        2⤵
                          PID:2448
                        • C:\Windows\system32\route.exe
                          route print 0.0.0.0
                          2⤵
                            PID:5088

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              powershell.exe.log
                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                              • Size 2KB
                              • SHA256 43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              StartupProfileData-NonInteractive
                              • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                              • Size 1KB
                              • SHA256 026d1569cc7d92522224cb7202b04adbf0978279191ab5814949d1ff9d618a6e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              __PSScriptPolicyTest_e5ivtn5a.icu.ps1
                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_e5ivtn5a.icu.ps1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              hh_watcher.exe
                              • Path C:\Users\Admin\AppData\Local\Temp\_haruhost-data\hh_watcher.exe
                              • Size 2.7MB
                              • SHA256 17ddc525db304346a27bd1fcb41ed80c78f919aa4e02db4e6fcc174ec821a825
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              1a7b6062-76e6-48ba-bfb0-802a4f789538.tmp
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\1a7b6062-76e6-48ba-bfb0-802a4f789538.tmp
                              • Size 1KB
                              • SHA256 ace1c73c6240c57bc5e116e577037995fc6de8c356ca908ea765904d4dc66bcf
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              crl-set
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
                              • Size 22KB
                              • SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 71835400d23e336abe5fcffcadb94058f5c706350e31cf15b1e38d251f013be7
                              • MD5 SHA1 SHA512
                              Submit Download

                              settings.dat
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Crashpad\settings.dat
                              • Size 280B
                              • SHA256 ee2e882b20628be6ba8bfa6b586bdc9445b79546e8879af4897da5653357ce11
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              throttle_store.dat
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Crashpad\throttle_store.dat
                              • Size 20B
                              • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                              • Size 48B
                              • SHA256 f025a51b929a062b11d79a6178d772ec1ef32e77dc5a4d24f63192c1822065e9
                              • MD5 SHA1 SHA512
                              Submit Download

                              the-real-index
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
                              • Size 96B
                              • SHA256 a298cd90d34edfaf1498b73a35f20033f08d033ff17d9b96a492cc788cf39aec
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              index
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\DawnGraphiteCache\index
                              • Size 256KB
                              • SHA256 44200a752913129dedd6065b6572776dba104bd124f34437705e35223c11646c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_0
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\DawnWebGPUCache\data_0
                              • Size 8KB
                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_1
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\DawnWebGPUCache\data_1
                              • Size 264KB
                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_2
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\DawnWebGPUCache\data_2
                              • Size 8KB
                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              data_3
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\DawnWebGPUCache\data_3
                              • Size 8KB
                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                              • MD5 SHA1 SHA512 SSDEEP
                              Submit Download

                              MANIFEST-000001
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
                              • Size 41B
                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                              • MD5 SHA1 SHA512
                              Submit Download

                              Network Persistent State
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Network\Network Persistent State
                              • Size 362B
                              • SHA256 22150999674ed3d620ec1c3f735b854d32df7e07990a19ad55940bcdfefa5d51
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Network Persistent State~RFe592b0e.TMP
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Network\Network Persistent State~RFe592b0e.TMP
                              • Size 59B
                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              SCT Auditing Pending Reports
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
                              • Size 2B
                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                              • MD5 SHA1 SHA512
                              Submit Download

                              Preferences
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Preferences
                              • Size 6KB
                              • SHA256 81fbb9d6878467583047ae54fa72eaa142427ee7e7c8f857a380f5a425861d04
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Preferences~RFe58b215.TMP
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Preferences~RFe58b215.TMP
                              • Size 6KB
                              • SHA256 19d6ea7ecc7e10b8d2326b647f7d89ec20421e3dd5420c9f41590c8c19a5480b
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              CURRENT
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
                              • Size 16B
                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                              • MD5 SHA1 SHA512
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Local State
                              • Size 3KB
                              • SHA256 ef9186dd2a8e416ae6ec03857e408f4d4583dad0898ffc3200e662bd31b5151f
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Local State
                              • Size 15KB
                              • SHA256 21b89ee897dd7dca645b69b1b51b20d8825d6943e5e385f0bb66b15b9ec616f4
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              Local State
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Local State
                              • Size 2KB
                              • SHA256 0cd501c43750d553fda1d528745c226acde70c0bbe77ab6303b7f606316ba17e
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              Local State~RFe5812b8.TMP
                              • Path C:\Users\Admin\AppData\Roaming\2026-06-04_dacfa5ad4610688bc3045e73820cd7b0_coinminer_dosia_frostygoop_glassworm_hive_luca-stealer_p.exe\EBWebView\Local State~RFe5812b8.TMP
                              • Size 1KB
                              • SHA256 1d42bc8945657713386aaa260c3081fb28b6deeaeed0d3fa95d7a7c2f1c78821
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              hyph-af.hyb
                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1805509211\hyph-af.hyb
                              • Size 70KB
                              • SHA256 5487ee44a4cd706d0086522e90c59c76cdf2ac68ce506fd3eae6054b9220c0cf
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              hyph-as.hyb
                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1805509211\hyph-as.hyb
                              • Size 703B
                              • SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              hyph-hi.hyb
                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1805509211\hyph-hi.hyb
                              • Size 687B
                              • SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              hyph-nb.hyb
                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1805509211\hyph-nb.hyb
                              • Size 141KB
                              • SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
                              • MD5 SHA1 SHA512 SSDEEP TLSH
                              Submit Download

                              manifest.json
                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1805509211\manifest.json
                              • Size 82B
                              • SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              manifest.json
                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_1936903424\manifest.json
                              • Size 43B
                              • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                              • MD5 SHA1 SHA512
                              Submit Download

                              manifest.json
                              • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2148_834293954\manifest.json
                              • Size 113B
                              • SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
                              • MD5 SHA1 SHA512 TLSH
                              Submit Download

                              memory/1212-10-0x000001A274EB0000-0x000001A274EC0000-memory.dmp
                              Download

                              memory/1212-3-0x000001A25B620000-0x000001A25B642000-memory.dmp
                              Download

                              memory/1212-2-0x000001A274EB0000-0x000001A274EC0000-memory.dmp
                              Download

                              memory/1212-1-0x000001A274EB0000-0x000001A274EC0000-memory.dmp
                              Download

                              memory/1280-39-0x00007FF9E2A10000-0x00007FF9E2A11000-memory.dmp
                              Download

                              memory/1432-157-0x00007FF9E2A10000-0x00007FF9E2A11000-memory.dmp
                              Download

                              memory/1968-220-0x000001B4943D0000-0x000001B494E92000-memory.dmp
                              Download

                              memory/3468-550-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-551-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-560-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-562-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-559-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-558-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-556-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-557-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-561-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download

                              memory/3468-552-0x00000270025C0000-0x00000270025C1000-memory.dmp
                              Download