6b2cc7312f65b465793585c0f73812b937649e22b552f5aa6ffca6960cc70ed9

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 14.4MB
Sample260629-d596yadv6p
SHA256 6b2cc7312f65b465793585c0f73812b937649e22b552f5aa6ffca6960cc70ed9
MD5 b6f823e9aae0ce31ee4b10e246a4e752
SHA1 9f8d75441a854023624506fffca2df377b0a90a3
SHA512 449f02d533a492795ac13524f219855df0bf8de60eba19858138a5522ae70ee56f738b4cb15e2e4e0ec9a495cefafb63dd558ca3a0bbe729def50770fe7a22ac
SSDEEP 98304:i6kIXhB9swPTszlKigW8+4CVfl5gNxJ+usLxdjCGNCQ46FypuarJ+usLxdjCNE7q:ie9skozlKp+4IflOpI2CpApI2e7q
TLSH
T185E69D17EC9554E5C4E9D234857A9223BB317C496B2427D32BA0F7283FB3BD06AB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery trojan

Malware Config

Signatures

Detects executables referencing virtualization MAC addresses 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c52b-351.dat	INDICATOR_SUSPICIOUS_VM_Evasion_MACAddrComb

Executes dropped EXE 1 IoCs

pid	Process
3252	NosVarya-Launcher-amd64-installer.exe

Loads dropped DLL 2 IoCs

pid	Process
3252	NosVarya-Launcher-amd64-installer.exe
3252	NosVarya-Launcher-amd64-installer.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\NosVarya Launcher\NosVarya-Launcher.exe	NosVarya-Launcher-amd64-installer.exe
File created	C:\Program Files\NosVarya Launcher\uninstall.exe	NosVarya-Launcher-amd64-installer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NosVarya-Launcher-amd64-installer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2904	wmic.exe
2904	wmic.exe
2904	wmic.exe
2904	wmic.exe
2356	wmic.exe
2356	wmic.exe
2356	wmic.exe
2356	wmic.exe
2296	wmic.exe
2296	wmic.exe
2296	wmic.exe
2296	wmic.exe
624	2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
624	2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3448	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2904	wmic.exe
Token: SeSecurityPrivilege	2904	wmic.exe
Token: SeTakeOwnershipPrivilege	2904	wmic.exe
Token: SeLoadDriverPrivilege	2904	wmic.exe
Token: SeSystemProfilePrivilege	2904	wmic.exe
Token: SeSystemtimePrivilege	2904	wmic.exe
Token: SeProfSingleProcessPrivilege	2904	wmic.exe
Token: SeIncBasePriorityPrivilege	2904	wmic.exe
Token: SeCreatePagefilePrivilege	2904	wmic.exe
Token: SeBackupPrivilege	2904	wmic.exe
Token: SeRestorePrivilege	2904	wmic.exe
Token: SeShutdownPrivilege	2904	wmic.exe
Token: SeDebugPrivilege	2904	wmic.exe
Token: SeSystemEnvironmentPrivilege	2904	wmic.exe
Token: SeRemoteShutdownPrivilege	2904	wmic.exe
Token: SeUndockPrivilege	2904	wmic.exe
Token: SeManageVolumePrivilege	2904	wmic.exe
Token: 33	2904	wmic.exe
Token: 34	2904	wmic.exe
Token: 35	2904	wmic.exe
Token: 36	2904	wmic.exe
Token: SeIncreaseQuotaPrivilege	2356	wmic.exe
Token: SeSecurityPrivilege	2356	wmic.exe
Token: SeTakeOwnershipPrivilege	2356	wmic.exe
Token: SeLoadDriverPrivilege	2356	wmic.exe
Token: SeSystemProfilePrivilege	2356	wmic.exe
Token: SeSystemtimePrivilege	2356	wmic.exe
Token: SeProfSingleProcessPrivilege	2356	wmic.exe
Token: SeIncBasePriorityPrivilege	2356	wmic.exe
Token: SeCreatePagefilePrivilege	2356	wmic.exe
Token: SeBackupPrivilege	2356	wmic.exe
Token: SeRestorePrivilege	2356	wmic.exe
Token: SeShutdownPrivilege	2356	wmic.exe
Token: SeDebugPrivilege	2356	wmic.exe
Token: SeSystemEnvironmentPrivilege	2356	wmic.exe
Token: SeRemoteShutdownPrivilege	2356	wmic.exe
Token: SeUndockPrivilege	2356	wmic.exe
Token: SeManageVolumePrivilege	2356	wmic.exe
Token: 33	2356	wmic.exe
Token: 34	2356	wmic.exe
Token: 35	2356	wmic.exe
Token: 36	2356	wmic.exe
Token: SeIncreaseQuotaPrivilege	2296	wmic.exe
Token: SeSecurityPrivilege	2296	wmic.exe
Token: SeTakeOwnershipPrivilege	2296	wmic.exe
Token: SeLoadDriverPrivilege	2296	wmic.exe
Token: SeSystemProfilePrivilege	2296	wmic.exe
Token: SeSystemtimePrivilege	2296	wmic.exe
Token: SeProfSingleProcessPrivilege	2296	wmic.exe
Token: SeIncBasePriorityPrivilege	2296	wmic.exe
Token: SeCreatePagefilePrivilege	2296	wmic.exe
Token: SeBackupPrivilege	2296	wmic.exe
Token: SeRestorePrivilege	2296	wmic.exe
Token: SeShutdownPrivilege	2296	wmic.exe
Token: SeDebugPrivilege	2296	wmic.exe
Token: SeSystemEnvironmentPrivilege	2296	wmic.exe
Token: SeRemoteShutdownPrivilege	2296	wmic.exe
Token: SeUndockPrivilege	2296	wmic.exe
Token: SeManageVolumePrivilege	2296	wmic.exe
Token: 33	2296	wmic.exe
Token: 34	2296	wmic.exe
Token: 35	2296	wmic.exe
Token: 36	2296	wmic.exe
Token: SeIncreaseQuotaPrivilege	2296	wmic.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 624 wrote to memory of 3448	624	2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 3448 wrote to memory of 1968	3448	msedgewebview2.exe	90
PID 3448 wrote to memory of 5856	3448	msedgewebview2.exe	91
PID 3448 wrote to memory of 5856	3448	msedgewebview2.exe	91
PID 3448 wrote to memory of 5856	3448	msedgewebview2.exe	91
PID 3448 wrote to memory of 5856	3448	msedgewebview2.exe	91
PID 3448 wrote to memory of 5520	3448	msedgewebview2.exe	92
PID 3448 wrote to memory of 1320	3448	msedgewebview2.exe	93
PID 3448 wrote to memory of 1320	3448	msedgewebview2.exe	93
PID 3448 wrote to memory of 1320	3448	msedgewebview2.exe	93
PID 3448 wrote to memory of 2844	3448	msedgewebview2.exe	94
PID 3448 wrote to memory of 2844	3448	msedgewebview2.exe	94
PID 3448 wrote to memory of 2844	3448	msedgewebview2.exe	94
PID 3448 wrote to memory of 2844	3448	msedgewebview2.exe	94
PID 3448 wrote to memory of 2844	3448	msedgewebview2.exe	94
PID 624 wrote to memory of 3252	624	2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	95
PID 624 wrote to memory of 2904	624	2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	96
PID 624 wrote to memory of 2356	624	2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 624 wrote to memory of 2296	624	2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:624
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=3.2.30 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=624.1056.14022331177731529039 /pfhostedapp:770d9d793ebf45d9fe6009ec6b251c944344a06b
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView /prefetch:4 /pfhostedapp:770d9d793ebf45d9fe6009ec6b251c944344a06b --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff898d65fd8,0x7ff898d65fe4,0x7ff898d65ff0
    3⤵
    PID:1968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=3.2.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1696 --field-trial-handle=1700,i,669953907783462228,5787411390293936006,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:770d9d793ebf45d9fe6009ec6b251c944344a06b
    3⤵
    PID:5856
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=3.2.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2068 --field-trial-handle=1700,i,669953907783462228,5787411390293936006,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:770d9d793ebf45d9fe6009ec6b251c944344a06b
    3⤵
    PID:5520
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=3.2.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2276 --field-trial-handle=1700,i,669953907783462228,5787411390293936006,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:770d9d793ebf45d9fe6009ec6b251c944344a06b
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=3.2.30 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=1700,i,669953907783462228,5787411390293936006,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:770d9d793ebf45d9fe6009ec6b251c944344a06b /prefetch:1
    3⤵
    PID:2844
- C:\Users\Admin\AppData\Local\Temp\NosVarya-Launcher-Update\NosVarya-Launcher-amd64-installer.exe
  C:\Users\Admin\AppData\Local\Temp\NosVarya-Launcher-Update\NosVarya-Launcher-amd64-installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:3252
- C:\Windows\System32\Wbem\wmic.exe
  wmic bios get SerialNumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2904
- C:\Windows\System32\Wbem\wmic.exe
  wmic cpu get ProcessorId
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2356
- C:\Windows\System32\Wbem\wmic.exe
  wmic baseboard get SerialNumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NosVarya-Launcher.exe

Path C:\Program Files\NosVarya Launcher\NosVarya-Launcher.exe
Size 14.4MB
SHA256 b324b74913f4e469691030181cc2afb98e220c69a0e4811ee2cf6582c1bdf8d9
MD5 f65c76878890c23d7b527058907f2021
SHA1 5fa5e66ef1155b552b5c7ed9da62956d1c564850
SHA512 69efe02f83a7ce777c61083a9cd90f027f6e2a8e5adcb28756b18647c772a2a30acbe8e39d30127eaff33153b5930c30d806d9c6873b24dfde1330b888c93d02
SSDEEP 98304:N8Kwgx/WdxchRVcmYC+bGs/5R4CVfl5gNxJ+usLxdjCDEnR40Po/KKbL2rJ+usLz:NlWdShRVcK5s/5R4IflOpI2xjkpI2eX
TLSH
T196E69D47E89555E5C4EDD234867A9223BB307C496B2427D32B60F7283FB7BD06AB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.exe

Path C:\Program Files\NosVarya Launcher\uninstall.exe
Size 88KB
SHA256 f9b6c04f98676fbf2b902eca6b1b749df8d8c90a5d79e0bf153add222ae2afbb
MD5 9d1f6c2c0b1e84c0995381677d18f3fc
SHA1 e4ef936ad5fe8e318b05b554e1528341c9d0d664
SHA512 f572e4ec97362921f8c073bf08427ecb05ce51be54313ac2ac9c85bcb682ea6568b1231d9b6e573cc046a1641aa39be818d359d594fa85a55bdc4ceabde34375
SSDEEP 1536:HfHLrLkSRoybCQUZsrs0DC1cukEX0q2HchWiFgmo8mdPRAK+DMGOfNqDorooZ:Hfr3k+o5buDC1cujX0q4iWZZ/SMtOoTZ
TLSH
T14E93D121E7A0C877F8F3467209773BA78FEB992152E45B4B43542E1E3C62182DA1F752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NosVarya-Launcher-amd64-installer.exe

Path C:\Users\Admin\AppData\Local\Temp\NosVarya-Launcher-Update\NosVarya-Launcher-amd64-installer.exe
Size 10.6MB
SHA256 c52f6f784346907ed976cf74db63dd3465ee0d95794252ab3799a3e0d4d73913
MD5 7caca17cf1d4bc1964a5957d9851aec8
SHA1 09232ec6e571d74ff0319e5e87d8c8fd5bc612c2
SHA512 9784706e7cfdd90eb7e28f929758bf6bb9184ed65e3444a840ca3c4a12695e161e5c21f62cc5406bae698c2a6325938be4cc0e4b25521a7c9d8ae11d67aa414b
SSDEEP 196608:/3070yAyMGtYOvAndRE9wc8NS9NvC4EdRpgq5uotRa5cE5Vz:/3DOtYOvCRineAt1UpxuotM5nz
TLSH
T1FEB6334745B50E0CC64EBB3029F3276C48F0E05F95E1A442AB3B295877AD4AD3EA7B5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy1871.tmp\System.dll
Size 12KB
SHA256 23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6
MD5 192639861e3dc2dc5c08bb8f8c7260d5
SHA1 58d30e460609e22fa0098bc27d928b689ef9af78
SHA512 6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc
SSDEEP 192:ljHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZqE0QPi:R/Qlt7wiij/lMRv/9V4bfr
TLSH
T1B1427C1297B089F2F551493419667F2A6FBEAC5C13F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsy1871.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy1871.tmp\nsDialogs.dll
Size 9KB
SHA256 89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912
MD5 b7d61f3f56abf7b7ff0d4e7da3ad783d
SHA1 15ab5219c0e77fd9652bc62ff390b8e6846c8e3e
SHA512 6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8
SSDEEP 96:ooEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YMNqkzfFc:ooEvCu5e81785qHFcU0PuAw0uyyIFc
TLSH
T16A12F992E2A454B3C5D6523B35AA2F2DCBBD5329B0927C01C7738E4D393957A6E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 4309220745cde8ff72172de9c22d01b0a30701ff22c4d8b0084e2fcc1965344a
MD5 900d17faa23728b60685251a998dd5cd
SHA1 5e0daacd7cdac40dca153c019e4008de0ec27e3e
SHA512 fe5f805e431eeb3e6030f13ffbd161e67b88023f58603cc251f0b6c3690a2f76af2e95529b45180124c346e05e69868970f3004bb29c35ad1884c011986d667a
TLSH
T1ADD0129273010534C02035330102A14D1440C50B814B818454288A6EBB040700B07481
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8f92b83f5e0913e4355c5ce3a3642deb7d1f3e417bb835f22920fd57bdffeba7
MD5 70a63801627a27e354e4acb8c012bebc
SHA1 e68ac779e9a07fca8e0bb66814ee1b397d1585a9
SHA512 286f7c042303f1f7744e7d18ab4661a79c10b6dc527bc36af9dbf582c7979ab97c3e9eacdb38cc3920ac4ffd8a9eb0d8af3345750f681b2a97a0eb12321ac321
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 07b8a257be5474ceec452244d5307e2ff4e29634c86e9af56bcbda7dfe2a51aa
MD5 71b0a0fc9e4025872ecf4d008c62fd43
SHA1 7b549739dc0ab121702d058cb07029e95bec14d8
SHA512 8c53a3aff190e9b830d1d4e962f5e2c96649d4583ceef23078f0e321c232efd0b8948d341252c641004de6595f581f41da433392e6aeccf378ced6e18bfc5506
TLSH
T177C04C7414570181EB1FCA7451917A533F2248189D966F5B559CDD6CCD123C68616810
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591d90.TMP

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe591d90.TMP
Size 48B
SHA256 dd9c63ebe11bfe5170f2c4d752673e1b5b61a2f5ec67237ec0accc4fa1ec79c2
MD5 111bcd141d55912bcf1d63134b4a2aa8
SHA1 8dacf2b217b4f94a328560dead56035e7c03940c
SHA512 449c29c5dc8f10c2ad4d32e83c69b2025a513335165c2dd923e3e0288f33a6ea2180b3d6371dc25d8fd99952fd1e7a9c4056f0ce952af709dc140f0883a099c6
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b61d3f07-b78d-456b-8e17-ac1f0775a606.tmp

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\b61d3f07-b78d-456b-8e17-ac1f0775a606.tmp
Size 6KB
SHA256 ff26f2c22c1c943cf4687b3f3c9e9fb8b85edf165e2cf8a7c2acbfab3b312a5c
MD5 6ef58d8a326941dabba30b78b679834b
SHA1 b1aff9aa6805d311b38039610d3ffb75d02eff51
SHA512 0fc618af67de95bb65d4efe66cbb28a6d88207e27bc44745e144e78fa6eec0267072dbe6c9c981d2f022ba03460eb6a3c8bf0cc5847716edb46261dd5ca5d8bd
SSDEEP 96:stm/d1e+UZb90kpo5h16Z5ags7/x+6MhmuecSaGKS1ejeiK+gqXwI8XM1C7K:steXTWoKagsV+F2aGtQj24Ag6K
TLSH
T101D1A6066E24697B8CC7E219FA36BB53E2F9A07271D51E48EBF8461C05D76CC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\shared_proto_db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 3KB
SHA256 70a6c5b184e175eca208d6aa6fd57c514bba4114e330ebdc8fb3f6f3bdd9f0c3
MD5 a88981e5e23a8436e8d7b7b167db4757
SHA1 439d4e0df023a078b4d580aeae20d9e17becaf6f
SHA512 9938721af884ab4ebe5397e820b87600ebc69b5771e527beba457bbb4ff56f88ed04a06cccdd8c9387da9fe715d2284ec5c9b500279bce76467d983f4cf35df0
TLSH
T1E1819536A964AA778EF3D609BC462F06EBA49067D5943F95D5EC0F0C02C72882383C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 2KB
SHA256 bf0c47330cef6df547eef18bd8b43fb63d6187bbcbe99d318103b50f0a3be95f
MD5 2e09b0797035e22d0c9bef6326d7b111
SHA1 0165111f496cd6ed580f5fcf9f01c4932582c69b
SHA512 91efefba59cda19c8008a3dad05f345732285603ce831cf22c5c0b0db5f2aaee01eba6e9e97dd33057440915b9272a8cd4787b244d592d5383acdd6682dea597
TLSH
T1095153337950A7B68AB397097D4B2F56CF7891A5A6A12F54E6DC0B0C02C791C2347C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 3KB
SHA256 585de2b82041054b70760a6d4a23652327d6aaa7aa63e43638990edf1a350590
MD5 4f126e6637ff0c673789ae689da2d69f
SHA1 6620a6484b040658843d045875d2f995d293626e
SHA512 6c0995d44c91ba3b8f4ca6055556cd47d6b637d13211a967e14d6aa61f250d14be44548c3854c0ffd668141801d8b330fc5690986f667eee0cff1229deb232e6
TLSH
T166718477A960AA778EB39B09BC862B16EBA49127E5D53F58D5EC0F0C02C76482347C12
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 4KB
SHA256 3e62235263c6d9fe2f03c59597d95cfac301330edd5592cfaf294fbabaf5ea82
MD5 42e1302e914b97b194f09fed56557a47
SHA1 9163ac93abd76144736d6fb04dc5c49a465fde39
SHA512 46445e7846fe081d6e01d084491dc43b1e9c112e018939051c6a3f686cdfcb732e472cf7bdcf9cd031fc2f670eefd5c2a4522ecc0d3cda6f04bcf0a36007a9d9
SSDEEP 96:F3B3NkGSVfP0QbGXF8kh/cI9URoDotoN5GnuB5ySp6HH6ZeZcTE+wa:Fx3NBSt0Qb0HeoDUaGO5ySGVk/
TLSH
T19A91852668A4B9778DB3D609BD862F07EBA49167D6947F54D6FC0F0C02C72882387826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58f5c5.TMP

Path C:\Users\Admin\AppData\Roaming\2026-06-27_b6f823e9aae0ce31ee4b10e246a4e752_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State~RFe58f5c5.TMP
Size 1KB
SHA256 d65e04ca3495f811475adebda17af9c584cb541eea26d6d2deda988f2deccc9b
MD5 afe57780ce66a6db6699bfb7d2f6167f
SHA1 5adc1ec81b1231a457ce29d697d5f605e16e7e8e
SHA512 f26d50420e1a30c263a7efbb3b8490c49fe65f58f3e8f911808af46849c1dce5903ba7150fa650b9f333849e54b4a39ad861e44c9bc49961284a97eb06cad53f
TLSH
T100317272E9A06BB29DA3A34A35477FD79F2080AA92A06F04E4DC470D03D784C766FC31
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2844-109-0x00007FF8BA450000-0x00007FF8BA451000-memory.dmp

Download

memory/5856-29-0x00007FF8BA450000-0x00007FF8BA451000-memory.dmp

Download