7dd6610e7e30a9c5f7741ba1a1bba7605eed9b43d84c1839974ac4c9841aa536

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/07/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 10.6MB
Sample260705-ecwcracy8j
SHA256 7dd6610e7e30a9c5f7741ba1a1bba7605eed9b43d84c1839974ac4c9841aa536
MD5 56d92c7d0df93f01f5b3ea745e7e06c9
SHA1 04eda7921f661dd5b51416ee199989e121c00bdf
SHA512 233a333bb137bf15a31f9afac2a79c843a75a3f07864c810be02c98dc965a902e65cc22fae658d32714fec92aa988c5afe4fd5285e1c51b36c37f35f074d41c6
SSDEEP 98304:9lR5ttMy4VlOjf2eeh6sl5LK++fEFAQ+Ebr00JEv06:9KjVlOL2ees++8CtNt
TLSH
T152B65C07EC6554E9C4AED1348A6291237F717C895B2227D32B90F7742FB6BE06EB8710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
880	msedgewebview2.exe
880	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4864	msedgewebview2.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4864	4216	2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	88
PID 4864 wrote to memory of 5832	4864	msedgewebview2.exe	89
PID 4864 wrote to memory of 3740	4864	msedgewebview2.exe	90
PID 4864 wrote to memory of 3740	4864	msedgewebview2.exe	90
PID 4864 wrote to memory of 3740	4864	msedgewebview2.exe	90
PID 4864 wrote to memory of 3740	4864	msedgewebview2.exe	90
PID 4864 wrote to memory of 1920	4864	msedgewebview2.exe	91
PID 4864 wrote to memory of 2968	4864	msedgewebview2.exe	92
PID 4864 wrote to memory of 2968	4864	msedgewebview2.exe	92
PID 4864 wrote to memory of 2968	4864	msedgewebview2.exe	92
PID 4864 wrote to memory of 1092	4864	msedgewebview2.exe	93
PID 4864 wrote to memory of 1092	4864	msedgewebview2.exe	93
PID 4864 wrote to memory of 1092	4864	msedgewebview2.exe	93
PID 4864 wrote to memory of 1092	4864	msedgewebview2.exe	93
PID 4864 wrote to memory of 1092	4864	msedgewebview2.exe	93
PID 4864 wrote to memory of 880	4864	msedgewebview2.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4216.2680.2609518966377043194 /pfhostedapp:572c985ddd81c18c643db09af34abf3c1e4419ba
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView /prefetch:4 /pfhostedapp:572c985ddd81c18c643db09af34abf3c1e4419ba --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0xa0,0x194,0x7ffa01765fd8,0x7ffa01765fe4,0x7ffa01765ff0
    3⤵
    PID:5832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1620 --field-trial-handle=1780,i,16984518896660995453,3849261115970517162,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:572c985ddd81c18c643db09af34abf3c1e4419ba
    3⤵
    PID:3740
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2080 --field-trial-handle=1780,i,16984518896660995453,3849261115970517162,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:572c985ddd81c18c643db09af34abf3c1e4419ba
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2228 --field-trial-handle=1780,i,16984518896660995453,3849261115970517162,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:572c985ddd81c18c643db09af34abf3c1e4419ba
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3404 --field-trial-handle=1780,i,16984518896660995453,3849261115970517162,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:572c985ddd81c18c643db09af34abf3c1e4419ba /prefetch:1
    3⤵
    PID:1092
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4444 --field-trial-handle=1780,i,16984518896660995453,3849261115970517162,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:572c985ddd81c18c643db09af34abf3c1e4419ba
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e293385cb67235307d288f57e101e0bb1b3ba3d084756b05419db176afa860bd
MD5 4b9503ec9b0abca1aa184b17b5f21fba
SHA1 02a449c4724cb7d9ff21a931e9e83fc483ded3da
SHA512 840639c5ef00f9ef12445b7b03dd8f248ab538ea888566d3b11f68fb5ac35d1537c14bca84413ae0f1763c7ca81b4bacc22984db1da5f8c810063fa1e76d465f
TLSH
T1B2D0121233110534C47034331453620C0900D10F81494108642A9A1D1B048D41D16441
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 bee5d06f878d66379002c92ab64db24cf97fa01636a9a1cbdcfb8d1e7aeaee13
MD5 19b63c1febb043ac30318f9b5567e28c
SHA1 f90c0e26e0693ba5def975155839ec216a0df328
SHA512 276a0c835da4fccdf90af739622cd986f893ff0954b4bc2258d401030a644423a0cdff0cf44efba4d738ac53774bea26c670f8be3fdaf2b378a778a67d12d73e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 cfbe152a3e0f9105bbc65db9c7d3e35fc16484220f1c2490b5a3dde03749a93a
MD5 0222c1c213155e7ecc7d3fd0b530df55
SHA1 cf47d683d3c6625b374464843f20a46d795f39c6
SHA512 a574185708157d66b9e29e1182e463d0e26dd8196ab3c7da3007682a102a9e067d5321feb337b3a068b8b5bce5fe05b6944410b249989e39ffa69d29b3a006cc
TLSH
T1DBB012B206040483C32C133058C5410031311F424127C50A4E8C00694C183940F05100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592929.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe592929.TMP
Size 48B
SHA256 fa2bc0a3cdfa5025242347a7b2a1fbaf4c218231d8413141ad889d0ae760c714
MD5 026d78285ccd3e6a0aa604f6a8ebe464
SHA1 bff9b80f7f5862b086af2d337f6987860ac99841
SHA512 4256c1ad78554c1023316ec8163ddc75cc964b0d03059e6709982dd9f69715719bcc4858fdcfae92b5b06cce7981e0f8e8afc27f6a19369d45ad7723245a2e44
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59fdaf.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\Network Persistent State~RFe59fdaf.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 e967a6755a0b39b33c49d6a52b7fc5f4523bc1ed560da458e3fd10c2831464e6
MD5 922ffdb1abb8d2dd2058421e88a57f6f
SHA1 325e4104ed840007baeaf9e813f77f71d257304e
SHA512 612089be14e1cca3f0f0f34dfccc978242d82a6a223a383185af2668f67dbf3f259fa76b9b48ff5411d09b7a4eac584fad83ede3c61934bcc6242d49025bab8a
SSDEEP 96:stt/dTakoDKGPeWb9HkWHo5h16Z5rs7/x+6MhmuecSXl1ejeBAK+gAn28XM1C7K:stxAkWR71HoKrsV+F2XlQj62G6K
TLSH
T1A9D1A5025E24A9BB4CC6E519BB39BB13E2F9603271D11E58E7F84A1C05DB6DD730780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6d1c275-4f14-4070-984c-ebe5eb3519e1.tmp

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\c6d1c275-4f14-4070-984c-ebe5eb3519e1.tmp
Size 6KB
SHA256 30a25ea868470da96d6bf99c8f3b35bc073e9a5b99b949abb77813d5f2f38186
MD5 cf21aeff4c18dc29e8935fce03722dd0
SHA1 b58758eb89510ab40e7fd2317e9ef64dec8a1e18
SHA512 ce307b782877bc60e6d172f6698ef4dd2f1666ee8cf22265442b7f103e7473b9297c0acdc01d376e90e1820b8d20cf0cf8d53fd52a564acb55138f2d62533889
SSDEEP 96:stt/dTakoDbPeWb9HkWHo5h16Z5rs7/x+6MhmuecSXl1ejeBAK+gAN28XM1C7K:stxAkWT71HoKrsV+F2XlQj6sG6K
TLSH
T138D1A6025E24A9BB4CC6E509BB39BA13E2F9603271D11E58E7F84A1C15DB6DD7307C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 15KB
SHA256 dc42ce9b2734c264e3f56cfd8124efddc095fa60ad8d6d3e1a304bc2cfee236f
MD5 e35e00f0de08c3010c23e6c0d90e6766
SHA1 a99f19c77c83575f92a20b76ff2195b64e676061
SHA512 13d8285cd9eec4365f4dbc47ab76f4569e72a296720f1666e85a44e2add85f3879510373284920e4389f1ac926c3e3c84e9d6be6a584213ec05bc8ff6fd11028
SSDEEP 384:Isrv+89zHqlDNP9oid6NBS4uNrfiT3XINY:zrv+4UNbdF1qT3XINY
TLSH
T1C372AE33D17C9B379DB38909B48A6A077B7850A761C21BA4D9D95F8D42CB4C92307D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 2KB
SHA256 744d252b1429d01c4a66e1866e296cc71981b9e020f94d02cdfe8a36380e8b80
MD5 5b4376d32459aa636b20bf8bea546d4b
SHA1 4be839e00092574c67b607e50fa1ceebd37b2d2d
SHA512 da991ddf79d3e88e6227b84f15d7966f651e10abad4d0d50439ea30682f277752445e65f6762fb70e29bc97a71b6bc648a11808cd8af8592797401e919b6daf4
TLSH
T1EF51A6339854EB7789E29A44794ABF23DE7541A67A622F54A9DC0F0C02C760C1747C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 3KB
SHA256 7eb2203128e09e6cd0b73feda50a5cbd8193a0ed903295d7c34f338a52f20190
MD5 5a4a4b4890d9b3bd373ed2fbdf44efe5
SHA1 0304ab49d265424c5fac9cedc2c80169b90a2ce2
SHA512 e0d6d21a51e2c86128896a91f76a3c963a5c7fcb4b7cdd0df10a407afbbbae5884ab2c69080b5362ab9066d90f82318c3367e26a19d7c7672ca1976680ac30f9
TLSH
T10E71953B98A4EA7B8DE2D904B9856F17A7A54137A5917F98E9EC0F0C02C738C1353C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58d685.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-05_56d92c7d0df93f01f5b3ea745e7e06c9_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State~RFe58d685.TMP
Size 1KB
SHA256 2098ecf8870f3b301412ad591d3ffca265432aea0b5ee5e00be8b6781c6ea5f0
MD5 3c5e600b4146a9d31da13facde17ce9c
SHA1 f9a9288739817c165689b4ec9ef63099f884777b
SHA512 e0535c92a8ee61aacb15c431014a1824eb39987a79ac33b351f4b59184b0cce7feab9f133248196abb0e43f567ca8acbaf186e860d2fda10898130cd51fbc21f
TLSH
T164316277C0D4AB73AD8265463101FF9B9E6101BB62218F04B4CC0A0C13D704C993FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/880-273-0x0000017C84600000-0x0000017C84601000-memory.dmp

Download

memory/880-275-0x0000017C84600000-0x0000017C84601000-memory.dmp

Download

memory/880-283-0x0000017C84600000-0x0000017C84601000-memory.dmp

Download

memory/880-284-0x0000017C84600000-0x0000017C84601000-memory.dmp

Download

memory/880-282-0x0000017C84600000-0x0000017C84601000-memory.dmp

Download

memory/880-281-0x0000017C84600000-0x0000017C84601000-memory.dmp

Download

memory/880-279-0x0000017C84600000-0x0000017C84601000-memory.dmp

Download

memory/880-280-0x0000017C84600000-0x0000017C84601000-memory.dmp

Download

memory/1092-79-0x00007FFA23980000-0x00007FFA23981000-memory.dmp

Download

memory/1092-201-0x0000018D2F860000-0x0000018D2F907000-memory.dmp

Download

memory/3740-200-0x000002B9AB560000-0x000002B9AB607000-memory.dmp

Download

memory/3740-26-0x00007FFA23980000-0x00007FFA23981000-memory.dmp

Download