91e2721bed1bbe9cc02bdcc956345e14fcb58f57d93ba40956416f1304ba2d06

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
Size 3.5MB
Sample260711-e7mdbsbx3q
SHA256 91e2721bed1bbe9cc02bdcc956345e14fcb58f57d93ba40956416f1304ba2d06
MD5 5a0cc0bcf7275ba808f608cf2aefb148
SHA1 819aec3c4eed0300b60001767bf292160db296a0
SHA512 615baac7fbf4c1e765ddde3883ccc6bf912b7ace2668152784ff91e35bcda027c7567f63f6a098b5d815e26fb78eaf2300314364e8d9db20b0d3374e47ad4752
SSDEEP 49152:L5wqglujg4i2mv1PdGqL+vyUOJlN9FySvZ3NvkW8EX/tMfA5gMmpsaHWC49LvVkW:twVQkXKvyjdtR3FzZCfA1mRoVvStt
TLSH
T18506332CB40EF876D294107D0EF5589CDF5DB22EDCA247CB53AEE03E857194D24A8272
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery spyware trojan upx

Malware Config

Signatures

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral2/memory/4852-0-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	UPX
behavioral2/memory/4852-168-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	UPX
behavioral2/memory/4852-196-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	UPX
behavioral2/memory/4852-197-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	UPX
behavioral2/memory/4852-257-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	UPX
behavioral2/memory/4852-280-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	UPX

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4852-0-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	upx
behavioral2/memory/4852-168-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	upx
behavioral2/memory/4852-196-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	upx
behavioral2/memory/4852-197-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	upx
behavioral2/memory/4852-257-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	upx
behavioral2/memory/4852-280-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp	upx

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_2104068410\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_2104068410\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_2104068410\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4332_626706539\test.txt	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5756	msedgewebview2.exe
5756	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4332	msedgewebview2.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4332	4852	2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe	87
PID 4332 wrote to memory of 936	4332	msedgewebview2.exe	88
PID 4332 wrote to memory of 600	4332	msedgewebview2.exe	89
PID 4332 wrote to memory of 600	4332	msedgewebview2.exe	89
PID 4332 wrote to memory of 600	4332	msedgewebview2.exe	89
PID 4332 wrote to memory of 600	4332	msedgewebview2.exe	89
PID 4332 wrote to memory of 4504	4332	msedgewebview2.exe	90
PID 4332 wrote to memory of 5212	4332	msedgewebview2.exe	91
PID 4332 wrote to memory of 5212	4332	msedgewebview2.exe	91
PID 4332 wrote to memory of 5212	4332	msedgewebview2.exe	91
PID 4332 wrote to memory of 6076	4332	msedgewebview2.exe	92
PID 4332 wrote to memory of 6076	4332	msedgewebview2.exe	92
PID 4332 wrote to memory of 6076	4332	msedgewebview2.exe	92
PID 4332 wrote to memory of 6076	4332	msedgewebview2.exe	92
PID 4332 wrote to memory of 6076	4332	msedgewebview2.exe	92
PID 4332 wrote to memory of 1136	4332	msedgewebview2.exe	96
PID 4332 wrote to memory of 1136	4332	msedgewebview2.exe	96
PID 4332 wrote to memory of 1136	4332	msedgewebview2.exe	96
PID 4332 wrote to memory of 5756	4332	msedgewebview2.exe	97
PID 4332 wrote to memory of 2376	4332	msedgewebview2.exe	98
PID 4332 wrote to memory of 2376	4332	msedgewebview2.exe	98
PID 4332 wrote to memory of 2376	4332	msedgewebview2.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4852.5264.15063786043889675842 /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AstralRPG\.webview2\EBWebView /prefetch:4 /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x164,0x198,0x7ffc6d9e5fd8,0x7ffc6d9e5fe4,0x7ffc6d9e5ff0
    3⤵
    PID:936
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1764 --field-trial-handle=1768,i,17184727266143763078,7933982483469525818,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978
    3⤵
    PID:600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2180 --field-trial-handle=1768,i,17184727266143763078,7933982483469525818,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978
    3⤵
    PID:4504
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2440 --field-trial-handle=1768,i,17184727266143763078,7933982483469525818,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978
    3⤵
    PID:5212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3604 --field-trial-handle=1768,i,17184727266143763078,7933982483469525818,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978 /prefetch:1
    3⤵
    PID:6076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1768,i,17184727266143763078,7933982483469525818,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978
    3⤵
    PID:1136
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4512 --field-trial-handle=1768,i,17184727266143763078,7933982483469525818,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AstralRPG\.webview2\EBWebView" --webview-exe-name=2026-07-11_5a0cc0bcf7275ba808f608cf2aefb148_hive.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=1768,i,17184727266143763078,7933982483469525818,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:62fb7a2e257de15309cead3b7463b61c4fa08978
    3⤵
    PID:2376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 afa5136e11d828069fd6d3a26299fe44526cc091476ff87161ed8c5dad42e913
MD5 88a5cc1b976896c0c9fd58a4d1ed16e2
SHA1 5f2675534dfedf8eacf6a40d41c2d771fdbdbaee
SHA512 8fcfb7e2a6b37062e1594c23213d0f43c1fabf70b568e1b851938839830328551c556df1726add75a4c606f34a0e81caa6381587648cee12b1e1c810d5dce637
TLSH
T1B9D0122232014134C01231731143710C1C40C30F80094114A429855D5E4907C0D02842
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 64d99c5f7853236781a7e5489dd21808019fc600a76375973817ebaf884019ee
MD5 628bbdf34a58b33a1a870cde131a9e45
SHA1 26d4fc6180b47d6d43b0d263201372c633701e71
SHA512 c467216de6a052f00ca0ae43ec4e5cafbc1e21572ee275c3c690fe485ea524e1023c4cc72f80c178db8ad4208ef129384850f337c56895120856c0e7ef4bde1e
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 e9d7bf098741e7b37aaf77473f513b13465ce6f247d402b77188ad39a46e13d2
MD5 260cef8fd97fd971c75d7c66e31b7eef
SHA1 20cfabc026ad4369517f834bafe19e0d38200051
SHA512 39b18d1780e09cc03f1ccce0bed171e438e4ad3003292a57ea4f1790709ba963e551a36f058cb108617e085385ca20f3deacbbd15ecbac0d477373bcef1d0649
TLSH
T118A00255138301E3C35517B420C1424373729C1947530791509981698D653C15711516
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bb47.TMP

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59bb47.TMP
Size 48B
SHA256 c924e774346f3742ca7cdfd122e09d485e6512044196310db026648ee8ce989f
MD5 82f49b4b647f1eb1a742b608ecc47756
SHA1 69995d5beaa22941264fed925df5b3eb8bf75940
SHA512 e503f3a0224b416c0351d9a3e517246aab6becd0413b049f424df18e71e0158c0406c824863f5942a6cd369585d7d35a7abb3b9dff978b9e572c4b28d9a4833d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\Network Persistent State
Size 821B
SHA256 170fce7668755cc49237ab445d1c799e247bcd8daa90ce7daefb0cc213584a78
MD5 5011fa8ab49c1bf450244325aaf30034
SHA1 c4948ae6c0df0efa1dd69db182920c671ddb4da4
SHA512 9dda4edfbd2ae1ccedb2363c5a5fbee8ccdd66f5abc03116a0d93949b98d0316da45dcdcd7d2f46c52219113ec2f91c0bed012ade01c29712522b3d2b0e7eae8
TLSH
T116016BB2C3D4C67D884512E42A247827CD3F151A12282D27DDEAFBEA5BE1475DA1094F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a7f14.TMP

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\Network Persistent State~RFe5a7f14.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Preferences
Size 6KB
SHA256 d20882bdd51b836d57ec9358d37d0ed1f6d068bf78264cc2a83d96aa2354e8c4
MD5 dacf2e627475830fbf952176b2dda825
SHA1 577675ee8c5f8a9ac3f70130e7404e1352cf281f
SHA512 a8660b6823a453b6e2ddfc36ab7aa5a95d1810a9aab3c1e2cb4154fec1af0541d7e3da610e728934e792ebe2f761d3b7c40ae3c827bdebf6c74f7ae278648250
SSDEEP 192:stnSnw73LvOUoKnksV+F2nvrwQjbAjLqo+G6K:stSnYv0sGJQioK
TLSH
T1FCD1B7025E28687B4CC6E159FE69BA57E2F9607161D11E58EBFC472C08DA6DC231390B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cefa309d-41dc-40f4-8ed5-babe6dff0fdc.tmp

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Default\cefa309d-41dc-40f4-8ed5-babe6dff0fdc.tmp
Size 6KB
SHA256 bf0575710a2d7804b9b763c43e02c78a64f41d8f381e84ae8e55447be494b9af
MD5 0d11a219adb93cdbc93da0ef2cc27f6e
SHA1 e5c88be3c89136a3c96deb4c60706cfcf60c2756
SHA512 6d4a8153a10536eeff105bf6a70fcd035920e6f42a9c10311b6fb0c6cdf24508cea094dc88b6dce93c766655c14d287e31fde8a1b0c91b82f89df1d0e644dbe4
SSDEEP 192:stnSnw73hvOUoKnksV+F2nvrwQjbAjtXo+G6K:stSnKv0sGJQZoK
TLSH
T1BED1A6025E28697B4CC6E249FE29BA47E2F9603171D21D58EBFC472C08DA6DC230790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 15KB
SHA256 9d704094f6a12bc23526e4d810c8adb0dacd7c822863aa094e62c7697ffe8c07
MD5 3196d3f27f3b91525ae3b03b01a96ebc
SHA1 3e8e637c00b9e112f83dd42401d747410e1cfadf
SHA512 967d87998f446dc93a81f916c9363dac43604987951406d8eb59639190924c2c36772d23f12bf56bfc8777e1d2d3082ef37550ad12ccbc499a0a3995845b3ad7
SSDEEP 384:hsrv+89zHqlDNP9oid6NBSvrsjzK3QE8N3:Orv+4UNbdxUK3J8N3
TLSH
T14B72AE33E67C9A379DB28548B88A2E0B7B78209251C30AA4EE985B4C428B4CD3307D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 2KB
SHA256 8bafba258cf5feab6a145d0f49417b16c3c562e8928cd7a64456b1dc8c29975e
MD5 74b0839ca0fedd390c39f52cefa8c29e
SHA1 368a079acb9088ce3e78526bc4d25e6bd3dde909
SHA512 9a45221fc8ad86096c492d4e19ca91de8bb5998f4158ba967e3fcf4bbec8272e81506b8b0bbce4949637dc34f53cb6d2d6f062f3a017dcd22090f159586f8632
TLSH
T1C751963369549A3789E28A04BD4A7F67DF3550659B522F506FDC4B1802DB98D2307C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State
Size 3KB
SHA256 26633e3a3d1d7d5e9e0e727412b1111727bbd4176ec1392774635b6902953e4a
MD5 756a6da3b62b86fd2d38ac7d31b10bc8
SHA1 3c97a8933493f70c2435827cf1ec82403ca1b5ac
SHA512 2d1a0505776ccc719dfdeef61a1c104ab011037764f6f2f692429caad57621339fdc0c317db9aae268fef0524a6687ebb0999ad4bce0e53dc8e9a8dc3886017a
TLSH
T16071897B5964D9374DE2CA04BD8A2F5AE7A55027D9913F94DAEC0F0C02D768C2343C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5969eb.TMP

Path C:\Users\Admin\AstralRPG\.webview2\EBWebView\Local State~RFe5969eb.TMP
Size 1KB
SHA256 88c5d235ecc183d83910bed818f7196034fdf91c0cd20bb82f00116343fd161f
MD5 63f9e4a7792fd3993e2e7a7fe03b2fff
SHA1 099d7b40a209dee3b3794958499d9ae19d5f5532
SHA512 aa2591ccdaf5bc9679832ab969540b0e7fd845134915279a59025b2bda4a1bbb494d84687959dc97c1373c10fee4c84021b85c238accf1b6553b7b95b2656137
TLSH
T1D2317477D1945A32AC8186457A4ABFEFAF3110AA46420E046ADC4B1913EB48D722FC32
MD5 SHA1 SHA512 TLSH

Submit Download

memory/600-66-0x00007FFC8F220000-0x00007FFC8F221000-memory.dmp

Download

memory/1136-246-0x00007FFC8EE40000-0x00007FFC8EE41000-memory.dmp

Download

memory/1136-245-0x00007FFC8EB40000-0x00007FFC8EB41000-memory.dmp

Download

memory/4852-197-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp

Download

memory/4852-168-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp

Download

memory/4852-196-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp

Download

memory/4852-0-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp

Download

memory/4852-257-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp

Download

memory/4852-280-0x00007FF7C2130000-0x00007FF7C4CBB000-memory.dmp

Download

memory/5756-276-0x0000013396F80000-0x0000013396F81000-memory.dmp

Download

memory/5756-270-0x0000013396F80000-0x0000013396F81000-memory.dmp

Download

memory/5756-278-0x0000013396F80000-0x0000013396F81000-memory.dmp

Download

memory/5756-277-0x0000013396F80000-0x0000013396F81000-memory.dmp

Download

memory/5756-274-0x0000013396F80000-0x0000013396F81000-memory.dmp

Download

memory/5756-279-0x0000013396F80000-0x0000013396F81000-memory.dmp

Download

memory/5756-275-0x0000013396F80000-0x0000013396F81000-memory.dmp

Download

memory/5756-268-0x0000013396F80000-0x0000013396F81000-memory.dmp

Download

memory/6076-110-0x00007FFC8F220000-0x00007FFC8F221000-memory.dmp

Download