cf2070ee6487db281939efc95b6fe7c29aeeb2548f76bf967ac004b3e85421ea

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 10.3MB
Sample260730-grkkxadp2x
SHA256 cf2070ee6487db281939efc95b6fe7c29aeeb2548f76bf967ac004b3e85421ea
MD5 047176173f689745bdf44d4b219054df
SHA1 7d9a98d21b80e7719bb79d07e5a2d1ad987f915e
SHA512 7635bf319fda49d6ec460ded6cc12d620a2b05a50800887e20b6fdeed2a5b584a96e5321d7d678d755ac013e5b77845eb10e499e2259b80188e13fc4aa7287fa
SSDEEP 98304:FGctRmrwJ3D6HXZ0Eba7ZGuI8XkvY6w+YbE:FmrwJ3On5ADx4
TLSH
T15DB64B57ECA140B5C8BED634856692637A717C484B3127D72B60F7282FB3FD09ABA740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
17	discord.com
18	discord.com
49	discord.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-ta.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1208783107\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-af.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-la.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-as.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-te.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1208783107\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-be.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_442628391\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1208783107\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-or.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-it.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-da.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-el.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-es.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-de-1901.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-et.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-sk.hyb	msedgewebview2.exe

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4660	msedgewebview2.exe
4660	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2264	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 5964 wrote to memory of 2264	5964	2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 2264 wrote to memory of 3152	2264	msedgewebview2.exe	90
PID 2264 wrote to memory of 2144	2264	msedgewebview2.exe	91
PID 2264 wrote to memory of 2144	2264	msedgewebview2.exe	91
PID 2264 wrote to memory of 2144	2264	msedgewebview2.exe	91
PID 2264 wrote to memory of 2144	2264	msedgewebview2.exe	91
PID 2264 wrote to memory of 1256	2264	msedgewebview2.exe	92
PID 2264 wrote to memory of 1284	2264	msedgewebview2.exe	93
PID 2264 wrote to memory of 1284	2264	msedgewebview2.exe	93
PID 2264 wrote to memory of 1284	2264	msedgewebview2.exe	93
PID 2264 wrote to memory of 5916	2264	msedgewebview2.exe	94
PID 2264 wrote to memory of 5916	2264	msedgewebview2.exe	94
PID 2264 wrote to memory of 5916	2264	msedgewebview2.exe	94
PID 2264 wrote to memory of 5916	2264	msedgewebview2.exe	94
PID 2264 wrote to memory of 5916	2264	msedgewebview2.exe	94
PID 2264 wrote to memory of 1924	2264	msedgewebview2.exe	98
PID 2264 wrote to memory of 1924	2264	msedgewebview2.exe	98
PID 2264 wrote to memory of 1924	2264	msedgewebview2.exe	98
PID 2264 wrote to memory of 3308	2264	msedgewebview2.exe	99
PID 2264 wrote to memory of 3308	2264	msedgewebview2.exe	99
PID 2264 wrote to memory of 3308	2264	msedgewebview2.exe	99
PID 2264 wrote to memory of 4660	2264	msedgewebview2.exe	100
PID 2264 wrote to memory of 3864	2264	msedgewebview2.exe	101
PID 2264 wrote to memory of 3864	2264	msedgewebview2.exe	101
PID 2264 wrote to memory of 3864	2264	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:5964
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5964.5044.8611735510618815375 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView /prefetch:4 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x104,0x194,0x7ffdcd195fd8,0x7ffdcd195fe4,0x7ffdcd195ff0
    3⤵
    PID:3152
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1780,i,8038991262536363973,2200213087910373560,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2144 --field-trial-handle=1780,i,8038991262536363973,2200213087910373560,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2452 --field-trial-handle=1780,i,8038991262536363973,2200213087910373560,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41
    3⤵
    PID:1284
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3500 --field-trial-handle=1780,i,8038991262536363973,2200213087910373560,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41 /prefetch:1
    3⤵
    PID:5916
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4556 --field-trial-handle=1780,i,8038991262536363973,2200213087910373560,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41
    3⤵
    PID:1924
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4548 --field-trial-handle=1780,i,8038991262536363973,2200213087910373560,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41
    3⤵
    PID:3308
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4548 --field-trial-handle=1780,i,8038991262536363973,2200213087910373560,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4444 --field-trial-handle=1780,i,8038991262536363973,2200213087910373560,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:26378b3605882612f1edd41803bc5a3c39903b41
    3⤵
    PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c75ea75f59977ca43c67e2a942fc35a3cbf33d8a7efe9d4ea6e71c5a0e684333
MD5 cb1c27bbe0f9815f5a7e167835d3f067
SHA1 d5a806f3b42817882a391a0231b5d6ce21d4aea5
SHA512 57e334d7037ca28d76626cf3caab4027d7aa5f499059bff8be4d042f031c9e3525053eee612bb564dc04fbc2317df2572b3d85aef559f366d138c0febb675da8
TLSH
T1E0D0123772220237C01032331552710C0400D11B81054004A43DBE1D9A04054091AC42
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 cd12d6638651afb22628900ee94de25df316237f8626ff3d9f8d3a41b4f02329
MD5 12db11c08789dd054879d5e91c3c63de
SHA1 ca0cdc65cd7ca6f487ab76d2ae9a3108a4fe62af
SHA512 fe06609c3bb428f668c0a05b591238e714fd1ba88b1cb0002b427ae8c2fe35608ab295748e8720936cdd653ccbe5eeea8af096869aeb9a4fcb7207c5936e405c
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

1aa48918-f4fd-4a7a-9735-cb3839eed5f5.tmp

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\1aa48918-f4fd-4a7a-9735-cb3839eed5f5.tmp
Size 6KB
SHA256 5dcbca4e5db07717970b15a6c0180eefb269ecef8fd3800b1de72c527c054ab2
MD5 7b9ad0146d56c26aad6a1511e58da25b
SHA1 f89b95c7fa7e141488b3ca737ae89c429364ad43
SHA512 831bc6b4053699242076e69c785bf0bfdbb4282579ca1c591495a93864920019eb8168f7fd177435c2f00dfbc42c440c6662aaa3eca46a4b756657456684bc5a
SSDEEP 96:ste/da8aDhb9kkCo5h16Z5bs7/x+6MhmuecSlJ1ejeNK+gVb/28XM1C7K:stmFHroKbsV+F2lJQjvLb/G6K
TLSH
T133D1A6065F24697B4CCAF519FA39BB42E2F9507261D51E58EBF8861C18EA6CC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9ac3253068085bb1b04acdc494a4037fafc725cd25abf910b453d65b354c7239
MD5 751a6d7dafab38eec73a3f3470f3a2ed
SHA1 d6e386f4ef5071076f45bc8288e26a2e80a99ca2
SHA512 c5c78442400f1c28b83253c6309ae9cbd088bd6bef5a87b5cac5a533f051d7b44b2ac3a13317c542c19361b641bff583f9e9c837e455b1f9a796c0e18a2a6d3c
TLSH
T12DB022E203320083C208033020CB80083032AF00C303CC8A20F303B8BAE23A203002A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59454c.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59454c.TMP
Size 48B
SHA256 2d53215f1adc84ae358b4f2f83a3f6da6eec64bb462a460887fa60986e52259a
MD5 ae32cbc29d5c6ad07f672355594bef3a
SHA1 de28d24006451b1549bcc46e15b0e37860d41e8c
SHA512 03a442fc9db9092879f4081cad4b1123c13433beb1fa6bcf4460e7c9bb78173eef3a00237ccd1d3f91cc250449e6db6ff90713791dfa605e8446d1e2306108bb
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\Network Persistent State
Size 557B
SHA256 f04096784f8b3dff01ae5f141b360e2477aee36efa87446e5ec07f7456f48a92
MD5 27a290d3f7c823445f62735ecceaf2df
SHA1 d205cee5cb436b964c3c84d2b61da257e2ca4d35
SHA512 8a496f40a2ad4c166370dd076f3fa6c45bcdcceab7df12e7ec3105493337d6b1ed2d680f605ffcc3956a927101641be642bd6218b1ccc880dd37e5ca929455d3
TLSH
T181F081B3C1D4C57D499513F457207813C52D041942182D27DDE5FBAA5BE1475A710C4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a1aec.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\Network Persistent State~RFe5a1aec.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\TransportSecurity
Size 522B
SHA256 e70f288b48e28c4676f7fe5413d5f9986fe57d23fdcad892cff1875707de54bc
MD5 e079efae170bfdc0161e2486055d795c
SHA1 f26dec73d160710dc513607df726f6731baa601d
SHA512 806c6081f13d725020ce5055082fe8a8b99241bf3fe82d507a44a806c92b8831236309fa1f0fbb904e5cb79255782d2d550d33930909112c04f80eeea44a08b6
TLSH
T16EF059A3C1AFE537103809AA1D807D0A5EBBF239438768F8D559C3AEF0919671326443
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe597a66.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\TransportSecurity~RFe597a66.TMP
Size 355B
SHA256 4ad055784f81ff53a75b45ca6e9818126f8eb52c39966723eaaa6a927156fcd5
MD5 f6f58064eb328b629bc6d20fc2457fc1
SHA1 a58a410c1c5ec249f9ec547b82f47855abbc25ab
SHA512 248a80f435500096cf61c478e4017e80f80112d23dd35589b81b8e9feae2ff2ccf0e06b22bc4af9349e8ee94da6f8f8cc0ff4c8948efad12f7fd5c0a3b187619
TLSH
T140E0D89340AFE577103909A61980BD4A5EBAF238438768F8D55583ADE091967122B042
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 d70c7afc18ac3e61ddc9a86ae2bbb5f3ccdfb5d75dd8a8cba26eb37592759442
MD5 ecfe6fc86f4c0393c80b4fce055a032e
SHA1 0fd8278fa4102b6f27c119b3f2da5073c1e1ac98
SHA512 4b217bd1a1e586120bda89c008f7ee3c10fb7abc6a33d244c36ea7d60172e948a9aae98bd87e5e11215f8c5441cf7da0312495c89ec1dee39c3659c1708a6cab
SSDEEP 96:ste/da8aiGhb9kkCo5h16Z5bs7/x+6MhmuecSlJ1ejeNK+gVbH528XM1C7K:stmF5roKbsV+F2lJQjvLbZG6K
TLSH
T161D1A7065F24697B4CC7F519FA39BB42E2F55072A1D51E58EBFC861C08EA6CC631780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 2KB
SHA256 bf01192aa0e27dc6305a8ab61e175c5889661f1505225d37cf44b7be6e8e63c6
MD5 72c5a3c032d117855b95978bb2966df1
SHA1 728f8c5a34a65cf26885ea32323be2eceee78cf6
SHA512 44071af7b21264bd9fe5e36e2c36e49d613aa5a7d7baac4fc2cc45a5c1a1001ee95ea0e379008dbede96aad114ea2254192127604e76d2669dbf29b661ced679
TLSH
T12B519473AE14DA3389E28A55F84B7F138B755062EB525F6099DD0B0C01D759C5706C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 3KB
SHA256 8b31ac2618d9506ddc1f9e085074649b5f7d99e9426b83118254db9edab43c09
MD5 abd1e514d5597014fe38c1c93faf6df8
SHA1 e324c6f9a3d68350037bebd4d218e61ec55a8a9a
SHA512 e0ef07a381b33413b8154e20ad89d2603d89e1a41fa8c78d229f18608ca56f505bd807cb23782539d1bc73064fa7f859484c12e72ae7ec24d4010e88f97fa098
TLSH
T126618277AA24DA378DE2DA15F88A3B12A7A15033EA917FA4C9EC0F0C01D729C1352C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 15KB
SHA256 2a8c6087ebfe370c3fe536fc5f331a7d44c045c434cc9321e23962dbec48cdea
MD5 3c731bbeb8e1266b0c458f3cfb5ab423
SHA1 e20a40b970ba318df39955c9ebd86b74e8b58842
SHA512 2fbb7c8ffaafdaf46f96f4d5cf84b969fcc257a2f0a2cb4ee92c71ffb55f17efd7ea3429fb1f846e29684383d2490011227529bc64e5198bb599819c0d1a0b6e
SSDEEP 384:o+aQikB+z/xvxjg/qhEwNBS3ujNCAisdzy9zm:n/UxvxjgC+PEwAisQFm
TLSH
T19D72AE3B59397E2395F3EA01B94E079BD7B8847295C26EB84EED5F0D0AC32D50342C06
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58f3c1.TMP

Path C:\Users\Admin\AppData\Roaming\2026-07-30_047176173f689745bdf44d4b219054df_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State~RFe58f3c1.TMP
Size 1KB
SHA256 decc03924639cb1368f3aad71d9b2d1092d9140d14582d836d2ce6fea8d480fd
MD5 b8b7c95de7e18d452a501e52faef1229
SHA1 04739c157c0139123b8b50c1a6096ab387a9efb6
SHA512 617fe31198db6b573df1d5237f1ec43b09e5e16f485966eec4e18e1a04dc20c23abfc77ea3525bf95887375e3c0b25eb801bb13d12abef19b49bde3d3ab628b2
TLSH
T149212DB3EB208B329CD1A656B04BBA471F312067E3118E5458DE8B0806E619DCB2BD32
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-bn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-bn.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-mr.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-mr.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nn.hyb

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2264_1703780507\hyph-nn.hyb
Size 141KB
SHA256 5bcbb58eaf65f13f6d039244d942f37c127344e3a0a2e6c32d08236945132809
MD5 f2d8fe158d5361fc1d4b794a7255835a
SHA1 6c8744fa70651f629ed887cb76b6bc1bed304af9
SHA512 946f4e41be624458b5e842a6241d43cd40369b2e0abc2cacf67d892b5f3d8a863a0e37e8120e11375b0bacb4651eedb8d324271d9a0c37527d4d54dd4905afab
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgY:p73HEUP8dsiinTThjy90VKY
TLSH
T1C1E319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1924-244-0x00007FFDEF120000-0x00007FFDEF121000-memory.dmp

Download

memory/1924-243-0x00007FFDEE6B0000-0x00007FFDEE6B1000-memory.dmp

Download

memory/2144-184-0x000001D78B970000-0x000001D78B99A000-memory.dmp

Download

memory/2144-19-0x00007FFDEED70000-0x00007FFDEED71000-memory.dmp

Download

memory/4660-447-0x0000026F28A90000-0x0000026F28A91000-memory.dmp

Download

memory/4660-445-0x0000026F28A90000-0x0000026F28A91000-memory.dmp

Download

memory/4660-453-0x0000026F28A90000-0x0000026F28A91000-memory.dmp

Download

memory/4660-452-0x0000026F28A90000-0x0000026F28A91000-memory.dmp

Download

memory/4660-454-0x0000026F28A90000-0x0000026F28A91000-memory.dmp

Download

memory/4660-456-0x0000026F28A90000-0x0000026F28A91000-memory.dmp

Download

memory/4660-455-0x0000026F28A90000-0x0000026F28A91000-memory.dmp

Download

memory/4660-451-0x0000026F28A90000-0x0000026F28A91000-memory.dmp

Download

memory/5916-102-0x00007FFDEED70000-0x00007FFDEED71000-memory.dmp

Download