f33d67a7d4a5cb2a8b35708ee29ca5c30a05f6bf4b81c6a4c77272c4a23ef0aa

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 18:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe
Size 16.4MB
Sample260815-w8mtxssaqa
SHA256 f33d67a7d4a5cb2a8b35708ee29ca5c30a05f6bf4b81c6a4c77272c4a23ef0aa
MD5 0ea31a674896bdff41cfaaf915ac84c5
SHA1 a4eada683e46001bfa6950c7b4663a570ee6fec3
SHA512 81dbdc2b6d03633bc4607675aaf55d94ea497cd2f73f388ca396a55ecd62fa803bc418a1705526d09e830528af1c39cdfa5b4e49cbd4a93589db0016a9e92cbe
SSDEEP 98304:Q6fgkhhqeaETyXFYGdMsIELlg+PmSgmjTQYxsWRXe6A8BM2BAfK+gHOYzq8NV4Gl:Q9DeaETYYkRg+f93dxfMleWG
TLSH
T1E9077D57F86500E4C6ADC635C666E263BF717C494B2027D72B50F6282FB3BE06AB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery spyware trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4620	msedgewebview2.exe
4620	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3252	msedgewebview2.exe
3252	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5756	2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe
Token: SeDebugPrivilege	5552	2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5756 wrote to memory of 5552	5756	2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe	89
PID 5756 wrote to memory of 3252	5756	2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe	90
PID 3252 wrote to memory of 2604	3252	msedgewebview2.exe	91
PID 3252 wrote to memory of 4952	3252	msedgewebview2.exe	93
PID 3252 wrote to memory of 4952	3252	msedgewebview2.exe	93
PID 3252 wrote to memory of 4952	3252	msedgewebview2.exe	93
PID 3252 wrote to memory of 4952	3252	msedgewebview2.exe	93
PID 3252 wrote to memory of 4900	3252	msedgewebview2.exe	94
PID 3252 wrote to memory of 4384	3252	msedgewebview2.exe	95
PID 3252 wrote to memory of 4384	3252	msedgewebview2.exe	95
PID 3252 wrote to memory of 4384	3252	msedgewebview2.exe	95
PID 3252 wrote to memory of 4724	3252	msedgewebview2.exe	96
PID 3252 wrote to memory of 4724	3252	msedgewebview2.exe	96
PID 3252 wrote to memory of 4724	3252	msedgewebview2.exe	96
PID 3252 wrote to memory of 4724	3252	msedgewebview2.exe	96
PID 3252 wrote to memory of 4724	3252	msedgewebview2.exe	96
PID 3252 wrote to memory of 1764	3252	msedgewebview2.exe	97
PID 3252 wrote to memory of 1764	3252	msedgewebview2.exe	97
PID 3252 wrote to memory of 1764	3252	msedgewebview2.exe	97
PID 3252 wrote to memory of 1764	3252	msedgewebview2.exe	97
PID 3252 wrote to memory of 1764	3252	msedgewebview2.exe	97
PID 3252 wrote to memory of 4620	3252	msedgewebview2.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe"
1⤵
- Checks whether UAC is enabled
- Modifies trusted root certificate store through registry
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5756
- C:\Users\Admin\AppData\Local\Temp\2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe
  C:\Users\Admin\AppData\Local\Temp\2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe --name=service --parent-pid=5756
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5552
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5756.4420.4718303934540575695 /pfhostedapp:3bb017a601434f64616005ac13b9d77531e2b4bc
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView /prefetch:4 /pfhostedapp:3bb017a601434f64616005ac13b9d77531e2b4bc --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x160,0x7ff9616e5fd8,0x7ff9616e5fe4,0x7ff9616e5ff0
    3⤵
    PID:2604
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView" --webview-exe-name=2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,2122736380608275010,16345810847073022362,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:3bb017a601434f64616005ac13b9d77531e2b4bc
    3⤵
    PID:4952
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView" --webview-exe-name=2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2084 --field-trial-handle=1776,i,2122736380608275010,16345810847073022362,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:3bb017a601434f64616005ac13b9d77531e2b4bc
    3⤵
    PID:4900
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView" --webview-exe-name=2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2284 --field-trial-handle=1776,i,2122736380608275010,16345810847073022362,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3bb017a601434f64616005ac13b9d77531e2b4bc
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView" --webview-exe-name=2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3496 --field-trial-handle=1776,i,2122736380608275010,16345810847073022362,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:3bb017a601434f64616005ac13b9d77531e2b4bc /prefetch:1
    3⤵
    PID:4724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView" --webview-exe-name=2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3976 --field-trial-handle=1776,i,2122736380608275010,16345810847073022362,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:3bb017a601434f64616005ac13b9d77531e2b4bc /prefetch:1
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView" --webview-exe-name=2026-08-15_0ea31a674896bdff41cfaaf915ac84c5_agent-tesla_amadey_coinminer_darkgate_dosia_frostygoop_g.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=820 --field-trial-handle=1776,i,2122736380608275010,16345810847073022362,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:3bb017a601434f64616005ac13b9d77531e2b4bc
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 41f98ef0927eb4234bdbf41c611766139714f7ba9e44b7409948004a75e87e8b
MD5 9d525d855b748fd28f28a404b919e7b6
SHA1 6b4302dfa48f79fe2471d1cea067d5f92b29050e
SHA512 f9a630e772ef31a8da7b5352324329ea23673f7aeafec3adb85d4d130d9138a46601213c7900772f9385d2c9720790a75edf38b5623d709b0ccc7a8b568fce47
TLSH
T151D0122336410134C0102533061265091411C54B40474101543ADA2D3A0409029024C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f5cee6315bfde209214351e30dbf8c686ab9a528fb2ed1067a133630a2741543
MD5 0de746bea5445baed6c8294967b89486
SHA1 66be7a162c024e43af7f673d321e46f830b354f0
SHA512 386a5c804c91e66a8eafdb6429564127023e9ea78e66cc8ca338cf722c0740f76733d2c3e64111c7200568aaaa39ef3ec0afc926f373709440bc61ec08df0118
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 d2eefe69c02fd03616768817bb9282cfd54930dedd9c5750ce712d39eb008f6d
MD5 a56a6ecb677547430ffde39b40aa9112
SHA1 5ffe98cb2fed4fa8c507122ddaf4e7ee823d951a
SHA512 3be9cab9ca48e362b7c91cf3255db21eeb2c8bb862cdb915f04a9d4b3eb4810ebd3fc08a5c6bf9ad2886653ced84b7f8d4ee736805219658e5ad3cf60fa85ada
TLSH
T129F068065372200DF386B730A1CEB5473232DF4440539EE31B849EF14612BB8CE60623
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59308c.TMP

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe59308c.TMP
Size 48B
SHA256 da1952dd0172589333f23f59dce2b952896a217f09b2d6f8349f6c761c2eeb8d
MD5 8a712510942133a380260732897df169
SHA1 fe80ba55cbc753a33b99d288a3ac8d7eb3a09d02
SHA512 65ea9de340c39a4d6e99f22f329be84e8173c7f5e0e0768d06d2ea4f1c488522368c1170200a50f82ccc7ecc75b31573de33a826b4d0a107a6f167fc13b0cbf0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Network\Network Persistent State
Size 3KB
SHA256 b14c09b1cb1506b991d1a4ac053a7f27b377cce76b6e22d0c1e3baf7f2c2a31b
MD5 f9d24aa38ad807ba1395c449c273d086
SHA1 efb673857a07812b0cf61479fdbf169f6f908d1c
SHA512 cf6a7e125dc77a46240b771aa9d232146cecf27ae401a8a2afe083fdb19ae0da9fc86fb025c5e272d65a5a7eab41908e3e0a89669db3798d81c0491adb669e0b
TLSH
T16A516BF683F4CA7E491167EC6A147D27CC39012A13283A639DDBEFA59EF2471D60190E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe59e8a1.TMP

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Network\Network Persistent State~RFe59e8a1.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Network\TransportSecurity
Size 691B
SHA256 8eb4bb76efdf11603b92108cc100df2c9757abb21999aef8653e790528e4f98b
MD5 ed28cf200cebfa1ffac847bbd5fa79b6
SHA1 1ae9f24fcdac48c29dbe317f6e67be65a37eac3b
SHA512 1e9b1ccb51788b4fc8585c1a6107922831a25ae2dcf598c00051c17b11522caf87cfe3833e8e9b490ebd7c16e571a31897679828710853953c037e928d397178
TLSH
T183017BE7993EA166507C046E6E877A053A39F43417D2A4F5DF55C2BCB0C08F706160A2
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59422f.TMP

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Network\TransportSecurity~RFe59422f.TMP
Size 523B
SHA256 d1169d9e99cf6e2845c6392efba5e4eb56f7be637311b83a4c324c6e0023c27c
MD5 3f8613a37d19c88df590fc1aea2709fa
SHA1 a2ed24f5d48b396ac99a1e6ec21d71f3e53577a6
SHA512 6ffd551af19b447122f9f75f127c081f93a19e7af994ae3cfce08ab68ea49358667b85ed8e005d540a07434eb4a47756e070d107963dc3039042074808e60241
TLSH
T169F0C9E3483EB176907C046E3D827E013A3AF43413C2A4F5EE5581BCA0C44F30A06092
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Preferences
Size 6KB
SHA256 f1f05a51ac11ae541b9a82fc97b84e90c7270d11c56d0e04a5cafd63d4603008
MD5 29de2173b5e79c117bef40cc92a27fc4
SHA1 0f89427fd9a3e22cd024d41876b1a0815eac5a00
SHA512 dee981c451ba0ad6620abf32e5877f7ddc9d1235cd2608d028764fb9307658b0790a1563baec9d2d760ad5b90762484a638f353ae7f6db36c0768c8ae246bcf8
SSDEEP 96:stE/d+h5Grb9TkWo5h16Z5cs7/x+6MhmuecSya1en23eXK+g+28XM1C7K:stIMYDoKcsV+F2yaQn2350G6K
TLSH
T107D196025E64797B8CCAF519BA25BB13E3F5607261D11E58EBF84A2C04EB6DC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cbfa0790-4b36-442a-a8ea-3231942e7a25.tmp

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Default\cbfa0790-4b36-442a-a8ea-3231942e7a25.tmp
Size 6KB
SHA256 698a3062e8e931efdfca1a7c5a900a43db43b7b4b4e34b3b0c2e820c1c0fe75d
MD5 841e116e2b980f360ff0ec2e51b6d8f5
SHA1 2ae3f97a992d1d8dd320b80f4fac6ad8bc446eaf
SHA512 252f7ad6713bae6ef2ee8c040f9b96ef2072675ab50b5cbe4b262f4e0047b4c6412bf8cd4bbb7a4192d03e5570cf36f00efcdde57e883eb6e9c1f0dea8f237f0
SSDEEP 96:stE/d+hCrb9TkWo5h16Z5cs7/x+6MhmuecSya1en23eXK+gl28XM1C7K:stIMCDoKcsV+F2yaQn235LG6K
TLSH
T189D1A5016E68797B4CCAF519BA25BB13E3F5607260D11E58EBF84A2C04EB6DC6307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Local State
Size 2KB
SHA256 7102901dbf07f8c2b5b9e689af39599135b77b77ca431430ccfee009f23ffd99
MD5 87a27d22465747dcd3ffe4f4b38c14ca
SHA1 061484e915e756fead51668c1c1967c49326e159
SHA512 c25a2c7f65b3e622fc9d6afc01f5b6396347a5ee450f6b885cfca392606d7eb72991fc3e4d92d60918aee2c1e29f3701f3960b5fd1ed8e2635fd4b92a1262bf9
TLSH
T12A5174B3AC64AA7789EA66487D4EAB23DE7590B1AA221F10DEDC1B1C01D725C1342C67
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Local State
Size 3KB
SHA256 c17ef35f39436c1f55d4b2d1df8465a245a4849904fc106ec1fa22510b1ec264
MD5 3dffc1058065f82445aef660dfc152a1
SHA1 4eacae20bfb18ec2ed9ad945c0fa97c84d5aca4e
SHA512 bac2b61b7e7ea1b408724544cf9f908556993a81d76faff3df39002d8a8ac8796f14a3e1de730480ae2a0f751a6ebed61b0b8fe86b6d05d1092310f38fda3f02
TLSH
T17E618473A974A9378DE6AA08788A6B17EBA59073E4A13F55CAEC1F0C01D738C1342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Local State
Size 15KB
SHA256 c54da0d35a59fc455e62e6417660d2e703f0d403a86695416483f4499c9a46d1
MD5 0d4ae2733c37e38616846e2557330ebd
SHA1 30204a32e64e07d820ce24616867ea85772a930f
SHA512 83e94be161482891c79d0a5f129b71bf21e259ba57b953da89047c51100cae61dc95bb3e075d76cbf088e5551157d56630459969eb13575f6d17611c76afd6bd
SSDEEP 384:D+aQikB+z/xvxjg/qhEwNBSSWjzcFdAVdpSu9zC:i/UxvxjgC+6cmdUJFC
TLSH
T1A8729E2798797E23A5F7BA09795D479BCFF884B254C16E684EBD6F0D06C72D80342812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe58cf9f.TMP

Path C:\Users\Admin\AppData\Local\Temp\Kickey\Webview\EBWebView\Local State~RFe58cf9f.TMP
Size 1KB
SHA256 a20226bc2a054dd2e5c6f37b139c3c1014de0baec250e1540b5a716f73f97b96
MD5 d7ce288455a89966e8fdbde52bd87bcf
SHA1 2652e62ee61bfadd9d09183cab5ea4e239b9407b
SHA512 5b108a5f0d6298edd772dd52b1c7bd40c01096b5b4d5fde1a88df6269022025b418ffb857b0f1fd31f125bd5db48f2fbde939f2d1399b4952413e02702fda423
TLSH
T1492187F3E8782733EDD9324A351AEB679E719076C1314F0459DD4B1C02D628C5617832
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4620-344-0x00000185ECFE0000-0x00000185ECFE1000-memory.dmp

Download

memory/4620-335-0x00000185ECFE0000-0x00000185ECFE1000-memory.dmp

Download

memory/4620-337-0x00000185ECFE0000-0x00000185ECFE1000-memory.dmp

Download

memory/4620-345-0x00000185ECFE0000-0x00000185ECFE1000-memory.dmp

Download

memory/4620-347-0x00000185ECFE0000-0x00000185ECFE1000-memory.dmp

Download

memory/4620-342-0x00000185ECFE0000-0x00000185ECFE1000-memory.dmp

Download

memory/4620-343-0x00000185ECFE0000-0x00000185ECFE1000-memory.dmp

Download

memory/4620-346-0x00000185ECFE0000-0x00000185ECFE1000-memory.dmp

Download

memory/4724-102-0x00007FF982FD0000-0x00007FF982FD1000-memory.dmp

Download

memory/4952-26-0x00007FF982FD0000-0x00007FF982FD1000-memory.dmp

Download

memory/4952-305-0x00000232B4F10000-0x00000232B50D3000-memory.dmp

Download

memory/4952-256-0x00000232B4F10000-0x00000232B50D3000-memory.dmp

Download