1ad15ef6614ee49a17cf4e7f011dcbfbf1d9343c9ee16fd87901261edebc2f21

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
Size 32.4MB
Sample261011-t7jprstybw
SHA256 1ad15ef6614ee49a17cf4e7f011dcbfbf1d9343c9ee16fd87901261edebc2f21
MD5 3a529ea62d0e850a5e409526292f4cf2
SHA1 19b59f0f191db3507d65b860b65de873c3d8cffb
SHA512 94f2fe04ab58d09d7ada837df55fa714b86e7e9901b7f8bf19d1beb5d8b22e856a1e80119ff6073629693945cdc7095b65995f7b6997173bd4e41d979854e0b0
SSDEEP 196608:EoBmragCtai+l0y+CeyfaZyJ4ynl7QUvPlXGykTnYclhWakO:EoRgQai+enyyZyJ4Ql77vPlalFkO
TLSH
T1C3772893B8950EDED0F95036C81594427F297C568F3057DB2A20B3653F7AAC0AFBA358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1023321860\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1023321860\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1023321860\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1023321860\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1845754128\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1845754128\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1023321860\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1845754128\protocols.json	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3192	msedgewebview2.exe
3192	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
5292	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1896	1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	89
PID 1164 wrote to memory of 5292	1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	91
PID 5292 wrote to memory of 1300	5292	msedgewebview2.exe	92
PID 5292 wrote to memory of 5968	5292	msedgewebview2.exe	93
PID 5292 wrote to memory of 5968	5292	msedgewebview2.exe	93
PID 5292 wrote to memory of 5968	5292	msedgewebview2.exe	93
PID 5292 wrote to memory of 5968	5292	msedgewebview2.exe	93
PID 5292 wrote to memory of 4396	5292	msedgewebview2.exe	94
PID 5292 wrote to memory of 2700	5292	msedgewebview2.exe	95
PID 5292 wrote to memory of 2700	5292	msedgewebview2.exe	95
PID 5292 wrote to memory of 2700	5292	msedgewebview2.exe	95
PID 5292 wrote to memory of 1860	5292	msedgewebview2.exe	96
PID 5292 wrote to memory of 1860	5292	msedgewebview2.exe	96
PID 5292 wrote to memory of 1860	5292	msedgewebview2.exe	96
PID 5292 wrote to memory of 1860	5292	msedgewebview2.exe	96
PID 5292 wrote to memory of 1860	5292	msedgewebview2.exe	96
PID 1164 wrote to memory of 1628	1164	2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe	97
PID 5292 wrote to memory of 1736	5292	msedgewebview2.exe	102
PID 5292 wrote to memory of 1736	5292	msedgewebview2.exe	102
PID 5292 wrote to memory of 1736	5292	msedgewebview2.exe	102
PID 5292 wrote to memory of 1212	5292	msedgewebview2.exe	103
PID 5292 wrote to memory of 1212	5292	msedgewebview2.exe	103
PID 5292 wrote to memory of 1212	5292	msedgewebview2.exe	103
PID 5292 wrote to memory of 3192	5292	msedgewebview2.exe	104
PID 5292 wrote to memory of 2828	5292	msedgewebview2.exe	105
PID 5292 wrote to memory of 2828	5292	msedgewebview2.exe	105
PID 5292 wrote to memory of 2828	5292	msedgewebview2.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Windows\system32\certutil.exe
  certutil -user -store Root
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=1164.3432.11624970879533405015 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:5292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView /prefetch:4 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x188,0x18c,0x190,0x184,0x198,0x7ffe8af35fd8,0x7ffe8af35fe4,0x7ffe8af35ff0
    3⤵
    PID:1300
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1776 --field-trial-handle=1780,i,4047577504193595226,2170305712630638533,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417
    3⤵
    PID:5968
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1780,i,4047577504193595226,2170305712630638533,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=1908 --field-trial-handle=1780,i,4047577504193595226,2170305712630638533,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3496 --field-trial-handle=1780,i,4047577504193595226,2170305712630638533,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4016 --field-trial-handle=1780,i,4047577504193595226,2170305712630638533,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=352 --field-trial-handle=1780,i,4047577504193595226,2170305712630638533,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417
    3⤵
    PID:1212
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4516 --field-trial-handle=1780,i,4047577504193595226,2170305712630638533,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3192
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView" --webview-exe-name=2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe --webview-exe-version=1.0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4080 --field-trial-handle=1780,i,4047577504193595226,2170305712630638533,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:ce9fe40d4c655aa4e077c773146eb92c5a796417
    3⤵
    PID:2828
- C:\Windows\system32\certutil.exe
  certutil -user -store Root
  2⤵
  PID:1628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80a5b7a8-684b-4d64-bdf1-c7721316e8f0.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\80a5b7a8-684b-4d64-bdf1-c7721316e8f0.tmp
Size 3KB
SHA256 8d07183231f1fa346b80c95b98af24e6e23563e9ec849dc427dcfe8cc0f3be18
MD5 d7636fa1a872a25acffb41b7d78cc1d0
SHA1 21df745aa426bbdbc572f1e43d4fd41ea80c8e29
SHA512 c6356c52d0db2885320f339af35062b5ea64b592e7b9b2e2f2b938436f09f8235a0ad08f0f6265244e5b01f7d69eb83aada77a906f7e85bfeb7fa29234fbbd91
TLSH
T1D361843359A0AB378DB29B4578CA3B13ABA55067E5C13F65D6ED0F1C01D72D81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 24f4b5eab2fc10fd868665d4eb5514a177bf27d27cc1824cac89f6f772731148
MD5 8abe0db0dc976a1fe2106d175e688d7f
SHA1 77a56e5f831f0e547508e6c1b7070490221e149a
SHA512 ff9e4912da58faba71ad86d7f1ccbb9eb47fe3a05380570255d3364fb4b9e10b368089c9d6279f758ad2eaa2971baae300e4cb6a7fc89de38eb6bd621eb0fb35
TLSH
T129D0121237110534C02425B30103B50C0400C10F400540459879AD5D1B584580E06482
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1a818481f12ca43bf3010661432c2be5812ea9285685a6cbb5952002340e60a0
MD5 e1a7cdb94b0aafa73322b09d2875ff4f
SHA1 fe55890b5b0cb1effb07bd493006663e46afc214
SHA512 b546c3089c6c0f1a67936a9e25fdb190b7cb84a995c55c2590c71ae1c373f4224c225845b74ea71dcd8121dd212271c35b7c684612ee93c5d2191ce6e2067291
TLSH
T148D0045057101400D11D55F34113F504411044041411014544F13C4405D440C4505041
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

71f33f66-3238-4ba4-9e63-6b303f37f20c.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\71f33f66-3238-4ba4-9e63-6b303f37f20c.tmp
Size 6KB
SHA256 0cd2f52008b6fb2261671c6cebdb3b907b86ee772272539c3d82d15831509aba
MD5 6ec8caec29478628dfe2a0a731c0f15a
SHA1 55cae90641d873b51fc7d5032716d39ca60ea313
SHA512 6d0df315ca00271488e1db6e0a603da26fdabee2eda629566f475947ad4e93da899273ac1e26a97050fe2844408b88d7cde21292210937769567ee5d4454f148
SSDEEP 96:stvXdS7VGuCb96kFo5h16Z5Ws7/x+6MhmuecSsi1ejeEK+gy1I28XM1C7K:st/MnsoKWsV+F2siQj4jG6K
TLSH
T1CFD1B7015E64797B4CC6F259BA79BA17D2F6507270D42E48EBF9452C08DB6CC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a6b5861-5123-4262-8662-3636276d6f4d.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\7a6b5861-5123-4262-8662-3636276d6f4d.tmp
Size 6KB
SHA256 32aa1ad0aef66b3b4f228a1fce9be27b15c5f0355e18e4660f731f77af4c9b96
MD5 13bb9f962e310749b46ab4434594ac27
SHA1 b7ee2c5335b6b5ace696e5c0120975390e7792f8
SHA512 fa7cfcfb7985bb49f4bccf0dc4eac5f8e393c2798343e882325ab915d4284931f101654b1f9ca54bedca362a893688ce060fd7cb3468d9f6eae1e754f513e40d
SSDEEP 96:stvXdS7OuCb96kFo5h16Z5Ws7/x+6MhmuecSsi1ejeEK+gy1Z28XM1C7K:st/MVsoKWsV+F2siQj4GG6K
TLSH
T1AFD196015E64797B4CC6F24ABA79BA17D2F6507270D52E58EBF9452C08DB6CC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 6605b2d96e5989465c3e0fe608e3c7d8a12aeead9dcaf3ae1c6cb86911f64413
MD5 1e202d05b20558322c482754957785ce
SHA1 8daca1aeaad7d5ceada85c6614fad28e65325776
SHA512 8b9acbb836469690a8c9f4a5ae7a30980f8c3ffaf11abb836cef3d14afa9d6704f7b664f1af5bc430daa012684bf8b961bc4deaa34a6983b06a4390f236bc862
TLSH
T112A0021041403607C253237195C213877B3D985116030B9575D0BC7C99E17437555175
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 48B
SHA256 169bb9fcc97d8928499072d7f7c4099aa3ad60a9bf19ae7698c29f76fb3aa6cc
MD5 21f38df17a61a26b3645c4b0d18013ce
SHA1 f4856a7bf89fac59799a3305467f03cd8bc69649
SHA512 c54e4569ca55939ce3757889fd73978d4e4363f317b0d08063e37c87f3d28ed35116ff6c566cc5f65b4a8cb92aca837a97567f494290b9e7d197051264493eff
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e99630de-c7a2-4a17-b63a-fc6c9a833dd4.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Network\e99630de-c7a2-4a17-b63a-fc6c9a833dd4.tmp
Size 555B
SHA256 fe2d8dbad2cf5c42e5863c141170988cbe068dbfd64549e16352f3d300cec12b
MD5 6b076ee2dd703031468333c0e185326e
SHA1 70da3b7e150ebddb3d4cbf7f2452ba0dabe499b8
SHA512 38b7273d199366f6e736c7e64366cd74ff8ca0c5eb7c57eeb1acb4510c2ae82823748f2439f3922bb695053fc749d4910f33cd9e2528fa0a7587750c9f2a61b3
TLSH
T16AF08BE1C2D486BD899113E866247823C92E040A52282E17DDE9FBBA5FE10799B1090B
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\Local State
Size 1KB
SHA256 f67a5181649c4a5434309a273649767a294cab6db508dee44a1407987a49f9df
MD5 bb0883e940de60c53d6e86bd4ce52ba2
SHA1 e818a0f50013e5dbccdc3e0fadc304c8eba3d7db
SHA512 957ec980566bf00b8cbd61f262faa649d6218f72e5417301f192f5e64c8f789cdc43ce6779bf197b93295dac0266531c4f7876f25f065f0a3eaa0b1093d6f422
TLSH
T1792165B295E05F33EC61278A25CA3B534F2160ABD1915F05A1DE8B2C01E71ECA25AD32
MD5 SHA1 SHA512 TLSH

Submit Download

a3c18cfd-e6a9-4804-9871-e330e54561a1.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\a3c18cfd-e6a9-4804-9871-e330e54561a1.tmp
Size 2KB
SHA256 7a00a1aa138f818ff0b2d91c17fe654c9d09d07c6ae65ce54d4f865110351f60
MD5 15e9d8cecfc13787bf5ab9be62ee281f
SHA1 1477916b3d3dadc8050036bdfff1d6533d623db1
SHA512 9eeee79ca62beeb0025a39b9ff89168151d8d18ca1898a3de3a9a586dc85b614330cd604e34f244b07317748b7eaac7a3cf01a4fbbae0148ab847d8468492148
TLSH
T1C05164336990AB77C9B25B8979CE3B138F36A096E6923F119ADD0B1C00DB19C1346C26
MD5 SHA1 SHA512 TLSH

Submit Download

a3f30d42-ca08-4892-8c5b-0fda1c5f46af.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-10_3a529ea62d0e850a5e409526292f4cf2_coinminer_dosia_frostygoop_glassworm_hive_knight_luca-st.exe\EBWebView\a3f30d42-ca08-4892-8c5b-0fda1c5f46af.tmp
Size 15KB
SHA256 cdbd9bfb33843a41c1d7fbf2b81f22683f489136627d5c29e0533debbfcab652
MD5 ee7e81c3e29b7fbda9b0ac89abd8ca38
SHA1 b329b25a286c1791db40f95f44557417ebee2b3d
SHA512 1b82cd8d597e9e398494f90f5e2673fdf71eea8a8a5b22d0c93ba5bf47bbdc9cc27932a02a9f7adae19481a51d99b1d21d0d3afbc4084c292667f8ab265346af
SSDEEP 384:O+aQikB+z/xvxjg/qhEuNBSITuwKc0I7MU5/Wvn9zM:Z/UxvxjgC+qAvIQzvnFM
TLSH
T1DE729E3755B87F33A5F3F6057A49174BCBB998A2E0C27A6489FA0F1906D72D80346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1023321860\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_128383574\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5292_1845754128\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1736-266-0x00007FFEAB8B0000-0x00007FFEAB8B1000-memory.dmp

Download

memory/1736-267-0x00007FFEAC3E0000-0x00007FFEAC3E1000-memory.dmp

Download

memory/1860-207-0x00000182CF050000-0x00000182CF126000-memory.dmp

Download

memory/1860-114-0x00007FFEAC2D0000-0x00007FFEAC2D1000-memory.dmp

Download

memory/3192-347-0x00000229CA8B0000-0x00000229CA8B1000-memory.dmp

Download

memory/3192-345-0x00000229CA8B0000-0x00000229CA8B1000-memory.dmp

Download

memory/3192-354-0x00000229CA8B0000-0x00000229CA8B1000-memory.dmp

Download

memory/3192-356-0x00000229CA8B0000-0x00000229CA8B1000-memory.dmp

Download

memory/3192-355-0x00000229CA8B0000-0x00000229CA8B1000-memory.dmp

Download

memory/3192-352-0x00000229CA8B0000-0x00000229CA8B1000-memory.dmp

Download

memory/3192-353-0x00000229CA8B0000-0x00000229CA8B1000-memory.dmp

Download

memory/3192-351-0x00000229CA8B0000-0x00000229CA8B1000-memory.dmp

Download

memory/5968-29-0x00007FFEAC2D0000-0x00007FFEAC2D1000-memory.dmp

Download

memory/5968-200-0x0000024DF4AE0000-0x0000024DF4BB6000-memory.dmp

Download