1fdaac46499d97593b30c05bc02c0fc59c62e0b04ec78a99a190fb4ee5be7f0b

Analysis

max time kernel
149s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe
Size 10.3MB
Sample261027-npyhbatves
SHA256 1fdaac46499d97593b30c05bc02c0fc59c62e0b04ec78a99a190fb4ee5be7f0b
MD5 946f237d34ddc4a14d76fa184ad8b7cd
SHA1 e35257976d75feb671fa10eed60813cc2552ac82
SHA512 ef394cf8e82875b454f3c5a9c829fccabdfcad65636125c1ee6612ed1b02bb3fc4f14663586210c2f904ada0a7f92d20f596da2cb923a118029032a4c1880475
SSDEEP 98304:uhJBkIui5TRgiUqfyXLR5kuQJkR22DvG7E:uhJeI/5TRTdfynkhG/Go
TLSH
T18FB69D03E85125E9C5AAD6748A668253BB723C495B3173C77B50F3692FF3BE05AB9300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3396	powershell.exe
4704	powershell.exe
5312	powershell.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Uses WMI to collect hardware manufacturer information 2 TTPs 1 IoCs

Uses WMI to read the system manufacturer, model, baseboard or display adapter, which is often used to detect virtual machines and evade sandboxes.

defense_evasion

System Checks

T1497.001

Windows Management Instrumentation

T1047

pid	Process
3396	powershell.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1936708734\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1936708734\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1946617500\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1946617500\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1946617500\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1946617500\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_2045366184\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_2045366184\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1946617500\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_2045366184\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_2045366184\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_2045366184\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_2045366184\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1936708734\crl-set	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4704	powershell.exe
4704	powershell.exe
4704	powershell.exe
3396	powershell.exe
3396	powershell.exe
3396	powershell.exe
5312	powershell.exe
5312	powershell.exe
5312	powershell.exe
948	msedgewebview2.exe
948	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
3508	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeIncreaseQuotaPrivilege	4704	powershell.exe
Token: SeSecurityPrivilege	4704	powershell.exe
Token: SeTakeOwnershipPrivilege	4704	powershell.exe
Token: SeLoadDriverPrivilege	4704	powershell.exe
Token: SeSystemProfilePrivilege	4704	powershell.exe
Token: SeSystemtimePrivilege	4704	powershell.exe
Token: SeProfSingleProcessPrivilege	4704	powershell.exe
Token: SeIncBasePriorityPrivilege	4704	powershell.exe
Token: SeCreatePagefilePrivilege	4704	powershell.exe
Token: SeBackupPrivilege	4704	powershell.exe
Token: SeRestorePrivilege	4704	powershell.exe
Token: SeShutdownPrivilege	4704	powershell.exe
Token: SeDebugPrivilege	4704	powershell.exe
Token: SeSystemEnvironmentPrivilege	4704	powershell.exe
Token: SeRemoteShutdownPrivilege	4704	powershell.exe
Token: SeUndockPrivilege	4704	powershell.exe
Token: SeManageVolumePrivilege	4704	powershell.exe
Token: 33	4704	powershell.exe
Token: 34	4704	powershell.exe
Token: 35	4704	powershell.exe
Token: 36	4704	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeIncreaseQuotaPrivilege	3396	powershell.exe
Token: SeSecurityPrivilege	3396	powershell.exe
Token: SeTakeOwnershipPrivilege	3396	powershell.exe
Token: SeLoadDriverPrivilege	3396	powershell.exe
Token: SeSystemProfilePrivilege	3396	powershell.exe
Token: SeSystemtimePrivilege	3396	powershell.exe
Token: SeProfSingleProcessPrivilege	3396	powershell.exe
Token: SeIncBasePriorityPrivilege	3396	powershell.exe
Token: SeCreatePagefilePrivilege	3396	powershell.exe
Token: SeBackupPrivilege	3396	powershell.exe
Token: SeRestorePrivilege	3396	powershell.exe
Token: SeShutdownPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeSystemEnvironmentPrivilege	3396	powershell.exe
Token: SeRemoteShutdownPrivilege	3396	powershell.exe
Token: SeUndockPrivilege	3396	powershell.exe
Token: SeManageVolumePrivilege	3396	powershell.exe
Token: 33	3396	powershell.exe
Token: 34	3396	powershell.exe
Token: 35	3396	powershell.exe
Token: 36	3396	powershell.exe
Token: SeIncreaseQuotaPrivilege	3396	powershell.exe
Token: SeSecurityPrivilege	3396	powershell.exe
Token: SeTakeOwnershipPrivilege	3396	powershell.exe
Token: SeLoadDriverPrivilege	3396	powershell.exe
Token: SeSystemProfilePrivilege	3396	powershell.exe
Token: SeSystemtimePrivilege	3396	powershell.exe
Token: SeProfSingleProcessPrivilege	3396	powershell.exe
Token: SeIncBasePriorityPrivilege	3396	powershell.exe
Token: SeCreatePagefilePrivilege	3396	powershell.exe
Token: SeBackupPrivilege	3396	powershell.exe
Token: SeRestorePrivilege	3396	powershell.exe
Token: SeShutdownPrivilege	3396	powershell.exe
Token: SeDebugPrivilege	3396	powershell.exe
Token: SeSystemEnvironmentPrivilege	3396	powershell.exe
Token: SeRemoteShutdownPrivilege	3396	powershell.exe
Token: SeUndockPrivilege	3396	powershell.exe
Token: SeManageVolumePrivilege	3396	powershell.exe
Token: 33	3396	powershell.exe
Token: 34	3396	powershell.exe
Token: 35	3396	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4988 wrote to memory of 4704	4988	2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe	89
PID 4988 wrote to memory of 3396	4988	2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe	92
PID 4988 wrote to memory of 3508	4988	2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe	94
PID 3508 wrote to memory of 1872	3508	msedgewebview2.exe	95
PID 3508 wrote to memory of 2340	3508	msedgewebview2.exe	96
PID 3508 wrote to memory of 2340	3508	msedgewebview2.exe	96
PID 3508 wrote to memory of 2340	3508	msedgewebview2.exe	96
PID 3508 wrote to memory of 2340	3508	msedgewebview2.exe	96
PID 3508 wrote to memory of 3244	3508	msedgewebview2.exe	97
PID 3508 wrote to memory of 5860	3508	msedgewebview2.exe	98
PID 3508 wrote to memory of 5860	3508	msedgewebview2.exe	98
PID 3508 wrote to memory of 5860	3508	msedgewebview2.exe	98
PID 3508 wrote to memory of 6044	3508	msedgewebview2.exe	99
PID 3508 wrote to memory of 6044	3508	msedgewebview2.exe	99
PID 3508 wrote to memory of 6044	3508	msedgewebview2.exe	99
PID 3508 wrote to memory of 6044	3508	msedgewebview2.exe	99
PID 3508 wrote to memory of 6044	3508	msedgewebview2.exe	99
PID 4988 wrote to memory of 5312	4988	2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe	100
PID 3508 wrote to memory of 4460	3508	msedgewebview2.exe	105
PID 3508 wrote to memory of 4460	3508	msedgewebview2.exe	105
PID 3508 wrote to memory of 4460	3508	msedgewebview2.exe	105
PID 3508 wrote to memory of 2904	3508	msedgewebview2.exe	106
PID 3508 wrote to memory of 2904	3508	msedgewebview2.exe	106
PID 3508 wrote to memory of 2904	3508	msedgewebview2.exe	106
PID 3508 wrote to memory of 948	3508	msedgewebview2.exe	107
PID 3508 wrote to memory of 4676	3508	msedgewebview2.exe	108
PID 3508 wrote to memory of 4676	3508	msedgewebview2.exe	108
PID 3508 wrote to memory of 4676	3508	msedgewebview2.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;(Get-CimInstance Win32_OperatingSystem).Caption"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8; $ci=Get-CimInstance Win32_Processor | Select-Object -First 1 # Все реальные видеокарты (встроенная + дискретная), без виртуальных адаптеров $gpus=Get-CimInstance Win32_VideoController | Where-Object { $_.Name -and $_.PNPDeviceID -like 'PCI*' -and $_.Name -notmatch 'Basic|Remote|Virtual|Parsec|Mirror|DameWare|Meta' } | Select-Object -ExpandProperty Name -Unique if(-not $gpus){ $gpus=(Get-CimInstance Win32_VideoController | Select-Object -First 1).Name } $gpu=($gpus -join ' + ') $os=Get-CimInstance Win32_OperatingSystem # Реально установленная память (planки), а не доступная системе $cap=(Get-CimInstance Win32_PhysicalMemory | Measure-Object -Property Capacity -Sum).Sum if(-not $cap){ $cap=(Get-CimInstance Win32_ComputerSystem).TotalPhysicalMemory } $ram=[math]::Round($cap/1GB) $b=(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion').DisplayVersion $caption=$os.Caption -replace 'Microsoft ','' -replace 'Майкрософт ','' [pscustomobject]@{CPU=$ci.Name.Trim();GPU=$gpu;OS=$caption.Trim();Build=$b;RAM=$ram} | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Uses WMI to collect hardware manufacturer information
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3396
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4988.3256.5155955925484563549 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:3508
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView /prefetch:4 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9a8665fd8,0x7ff9a8665fe4,0x7ff9a8665ff0
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1764,i,2704741288995845057,11821933876341499693,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6
    3⤵
    PID:2340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2024 --field-trial-handle=1764,i,2704741288995845057,11821933876341499693,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6
    3⤵
    PID:3244
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1764,i,2704741288995845057,11821933876341499693,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6
    3⤵
    PID:5860
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3468 --field-trial-handle=1764,i,2704741288995845057,11821933876341499693,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6 /prefetch:1
    3⤵
    PID:6044
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2132 --field-trial-handle=1764,i,2704741288995845057,11821933876341499693,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=820 --field-trial-handle=1764,i,2704741288995845057,11821933876341499693,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4372 --field-trial-handle=1764,i,2704741288995845057,11821933876341499693,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:948
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView" --webview-exe-name=2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4516 --field-trial-handle=1764,i,2704741288995845057,11821933876341499693,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:5a7d68b63cfc2334ccbed295eac03a167dc920c6
    3⤵
    PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "[Console]::OutputEncoding=[System.Text.Encoding]::UTF8;$OutputEncoding=[System.Text.Encoding]::UTF8;(Get-AppxPackage | Select-Object -ExpandProperty Name) -join \"|\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 aa9d75f05d953796ee77eff40babda5cb50d75cab0b48e32a3bb8f0ede17ee16
MD5 86a16307486311e1f569d85a7acb2e5d
SHA1 2b8474334c120eb09fa6284fdd061a98c0303794
SHA512 d98ad0fb904eddf3a142590e34417beca4bcfbdbb8171a2bcbbf6f8393b0f9e9025873cc7ee68bf4f68e3b3bd7609c2a322da1bdfafbbbbc762723614f7d188a
TLSH
T1C531F033B39C4199C859143A10CDAE1031B7E7DF84AEDFDB7A91D119742F289CE64650
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2706f7a3cde18304b8eb65dc0fa6d884f09a46a78e320302afda951d20885534
MD5 dc6571b4e39d13392bb7f996d9a95ef5
SHA1 a1838cd4f6a2a1ff743489171ba9f83c662362c7
SHA512 5e2582268c12399a5b29751932d896eb47931478bbafa197faf15d26470a589e1892887a85e7061e431ad8163259ee00682e34c167e9ca204ffd33c888a35f63
TLSH
T199219833F3DC8214CC99003A10DDAC1036B6C7CB40DECF9B6B85E159A82F298DF60160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_00kkbggr.y2b.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_00kkbggr.y2b.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

3b6e1dd4-aed6-4107-8d08-3091bcc7cf38.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\3b6e1dd4-aed6-4107-8d08-3091bcc7cf38.tmp
Size 3KB
SHA256 85a98e96610832c46daf6283466c7e2151d9d4fca60c63d18962af3e15b7e751
MD5 1c9c8c3d0bfa09a507b410d6968d15bc
SHA1 2dd809688b036483ebcea630a8f9ec7d3e634e62
SHA512 d8e24bd1b86bb0f2e445c257c1897c8e0acb8deba0fa51b157b88ea4a99343c74442e37a2a8a93a566b429ecc4b301ef053d60c2cf165a2312d3b87f9a2dd547
TLSH
T10961623BA974EA778DF2DB04B8862B16ABA59027E9853F55C6EC0F0C01D73881356C17
MD5 SHA1 SHA512 TLSH

Submit Download

3e5c27fb-630c-4f01-95be-777f0c90b1fe.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\3e5c27fb-630c-4f01-95be-777f0c90b1fe.tmp
Size 3KB
SHA256 84ca329e3dd464d99a4eb4b25aaa4eb11835c6e043be0d91f2139b2c3ebcabf9
MD5 b66e9cd4d1bd565c6448947b620714d4
SHA1 44b7a7fcbf0e859dc2558de862aca85d3da369d9
SHA512 e8fc966a1e7f0ea2547e9162e0ac948b36e9e6756c8282350b0b7283aae25146e30e4b56bd681db952cec6c7561acdb6d895f34a9f2c8a967d370b7ad8dc7c61
TLSH
T10771633AA974EA374DF2DA04B8863B03ABA59067E9853F95CAEC0F0D01D73881346817
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c33e63795a9f9b7b6d9cf55c84cee61ed69235138200b0a55f1152731c556ec0
MD5 199319d7c461d8fff3588f07b5772558
SHA1 c9475bd21f6908b372b023357d5d458db62e5529
SHA512 ef94e1c890845072799893e271ccfecbcdb99583045b1bcf53d0024a8e3d891f0d8f9e1a9de03ad4baf6eaebe83b5eb83f3a9e2dc614c6404b331b5322435d9c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 36160ae2757cb7809940df307dbab58b0aa416e5fa19e5931b1cb04eea32f431
MD5 373a1b9f8cf3171fd4a84437b1ae708a
SHA1 e6281f47b3ea52596b918a6796d898e692c79978
SHA512 bb309d3757effc0a4dcd1bbc09549449a372d2ece080bbb14f5ecb594eaadbb22a96a38d867a6a083539e54b26ba6d87619f106169f50ec24b83466ee3f8b067
TLSH
T11DD01123B2220238C32020330022A38C0800C20F838AAA02A8388AAE2A880A80E02882
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

61167e19-c185-402f-9c33-18a89cb6dc09.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\61167e19-c185-402f-9c33-18a89cb6dc09.tmp
Size 6KB
SHA256 b4e7a7cec87af04275fd66ce9d5c42645b378ba53e15bc9ccd1d7671d08c021c
MD5 004f3584a55bb2d01a2e286298f88011
SHA1 5d2a147eb77c0f02f8d6d5f24fea4258fa219786
SHA512 a4780007248a947db246c2119f6f32a13831b87d66eaf55653293eeb49d390cc6662eef7244ca082e877fac714341933bce1db338b5e75fee4b5ae627ea4035b
SSDEEP 96:stQ/dWVuGdOb94k+o5h16Zdss7/x+6MhmuecfB/1ejeAK+g528XM1C7K:stEM1XToKssV+FLB/QjgPG6K
TLSH
T1B2D1A9015E2479BB4CCBE619BE35BB13E2F5A47161D51E58E7FC461C08EB6DC220B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 72B
SHA256 840eb57e88d24b476f050031fdef1111a31b6821ad4dc55ee1dc18ecfe278d31
MD5 8cfd433a28ea0124ed359382dc99026d
SHA1 be339978d59c6a80613006d88c42a8ade3dddb80
SHA512 155c296d3b907550427a920c3e7c3e042491a8ba1c73d99bf619b42f63e4ad911e96487d9ad5ba66277eed33b8bf7407d4eeffb10f94248ce23be96d852ef709
TLSH
T134A0023125909147D3C08B7024D543A033B4983D5E23CF5170950174DDD03804D11406
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 636c596f8f991ca8e82e75a0382742615952d97ff4ded40e8684429b5d28abe1
MD5 9c3d3fb169b0bf460eb5d30480a030d1
SHA1 eb8ae3dfe211afee3e82cf4b1eb45a8aa8cda170
SHA512 ed14af2bc8d6ba02c78abaeb9c7646a50b3713cda635082be210a5f8d6328dd659eaeaef2458cb8e737b5d2335fa89e1556536b71e5154bf996a17051cfb435f
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d45c171a-9f8a-430a-a159-01b16eae6fb6.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\Network\d45c171a-9f8a-430a-a159-01b16eae6fb6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\Preferences
Size 5KB
SHA256 579c3bcdc1683c3ea1ede5075f15b0a1dd61e9ca409a8ece7cb4bf392e75d7d2
MD5 0c2fec7c6dc9ca7c54be7fc84d714054
SHA1 b407a106b0362875039b7968d2b39140443e2096
SHA512 e7e9d65f1cc347242d91df53085700e0c844dbbe66c56b63ea6f689f33f015adad175595d814af73dfaea15aa6e477ab2ad8c6ef11a4b1e1710090ed73874c80
SSDEEP 96:ri/dhsVPdOb94Lgdo616ZZs7/x+6MhmuecmjeAK+g228XM1C7K:r6gjXKojsV+FijgsG6K
TLSH
T19AC196015F24697B4CC6E609BA357B03E2F6903235D52D58E7FC866C08DB5DC621BD0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

da6edcc5-67fd-4807-971d-dde44eccb9ec.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Default\da6edcc5-67fd-4807-971d-dde44eccb9ec.tmp
Size 6KB
SHA256 078954b76df8ff912b6340cd29fa2b399bc3c7fdaf0c39e3cc6dc750bb6d8cbe
MD5 b770aa8fbfad7d83a25812c8246cd074
SHA1 b63227959b7b32f626e68c0fb1073348eadc36a7
SHA512 e5703cfbbd102f494b813d4d81a92c0614aec7e1f52ebcb82945d63092dd39daf491b63dcf83887ad892081bbd3bf6e1d4f214829fc48f753e69f81ab6da617f
SSDEEP 96:stQ/dWVPdOb94k+o5h16Zdss7/x+6MhmuecfB/1ejeAK+gH28XM1C7K:stEMjXToKssV+FLB/QjgVG6K
TLSH
T177D198015E24B9BB4CCAE619BA35BB13E2F6A07171D51E58E7FC452C08E76DC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Local State
Size 1KB
SHA256 859131cfadf014cc1cd1f48e22037dd36d2e0d0e9eb17b40512166883586be59
MD5 4acbc45e2d22171f2d4246ada9d9c519
SHA1 0c43f352709bf031b141184ad6295d1eabc49f89
SHA512 221e63a10c5687258560a7cb434551ff9df2adf3dc781d243aece47cfaca2a59520f248c41f7e4f41361c1d11d4cd4da0799b432e866bb3ddff18501e3cd71c5
TLSH
T193216577D4789B32ACA5E34920063F578F71506B86454E0092DE4B1D11E724DA26F936
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\Local State
Size 15KB
SHA256 052000a53fadcd85f7a0c94afc021ba79fb388b8e46e97321f7e94c33d085511
MD5 4ed8034e8d1cdf956ed433424163cd21
SHA1 511c0756c464a899788553c818e24eaaa3c0ea5e
SHA512 d5b85abdadcba9eca0c4ef73576db07787b8f508134191b527c56e76982c2e130a52831a93a8f3beb260fd226c0af9c5112fc4d82fd7aab724ba124d1c4eb118
SSDEEP 384:9+OBqImmJvGBLx3NaFMJFNNBSBP8FL9+g6ro:wcvGtlN/J9I8
TLSH
T1AB72AE7B2C656A232CFBC609BA8E6747CB616253C4D57BD4DDEC9F0F102B5441352905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f276c12a-6a0d-4f0d-a35f-17312b3653ff.tmp

Path C:\Users\Admin\AppData\Roaming\2026-10-26_946f237d34ddc4a14d76fa184ad8b7cd_coinminer_dosia_frostygoop_glassworm_hive_icedid_knight_.exe\EBWebView\f276c12a-6a0d-4f0d-a35f-17312b3653ff.tmp
Size 2KB
SHA256 71e78caa000af361673249674eb547dfc9955f869690b22b31045ba82b35a509
MD5 011b81342d7c766bf7321327e19b46b6
SHA1 3a5169792c9f70b08269467f1bafb1631cac1207
SHA512 c0c8172e81a1f69530dc9f35f99a52e70939ce499e6a14668df13b363306a0b2ce4d76098e3aa669331ce8e6d28230070ddfbefdae8a26603fe96a86130377b8
TLSH
T1A4519533AC28AB7799F2C748780A3F23CF7590669E561F1096DD0B1C00E765C234AC2B
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_1946617500\manifest.json
Size 80B
SHA256 abe933f0db95b1a75786da21de82feb5270ffa7ae072270923da2437710d93ba
MD5 3790d9257ba14f8be2ba08acf259a57f
SHA1 c54ab2e79d0ac9dc27425c7450e01ad593f02d60
SHA512 9568fef732369f06aafd8270638a38531a26f6f40a1c7c65fb7254eed36807789756e1c6efabaec86017b3decead2773de9ef5814650dbb334e6000ebd44a467
TLSH
T1A8A012605811E13310C403700260438243E01C112015240405461140218823713A3129
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3508_2045366184\manifest.json
Size 1005B
SHA256 1cc15465230ffb75fd028ee3b2189c8774f56bc7dee8dd17b952e6ca92144004
MD5 58954048e70c81669675d4f87ab50af1
SHA1 8ab675ea31801bbb91c33fd381f4c202bfd7882e
SHA512 f9b8c236c9404936b93ba92550c21a0344b657c42cd98e091cda32e33fed860d59ac0cb97451ca61b2d8e6a943a983ded569b1d7ecd541e832e3ca87b39ecbd0
TLSH
T161115E00DD384DD326D4B6A21CC6580957661DAF5CC27E54379E161D4F1C8AB927376C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/948-421-0x000001E434300000-0x000001E434301000-memory.dmp

Download

memory/948-422-0x000001E434300000-0x000001E434301000-memory.dmp

Download

memory/948-426-0x000001E434300000-0x000001E434301000-memory.dmp

Download

memory/948-425-0x000001E434300000-0x000001E434301000-memory.dmp

Download

memory/948-424-0x000001E434300000-0x000001E434301000-memory.dmp

Download

memory/948-417-0x000001E434300000-0x000001E434301000-memory.dmp

Download

memory/948-415-0x000001E434300000-0x000001E434301000-memory.dmp

Download

memory/948-423-0x000001E434300000-0x000001E434301000-memory.dmp

Download

memory/2340-114-0x00007FF9D4370000-0x00007FF9D4371000-memory.dmp

Download

memory/3396-171-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3396-142-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3396-184-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3396-179-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3396-48-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3396-186-0x00000229FB4A0000-0x00000229FB9C8000-memory.dmp

Download

memory/3396-188-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3396-185-0x00000229FADA0000-0x00000229FAF62000-memory.dmp

Download

memory/3396-47-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/3396-46-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4460-350-0x00007FF9D4490000-0x00007FF9D4491000-memory.dmp

Download

memory/4460-349-0x00007FF9D38E0000-0x00007FF9D38E1000-memory.dmp

Download

memory/4704-16-0x000001BAEA4C0000-0x000001BAEA4CA000-memory.dmp

Download

memory/4704-11-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-24-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-1-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-5-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-4-0x000001BAEA400000-0x000001BAEA422000-memory.dmp

Download

memory/4704-6-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-7-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-8-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-9-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-10-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-22-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-21-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-20-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-19-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-18-0x000001BAEA500000-0x000001BAEA524000-memory.dmp

Download

memory/4704-25-0x00007FF9B2A00000-0x00007FF9B33A4000-memory.dmp

Download

memory/4704-0-0x00007FF9B2B8F000-0x00007FF9B2B90000-memory.dmp

Download

memory/4704-17-0x000001BAEA500000-0x000001BAEA52A000-memory.dmp

Download

memory/4704-15-0x000001BAEA740000-0x000001BAEA7F2000-memory.dmp

Download

memory/4704-14-0x000001BAEA4A0000-0x000001BAEA4BE000-memory.dmp

Download

memory/4988-29-0x0000029F681A0000-0x0000029F681C8000-memory.dmp

Download

memory/5312-289-0x000001BC630A0000-0x000001BC630C6000-memory.dmp

Download

memory/5312-288-0x000001BC62E30000-0x000001BC62E38000-memory.dmp

Download

memory/5312-286-0x000001BC62E20000-0x000001BC62E2A000-memory.dmp

Download

memory/5312-285-0x000001BC62C10000-0x000001BC62C16000-memory.dmp

Download

memory/5312-284-0x000001BC62C00000-0x000001BC62C08000-memory.dmp

Download

memory/5312-283-0x000001BC630F0000-0x000001BC6311A000-memory.dmp

Download

memory/5312-282-0x000001BC63050000-0x000001BC6306A000-memory.dmp

Download

memory/5312-281-0x000001BC63260000-0x000001BC63464000-memory.dmp

Download

memory/6044-168-0x00007FF9D4370000-0x00007FF9D4371000-memory.dmp

Download