90bc42881701c5be22be13b4f962708f09cb7b2e3a4623473da5e17550ee4b1f

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 07:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift (1).exe
Size 19.3MB
Sample260707-h4wpdact2t
SHA256 90bc42881701c5be22be13b4f962708f09cb7b2e3a4623473da5e17550ee4b1f
MD5 0033b392c5624d739c95af6cbb56d778
SHA1 837df1989cbb4887f067d8faf167e13a437162f4
SHA512 0930d1cd2d5baffa8ec2a817c5a9e3ce63684906dbdf63b1c073d013071f7f99b807a6c1116538d1444fbb05010085310c23c76cf497dc7c2eb9b09722ef2049
SSDEEP 393216:H4TWihKOqnU9jpjI9JT4YNIGiapB89/9RQXuab0TlRVnK2UvWiDYY:YNqiI9llNIdapBqFUdDYY
TLSH
T13717332B412AFD95C5402BB6EC226D56708B557C0E462366787F0FF25D8730FBBEA482
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Swift (1).exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
65	2396	Swift (1).exe
69	2396	Swift (1).exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Swift (1).exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Swift (1).exe

Loads dropped DLL 2 IoCs

pid	Process
2396	Swift (1).exe
2396	Swift (1).exe

Themida packer 15 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2396-5-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-6-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-7-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-8-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-9-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-10-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-11-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-12-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-16-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-21-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-218-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-259-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-305-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-327-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida
behavioral1/memory/2396-421-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Swift (1).exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2396	Swift (1).exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2660_1044482974\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2660_1792311450\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2660_1792311450\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2660_1792311450\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2660_1044482974\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2660_1044482974\protocols.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278823574680903"	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2660	msedgewebview2.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2396	Swift (1).exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2660	2396	Swift (1).exe	85
PID 2660 wrote to memory of 4692	2660	msedgewebview2.exe	86
PID 2660 wrote to memory of 3056	2660	msedgewebview2.exe	90
PID 2660 wrote to memory of 3056	2660	msedgewebview2.exe	90
PID 2660 wrote to memory of 3056	2660	msedgewebview2.exe	90
PID 2660 wrote to memory of 2832	2660	msedgewebview2.exe	91
PID 2660 wrote to memory of 3348	2660	msedgewebview2.exe	92
PID 2660 wrote to memory of 3348	2660	msedgewebview2.exe	92
PID 2660 wrote to memory of 3880	2660	msedgewebview2.exe	93
PID 2660 wrote to memory of 3880	2660	msedgewebview2.exe	93
PID 2660 wrote to memory of 3880	2660	msedgewebview2.exe	93
PID 2660 wrote to memory of 4756	2660	msedgewebview2.exe	117
PID 2660 wrote to memory of 4756	2660	msedgewebview2.exe	117
PID 2660 wrote to memory of 2316	2660	msedgewebview2.exe	118
PID 2660 wrote to memory of 2316	2660	msedgewebview2.exe	118
PID 2660 wrote to memory of 228	2660	msedgewebview2.exe	120
PID 2660 wrote to memory of 228	2660	msedgewebview2.exe	120

C:\Users\Admin\AppData\Local\Temp\Swift (1).exe
"C:\Users\Admin\AppData\Local\Temp\Swift (1).exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Downloads MZ/PE file
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=RemoveRedirectionBitmap --lang=en-US --mojo-named-platform-channel-pipe=2396.5032.352124779826097649
  2⤵
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\swift\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffcf4acb078,0x7ffcf4acb084,0x7ffcf4acb090
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1832,i,7984273767277090400,12237399783175324446,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2136,i,7984273767277090400,12237399783175324446,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
    3⤵
    PID:2832
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1900,i,7984273767277090400,12237399783175324446,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
    3⤵
    PID:3348
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3556,i,7984273767277090400,12237399783175324446,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3664,i,7984273767277090400,12237399783175324446,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:8
    3⤵
    PID:4756
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,7984273767277090400,12237399783175324446,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\swift\EBWebView" --webview-exe-name="Swift (1).exe" --webview-exe-version=0.1.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4228,i,7984273767277090400,12237399783175324446,262144 --enable-features=RemoveRedirectionBitmap --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
    3⤵
    PID:228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2660_1044482974\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2660_1044482974\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

ntdll.pdb

Path C:\Users\Admin\AppData\Local\Temp\Symbols\ntdll.pdb\96EF4ED537402DAAA51D4A4212EA4B2C1\ntdll.pdb
Size 1.5MB
SHA256 25425ac4b85a72123fc0ccdcca4b75947e5f39fa0f369ab4c0fca4a3bbdd6189
MD5 d09b58cfbc344a0696116962c27fff11
SHA1 ec6d4f80bb407083243c054264218d2fecce4091
SHA512 af011632ebf61f902e033aea4a58b1a50e0cb5fe41f5d5ab9ff076e385cab0a5102aed44fce9d912b9dc115f61c7c7aa9b41e0f7d66f5c3c60aca42623c4847d
SSDEEP 12288:EwDSf2YDQOOoJ/qkhmr4Fk1BUVaV+CI+WzZQx:D+fwu5hmMG49VFQ
TLSH
T10575F726B786BEF3E80A467EE017071EE7B8CAC053A583D7B94473A61CD62558F6D310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msdia140.dll

Path C:\Users\Admin\AppData\Local\Temp\msdia140.dll
Size 1.4MB
SHA256 26295cdc39ec335323a74ee2c5d3df238926cd4e4a53aa39cfc15232165262f2
MD5 da3f8ac9aeea2931c655ca33d0b4a7c4
SHA1 04b10aa54f2f80fdea61a41ffc71efc9c37cf930
SHA512 9e9aa019def12ab343939c4dfcfeda5ef850dad50327f248a507ce19c36ee37c427d5d2a98c421401b63872f7b86ee99b087dfb1e697467a4435eca388fffcbb
SSDEEP 24576:keWnRymMrBp4L+xldZhcJEMm5zGR/C+TAjRKHxdaExC:keWdMrkKzGrTAjRKHGv
TLSH
T150656C5BB2E440A8D56BC178CA1B8A06D7F67805032097CF17A8476EBF27FD52A7D360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Users\Admin\AppData\Local\Temp\symsrv.dll
Size 193KB
SHA256 51da071bab34abc9db349b471f24e06697cfa65f6f74e4cd995e09cf9e96bc35
MD5 cae67c24308aa631784b44096727f5c5
SHA1 6248ffc8d8b852da4318140480cf1c044fac5ff2
SHA512 0bf3fb2cb5632ce0099cb099b6c10fd9e083c006cbefdb1333c8b7c162b22c31d57528cf4633eab07e5c8cfe4efd13a382f6aef1b7b8c62273cce8ca3df08292
SSDEEP 3072:Dh89cklYH7jh4y7IdvfXpDw0/6+RJa8KNMm9qTuyb/kdR+Hco6Pg:DSfA76y7Q3Xy0iUb8dtg
TLSH
T18414E71273E80069E566B6788EA7CA06E772B9A45771C3CF0160856F4E9B7D0EF34372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\swift\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c38f74a4dc79e2de8f3d48f10db4e71c3ce76bb9bb30ec7a57e3cdc6143b4432
MD5 9640345032f869df0bedf65ea1d7ab89
SHA1 ecdb0717814b42a5af071a9581f581cd0108b9b1
SHA512 6f01bf192318d5182a7174da856734aac030719f070ad4ec9a09fc3f851db16710e6fcf076ff76ef55d6feef4276579678a9280c6882748cfb4869eabe07fb88
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 890987954b1a6dbc061eeaf3673682333c52e4431895d822d02dd25e494e5140
MD5 fa8fd2d580a97d3f4d0f20c9d5762e1f
SHA1 44407e884c0833ab063f32ef8eb2c00d40dbd88e
SHA512 ea7ad4d478d371d29c59a1760f4e3d91b737ab0a58e55bb2d4fc3bdfbbf6fdab996e70ae70b22c465e5b4b97d9ae7a32ff7a9e61aa3903f6bc305d777e24817a
TLSH
T107D0122273110974C01025331102A1481800C61F804941445C28855D2B090500907841
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 ccc2b6bd2f2a7358c12c74da8b63c27681fc52d32226d04757cc852571ac3196
MD5 f0b3c08db2e6c48adfe5d97d71cc8c3d
SHA1 990a787faeac5af4398c3b3945c4010b818b390b
SHA512 a60c21b53d64a3a8a659404d11ab2c3b7ee998f7c11fa3183830d445b43752d30dc99d8447e12ec1ab3d3098a5aefa7b9873e1405088e0d81f9ae0b2de6bf54a
TLSH
T114E0A761FF4D14C1D72032F441CE1757757848F0F5370F08325425B86640310C74C1C5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5943d5.TMP

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5943d5.TMP
Size 48B
SHA256 080ab90069eab3292b18845f659aa1dd6a26ac7f9618b60c63a4538f77b68f5d
MD5 b6fd29215e9d2ec705502754edbdfd30
SHA1 261ef6ad1c2c194568adac40c8d597e0187a1bb4
SHA512 0239f1227684548eb819c3575992eef64621c31dd33cae07b4d9dd4e4f40bbfeae445a3058bdb3e7eb2ca22b0f815f4f3da5f0eadca5ed7283e6980a7cdfb6df
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5a06d7.TMP

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\Network Persistent State~RFe5a06d7.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences
Size 6KB
SHA256 1de74127c6d0a2459a4e778daff54d9384cef345054b4b41dbfc7427d7d89ec7
MD5 083b117d2f3bcdc603b1cb0f4f94796f
SHA1 71c7ce75fb71d77d2f1900be10a60330d1017caf
SHA512 863800540f6422e1f2d49a0c4da96913b28cb37bf4a110e94e963c06569fb474796591ba79238dd72ee6d243a34fb9ad178332d252b5dcb5f3308c190c8c5738
SSDEEP 96:stg05diuSbBb9Nff5Z8i0vhEZktLm/7qx+WVHMSm+uecJTn1idQjE+gPkMEB:stg0GZxfxZ8paAa/S+WiTTnwd5NkM8
TLSH
T1AFD1A6035E68AD774CC7E619BE35FB52D2F6106262D50E58EBFC861C09D66CC630790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences
Size 6KB
SHA256 e36f5f234422875a3173aa59e41349c477547a8ea5a6d88ad706e6c6f7da928e
MD5 8cf17e56cd73b6fa95a59b5de7917c2a
SHA1 7d1dc50eb8a3870497bef9c11b8d44443fcefd19
SHA512 dfa8a08e9f6450d1387945d2e4fadc6466be2b47fdcdc731dde17830b3cc879c7b72755bd19f9a45c5b92d02a8d8d2b56b11c8875c69caa9a48fcbcd71bf88b2
SSDEEP 96:stg05diuSbBb9Kff5Z8i0vhEZktLm/7qx+WVHMSm+uecJTn1idQjE+gF5kMOB:stg0GZGfxZ8paAa/S+WiTTnwd5z5kMC
TLSH
T1C7D1A5035E686D774CC7E619BA35BF62E2F6102262D50E58ABFC871C05E76CD620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe593118.TMP

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Preferences~RFe593118.TMP
Size 6KB
SHA256 e507e7a3a5bd505f82a5dfbe27f7b4ccb7308cd6da88110280122a3c65651116
MD5 c19f677067aeaf72d1cf82d23f7517a9
SHA1 849a14c92c6c00c6604b32d89b4c4a0c509526e9
SHA512 946b5e1c94112c08bc6b7da57b8f5f05d151f25e70f3a02225fa01fd678dbade935094acdc257e05effa91d9cdecf72d8047d86d0cddc3e002cef3c96ed55148
SSDEEP 96:stg05diuSbBb9NffldZ8i0oEZktLm/7qx+WVHMSm+uecJTn1idQjE+gPkMEB:stg0GZxf3Z8pFAa/S+WiTTnwd5NkM8
TLSH
T1EAD1B6035F68AD7B4CC7E218BA35BF52D2F6102162D50E58EBFC871C09D66CC620790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\swift\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\swift\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\swift\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\swift\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 16KB
SHA256 1bc40910c7788bfaefebe99295ecf2d1d89ade55309dd080c8a0573ef51adc82
MD5 d29699c0b6912c966f7c4e83c525d0fb
SHA1 f81d9d443bd5f84cb781ea4ec5f53e74c33bf851
SHA512 8a95ef23caf8b2e7b89258581029a4ac30e83bcba22dac33390a7807dc0aadd9fff2779998d86747cd2b688779e187793f18b6faef4165167b236d08a97aac2b
SSDEEP 384:zNsrv+89zHqlDNP9oid6NbzNzk6lXCnwyCN0:Grv+4UNbdoblXcwyCN0
TLSH
T175729D33A5689B339DF29948F88A6E177B78615681D20BF8DAD90F8D42DF0D92302D13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 1KB
SHA256 2bc306373a8656002fd2d6f73a07febc635dfae1b8b282f67632293ed9dcee98
MD5 1d9fa89aef38317988fe342beec2ec14
SHA1 7698ab4c3d1bcbe541fd3aa302b9c227a7a042fb
SHA512 38d5cee2b98186351586cdc34ad8f5c1cef1607a8916f57fea6a3b96b0938c7f0912e2b5a001ed2acbe241c650f1950c4a29524ee8db08af8cd871d9d25a024b
TLSH
T19D316573D4986F32BC819981F50E3B575E61202AC2318F48A2DE4B0C13EB6DCD626C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 2KB
SHA256 36c28eeb6becf3a84847661da5fbcca697ba0b3f9357e05fd6ec84736dd32f7b
MD5 9f9d0d4cd6cb0c2c38586698ce14c615
SHA1 47185a3bb54d207d251057b6feca27e1f90cbfd2
SHA512 7fb82a0a1c4e4b2314aee74949648e22780c8b3eac2d73f20e6897a07de2f02ba04d54d61e65d1ff34aa6a59faacf46c72b6130dadb775b914aa6b2f3ba77d30
TLSH
T123517473A848AE369DE28944FD4D3F23DA756165D6611F54AADD0B0C02DB6DC5302C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 4KB
SHA256 bc729fa8b394bb1b353464914b64a7707d0cd465d7c2c7ca29582ce2517ac3d7
MD5 6875a06d2fe35a230d41ec7e15f82aa4
SHA1 c06ff9fc6f98c109bda46de447bef471bb5b4037
SHA512 b7e3b877d57a327aec1b80dc40e12588f7b34bd3b1eb234614335dead6474e016f648dbeb535e7f359d9d7c53ef9eae5871b0534630ee88f6b0379433b6f0573
SSDEEP 96:zuubNkCEIfWcJLE8Frh/cInURoDoto+5FlDLUBkZY685+ZbWllaODZETCnl0a:zDbNbkOnooDUh/LYkZ6lltN8Cl
TLSH
T1A8919523A864AE279DF2D945FD492F13A6A15027D5A56F98DAED0F0C02DB3DC1342C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State
Size 3KB
SHA256 2f2cde666a0216a9ec9b373b2f6599cee7a89837e16f6e75c9bf2df48a3d6311
MD5 e3d164bf26ecb97f6735bf46fde12d40
SHA1 cc5f301c368f2f5d1d7bc0c4015cba2c754c3507
SHA512 30c9f54bc15990d7202d3762bb77fea6b5fb065245c1ed7d4de52b2a43a34ce8260c4ced3acbffc2f004d9ad55651f5ba18e61e3e97b870eb8fd8a7ee8cb281b
TLSH
T167719623A868EE274DE2DD44FC892B16B7A55127D6913F98DAED0F0C02DB3D81342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58d627.TMP

Path C:\Users\Admin\AppData\Local\swift\EBWebView\Local State~RFe58d627.TMP
Size 1KB
SHA256 7cb29ca4155b6fed8987e1bdb3a4462b3903163989b5da9358e39a9176e538d0
MD5 16cb52ec859f7106723a38aaa7ce4cfb
SHA1 f6ea734439e8a0728371fb55b1f42615caa30eef
SHA512 2a50f427900f604c13836a8256a49b220e3245da0ba7195ce5de4a30a59378342c92a81f698330064e5a6fd4c4e89b3dd728acf5f7ef65892f25f6af84ab30cb
TLSH
T155211573D4986E31BC818851F51E7B471D60502682214F0CD2DE471C12EB6DCC763C37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2316-403-0x0000016CE1A10000-0x0000016CE1A3B000-memory.dmp

Download

memory/2316-398-0x0000016CE1A40000-0x0000016CE1A41000-memory.dmp

Download

memory/2396-327-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-8-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-421-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-5-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-6-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-217-0x00007FF6048F4000-0x00007FF605E70000-memory.dmp

Download

memory/2396-259-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-7-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-21-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-218-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-16-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-12-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-11-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-305-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-10-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/2396-2-0x00007FF6048F4000-0x00007FF605E70000-memory.dmp

Download

memory/2396-9-0x00007FF6030D0000-0x00007FF606B17000-memory.dmp

Download

memory/3056-41-0x00007FFD10990000-0x00007FFD10991000-memory.dmp

Download

memory/3056-241-0x0000019866A30000-0x0000019866ADC000-memory.dmp

Download

memory/3348-102-0x0000027518BF0000-0x0000027518BF1000-memory.dmp

Download

memory/3348-242-0x0000027518BC0000-0x0000027518BEB000-memory.dmp

Download

memory/3348-101-0x00007FFD11000000-0x00007FFD11001000-memory.dmp

Download

memory/3880-243-0x000001D22AE10000-0x000001D22AEBC000-memory.dmp

Download

memory/3880-128-0x00007FFD10990000-0x00007FFD10991000-memory.dmp

Download

memory/4756-357-0x000001CA43DD0000-0x000001CA43DD1000-memory.dmp

Download

memory/4756-366-0x000001CA43DA0000-0x000001CA43DCB000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads