Overview

overview

10

Static

static

3

2026-07-23...yn.exe

windows10-2004-x64

10

2026-07-23...yn.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/07/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe
  • Size 16.6MB
  • Sample260723-rak58abc94
  • SHA256 c88559d848605be3553c40c9347396eedfded0b2d640764cb5b2144b5dbf19b4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoverypersistencepyinstallertrojan

Malware Config

Signatures

  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Executes dropped EXE 7 IoCs
  • Loads dropped DLL 24 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    defense_evasiontrojan
  • Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 16 IoCs
  • Detects Pyinstaller 1 IoCs
    pyinstaller
  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 32 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3548
    • \??\c:\users\admin\appdata\local\temp\2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
      c:\users\admin\appdata\local\temp\2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:936
      • \??\c:\users\admin\appdata\local\temp\2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
        c:\users\admin\appdata\local\temp\2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Checks whether UAC is enabled
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5760
        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe  --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --disable-features=ElasticOverscroll --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=5760.5580.15134759962433249226 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a
          4⤵
          • Drops file in Windows directory
          • Enumerates system info in registry
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of WriteProcessMemory
          PID:1264
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView /prefetch:4 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x180,0x184,0x188,0x15c,0x194,0x7ffa52925fd8,0x7ffa52925fe4,0x7ffa52925ff0
            5⤵
              PID:5924
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1740 --field-trial-handle=1744,i,2422967150961076241,16696021642790562415,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:2 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a
              5⤵
                PID:2468
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2068 --field-trial-handle=1744,i,2422967150961076241,16696021642790562415,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:3 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a
                5⤵
                  PID:2644
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2320 --field-trial-handle=1744,i,2422967150961076241,16696021642790562415,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a
                  5⤵
                    PID:2616
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3472 --field-trial-handle=1744,i,2422967150961076241,16696021642790562415,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a /prefetch:1
                    5⤵
                      PID:5480
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=1264 --field-trial-handle=1744,i,2422967150961076241,16696021642790562415,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a
                      5⤵
                        PID:4712
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4504 --field-trial-handle=1744,i,2422967150961076241,16696021642790562415,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a
                        5⤵
                          PID:824
                        • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                          "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4516 --field-trial-handle=1744,i,2422967150961076241,16696021642790562415,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a
                          5⤵
                            PID:1852
                          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView" --webview-exe-name=2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=4632 --field-trial-handle=1744,i,2422967150961076241,16696021642790562415,262144 --enable-features=MojoIpcz --disable-features=ElasticOverscroll --variations-seed-version /prefetch:8 /pfhostedapp:99cbae25258d9711405b38f3e8b12ff259b0fa9a
                            5⤵
                              PID:6060
                      • C:\Windows\Resources\Themes\icsys.icn.exe
                        C:\Windows\Resources\Themes\icsys.icn.exe
                        2⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • System Location Discovery: System Language Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2940
                        • \??\c:\windows\resources\themes\explorer.exe
                          c:\windows\resources\themes\explorer.exe
                          3⤵
                          • Modifies visibility of hidden/system files in Explorer
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Drops file in System32 directory
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious behavior: GetForegroundWindowSpam
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:3100
                          • \??\c:\windows\resources\spoolsv.exe
                            c:\windows\resources\spoolsv.exe SE
                            4⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of SetWindowsHookEx
                            • Suspicious use of WriteProcessMemory
                            PID:676
                            • \??\c:\windows\resources\svchost.exe
                              c:\windows\resources\svchost.exe
                              5⤵
                              • Modifies visibility of hidden/system files in Explorer
                              • Executes dropped EXE
                              • Adds Run key to start application
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of SetWindowsHookEx
                              • Suspicious use of WriteProcessMemory
                              PID:3740
                              • \??\c:\windows\resources\spoolsv.exe
                                c:\windows\resources\spoolsv.exe PR
                                6⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of SetWindowsHookEx
                                PID:4128

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
                          • Path C:\Users\Admin\AppData\Local\Temp\2026-07-23_0b6efe6ecee439f52143c4499e53d6a1_cobalt-strike_elex_glassworm_icedid_njrat_swisyn.exe 
                          • Size 16.5MB
                          • SHA256 67982a0a29eccc920bacf72b94a1bce7adf5e9810ba2843a9f9663232fdaeeb5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\VCRUNTIME140.dll
                          • Size 117KB
                          • SHA256 052ad6a20d375957e82aa6a3c441ea548d89be0981516ca7eb306e063d5027f4
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          VCRUNTIME140_1.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\VCRUNTIME140_1.dll
                          • Size 48KB
                          • SHA256 6a99bc0128e0c7d6cbbf615fcc26909565e17d4ca3451b97f8987f9c6acbc6c8
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _bz2.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_bz2.pyd
                          • Size 84KB
                          • SHA256 b3dd7cea6d03342252834cebcc814af37d850b86d0627fa22b7f6990882f2f8b
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _cffi_backend.cp313-win_amd64.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_cffi_backend.cp313-win_amd64.pyd
                          • Size 176KB
                          • SHA256 91a8b18110a0ca95026e77b27bcaa3bcab6ecafbd22580c4fc29eac2e6e744e6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ctypes.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_ctypes.pyd
                          • Size 130KB
                          • SHA256 dfa65498c77e71f038883337d2b5ffd92508489e79e6ee5e96ddec4ecf2a7fa1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _hashlib.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_hashlib.pyd
                          • Size 67KB
                          • SHA256 1a3010b06c2fcd625dece3dd0883ca060e98b94adc062b06cb1a671cfc3b5caf
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _lzma.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_lzma.pyd
                          • Size 155KB
                          • SHA256 f20be6a9fee8fb5d53170c4bc24a39b48d3c0ccbe8e2000e60ff7d65b77c6ea1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _queue.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_queue.pyd
                          • Size 34KB
                          • SHA256 1e349a13913370369059a4ae5951157112b5eba53ed4389c18ffc5e00af1a037
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _socket.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_socket.pyd
                          • Size 84KB
                          • SHA256 127a39d2198f17dd9b573904fe7e4040c7c8718753e6c4edee2ff6c35f487fac
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _ssl.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_ssl.pyd
                          • Size 177KB
                          • SHA256 faf716d309349dbd54efd7fb402bd42ed21a537614ac0da89ed92ba307ecbf15
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _uuid.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_uuid.pyd
                          • Size 27KB
                          • SHA256 6748c182df6181cff8691da72dbb81f4f7f446ac7482d5dfe671f2b5333aed5d
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          _wmi.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\_wmi.pyd
                          • Size 38KB
                          • SHA256 3be5e14e9a9dc49f099209dee98b9cb5e31ade3b0deab52277026bb14df5bdb6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\ada92cb5d92a588d1b93__mypyc.cp313-win_amd64.pyd
                          • Size 221KB
                          • SHA256 58c25c988641247cc153a987d1080dceb65c3a5cea68be96f0ac5b29c700ab05
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          base_library.zip
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\base_library.zip
                          • Size 1.3MB
                          • SHA256 8be8ae6e06d006427c4226b39ce218c6ba98c41ace0cabf758cf3995084397c1
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cacert.pem
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\certifi\cacert.pem
                          • Size 228KB
                          • SHA256 bbc7e9c01d7551bb8a159b5dedd989b8ee3ce105aff522b68eb1b01bf854cab0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          cd.cp313-win_amd64.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\charset_normalizer\cd.cp313-win_amd64.pyd
                          • Size 10KB
                          • SHA256 77e1c9c2679ea4855d5b97dba2666c6b4cfe32636945f5bb8399ff2c7ef1b050
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          ClrLoader.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\clr_loader\ffi\dlls\amd64\ClrLoader.dll
                          • Size 10KB
                          • SHA256 07f62bcb1b70320f221ffb2cfc5ce6133815195f3e7cdb8d833222506188c2ac
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libcrypto-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\libcrypto-3.dll
                          • Size 5.0MB
                          • SHA256 ccfffddcd3defb8d899026298af9af43bc186130f8483d77e97c93233d5f27d7
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libffi-8.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\libffi-8.dll
                          • Size 38KB
                          • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          libssl-3.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\libssl-3.dll
                          • Size 776KB
                          • SHA256 007142039f04d04e0ed607bda53de095e5bc6a8a10d26ecedde94ea7d2d7eefe
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          python313.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\python313.dll
                          • Size 5.8MB
                          • SHA256 41ec4fc4e5bc8b207258590238f7f050b13fdfee84c4a7b1ecff6e945d031a10
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Python.Runtime.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\pythonnet\runtime\Python.Runtime.dll
                          • Size 435KB
                          • SHA256 648e6b415be8f45018af71f377aa3a97772799b353ac3a5e8612a99313de4907
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          select.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\select.pyd
                          • Size 32KB
                          • SHA256 9cc1ef0264060099503592db57ee7d7c1f8d6bea689b2ed125919c7a30b7ab7f
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Lorem ipsum.txt
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\setuptools\_vendor\jaraco\text\Lorem ipsum.txt
                          • Size 1KB
                          • SHA256 37fedcffbf73c4eb9f058f47677cb33203a436ff9390e4d38a8e01c9dad28e0b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          unicodedata.pyd
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\unicodedata.pyd
                          • Size 695KB
                          • SHA256 1989628f16052f9123c5cf603e96490a75fde6228315457556f96a838bf9e904
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Microsoft.Web.WebView2.Core.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\webview\lib\Microsoft.Web.WebView2.Core.dll
                          • Size 413KB
                          • SHA256 5c8c1ebcda165080f47028ae562488fa6aeb137e5cb9d65f50926bb1f4d2c3de
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Microsoft.Web.WebView2.WinForms.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\webview\lib\Microsoft.Web.WebView2.WinForms.dll
                          • Size 36KB
                          • SHA256 392de22ba90a106447af6ab06223d3941bc024028fa53f2ec32a225b08856544
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          WebView2Loader.dll
                          • Path C:\Users\Admin\AppData\Local\Temp\_MEI9362\webview\lib\runtimes\win-x64\native\WebView2Loader.dll
                          • Size 154KB
                          • SHA256 824e7d6a57e7a107bf3982bf593315547f8e578f26994e51a2d7b984a58cee1c
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          settings.dat
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Crashpad\settings.dat
                          • Size 280B
                          • SHA256 d2eefc7a36ee7cd9431594f6055b777df332834bf414075269eaf9893b4c0ac0
                          • MD5 SHA1 SHA512
                          Submit Download

                          settings.dat
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Crashpad\settings.dat
                          • Size 280B
                          • SHA256 a33b81f0398e4122339b1eb70a03db6f923bc0c37ae231ca42aea3ac200500d6
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Network Persistent State~RFe5adb1f.TMP
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Default\Network\Network Persistent State~RFe5adb1f.TMP
                          • Size 59B
                          • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          SCT Auditing Pending Reports
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Default\Network\SCT Auditing Pending Reports
                          • Size 2B
                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                          • MD5 SHA1 SHA512
                          Submit Download

                          c50bd04a-a101-4468-83f0-c504e1ee85f5.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Default\Network\c50bd04a-a101-4468-83f0-c504e1ee85f5.tmp
                          • Size 111B
                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Preferences
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Default\Preferences
                          • Size 5KB
                          • SHA256 159edbd20e3b7021946622e5b9b38eed80841f0a9d4698ac81cb8efe0bb6a53e
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          CURRENT
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Default\Sync Data\LevelDB\CURRENT
                          • Size 16B
                          • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                          • MD5 SHA1 SHA512
                          Submit Download

                          MANIFEST-000001
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
                          • Size 41B
                          • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                          • MD5 SHA1 SHA512
                          Submit Download

                          de25cb49-3555-479c-9012-1c2751869970.tmp
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Default\de25cb49-3555-479c-9012-1c2751869970.tmp
                          • Size 4KB
                          • SHA256 1e2a3bf9a45fa19dbd66f43c838fc32e048c0055bb92e45cd014821d33d450f5
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Local State
                          • Size 15KB
                          • SHA256 9ead21014e94a38ef66d85c36685e1c8d66e375a7f14888d7a597121b3dad226
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Local State
                          • Size 2KB
                          • SHA256 470593f4426d96019e9bb1487741af3f8a635639b9850ccfa70921348f5715ce
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Local State
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Local State
                          • Size 3KB
                          • SHA256 2f223032ae650c80411fda8b7fb2060f14cccf5f9efe3217089ff16d25fa3cab
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          Local State~RFe59b423.TMP
                          • Path C:\Users\Admin\AppData\Local\Temp\tmpehh9al89\EBWebView\Local State~RFe59b423.TMP
                          • Size 1KB
                          • SHA256 4f43022dd7380f80bb846706f24f448ec4abc7f3b174c6c4bc640485add225e5
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          explorer.exe
                          • Path C:\Windows\Resources\Themes\explorer.exe
                          • Size 135KB
                          • SHA256 c7fd0701026371c03b22ec4734b40f746d697c5f20d5d06395d02cf5ae4e2867
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          icsys.icn.exe
                          • Path C:\Windows\Resources\Themes\icsys.icn.exe
                          • Size 135KB
                          • SHA256 78550523c2023890e3c8ce1cbe5e2f56e0ab7b2aa7e6ce0a315c6d6b3bfea1d0
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          svchost.exe
                          • Path C:\Windows\Resources\svchost.exe
                          • Size 135KB
                          • SHA256 bec2b5ed72f9ebfc7f6537084c58ca5310340a77296b6cd1fad51c6f1657807a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          spoolsv.exe
                          • Path \??\c:\windows\resources\spoolsv.exe
                          • Size 135KB
                          • SHA256 fa0f1b95e3103225ce3fb92723458ef9f0d426dd5bb4ce9b63b78fc04c916479
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          memory/676-1153-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/1852-1450-0x000001A34E6F0000-0x000001A34E6F1000-memory.dmp
                          Download

                          memory/1852-1446-0x000001A34E6F0000-0x000001A34E6F1000-memory.dmp
                          Download

                          memory/1852-1447-0x000001A34E6F0000-0x000001A34E6F1000-memory.dmp
                          Download

                          memory/1852-1439-0x000001A34E6F0000-0x000001A34E6F1000-memory.dmp
                          Download

                          memory/1852-1449-0x000001A34E6F0000-0x000001A34E6F1000-memory.dmp
                          Download

                          memory/1852-1441-0x000001A34E6F0000-0x000001A34E6F1000-memory.dmp
                          Download

                          memory/1852-1445-0x000001A34E6F0000-0x000001A34E6F1000-memory.dmp
                          Download

                          memory/1852-1448-0x000001A34E6F0000-0x000001A34E6F1000-memory.dmp
                          Download

                          memory/2468-1218-0x00007FFA7A180000-0x00007FFA7A181000-memory.dmp
                          Download

                          memory/2940-1154-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3100-1377-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3548-1157-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3548-0-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/3740-1378-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/4128-1152-0x0000000000400000-0x000000000041F000-memory.dmp
                          Download

                          memory/4712-1389-0x00007FFA7A730000-0x00007FFA7A731000-memory.dmp
                          Download

                          memory/4712-1388-0x00007FFA7B2C0000-0x00007FFA7B2C1000-memory.dmp
                          Download

                          memory/5480-1282-0x00007FFA7A180000-0x00007FFA7A181000-memory.dmp
                          Download

                          memory/5760-1180-0x000001C70A480000-0x000001C70A488000-memory.dmp
                          Download

                          memory/5760-1169-0x00007FFA6C880000-0x00007FFA6C88A000-memory.dmp
                          Download

                          memory/5760-1172-0x000001C70A460000-0x000001C70A47A000-memory.dmp
                          Download

                          memory/5760-1173-0x000001C70A440000-0x000001C70A448000-memory.dmp
                          Download

                          memory/5760-1174-0x000001C70A450000-0x000001C70A458000-memory.dmp
                          Download

                          memory/5760-1175-0x000001C70A490000-0x000001C70A498000-memory.dmp
                          Download

                          memory/5760-1178-0x000001C722DB0000-0x000001C722DD2000-memory.dmp
                          Download

                          memory/5760-1179-0x000001C7233A0000-0x000001C72395A000-memory.dmp
                          Download

                          memory/5760-1168-0x000001C70A380000-0x000001C70A38A000-memory.dmp
                          Download

                          memory/5760-1183-0x000001C70A480000-0x000001C70A488000-memory.dmp
                          Download

                          memory/5760-1189-0x000001C70A540000-0x000001C70A548000-memory.dmp
                          Download

                          memory/5760-1187-0x000001C70A480000-0x000001C70A48E000-memory.dmp
                          Download

                          memory/5760-1185-0x000001C722E50000-0x000001C722EBC000-memory.dmp
                          Download

                          memory/5760-1171-0x000001C70A440000-0x000001C70A4B4000-memory.dmp
                          Download