66e8de52e7e62bfad6af32a2953b49d1e15498d07ed91ec9927dd2982ac0de61

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 00:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BeeChecker.1.27.1.exe
Size 45.8MB
Sample260509-bbmsfact8n
SHA256 66e8de52e7e62bfad6af32a2953b49d1e15498d07ed91ec9927dd2982ac0de61
MD5 4e6929e1006fbe0746788d154886a325
SHA1 c25853bce0355482b6b655cc9a355bfeacce71dd
SHA512 93a77a2492607fe5240f81390c21f2b1df3cc7a43b8a713f02861423dc9849b5c08de71994fff17f8612c6366dfdc4eb011da440144402fd27ee1e332f820b2c
SSDEEP 786432:aeka+Ha0+3H2yUMotV3WGzG1U2J8Rc0Sgr8AmXYXkH4AAkSwYVEfSDzb8fJXFzRB:up6j3H2ykzK1wrvmYUYXVpSVzRBzs
TLSH
T114B723D52BBC105DC40B8E30DA895FF9E7C4AC47E8B958E77F8204066F7AC65C8A642D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery trojan

Malware Config

Signatures

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	BeeChecker.1.27.1.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3684	BeeChecker.1.27.1.exe
3684	BeeChecker.1.27.1.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227619387032606"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3684	BeeChecker.1.27.1.exe
3684	BeeChecker.1.27.1.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
6112	msedgewebview2.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 3684 wrote to memory of 6112	3684	BeeChecker.1.27.1.exe	79
PID 6112 wrote to memory of 5784	6112	msedgewebview2.exe	80
PID 6112 wrote to memory of 3340	6112	msedgewebview2.exe	81
PID 6112 wrote to memory of 3340	6112	msedgewebview2.exe	81
PID 6112 wrote to memory of 3340	6112	msedgewebview2.exe	81
PID 6112 wrote to memory of 3632	6112	msedgewebview2.exe	82
PID 6112 wrote to memory of 5876	6112	msedgewebview2.exe	83
PID 6112 wrote to memory of 5876	6112	msedgewebview2.exe	83
PID 6112 wrote to memory of 4876	6112	msedgewebview2.exe	84
PID 6112 wrote to memory of 4876	6112	msedgewebview2.exe	84
PID 6112 wrote to memory of 4876	6112	msedgewebview2.exe	84

C:\Users\Admin\AppData\Local\Temp\BeeChecker.1.27.1.exe
"C:\Users\Admin\AppData\Local\Temp\BeeChecker.1.27.1.exe"
1⤵
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3684
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=BeeChecker.1.27.1.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --mojo-named-platform-channel-pipe=3684.4332.13693835135796100132
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:6112
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff84620b078,0x7ff84620b084,0x7ff84620b090
    3⤵
    PID:5784
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView" --webview-exe-name=BeeChecker.1.27.1.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1664,i,2824074488206545545,15929183654869731080,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1672 /prefetch:2
    3⤵
    PID:3340
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView" --webview-exe-name=BeeChecker.1.27.1.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1980,i,2824074488206545545,15929183654869731080,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=1996 /prefetch:11
    3⤵
    PID:3632
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView" --webview-exe-name=BeeChecker.1.27.1.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2244,i,2824074488206545545,15929183654869731080,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:13
    3⤵
    PID:5876
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView" --webview-exe-name=BeeChecker.1.27.1.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3544,i,2824074488206545545,15929183654869731080,262144 --disable-features=msSmartScreenProtection --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:4876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

483d174f-3819-40aa-a458-3b9b9c5db784.tmp

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\483d174f-3819-40aa-a458-3b9b9c5db784.tmp
Size 1KB
SHA256 0173b91680be3f7e855d9bcd69e12ce727415ec58fe909d97b5b02f218ef8534
MD5 31ce4b3cda9174f1dab88822bc9eebcd
SHA1 85218967064d685bd1449a4043e84b27911476fc
SHA512 3ef03ad7e1ea769a2462ab58e239a09822e73f70ad57c9e5f701e8a07b3ee9ea7c7849e14dbed31e9a0940ea6824b46947589de12945630850d07d1d43cb57ed
TLSH
T16731A7B3E5D85B339CC2E602F14A7B573F20426E82614F48B0DE0B2901EA29CA526C33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 1221348fc9dcbbaa2b640b460e74a590df6d4d7f7246ffa5605d70c4d9a530b6
MD5 76f8f7fc38ccd5c285e42d4cdefa276d
SHA1 b4f9ccca0c8e4398c08e6dab92f148e8cdc602f9
SHA512 6d62f37684a6630a40bc86f47f0d7bca6fe3267f4486ff21593a918af3bf1f4b0a83ef0a6562adbf2c79a739addc741594e643350a740e7c9446358e45f99bbf
TLSH
T140D01123B322823EC03020B30803A20C0A02C20B820A8000A83ACAAE2E08CA00E0A8A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 0848749f3fa98b532dc58cbd0afb72dea9086a6661b8f287708f286efea49179
MD5 fb9c446e465e91d79fc0b68584d550ea
SHA1 3d75c1f7e4d7a36b61a96887082b9f9086217a08
SHA512 1912a401d7258d8c8450c7bbf081f65ac3a94c57da6bee8d02c658fc22ed92bad00352d10e24497d3aa49d55f649ce9133af9bb974f979baf3c2066fdb9d220c
MD5 SHA1 SHA512

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 12c4901d0af723c53fdf7ba3b52f95afd1e690ef7c488f3184427e11499ef95d
MD5 cc3bff8c96ff7b639fb51a148bd70e28
SHA1 e81b0f8b752aa9b69fc57cf9f2319638a3306126
SHA512 a8f2e35a9d9ee090eb752b59c8d6d151984b97a9b78dc518415d08463024bf9f53ec831c4147eb5e0d99488f6f6a584fed45be66013769cb6bb088d0200aaad8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 acfcf1cfc0b803c32556be6c25e953b81cc6d1d752886d6ac3e3689855324a84
MD5 57c61f4f7a83c33bf80b19e67c16ad17
SHA1 5dc366d511644b94e011d83b8bfe76698d6e1c0a
SHA512 05175dd2936ab99ca97e9cca6daf86f2537bc655a2a8bd7b32cd0548a9494486a0c15fc0d92de603def1b0e0a27f5456bcc32a59e9a15b4060a66f144268de62
TLSH
T15FD012283363C353FF1D11B053CE93C478310B2095133E9B75450DB54F517E38501140
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe589863.TMP

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Network\Network Persistent State~RFe589863.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 a5cb6a612641daf847e9bfb86e3f3f637cdd2203b5c0288b9e82fa83bbb58e18
MD5 250922b29c8f6dcb57fdb67053566709
SHA1 d6c70a5d5ce389a061b46a30fe3bbd547169c1bf
SHA512 02d544abfb5dbfc0b14e884477c2c3da4e342115905dce12260780f80763b41d1ddee31a9610ec6cf16e9f416ff215a66d483ba777f1b237bf9dbe0b63877d89
SSDEEP 96:st/05iys/3G5b9YoTffqlZ8i0vhEakcmm/7qx+WVHMSm+uecSD41idQjL+gRNMQf:st/0UyucfGZ8paIT/S+WiQD4wdWZMSKC
TLSH
T1D0E1A8029E68A9775CC7F619BA39BB53E3F9106266C41E58EBFC861C04D66CD720780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe589843.TMP

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Preferences~RFe589843.TMP
Size 6KB
SHA256 3ec91f87fa54fe2b389d53c611470954f19f17a633a566846d2369c4240516fb
MD5 b2c030cf8b4becc7c461c186563fd0ef
SHA1 b3e9b51f8457c14f28b1539c9bd36b91f4ee2270
SHA512 1541ff6cbeb85cac8aaef5696b4f7c3300a5ac0b88b7a87c5853d16e1666c85b8499d2c02ab69b653d2287390d8efed9a4aed5fa8a10761108d47c78c34b3869
SSDEEP 96:st/05iys/3G5b9yTffvZ8i0vhEakcmm/7qx+WVHMSm+uecSD41idQjL+gKM+MEB:st/0UyuPf3Z8paIT/S+WiQD4wdWQM+M8
TLSH
T1B1D188039E68A9774CC7F619BA39BB52D2FA106266D40E58EBFC861C08D56CD730790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Local State
Size 2KB
SHA256 222906b70710c9d8ca120ae0de9d7dc1d0ee8105fe6459bf70ea196ad32ea139
MD5 ffb286e3b44b7db65738b711fc79c3d4
SHA1 9b6790eb19a53262348693283839f62e086e075b
SHA512 c49f5b198979670e2c654879807a781476ff6b427414051767d1c8f5d4c5f13f71a0c330a8673c856a60e34bd66cc48011bd625cf0afd402810c775fe0702ad1
TLSH
T1E5518873B8589B3389E39A04F94D3F13AB3951A997612F55A9DD0F1801DB65C3302C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Local State
Size 3KB
SHA256 2d5f32aac297d647c28677643eedeb78caad1adb0fefd234f6ed6a1428ff8703
MD5 d41df52c2eed97b4681127c2158bdeaa
SHA1 d253fc5a912890c05cc6f796d73e01490098efaf
SHA512 f1c2ae33304b12d90ec8e8f101d0175f8d7d69d5d218c35fe10ff4235760f7656117f9b9e4f67d8f73a71f9c4f40b6dfb5cad4f8175c6da93a6b5d375dabb79f
TLSH
T1DB718533A9A8DA274DE3EA00F8893B17B7655167D6913FA9D9EC0F1D01DB3982342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Local State
Size 15KB
SHA256 f5acba1a04ca5774f6909f671125a916526471355fc30e2744df24cb994c3ed6
MD5 cba02680d46a6cd2495cb61fcf36a80f
SHA1 e345894f546eb47d49c83fdd402a879285c4ccee
SHA512 c57f35b044fb70b4d3cb0bd7d01c23e213f97efb7c1045650cb5f0762f9559e1fd2a893ed71554ed7c68eebc3e15ed50022f61b01b12a4b6fab3f93d1ef64142
SSDEEP 384:zkvsrvyOiyp4+IWA1eUVWGfvvLhNbLVpTTRB1uk620:o0raxyp4sQe6WGfvLVJHB6X
TLSH
T1DC72BF710AB49A37DCE6AC07FC4F3A077AA8556ADAD02F84B4D86F1E014F28C1702D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe581e51.TMP

Path C:\Users\Admin\AppData\Roaming\BeeChecker.1.27.1.exe\EBWebView\Local State~RFe581e51.TMP
Size 1KB
SHA256 1dc31e1a4f0911f05e0020c768c99a16be717293ed2c1009591a38b759e48577
MD5 9028586f926e856e601f8c4860de9307
SHA1 80a66b8a6c3837538dbdda70a24b26cdcdc975a6
SHA512 535f96b7cf2f59b1995e4dd76a4e1be9f7c1aad9e8eca06a7f7cd1688c915f9a6a066fc26f29bb9deb415b8f9cd5073a001b96234daddf04f5ffe52935e38cb4
TLSH
T1DC2184B3D4DC5B33AC82E901F146BB873E24426E82605F19F0CE072901DF6AC9622C33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3340-84-0x00007FF863B50000-0x00007FF863B51000-memory.dmp

Download

memory/3340-287-0x0000025E5A520000-0x0000025E5A6BA000-memory.dmp

Download

memory/3632-288-0x00000266CFF20000-0x00000266D00BA000-memory.dmp

Download

memory/3684-32-0x000001D7FF7D0000-0x000001D7FF7D1000-memory.dmp

Download

memory/3684-51-0x000001D7FF950000-0x000001D7FF951000-memory.dmp

Download

memory/3684-26-0x000001D7FF770000-0x000001D7FF771000-memory.dmp

Download

memory/3684-25-0x000001D7FF760000-0x000001D7FF761000-memory.dmp

Download

memory/3684-24-0x000001D7FF750000-0x000001D7FF755000-memory.dmp

Download

memory/3684-23-0x000001D7FF740000-0x000001D7FF741000-memory.dmp

Download

memory/3684-22-0x000001D7FF730000-0x000001D7FF733000-memory.dmp

Download

memory/3684-21-0x000001D7FF720000-0x000001D7FF721000-memory.dmp

Download

memory/3684-20-0x000001D7FF710000-0x000001D7FF711000-memory.dmp

Download

memory/3684-19-0x000001D7FF700000-0x000001D7FF701000-memory.dmp

Download

memory/3684-18-0x000001D7FF6F0000-0x000001D7FF6F1000-memory.dmp

Download

memory/3684-17-0x000001D7FF6E0000-0x000001D7FF6E1000-memory.dmp

Download

memory/3684-16-0x000001D7FF6D0000-0x000001D7FF6D2000-memory.dmp

Download

memory/3684-15-0x000001D7FF6C0000-0x000001D7FF6C1000-memory.dmp

Download

memory/3684-14-0x000001D7FF6B0000-0x000001D7FF6B7000-memory.dmp

Download

memory/3684-13-0x000001D7FF6A0000-0x000001D7FF6A1000-memory.dmp

Download

memory/3684-12-0x000001D7FF690000-0x000001D7FF692000-memory.dmp

Download

memory/3684-11-0x000001D7FF680000-0x000001D7FF681000-memory.dmp

Download

memory/3684-10-0x000001D7FF670000-0x000001D7FF674000-memory.dmp

Download

memory/3684-9-0x000001D7DA2F0000-0x000001D7DA2F1000-memory.dmp

Download

memory/3684-7-0x000001D7DA2D0000-0x000001D7DA2D1000-memory.dmp

Download

memory/3684-6-0x000001D7DA2C0000-0x000001D7DA2C1000-memory.dmp

Download

memory/3684-57-0x000001D7FF9C0000-0x000001D7FF9C1000-memory.dmp

Download

memory/3684-56-0x000001D7FF9B0000-0x000001D7FF9B1000-memory.dmp

Download

memory/3684-55-0x000001D7FF9A0000-0x000001D7FF9A1000-memory.dmp

Download

memory/3684-54-0x000001D7FF980000-0x000001D7FF991000-memory.dmp

Download

memory/3684-58-0x000001D7FFAA0000-0x000001D7FFAA2000-memory.dmp

Download

memory/3684-53-0x000001D7FF970000-0x000001D7FF971000-memory.dmp

Download

memory/3684-52-0x000001D7FF960000-0x000001D7FF968000-memory.dmp

Download

memory/3684-27-0x000001D7FF780000-0x000001D7FF781000-memory.dmp

Download

memory/3684-28-0x000001D7FF790000-0x000001D7FF795000-memory.dmp

Download

memory/3684-29-0x000001D7FF7A0000-0x000001D7FF7A1000-memory.dmp

Download

memory/3684-30-0x000001D7FF7B0000-0x000001D7FF7B5000-memory.dmp

Download

memory/3684-31-0x000001D7FF7C0000-0x000001D7FF7C1000-memory.dmp

Download

memory/3684-0-0x00007FF865710000-0x00007FF865712000-memory.dmp

Download

memory/3684-33-0x000001D7FF7E0000-0x000001D7FF7E1000-memory.dmp

Download

memory/3684-34-0x000001D7FF7F0000-0x000001D7FF7F1000-memory.dmp

Download

memory/3684-35-0x000001D7FF800000-0x000001D7FF801000-memory.dmp

Download

memory/3684-36-0x000001D7FF810000-0x000001D7FF811000-memory.dmp

Download

memory/3684-37-0x000001D7FF820000-0x000001D7FF821000-memory.dmp

Download

memory/3684-38-0x000001D7FF830000-0x000001D7FF835000-memory.dmp

Download

memory/3684-39-0x000001D7FF840000-0x000001D7FF841000-memory.dmp

Download

memory/3684-40-0x000001D7FF850000-0x000001D7FF851000-memory.dmp

Download

memory/3684-41-0x000001D7FF8A0000-0x000001D7FF8A1000-memory.dmp

Download

memory/3684-42-0x000001D7FF8B0000-0x000001D7FF8B1000-memory.dmp

Download

memory/3684-43-0x000001D7FF8C0000-0x000001D7FF8C1000-memory.dmp

Download

memory/3684-1-0x00007FF7B6170000-0x00007FF7B7170000-memory.dmp

Download

memory/3684-271-0x000001D7FFFA0000-0x000001D7FFFD1000-memory.dmp

Download

memory/3684-8-0x000001D7DA2E0000-0x000001D7DA2E4000-memory.dmp

Download

memory/3684-44-0x000001D7FF8D0000-0x000001D7FF8D7000-memory.dmp

Download

memory/3684-45-0x000001D7FF8E0000-0x000001D7FF8E1000-memory.dmp

Download

memory/3684-46-0x000001D7FF8F0000-0x000001D7FF8F1000-memory.dmp

Download

memory/3684-47-0x000001D7FF900000-0x000001D7FF901000-memory.dmp

Download

memory/3684-48-0x000001D7FF910000-0x000001D7FF911000-memory.dmp

Download

memory/3684-309-0x000001D7FFFA0000-0x000001D7FFFD1000-memory.dmp

Download

memory/3684-49-0x000001D7FF920000-0x000001D7FF921000-memory.dmp

Download

memory/3684-50-0x000001D7FF930000-0x000001D7FF931000-memory.dmp

Download

memory/4876-200-0x00007FF863B50000-0x00007FF863B51000-memory.dmp

Download

memory/6112-272-0x000001FF1CC00000-0x000001FF1CD9A000-memory.dmp

Download

memory/6112-441-0x000001FF1CC00000-0x000001FF1CD9A000-memory.dmp

Download