46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06

Analysis

max time kernel
57s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.exe
Size 4.9MB
Sample260910-tnftrsvscy
SHA256 46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06
MD5 8919061c14c9ce20b2ee4d9b41229b25
SHA1 10e391bd3f81b348a03aa3d826854117795ee826
SHA512 e2c41099cc9a28b0784009f3940b725b81227b31fa77abbc96d174bee98d35366b392f0caf92c53ffd516c454e605f7cf18dc8ea9583a048450e60717c080682
SSDEEP 98304:twuvY4prSHnTe+s0PZV3Bf5lvw0lKx0hZnLqQQ3weDp//XiE1t:OuQorSHTdnZVhU0hLQ3we1fiut
TLSH
T1C1363317A7C3E435F1327875C859C298BE2B7DA858F253864CB5C68D8B790F219B2B31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution installer persistence privilege_escalation

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	RegCleanPro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RegCleanPro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	RegCleanPro.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RegCleanPro.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	RegCleanPro.exe

Executes dropped EXE 6 IoCs

pid	Process
2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
2160	RegCleanPro.exe
4488	Cloud_Backup_Setup.exe
4224	RegCleanPro.exe
1100	systweakasp.exe
4608	systweakasp.tmp

Loads dropped DLL 11 IoCs

pid	Process
2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
2160	RegCleanPro.exe
2160	RegCleanPro.exe
4488	Cloud_Backup_Setup.exe
2160	RegCleanPro.exe
2160	RegCleanPro.exe
4224	RegCleanPro.exe
4224	RegCleanPro.exe
4224	RegCleanPro.exe
4224	RegCleanPro.exe
4608	systweakasp.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\roboot64.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Windows\system32\roboot64.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\RegClean Pro\is-ST55H.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-0HHMS.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-RCI8C.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-HGH1K.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-JG8LA.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-8IV05.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\CleanSchedule.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-12QQL.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-QPS2O.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-0DTG9.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-0H27P.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-8PBEQ.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-674LE.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-J6GGP.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-FO8IL.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\xmllite.dll	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-L21BD.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-7DM7O.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-NV3I3.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-ICTDL.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-G0GJ4.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\SSDPTstub.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-LFN9A.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-8KB56.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-B9I4U.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-O6D3A.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-G1BR2.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-P6VIB.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-U3EBQ.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup_Intl.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-004M6.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\unins000.dat	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-1O2D8.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-F7FH8.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\systweakasp.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-UV9UN.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-6SOOM.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-7RFTM.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-V08GO.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-DI14R.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-19KNQ.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\isxdl.dll	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-CGL9E.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-53GEI.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-S4DTC.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-5C1SG.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-46BCN.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-TNFT8.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-TE07Q.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-OC3Q1.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-Q98UN.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-TFMVQ.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-LCLQV.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-JQUQ7.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\unins000.msg	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-K3GE0.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-4I68H.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\unins000.dat	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\RCPUninstall.exe	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-30TO8.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File created	C:\Program Files (x86)\RegClean Pro\is-9TR9K.tmp	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
File opened for modification	C:\Program Files (x86)\RegClean Pro\RegCleanPro.dll	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\RegClean Pro_UPDATES.job	RegCleanPro.exe
File created	C:\Windows\Tasks\RegClean Pro_DEFAULT.job	RegCleanPro.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\software\Microsoft\NetSh	RegCleanPro.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	RegCleanPro.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	RegCleanPro.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegCleanPro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systweakasp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systweakasp.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegCleanPro.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Cloud_Backup_Setup.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1224	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 7 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/5000-1-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral1/memory/5000-22-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral1/files/0x0007000000024572-133.dat	innosetup
behavioral1/memory/5000-188-0x0000000000400000-0x000000000042D000-memory.dmp	innosetup
behavioral1/files/0x0007000000024543-540.dat	innosetup
behavioral1/memory/1100-550-0x0000000000400000-0x000000000042B000-memory.dmp	innosetup
behavioral1/memory/1100-879-0x0000000000400000-0x000000000042B000-memory.dmp	innosetup

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000024544-172.dat	nsis_installer_1
behavioral1/files/0x0007000000024544-172.dat	nsis_installer_2

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335303627033318"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\ECMASCRIPT\OLESCRIPT	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact\ = "JScript Compact Profile (ECMA 327)"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\ = "JScript Language Authoring"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact\OLEScript	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}\nlccbmJ	RegCleanPro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}\PhzsgqopsbhuP\ = "qhJEQQDMvHMVRUxBXeerJr"	RegCleanPro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}\mNpckwdcukdIF	RegCleanPro.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\LIVESCRIPT\OLESCRIPT	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.2 AuthorJavaScript1.3 Author	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\INPROCSERVER32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}\mszzq	RegCleanPro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author\ = "JScript Language Authoring"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\ = "JScript Language Authoring"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}\PhzsgqopsbhuP\ = "qhJEQQDMvHMVRUxBXeerJu"	RegCleanPro.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\SysWow64\\jscript.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\ = "JScript Language Authoring"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Compact Author\ = "JScript Language Authoring"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript Author\ = "JScript Language Authoring"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\ProgID\ = "JScript Author"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\JSCRIPT.ENCODE\OLESCRIPT	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{F0B7A1A3-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}\gdrIoWpk\ = "\x7foFdlK`CdOP"	RegCleanPro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}\myhms\ = "y_YlL\x7f^qnc}{`AQhHjDlZeYSI`Plua"	RegCleanPro.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Component Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode\OLEScript	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F414C262-6AC0-11CF-B6D1-00AA00BBBB58}\Implemented Categories\{F0B7A1A1-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\JAVASCRIPT\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\JSCRIPT.COMPACT AUTHOR\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\OLEScript	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{459DD0F7-0D55-D3DC-67BC-E6BE37E9D762}\uysGt\ = "njB_aKaAwmHYPa`CctBga"	RegCleanPro.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript\ = "JScript Language"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ThreadingModel = "Both"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c262-6ac0-11cf-b6d1-00aa00bbbb58}\InprocServer32\ = "C:\\Windows\\SysWow64\\jscript.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc5bbec3-db4a-4bed-828d-08d78ee3e1ed}\ProgID\ = "JScript.Compact"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{F0B7A1A2-9847-11CF-8F20-00805F2CD064}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\Implemented Categories\{0AEE2A92-BCBB-11D0-8C72-00C04FC2B085}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\LIVESCRIPT AUTHOR\OLESCRIPT	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\LiveScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}\OLEScript	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript.Encode\ = "JScript Language Encoding"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC5BBEC3-DB4A-4BED-828D-08D78EE3E1ED}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.3	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\JavaScript1.1 Author\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript Author\ = "JScript Language Authoring"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript Author\CLSID\ = "{f414c261-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\JScript\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ECMAScript\CLSID\ = "{f414c260-6ac0-11cf-b6d1-00aa00bbbb58}"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe
1280	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: 33	2160	RegCleanPro.exe
Token: SeIncBasePriorityPrivilege	2160	RegCleanPro.exe
Token: 33	4224	RegCleanPro.exe
Token: SeIncBasePriorityPrivilege	4224	RegCleanPro.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
1280	msedge.exe
1280	msedge.exe
2160	RegCleanPro.exe
2160	RegCleanPro.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2160	RegCleanPro.exe
2160	RegCleanPro.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2160	RegCleanPro.exe
2160	RegCleanPro.exe
2160	RegCleanPro.exe
2160	RegCleanPro.exe
4224	RegCleanPro.exe
2160	RegCleanPro.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 2980	5000	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.exe	86
PID 2980 wrote to memory of 4408	2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp	87
PID 2980 wrote to memory of 2160	2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp	92
PID 2980 wrote to memory of 1280	2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp	95
PID 2980 wrote to memory of 4488	2980	46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp	96
PID 1280 wrote to memory of 4164	1280	msedge.exe	97
PID 1280 wrote to memory of 1224	1280	msedge.exe	98
PID 1280 wrote to memory of 1584	1280	msedge.exe	99
PID 1280 wrote to memory of 1584	1280	msedge.exe	99
PID 1280 wrote to memory of 1584	1280	msedge.exe	99
PID 1280 wrote to memory of 3208	1280	msedge.exe	101
PID 1280 wrote to memory of 3208	1280	msedge.exe	101
PID 1280 wrote to memory of 5012	1280	msedge.exe	102
PID 1280 wrote to memory of 1556	1280	msedge.exe	103
PID 1280 wrote to memory of 5012	1280	msedge.exe	102
PID 1280 wrote to memory of 5012	1280	msedge.exe	102
PID 1280 wrote to memory of 1556	1280	msedge.exe	103
PID 1280 wrote to memory of 1556	1280	msedge.exe	103
PID 1280 wrote to memory of 4552	1280	msedge.exe	104
PID 1280 wrote to memory of 4552	1280	msedge.exe	104
PID 1280 wrote to memory of 4552	1280	msedge.exe	104
PID 1280 wrote to memory of 4312	1280	msedge.exe	105
PID 1280 wrote to memory of 4312	1280	msedge.exe	105
PID 1280 wrote to memory of 4312	1280	msedge.exe	105
PID 1280 wrote to memory of 2984	1280	msedge.exe	107
PID 1280 wrote to memory of 2984	1280	msedge.exe	107
PID 1280 wrote to memory of 3296	1280	msedge.exe	109
PID 1280 wrote to memory of 3296	1280	msedge.exe	109
PID 1280 wrote to memory of 3912	1280	msedge.exe	110
PID 1280 wrote to memory of 3912	1280	msedge.exe	110
PID 1280 wrote to memory of 3912	1280	msedge.exe	110
PID 1280 wrote to memory of 3708	1280	msedge.exe	111
PID 1280 wrote to memory of 4208	1280	msedge.exe	112
PID 1280 wrote to memory of 3708	1280	msedge.exe	111
PID 1280 wrote to memory of 4208	1280	msedge.exe	112
PID 1280 wrote to memory of 4500	1280	msedge.exe	116
PID 1280 wrote to memory of 208	1280	msedge.exe	117
PID 1280 wrote to memory of 208	1280	msedge.exe	117
PID 1280 wrote to memory of 868	1280	msedge.exe	118
PID 1280 wrote to memory of 868	1280	msedge.exe	118
PID 2160 wrote to memory of 1100	2160	RegCleanPro.exe	119
PID 1100 wrote to memory of 4608	1100	systweakasp.exe	120
PID 1280 wrote to memory of 4640	1280	msedge.exe	122
PID 1280 wrote to memory of 4640	1280	msedge.exe	122
PID 1280 wrote to memory of 220	1280	msedge.exe	123
PID 1280 wrote to memory of 220	1280	msedge.exe	123
PID 1280 wrote to memory of 5628	1280	msedge.exe	124
PID 1280 wrote to memory of 5628	1280	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.exe
"C:\Users\Admin\AppData\Local\Temp\46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\is-TNJGU.tmp\46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TNJGU.tmp\46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp" /SL5="$590230,4568629,141312,C:\Users\Admin\AppData\Local\Temp\46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s "C:\Windows\system32\jscript.dll"
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4408
- - C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
    "C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe"
    3⤵
    - Checks BIOS information in registry
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2160
  - - C:\Program Files (x86)\RegClean Pro\systweakasp.exe
      "C:\Program Files (x86)\RegClean Pro\systweakasp.exe" /verysilent
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\is-IQTQC.tmp\systweakasp.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IQTQC.tmp\systweakasp.tmp" /SL5="$20378,193643,132096,C:\Program Files (x86)\RegClean Pro\systweakasp.exe" /verysilent
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.systweak.com/registryCleaner/afterinstall.asp?newrcp=1&utm_content=AfterInstall&utm_term=Setup&page=install&utm_source=afterdownloadcm&utm_campaign=46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06&utm_medium=newbuild&LangID=en
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7fff967dc188,0x7fff967dc194,0x7fff967dc1a0
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,9215723131660685279,12107901491176234212,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
      4⤵
      System Time Discovery
      PID:1224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,16080175711035629518,5200632440225856537,262144 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
      4⤵
      PID:1584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,6279867327223602497,12566500533154721603,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
      4⤵
      PID:3208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,12136650449195895481,11661540064819284159,2097152 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,9043605849640575208,10963034821688295354,2097152 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,5392274736924847860,17518676850376078765,2097152 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
      4⤵
      PID:4552
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,14121998011949521089,10014067066696454606,2097152 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
      4⤵
      PID:4312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,9774203007110401270,12263070014649113428,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
      4⤵
      PID:2984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,16275168969829806525,4522150114835596955,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
      4⤵
      PID:3296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5204,i,9573996001811192400,18332703253266003373,2097152 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
      4⤵
      PID:3912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,107890885178117870,1103645801119571477,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
      4⤵
      PID:3708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,10539016262160950872,12158987793753886833,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,5938646186755425855,3668444175484094676,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
      4⤵
      PID:4792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,5938646186755425855,3668444175484094676,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
      4⤵
      PID:4500
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2277180947565909195,15075870870300039379,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
      4⤵
      PID:208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,5081504152961801951,3897277833749401822,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
      4⤵
      PID:868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,5530350222774345036,14327773556385895806,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
      4⤵
      PID:4640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,2666458116426988949,9912964912055255853,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
      4⤵
      PID:220
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,1491920983493876326,16937037044003672412,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
      4⤵
      PID:5628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,8807436983848683916,7581558568475959429,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:8
      4⤵
      PID:5144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,7013134677943336251,11607638963255166550,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
      4⤵
      PID:5136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,6792987475868062388,15788734685728911039,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
      4⤵
      PID:3584
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,5947130107537813805,3974570199953942263,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
      4⤵
      PID:5524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,6331154220187349205,13267346757034861361,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
      4⤵
      PID:6116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,2329978347617443322,15118718458484824953,524288 --field-trial-handle=2308,i,16325791049763317167,8710688940256108085,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
      4⤵
      PID:3584
- - C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup.exe
    "C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:4488

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1604

C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
"C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe"
1⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4224

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x418
1⤵
PID:5992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Cloud_Backup_Setup.exe

Path C:\Program Files (x86)\RegClean Pro\Cloud_Backup_Setup.exe
Size 72KB
SHA256 ee46c0cc73b34cf3d872c708be5db50b1bbcd626b43ff3c714755a99271acbcf
MD5 4da7d068a06a8e635484364e4a9ed79e
SHA1 29537b5d9e0b9006067890e1d21d0ce6f22e8a99
SHA512 49e36d7b99ed7717292f3944fc3d68dba7167649c975beb3d137fabc43e7883363a5fd1a4c4522feea4dbf9e76bc38c3307b9b12c6d453345685d60e85d46625
SSDEEP 1536:gpgpHzb9dZVX9fHMvG0D3XJSqkSZZZ3gNVRD661ib/OkYykqIzjbanyDPi:2gXdZt9P6D3XJsUYRD66Ybmkb5KY
TLSH
T12473BE037FC199F3ED8206301577DB36EB32ED6996C05A0357A43F7BEE72212891A589
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegCleanPro.dll

Path C:\Program Files (x86)\RegClean Pro\RegCleanPro.dll
Size 1.6MB
SHA256 17a0ca0d6915c13053c5fd5548961951537f04e83088d93c65dc0c490278ddfc
MD5 dff748343a38b3de382dd79d34fc1c98
SHA1 f19ceb5cf701cecd618b4f40de2f4599f5ed2afd
SHA512 53dac263323e4411e3004a2b32d1941bd59f51bed1bc52b40ccec8e73f2bb9fbb1460ceca987ff22f813da76c26fe2d307950b67e3af5e317a6c6bd6f6fafe87
SSDEEP 24576:1V7SHcA9vDdZvFgSh6QnTrtQ1gjekxbP2YPLGFYT8XyUohE4xOtAVAyZ33Oo:1V7yb1gQnT5QKxbJf8XyUoh5VAmnOo
TLSH
T17375AF107641D43EF4EF01F2DABE8E6D48E97A924B7401D7A3C81D8E5A749E3B632247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegCleanPro.exe

Path C:\Program Files (x86)\RegClean Pro\RegCleanPro.exe
Size 7.5MB
SHA256 1ad68845d9275b6af6629d39f7c9b2ff3b5f4ffbde98e5e5d80c3f907f6bd23e
MD5 38755468b06efbd48747341405969188
SHA1 a99c38c5c60d2c80cb4839c6f00a6cd7eaf63fb2
SHA512 30db828c496733ca17f321005b146a3d50ccb4dcd217573a18b48dd8984fb73815d1615143c1182c67a9da7b0456cf3cea29a6d354065f39ee270b64f6e2d615
SSDEEP 98304:b9BI6Wn1tnYzQFHQSP+d6Y+1+cGgr304nKDhHxS:By6E2SPG6YlcGgrkFlHxS
TLSH
T161861851F202F822DE5289BFB76FEE4058276E645F22803B3C5DB67717F63811818E69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SSDPTstub.exe

Path C:\Program Files (x86)\RegClean Pro\SSDPTstub.exe
Size 629KB
SHA256 8ffeb546c8d847b50a8c4625ba3fee4d4f39f218e7bd2d8f92246291ef1aae15
MD5 dd5965e137ae0958cdccf49c262095fd
SHA1 476063885747edd774a6b8cb2790703503a75a55
SHA512 25d3f843d034c0125bc50e57a2b0bd58dcbbf7661e2513b6b67a25134499db156270836ed0aab17f67e4727da3c15759c0961b6ca0b8904a39fe0fe778013f6e
SSDEEP 12288:XSxG0t888888888888W88888888888ICf5vEreUx9RsUEUJ2iFRza247/xfl23nt:ixGjChErHhBEs+247/xN23nVoJE/t
TLSH
T1D8D40103B3C34075F9665E35C9B580146E27BAB819F2642D3DF9EB0E4AB5BC25C36722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eng_rcp.ini

Path C:\Program Files (x86)\RegClean Pro\eng_rcp.ini
Size 84KB
SHA256 76ba9532cba0d6ed36ced42364c1a64dc280d8a97b2d37b06bd58425f8abaf64
MD5 dbe1dd3718d34af9966819bdf8e3eadb
SHA1 3ed33dd7ee19cc28500632f46f5bcac8ca26804d
SHA512 10dbef659780a80258a00341fb6f29aad7b843fe42fac756ad7b46945cc820f9587165f4391749e5cea87b9d06f3469285e028ae96b66119dfa2eaedf641caff
SSDEEP 768:ntdVlkZTcQoC5oqOupTWK/50rLrr5r54j7UkjCH8M8TLLg/UIZpedwQKv0U/67Zp:fOBTWK/5MUZQFhsRj
TLSH
T154839B0267FD5118F5F33F91AEB98A748E36BCD6A939C21D1584480E4AF1E40D972BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isxdl.dll

Path C:\Program Files (x86)\RegClean Pro\isxdl.dll
Size 153KB
SHA256 820635da282a1d15ac3b7fcfe189f93710b7a436c4afe72a6532df05c7901606
MD5 88aa73b0052a2602c9609fcc4bd20a5b
SHA1 ed32e5fb4f1d3c2cb849cc9a448f3a1a60932b2f
SHA512 0d95b6e3078a53f5b4ffbc34403f1caccfa8361b1caf581ec2fab8f5d754257263b669e3d26aa03d9f4636b58824fc706597e366bdd979cd0dfcb21645dee22f
SSDEEP 3072:GLHq/Hs2518t3JAryzGYihGQ3mI++yruR3DiysXqos:6Hq/HvAtTMhGRoNpsXQ
TLSH
T120E36C10B601D036E8BF167A8A7E8B75662EBD305B9850C773CC4E9E5EA56E13F31207
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

systweakasp.exe

Path C:\Program Files (x86)\RegClean Pro\systweakasp.exe
Size 571KB
SHA256 35fc8ae3f19a587d632749758d08f87eabe9fea307ddaa81eb671bf98a9fbd60
MD5 44065fed2913835ec7481775e6a84cb6
SHA1 4e949509f87dcd9ea158d52bcd4391adff211475
SHA512 136e87d221bede6cdc8fc0802e2a0681f8928a5f4c6e692af08d11b08f272f87fd0401e5d17edd363a02f9c8e29a7ae40d38926837f5034f5832efbf0aeb0961
SSDEEP 12288:qSxG0m888888888888W88888888888qqP7mApmqeBrSDS0PmMTzoe7aINt:hxGAI7mAvQMTzoe7Jt
TLSH
T115C4F103B7C31076F8745D7984758014AD277EB519F2A01F3DB9FA0E8AB8AC29C76762
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmllite.dll

Path C:\Program Files (x86)\RegClean Pro\xmllite.dll
Size 124KB
SHA256 b55a978443ef0b873875910283bedfab0c3133bac7be72a68ed5146f83f1ef8c
MD5 71a2dca8f626fcef8bff7e2c17c67a7f
SHA1 5aaea93ec3f4d722d7ea0c2d86bc4f3cbdce5c92
SHA512 5244918679eba6e7af8e367c66c3d1bdcfa2323400994ecda37ccd697fb28b52ffdad992650929ec98b98ae9e0213074368a8881c6a62e48579c30f17051a17d
SSDEEP 3072:KHekJbbLs0atItGxWuLEOFthW/dfmwcFK:+/B3s0aatr7OvhWdmA
TLSH
T1F9C31722F01380B8E06660309A5DB7B6F5ACFAB008E9BB4F3FE4EA765910552D719D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1280_1291307709\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping1280_1910933380\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 77b4f7717628c6e13b543c12227cdf260079d98c302944b74c8adc747cfb4c0f
MD5 856ea8697c203305958e576f89f31811
SHA1 73d09984ebcc2169457a78599afebfb489472c48
SHA512 deceef0894f31f179948017b86521a4911af874079b5aa9df0114d36efc7d0e601606898d3f74bcbcc7a3f90d636055d63f79802d5a0f28d9ae9a752dcd5a16d
TLSH
T1757172380DB6AB18E735237396F961F63172A2EDF1078DD48054D87C1407BA1C796E9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59206f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59206f.TMP
Size 3KB
SHA256 d16d9db1f9120a61c5b92710c2ec77eb4ce80ad39d38140052ab527cdf65ec6f
MD5 b2b89970d1ca9e4080cf34300288957b
SHA1 40f57688aaea7a1e0bb4656a1eff8bbdcc31852c
SHA512 3c55b03007cecc8de21342dd17bb69642d70a128eb97282b3a7b5b2cfba5e0cbe07b22f00c062f8523ca39d6f4ff421d0cb1e2d3bed18a8261046d7a312f47c9
TLSH
T1656180390D76E318F332633288FD62F930B2A2EDF1574D898044D87C1006BA0C79AEAC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 4b9b8edb5bd7e9e4c8b72d736307ee324833dfe03bdb170bebba675660a9a768
MD5 eed5702200b62210f5428954bcf2f675
SHA1 eedf186d7ca07040c70e8bd6521e06bd30146970
SHA512 3e7490c2c5812254e1da483fd34b551da26a7776a55e51625d361ea871021de39ca760b4ef59e9350d1a4d8927fd7d372a5867ec527af6532467bbc3001eb90b
SSDEEP 96:DZOmG+eb3FEe4DCzyzzqZdbdvzEqjVe1EVP2hk7IiwQ:DcmG+ebKe4DCOzzqfbdvYqhuEVP2hk79
TLSH
T12BC1D1F3C7E4962ECD2152F0A7296E2FCD5E092452183D5ACAE4EF1BA7D2470E34065E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cbba7e26325fdfbb6906a9cb5f04791ffb3c93f2f4fbd67906e7213b7bbb1335
MD5 9b506d52ce744de8c2a4aee5510a47f2
SHA1 4f7df80ca3332887694bdf4e75bb75d949a16f8f
SHA512 d4e34d856db0cbde748c4ed1b53dc52c72fe64c32bc483f6a5b5369736c3f64290f6b3b2fc90fe44b9055925b339cc8ac94f6d2b31cb6ff26eeff62802afe52a
SSDEEP 192:sxZnBRKyM/jK1Ml8MZY/f1seI3VOIdp3sHW6+WNDJe/rILIeJVIV6EvsSbRjfQEc:sxZBMhY/f1seUcHbQ/rO5VwR5c
TLSH
T1EC52E956AA346D77CCDBD219F555BB53D6F50432A6940E84AAFCDA2C00E7AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 4a6f92d223c4f8d5f5d5ffa3d9af681840a59fee39a775b0b5f3eb48c797d451
MD5 a20ed57c97703bb245212c1c7559084f
SHA1 1f2636305c1b66722e147a454f6bf82d65348cbe
SHA512 16fbf6d8612a7c056f5f3397490195fb5b7eef112027d8490ec3ac55a167e03a2fb738afb200e568b2f042125ed76aa1a209c92955e483e845ce3c177cc83765
SSDEEP 768:/zseJLd7pLuLbhxWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVD88cLly0ppcro4:/zseJLLEbhxWvhfynu1jaG88cL88pH4
TLSH
T162F2FB3B680CCB7E4F804E9CEC2A7F9A6EE801CB56D8895487E9941C03C66EF15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bc28f8a32b6e65f5e0acf8a79a79e5a76495f424043635669087808942d682d4
MD5 e7dae4b9ccefce451768bb2a41397f80
SHA1 9795bcae321d25b01dca99a29cbd31374d019234
SHA512 724f37187d50c1b0c498a906098df792a7387c0086b1eda103210abb8b9d6bfa02ba223f27725aff684913d437fb2072e1c54c6d73bc037edc7c8318682d8139
TLSH
T181A00216C6540542D10402B2D14B019432118C194D1D921380A9406CE8617A05312019
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe590e9c.TMP
Size 48B
SHA256 d60802c9c577eb7fed3a2b437eefbf0811f4659c5c020b5498398dc1e70b4cd4
MD5 1631ba8c3e5080a14fe2571177fa4611
SHA1 88d45a8c34766fb53e567ee0996175571d266184
SHA512 f54e2ca0ab7ff690ede392282c14407fcc989944481720ca04a768a17a9b8daa31c26b8d69bf03a7ccba834ba1984b4c56cde1f526f7aa2ba7297a72135ccd25
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c85fd258ab73c7bbfa363e770b2534d0dfbc7342047c7a7f42b25d4806e0698d
MD5 b8e016168ac208eb9d5f4c57126c7488
SHA1 e796e11d5716a2ecd23194eacf2fdf24748061fd
SHA512 502f293b40b2651039249b552ea9369cebc099bb45fbef0e39dfd4f1d60fe371e2c7e54b896cd0e45d58021524d7e7337466e835d541155d66ad650aeb2a8001
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1E+:KYHIhKggkXyV7IlKIcg/ydfIlKwswMz
TLSH
T10C912223353B02823C7D2A4CA2A7D63A4E4173A7745CA4AF7BB900A15D27E515EFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5998db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5998db.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b41df57c93f2712f60ae4aadd04ea92595a4319cb1c7e0457382d5c28b36b97d
MD5 02cb136b5b62d5629a2bcd15eb83effd
SHA1 fd85c0607fc87e24a983e890992db1a3e9c48a32
SHA512 ae2e6a8f600496c4d79e424111e23416cb48aec62eb31f1c3527c63daedb7d00cd352486c39075c6f9079d93e85365af83753ff34cd3f87b26ec4a0087ecd23b
SSDEEP 192:uubI+xasuheOwQxMrsNNYVQESriM7MlCQmiU15gN4MTXiSCaS0u08z1cqvuCk:nSZcIUsNNEW74+ECp+u1QCk
TLSH
T156726C719CB99C3AA8E7B105F58633435FF8A0B7A6C44F40E5EDAF1D00D6298170B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a4836bec084fb020ae08b625747c4718ddd0bb2ce04b5588f9c821b03f69f346
MD5 863814fa861ce06ae9db6fba7d7283f5
SHA1 1a281daf1a37c29cef1e3a5bcafc2b1057e9680b
SHA512 50d120ce5ced628f10b6bc5924a451f0b9f3775abd4c4ad84b857a1720fa9d634582a56679429ae470f146d1038c322b1c7e4dc2a1774912edba55ad28fb6489
SSDEEP 384:nMiFoZcINsNX8TUNTUlIlPW74+tC5DfYF+ubQCk:3FWNawgsvJF3QCk
TLSH
T1D1C272F198D7893AE8AE5383A77D2E469EBCD05375884984F7D85E1CCC821BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 78fc143c8de37715929d3e119163976bc68f7e8dfd09706f04d7cbe39be1acf9
MD5 5567cf24d65cbb7c26434a03ae9d528e
SHA1 180a0e359a0036d3832d7e2e7bf73f3d9c26ec83
SHA512 f88c80cf0e03d430d357deb73e70a93cc92741ba11eb0c25faa48f5c75fa9fdd8ea010c37ae77b7ea71d97f1c77fac506260ab550a20b4b79252025835222d98
SSDEEP 192:RONw6vMnPQmiUym+ehTXiSCaS0uo80IcqvuU/u:RONw6UnRqea+utQU/u
TLSH
T1F3120A75AC699C2B69A7B401F4CA33971FB461BBA9848F50FAD82F1C00D7658270B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 05a0ea3f2d0f68e560196482bb09eb4fa4caf0c69861ba324b303c65c6992ecc
MD5 e6cc23d3edf5ffec601d874ecb32f955
SHA1 6e4797f010b84d64c60396b606b8238856286687
SHA512 c38dfe7716270f7779961c0302c5e4346b98fb9d3ddcb9c57b705dc23d762aec4ea526fdfe2c81b96d3f81479bea0f17b96d0ed09247bff1da2df27f50c34018
SSDEEP 192:uuQI+xasuheOwQxMrsNNYYQESriM7MlCQmiU15gN4MTXiSCaS0u08z1cqvuCk:nPZcIUsNNPW74+ECp+u1QCk
TLSH
T1D1726C719CB99C3A98E7B105F58633535FF8A0B7A6C44F40E5ECAF1D00D6298170B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 031dccec886b761b0ed7feaeace91afa0e7b7908f60b4e8275ee823d9a3db73b
MD5 c1263e5e042b0215accbc7342fc61868
SHA1 5453253647e1c326c5e1af3a9e298603187eb683
SHA512 e67ef384d00299c3b1e03ae2aa5e0fa7f5c2b4e5a56f5b8dcd5533258fe21efdac53dde278f55fb5354d9bc1ff6eaad8ac1785377087c86be645d88aaa486051
SSDEEP 96:eqONkxQsjpflMoUZre5ih/cIPURHl8h4otop5UOD+BjPYvlCr5pgz6qNGeAL5YSz:lONB6vMtPQmiUyF+ThTXiSCV847FsU/u
TLSH
T1A4020935AC686C7BEAA7AE45F48A23172FF4606FA5905B50EAE83F1D00D765C1303D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

06799d0c-2818-4368-9d32-621af4b1c9d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\06799d0c-2818-4368-9d32-621af4b1c9d1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 295f1cc197eb7f75bc9f7f610e7d28c1acad15212a043af4983b4404759c5b12
MD5 439593f1ff890f7119a7be98cd50fed5
SHA1 1c6ba6674d9aabdec1026e2405bb1f16f97c61d9
SHA512 cb3586dfc9a526ea15ff01f769be529cafb21cbd4cf5c7210cb65d2f84af4e3a0225751797923da414178b08c495741bf50a44761b04fd1fa7c5544d402f0ed5
TLSH
T1C141E7A8A6EE1148B3B73F5A9FF6A86E447A79372E06D45E00010D4F0A66B45CD61733
MD5 SHA1 SHA512 TLSH

Submit Download

RCP[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6HU372F7\RCP[1]
Size 13KB
SHA256 286de32cf207040f70af0792b94ce5a579d9fef916e4833ee067cbd3bcf3784c
MD5 96be0110dbb39b7689b363f91ff6b2c6
SHA1 f5be5a4bd7e9786b321cfe90d18b2e2878e6aed4
SHA512 0b07bfbc305c29ad24aafbd9e3be1bba0789163e7894d5bc67ca577c01b9cd3871dfa366a8bd682395a094df22a3aab7b2cee6d127935fe0c1ee95a833bce570
SSDEEP 192:WsE75+CtCnq4m7HvLbKXJqILAFH/co7QkJR37Of1S5e/udqMkAmA2VOrc8MzOINV:IZ0qbPLvMB1Sq
TLSH
T1AD52131A530A6347F5950C177383FFB7681CA986A1BE5B79B8292C0DC8CE5337B82725
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Small_level_2[2]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6HU372F7\Small_level_2[2]
Size 2KB
SHA256 f6c207e2fccd2fcecab74143934a154385a352c00308166cb5fab021bba6268d
MD5 25c580fa422d99857459e41d9b16c83a
SHA1 ce852f4968377e8857756e41164c144998f47b49
SHA512 a093f40fe84e4d5476bb38277a65e955669782c3fce921510dd0f2d61e3dae9ac85194e8e6a4b4f1637d4199b6ee6e42fdad15b8e664547c2805ef1d551b5639
TLSH
T10741D89ABA4278030C8D99556EFE95375D225C808AD8E8C7ACDACE0847A01F58C2D64F
MD5 SHA1 SHA512 TLSH

Submit Download

Small_level_4[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6HU372F7\Small_level_4[1]
Size 2KB
SHA256 086a52ca0d849a10ce2bcba331108bdba651db6d24fa4e81d41118aa84a68547
MD5 2521308455b5c595c5c5eb7facf0400a
SHA1 d1dce845d7fcea2f22d2f0ee7cb608c118bf7237
SHA512 2d4a0a74e9a414ce11bf56b14bb11352d1fd96636c35e06a7b9afad7788fe77820e913a6e79a63ef5e0082fbceb8f579622f152130528755448b0822863f5102
TLSH
T103512B4DFD9238421968E8A2289ED8377161D84019F0FDD9CCCEF51D46B96E9C14E1CB
MD5 SHA1 SHA512 TLSH

Submit Download

alttxt[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\6HU372F7\alttxt[1]
Size 4KB
SHA256 cf8639233a6aec75c5b3d0d5877a01e758bf7c184e4eed261994240c52d18ccf
MD5 ceac94607a86429e7927f7b85cdcad25
SHA1 6ab8d7fd80fc8e2288357cc83dd3d73a34cc8bb7
SHA512 8d5052701e27d09416fe992b41bb35f3a0d3cbd3a5187222601a9c049cf96213094557b8e6c7b24053802440242d1419a50361cad54c24d9416f36f095c77866
SSDEEP 96:xqZCqadhuehRNeGhROzo0DIuvIuim44gJfJq/MgEfgKyCvWAfWdq2n:xqZCqadge/5/cjNvNimncwXx+WA6
TLSH
T13EA151E91943783406DB021A6556BBC67C308807BA83B092B4FC7998B774AB67475FBC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Small_level_1[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\76M6ZWYJ\Small_level_1[1]
Size 1KB
SHA256 a94c0887c6b8f5db2b4fe79ffac4c376b470f120ea7e596f2a86080d4532c68d
MD5 281681776d56cc91225927412c1a784e
SHA1 62907cf9d229d456719348237c04a9351730604a
SHA512 c5cebcf911400f90e0552d823383474af95723ba14d40279e6ccd4f7a94765eaea6d83ddb468217b5e67da28d3f7b4bb21c6592766561fd1940acade76255cb3
TLSH
T155319698EB84BC03C049F5F63CF79A57455A9C00EBF4E552F8DE851D99650F391480C7
MD5 SHA1 SHA512 TLSH

Submit Download

Small_level_6[1]

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\V93YYQQI\Small_level_6[1]
Size 2KB
SHA256 54312b797f4a93f8f8f3cc6d699cf7406faf35f37333284b11af85c399584ce5
MD5 647a5d61126a8166dd8c85075765f23d
SHA1 be371b23cb84edecd90091c16c817c321bec692a
SHA512 a70e39c44811ef4873c7d8b26ffda0d27d481a9c2d342aa5a2f980287fd101fad9d6ddbddf54e82d68ae42d003538cfbb56068a756ab5c528081a5af78e634d5
TLSH
T1D7512B56B2A5AC8A1AD188A07AEBD416207380004BE8D9A659D64D1E87710F2ED363E3
MD5 SHA1 SHA512 TLSH

Submit Download

2362561e-f3ea-49b9-8ae3-3cac2e88a641.tmp

Path C:\Users\Admin\AppData\Local\Temp\2362561e-f3ea-49b9-8ae3-3cac2e88a641.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

52592840-ea6c-45d5-be04-ae7ba02f64fe.tmp

Path C:\Users\Admin\AppData\Local\Temp\52592840-ea6c-45d5-be04-ae7ba02f64fe.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

D94CB95F.TMP

Path C:\Users\Admin\AppData\Local\Temp\D94CB95F.TMP
Size 160B
SHA256 2fd3a6d053751766d19849bba9d08fb027d82caba7b7f447d32ec401ee4dd33a
MD5 ea4f92189fa66aa713031296664a589c
SHA1 9428242f5b782e83a169174b4a907cad6291e183
SHA512 4b240ee0fee3f8a0690a71b0d0bad67afaec613b4249d6798a369255ca3d1d367643a0e93bd31315d50eceb2b258059bdebf73a615d740c0a3a7ac0057b289ae
TLSH
T1F4C08C6FA89A472A02431B43AA9C932238A12C8A71A571EA0DB614B46420E918F152E6
MD5 SHA1 SHA512 TLSH

Submit Download

systweakasp.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-IQTQC.tmp\systweakasp.tmp
Size 1.1MB
SHA256 3f8c455ab5e927d205eaf643f8c045c9115f4081049d1319d8ae9894ef21a397
MD5 d4fde02fb6b4eb1bebc289aca8289ae9
SHA1 9518abb7827a4e5b0eb52ff9221d1224f23c7e06
SHA512 f99e61ef419f88ebc8d48298a5eed91e6ce0440f8ca075947a612d46d2ac9cfb66865c898c86bc8b0224c68eab61c396b414ba4c0fd64c71551c90d22cdded5f
SSDEEP 24576:A4VN4kkKF3hDXq8xeidJLvktRskkkkJBcTgoALoyo52ZEdB+gepvx9Jf:FT90D3D2wB4n
TLSH
T1A7453A22A3924437D5732F759D6BC2946C36BE202EB4D58A7EF89E0C0E39B417D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M7JLK.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
TLSH
T11051CE835239A462C41A37B426E7E509B35B467643CE4FE33590230EF8876F80C35D90
MD5 SHA1 SHA512 TLSH

Submit Download

roboot64.exe

Path C:\Users\Admin\AppData\Local\Temp\is-M7JLK.tmp\roboot64.exe
Size 19KB
SHA256 249aff413bbcca3e894681b45b3fe3130ed7c8718f3aef124b31f7da7b948f5a
MD5 24c56d9d97371ec343278e862541b3ed
SHA1 ba39f8c9886ef4aabd72262b192db8a177c7e206
SHA512 4db29038775dc5b92d25c9d02488f3d63fb936f281633e546b83c69454ce420f7eb6b574a783ade2c199f71d0945323de32ff4211717151780e8cd9b74462b9d
SSDEEP 384:vuTf66v33gh5Qp1n4XXKeGB/cnYPLScj0eMAvl:ez3sQAqcf6tvl
TLSH
T108923B93C775045AECA7CB7082F7C6A3AC71BE408F95A6CB416151981EA9FE0763930E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_shfoldr.dll

Path C:\Users\Admin\AppData\Local\Temp\is-SQ3CE.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
TLSH
T1E9A2B602A7FD2624F2F3AF746EB626214ABBBC666D36E10D2610504D0C30E95DEB5733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isxdl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-SQ3CE.tmp\isxdl.dll
Size 152KB
SHA256 31163bd401dd84733cb21fd84a25e883082c70640fcc255883b637788a7bed4c
MD5 1e95c2a4d1c4f57b67cca6ab4c2c8b91
SHA1 9c9501210b5469c1a390f5f44674dde5ece10b09
SHA512 9d6cf00fd1a66d044f3e100a29e5154eb68e785be97033d277a6255c69e6fb0340c117299e7c4273053205d44f9fde1353e2aa0f19b3589413fe8c90ccacc8c8
SSDEEP 3072:LLHq/Hs2518t3JAryzGYihGQ3mI++mh6iysXqa:3Hq/HvAtTMhGRorpsXL
TLSH
T123E36C10B601D036E8BF167A897E8B75662EB9305B9450C773CC4EAE5EA96F13F30217
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-TNJGU.tmp\46fa739801eb6061b00f9a9547730798db67dc204e9c2aa6c391c0009ef51e06.tmp
Size 1.1MB
SHA256 c5b8ee03932fda12b8afee7350b3bacc018937a685a4921acc952d07c363b603
MD5 d49a1c9e2e36a9934b5f5f9580aa323b
SHA1 c5cfdd80202b5645158fd60e61730e151ebe825e
SHA512 b7a6f3d655c370028b829c9e90b167b3c7f4028ee01ea8f5a0e13115e17c93eb049c77f9d6086add155f0f46467b63ed13dffed5aaea1cf5eaac2cd9a642abb9
SSDEEP 24576:J4VN4kkKF3hDXq8xeidJLvktRskkkkJBcTgoALoyo52ZEdB+ge5vx9oS:yT90D3D2wBcH
TLSH
T104454A22A3924437D5732F759D6BC2946C36BE202EB4D54A7EF89E0C0E39B817D35392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NSISdl.dll

Path C:\Users\Admin\AppData\Local\Temp\nszA9D8.tmp\NSISdl.dll
Size 14KB
SHA256 dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
MD5 a5f8399a743ab7f9c88c645c35b1ebb5
SHA1 168f3c158913b0367bf79fa413357fbe97018191
SHA512 824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
SSDEEP 192:tUZTobBDJ68r67wmsvJI5ad9cXzFOVu+mZ/P3p+57CvpVqDxVp01Dwn2GRPgsfA:6Bo/680dCI5adOjFOg9//p27uNw2Go
TLSH
T1D6624C15AA2008F6C761127470E73BBE2BB34E72471485C39BE3595FBD25603AB72AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1280_1648570202\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0983a4f9-da20-4b61-9402-94ad69507eda.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1280_626762284\0983a4f9-da20-4b61-9402-94ad69507eda.tmp
Size 157KB
SHA256 e03138d37406c2bedec93e5a7c44a457a6b19cf4fee5dfe5a46450fcea1bf85e
MD5 088d09e1a5cd1db2f55a4f5131b75b3b
SHA1 4e017079555c92f2f9419a53ab89aae7c5425550
SHA512 f8e7a1652d20778af9e0aefef0f24bb477260eefd5c6cecd3b4e17276b7d6c8d79554e850b9a9fdd9c65095ae16dad8868df304ee7a057ec7cea5a35b9e526ad
SSDEEP 3072:sA30KAb7L7nAnBPxnb8b4HpQgHY15vClaH4d6r1tx:sAkKAb7L0Qb4HpQgoq8tx
TLSH
T182F3E1AD2FEE891ACD0B50BD3B04B38BC90A8F07820A655F735F8015997475D17A2DFA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eng_rcp.dat

Path C:\Users\Admin\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\eng_rcp.dat
Size 31KB
SHA256 13da81e8da7ed768660ee536f6728a52c939680b9fc6bc21fa832452a739c999
MD5 8c6827c56addf489ea0377ae9c14328f
SHA1 bcf659c258d7b9e37d9b827ce8469b938924f98e
SHA512 ae507483eeab4d2e7866d448a80613a1280678501db322e519f5405c712bad27fadb3f2333d0923263026fb8ec9012895d14b2daaf23ac6b200fcdfc4122b037
SSDEEP 384:+hASsW+ogacuSk2k+CmaqgZKvI6cHgUZ7Iuas0Jy5Ysmto6Kqo:+hA9uHPZuI607Iuas0Jy5qKL
TLSH
T1B6E2484067FE9218F5F27F922EF896605E3ABCD6AD39D22D1245805E8AB1E04CD71732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

log_09-10-2026.log

Path C:\Users\Admin\AppData\Roaming\Systweak\RegClean Pro\Version 6.1\log_09-10-2026.log
Size 1KB
SHA256 dbd75fd306f430f6609f2dd0e47499fa85f5233db37b6fe34a73fa2a4594f032
MD5 22f077dbb5a996e21e10a38a412b574d
SHA1 68a5952c3d7ff06170da48d7a7cdc06a647def11
SHA512 17dc17d40d3835aeede249187d3279906e2d850e5869e06c43a3308b5cc2d1f69544a22719088c0a86f8c9acaa88b4a708c56e0e06e074918038d0b98b94581d
TLSH
T11A21DB8317DC002AB9B71EA4A9B185258717FDB1CD39C14D0299959E0EE3B08A4207AB
MD5 SHA1 SHA512 TLSH

Submit Download

RegClean Pro.lnk

Path C:\Users\Public\Desktop\RegClean Pro.lnk
Size 1KB
SHA256 9601a4f1de318d752c1a143de0f1e6de50909645fe275e548efd978817455729
MD5 af462b6cbbe7ff67b7c47c2863992226
SHA1 1d13cdf73b799eb940d49dd1b13a6bdc9438272b
SHA512 b4f2544edd6d0ee0afef7a31e069e72ebb42540b7aad0cbc16f3eb45ec28a9ea0fe632ca8042d21b55f50908a82c9665022be54beb096df57ff4faefc73c4010
TLSH
T12621D0004FFB8A5EF9B245769861DB12A633FD02E7680F9F0140020D1C77E05A859FAE
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1100-550-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/1100-879-0x0000000000400000-0x000000000042B000-memory.dmp

Download

memory/2160-194-0x0000000002B90000-0x0000000002BBA000-memory.dmp

Download

memory/2160-164-0x0000000003380000-0x00000000034B1000-memory.dmp

Download

memory/2160-1060-0x00000000102C0000-0x00000000103C0000-memory.dmp

Download

memory/2160-189-0x0000000010000000-0x0000000010212000-memory.dmp

Download

memory/2160-848-0x0000000010000000-0x0000000010212000-memory.dmp

Download

memory/2160-190-0x0000000010000000-0x0000000010212000-memory.dmp

Download

memory/2160-1011-0x0000000010000000-0x0000000010212000-memory.dmp

Download

memory/2160-937-0x0000000010000000-0x0000000010212000-memory.dmp

Download

memory/2980-6-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/2980-23-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2980-161-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2980-179-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2980-26-0x0000000000400000-0x0000000000530000-memory.dmp

Download

memory/2980-24-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/4224-410-0x0000000010000000-0x0000000010212000-memory.dmp

Download

memory/4224-373-0x00000000032D0000-0x0000000003401000-memory.dmp

Download

memory/4224-414-0x0000000002FC0000-0x0000000002FEA000-memory.dmp

Download

memory/4224-553-0x0000000010000000-0x0000000010212000-memory.dmp

Download

memory/4224-411-0x0000000010000000-0x0000000010212000-memory.dmp

Download

memory/4408-15-0x000000007398A000-0x000000007398B000-memory.dmp

Download

memory/4608-878-0x0000000000400000-0x000000000052E000-memory.dmp

Download

memory/5000-22-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5000-188-0x0000000000400000-0x000000000042D000-memory.dmp

Download

memory/5000-1-0x0000000000400000-0x000000000042D000-memory.dmp

Download