5b352464a8a916c1e43a01fc0e7b166a150c67abb464f03ca4367aa20cd2a418

Analysis

user interaction
yes
max time kernel
165s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/10/2026, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ShulkerV2.exe
Size 14.5MB
Sample261020-sf8ddaca84
SHA256 5b352464a8a916c1e43a01fc0e7b166a150c67abb464f03ca4367aa20cd2a418
MD5 880abf38a0c6a5a4a6a114f8d183836f
SHA1 b410b8a39e57b4813066dab8439ca9c14235b963
SHA512 3e2afa61b3f2aea2550d6b73ab968466c59a3ab8ad1bc9265fb9a8c1298a47fd4bbe9b48cea96b47d6c994c25d1c24da081a58bfde43da3e42d300f2ba4c0ef2
SSDEEP 393216:4nOQI2CStEyOZvO+J5U1WAsXo8UWsfs1onTFB+LfGOE:4OQfoyal51po/
TLSH
T170E633378AD57CD3C2A967F16D210820AA70F9379F829434F62F9729C64656ECF35B80
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	ShulkerV2.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	ShulkerV2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	ShulkerV2.exe

Themida packer 21 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/3432-0-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-1-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-3-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-2-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-4-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-5-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-7-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-20-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-192-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-193-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-221-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-225-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-251-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-263-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-265-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-267-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-316-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-341-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-365-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-412-0x0000000140000000-0x00000001423E7000-memory.dmp	themida
behavioral2/memory/3432-414-0x0000000140000000-0x00000001423E7000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ShulkerV2.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 1 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3432	ShulkerV2.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1411639411\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_723846116\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1411639411\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1411639411\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1411639411\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_723846116\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1411639411\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_723846116\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\surnames.txt	msedgewebview2.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5988	msedgewebview2.exe
5988	msedgewebview2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
2956	msedgewebview2.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 3432 wrote to memory of 2956	3432	ShulkerV2.exe	90
PID 2956 wrote to memory of 3796	2956	msedgewebview2.exe	91
PID 2956 wrote to memory of 2828	2956	msedgewebview2.exe	92
PID 2956 wrote to memory of 2828	2956	msedgewebview2.exe	92
PID 2956 wrote to memory of 2828	2956	msedgewebview2.exe	92
PID 2956 wrote to memory of 2828	2956	msedgewebview2.exe	92
PID 2956 wrote to memory of 4652	2956	msedgewebview2.exe	93
PID 2956 wrote to memory of 5688	2956	msedgewebview2.exe	94
PID 2956 wrote to memory of 5688	2956	msedgewebview2.exe	94
PID 2956 wrote to memory of 5688	2956	msedgewebview2.exe	94
PID 2956 wrote to memory of 5600	2956	msedgewebview2.exe	95
PID 2956 wrote to memory of 5600	2956	msedgewebview2.exe	95
PID 2956 wrote to memory of 5600	2956	msedgewebview2.exe	95
PID 2956 wrote to memory of 5600	2956	msedgewebview2.exe	95
PID 2956 wrote to memory of 5600	2956	msedgewebview2.exe	95
PID 2956 wrote to memory of 4292	2956	msedgewebview2.exe	99
PID 2956 wrote to memory of 4292	2956	msedgewebview2.exe	99
PID 2956 wrote to memory of 4292	2956	msedgewebview2.exe	99
PID 2956 wrote to memory of 2812	2956	msedgewebview2.exe	100
PID 2956 wrote to memory of 2812	2956	msedgewebview2.exe	100
PID 2956 wrote to memory of 2812	2956	msedgewebview2.exe	100
PID 2956 wrote to memory of 5988	2956	msedgewebview2.exe	101
PID 2956 wrote to memory of 3960	2956	msedgewebview2.exe	102
PID 2956 wrote to memory of 3960	2956	msedgewebview2.exe	102
PID 2956 wrote to memory of 3960	2956	msedgewebview2.exe	102

C:\Users\Admin\AppData\Local\Temp\ShulkerV2.exe
"C:\Users\Admin\AppData\Local\Temp\ShulkerV2.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --disable-features=msSmartScreenProtection --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3432.1128.4961324736054935682 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView /prefetch:4 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ff9f0f55fd8,0x7ff9f0f55fe4,0x7ff9f0f55ff0
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1860 --field-trial-handle=1864,i,470743786139052868,14327281695656921517,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:2 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339
    3⤵
    PID:2828
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2204 --field-trial-handle=1864,i,470743786139052868,14327281695656921517,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:3 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=2504 --field-trial-handle=1864,i,470743786139052868,14327281695656921517,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339
    3⤵
    PID:5688
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3580 --field-trial-handle=1864,i,470743786139052868,14327281695656921517,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339 /prefetch:1
    3⤵
    PID:5600
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4480 --field-trial-handle=1864,i,470743786139052868,14327281695656921517,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4624 --field-trial-handle=1864,i,470743786139052868,14327281695656921517,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339
    3⤵
    PID:2812
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4664 --field-trial-handle=1864,i,470743786139052868,14327281695656921517,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5988
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView" --webview-exe-name=ShulkerV2.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --no-appcompat-clear --mojo-platform-channel-handle=4068 --field-trial-handle=1864,i,470743786139052868,14327281695656921517,262144 --enable-features=MojoIpcz --disable-features=msSmartScreenProtection --variations-seed-version /prefetch:8 /pfhostedapp:5f9d7852a6ca24e19a4924a7efb6ef99ad015339
    3⤵
    PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

51f6f87c-87e7-4a7e-8c4c-6ece50d9b45b.tmp

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\51f6f87c-87e7-4a7e-8c4c-6ece50d9b45b.tmp
Size 3KB
SHA256 076de64897d45f58b15838428e4f87c4136b5579c928f1d1c864f1019d2273c8
MD5 56da78e50ae87b7ef396a6140e937fbb
SHA1 db6f3107c3d445e20d27924746c5905c95587646
SHA512 842a7427fb414fa26487426cc4416ce6cf39bca00b081ec07bfa107468008f72a5f0ad1aecfd644977f8cbbfdad5bbef4feaef03572c0a44731a0af5261a9419
TLSH
T17E61963369B4AB374DF39A04B8C62B06A7A5812BE5923F99C6EC4F1C01D72D81342D67
MD5 SHA1 SHA512 TLSH

Submit Download

848394eb-3fb7-43c4-91eb-1a6f234fb0bc.tmp

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\848394eb-3fb7-43c4-91eb-1a6f234fb0bc.tmp
Size 3KB
SHA256 1c0b91d07864ff7e13a47591a48ce872060fff9fc73b0e0405575dbff71869cb
MD5 f9f2a2c59b1591bd202ba3fc586322f2
SHA1 7fdbe045795be5d125aa6c4fd4b7ccdad596f223
SHA512 455dbc5b31788cba6f46d7912fd62fdfcda3c462211cfcb164fa9cf9c742b081e402632f7940db51a0aedaee8426d13a849f37a897f85c2fbbfb94081af02c62
TLSH
T17781B63269B4AA374DF2D508B8863F07AB65906BE5963F99C6EC4F0C01D72CD1342D67
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3f5903ab60aaf4fc6c20e9e704f862273c0e65b73945bc0b441e53aa401ed87b
MD5 62e4795db648b1f6b4113ce91a279e63
SHA1 4138f9cb17fb8207b338c005023eb19222c52727
SHA512 95ee67e3ca259b7b030169cf494c40c292a6164f61b41437965d0e6525697744601786d76753f169d361c99730c6d55e0077d47aaca8a25f6c0aa22d1c9484b1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8128cb1b1371a6346ce51d45bc708cd291c5a2f144023341c6df7ee2185b755b
MD5 07fb1b0c291034d5eb530ac36435ebbe
SHA1 24076e3b53548ffb6170b85dce7ac2c982978af3
SHA512 570bcc4bf4b79eb837e45a32c9f909d30796076307db791ea25438c905729738c52d47e927f8ffbab546ab7f76de006ad2fa4f467ca86e6549d89351890d08a8
TLSH
T128D0121B3691013CC01425332046A1082810C20F8105410054B8851D1A040A10902481
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

535dcfc6-82f4-4cd7-8676-c8839184f0af.tmp

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\535dcfc6-82f4-4cd7-8676-c8839184f0af.tmp
Size 6KB
SHA256 36236357407baa4d0e5b00dc5d1494e76d79df90894f2e321dfe340b39fe4b56
MD5 90313e15ad74e663ef608c137778391a
SHA1 cc4878ac5add6a5551a582380bb75feb0fa9b204
SHA512 75dd268c22345638cfd93915b44bad1459235e04d5b0bd588edf99376011e7cb1c444368fa63e366148e7f88d0694e8173d6a01add7c7eee30f8c8d7505f93db
SSDEEP 96:st8/dNDJ3b9B6kao5h16Z57s7/x+6MhmuecS9D1ejeMyK+gIf28XM1C7K:stwPkRoK7sV+F29DQjLVkG6K
TLSH
T112D185015E24B97B4CC6E109FA75BA07E2F9A07271D51E58EBF8852C04DB6DC6317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 312B
SHA256 5da1524b92c0e363df422f4b085d91af61fc48569677c84d4d2a2a81422dd99e
MD5 d311d12342b023230b5a216ffb52cc46
SHA1 9b1062c3a773c0a2a09652bad06fc54bd3414fbd
SHA512 d59245875b8384a2837dfe295f895c12ca9f6ff4ef417cf129b3e18a8de29ab2b5bfc80e75ea30d9f011f8019d27bc2feb1570118e048b3a18987b4e238c2ca8
TLSH
T1B5E0A9D28A217297F3B8B138A6C2F188B0324DAF7AE34DC89E4331F819363820170200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 26f6c1c2d238fd882cddb4cad19b707257348ce33f58f04cf405314d390fd264
MD5 a181f0c5805dd2bdf24e4446b7cb73d0
SHA1 f7fc39e94b46226486c46698f36330b592d21231
SHA512 5c22ec8e0544ce4f0bb0aac2b43752e8cf85cdb83f60073635a7296b89bc35702901feaea383ecf47e2a01a46c757140d05d52fba331a5f53e233c9425f3c41d
MD5 SHA1 SHA512

Submit Download

5ab6238e-cf35-436c-8185-9c0b12999798.tmp

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\Network\5ab6238e-cf35-436c-8185-9c0b12999798.tmp
Size 358B
SHA256 834c5ff73eaccbd9e9ae94d8314e3318e72d61d96b9b8d6796f23dfb4fad5a76
MD5 c7c22fed26321b913a1b2ae7a2b7ddd0
SHA1 dd9b5f4f2fc778ec5ccadb84eba1eb58075240c1
SHA512 de2e2d70d112162f74a01c6fe0abedceaaa5b116cd2533f424329561070f78cb2ad2d941f4c7ad3a89e5f5433005ebc0daaf3d5935a27a011223e63e9278f0c0
TLSH
T158E0C062C1D0997D4A4043E826243C53C63E0406122C1EABDAE9F7AA87A10BC9D1040B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\Preferences
Size 6KB
SHA256 3ee76add7f635fe91aa7bc283bdadb11c3aa837c9f5045b2f30f83556c62c7f4
MD5 ed29a2c3902e8415012e87cfde2d5ea2
SHA1 66eac31bbe1873e793e0c98903faf15966fbba16
SHA512 8cd098c0c6835d15348f45964f8217f34e2c8e29428eb6a369becc734754d3ecab04b9fa9035c29f9d120a01456370ae528a368c0edb0c557a96dc4e37670fe4
SSDEEP 96:r8/dNDJ3b9B6kUdo5h16Z57s7/x+6MhmuecS9D1ejeMyK+gIf28XM1C7K:rwPkXoK7sV+F29DQjLVkG6K
TLSH
T1AFD1A5015E24B97B4CC6E109FA79BA07E2F9A06271D51E58EBF8862C04DB6DC6317D0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ecea38a0-720a-4a3b-b9b2-b7ac3462e649.tmp

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Default\ecea38a0-720a-4a3b-b9b2-b7ac3462e649.tmp
Size 6KB
SHA256 f958273833c39041b7c33983c65bfa42c7231c8532bfc7118f9b54e4fdd803ec
MD5 ca0022d55fc54297b282a718c7068d4e
SHA1 69d410e960c7cc678a000be6d957534ec06b3ebf
SHA512 a1929e1787236edd557a909ab01e220b700847847d29994ca9222f8c31623c4e90e378f31f4614be991e0f86794b1c2f3e694337524ae6213bc7b49f01a21a70
SSDEEP 96:st8/dNDAG3b9B6kao5h16Z57s7/x+6MhmuecSpflAMHnjeMyK+gIYv928XM1C7K:stwP+RoK7sV+F2pflAqjLVtv9G6K
TLSH
T1DFD196025E24797B4CC6E119FA79BA07E2F9A07271911D58E7F8892C04DB6DC6217D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Local State
Size 1KB
SHA256 4d6a2f6841a9ab4bf9321849077460bd2d637731e42cd3d47c4e08b31a365ea0
MD5 2252e600984fcbd76edcfdb0a070e9aa
SHA1 62da8f76789cd6ea91c1dbaae9d61b7c44369b98
SHA512 12923280b2dde11bef5522811030d223ddae0f4e03302ed02d3d58a980342024d3ca83f777bfb565ad5a20aa67139c8394e4ac339fe4d45bf7ea8c8fd515186c
TLSH
T1D82195B398F85F33AC9222057197AA1B9D22806E41514E4451DDC62C01E31CCDA1BE73
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\Local State
Size 2KB
SHA256 ffff002de0181fac43e7c9563b81d78d2527716e79b0b2f58ead9ebce2643150
MD5 2fd5911748165c4ad35115416bda5088
SHA1 f55dc1efed96a556fdef6d46bd0180a2f76595d4
SHA512 60cb91d26305d8166d22d276d6f751c66813c4c13c3442436c755fb17e2d09995c29056e5c9e01ca75eb97145044d6aada6d85b7819671663ca8d490ae332187
TLSH
T19F51B4336868AB378DF28608B99B6F13CE358169A6532F4496DC8B1C00D719D5742CB7
MD5 SHA1 SHA512 TLSH

Submit Download

fff19e74-c465-43e2-8d7e-7f54b99df81e.tmp

Path C:\Users\Admin\AppData\Roaming\ShulkerV2.exe\EBWebView\fff19e74-c465-43e2-8d7e-7f54b99df81e.tmp
Size 15KB
SHA256 44d6fdef458844e33b957984b0cc42b816544eb831bbd9f3c8c06fd285d845e6
MD5 c523188192eebf3eb1924bab98fb3edd
SHA1 1126e3025f6770496dafc04aaaa56e7cf662a9e9
SHA512 74a04f6f7b6b5e3509466cf26926ad4e1e77b728c7e86fdef0da214cfdf79181a5c050966b36fbda0acf3e2e8ebfb96dc2a40e5a846165e5ec0f057f3a37a5c2
SSDEEP 384:r+OBqImmJvGBLx3NaFMJFNNBSV7w8ji+BoPck3Q8vg6rU:ScvGtlNA8uboUk19o
TLSH
T1AD72AE7A18752B232CE3C509BACA674B8E31A257C0D67BD9C8ECDF0E11AB1850342D96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_1411639411\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_23683511\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2956_723846116\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2828-208-0x0000021FCDB20000-0x0000021FCDB4A000-memory.dmp

Download

memory/2828-106-0x00007FFA12050000-0x00007FFA12051000-memory.dmp

Download

memory/3432-221-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-316-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-225-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-193-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-192-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-414-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-20-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-7-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-251-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-263-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-265-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-267-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-5-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-4-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-2-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-412-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-1-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-0-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-3-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-341-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/3432-6-0x0000000140D50000-0x0000000140D51000-memory.dmp

Download

memory/3432-365-0x0000000140000000-0x00000001423E7000-memory.dmp

Download

memory/4292-296-0x00007FFA124B0000-0x00007FFA124B1000-memory.dmp

Download

memory/4292-297-0x00007FFA12080000-0x00007FFA12081000-memory.dmp

Download

memory/5600-121-0x00007FFA12050000-0x00007FFA12051000-memory.dmp

Download

memory/5988-360-0x0000015574390000-0x0000015574391000-memory.dmp

Download

memory/5988-363-0x0000015574390000-0x0000015574391000-memory.dmp

Download

memory/5988-362-0x0000015574390000-0x0000015574391000-memory.dmp

Download

memory/5988-361-0x0000015574390000-0x0000015574391000-memory.dmp

Download

memory/5988-359-0x0000015574390000-0x0000015574391000-memory.dmp

Download

memory/5988-358-0x0000015574390000-0x0000015574391000-memory.dmp

Download

memory/5988-352-0x0000015574390000-0x0000015574391000-memory.dmp

Download

memory/5988-354-0x0000015574390000-0x0000015574391000-memory.dmp

Download