8322a536e62f5119229243293fa41d06c420a911d21214ec78c1289b796957a6

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 12:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
kl.exe
Size 1.7MB
Sample260801-pkrdwaveka
SHA256 8322a536e62f5119229243293fa41d06c420a911d21214ec78c1289b796957a6
MD5 13f377dd0e67abcdb266bc2433bccaca
SHA1 ffeb81b2270cabd47a30719c2c6b6a824878925f
SHA512 6aacb1365a1812f6ee402598c5bf5969e25091c5502e4ea07d407776b09ed58fb32f9efabbc07ca0b50035c98636b8bee5b96f01afa4b5f4a89541c4480d4594
SSDEEP 49152:Pc/OpzSXnBOxfAnyv3TnYZVKVC6mE8vN41AboWe:U/iinBOxGIcVjv0AbW
TLSH
T14185339657E09879D2611E3148FFF9343A37CD414827F7EBBB784F3120A2597AE2A814
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery installer persistence

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
5104	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
4872	silentkeyloggerfree.exe
4160	unukfree.exe
5384	Au_.exe
1568	silentkeyloggerfree.exe

Loads dropped DLL 12 IoCs

pid	Process
5672	kl.exe
5672	kl.exe
5672	kl.exe
5104	silentkeyloggerfree.exe
5672	kl.exe
5672	kl.exe
3420	silentkeyloggerfree.exe
4872	silentkeyloggerfree.exe
5672	kl.exe
5672	kl.exe
5384	Au_.exe
1568	silentkeyloggerfree.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ukfree = "C:\\ProgramData\\ukprfree\\silentkeyloggerfree.exe"	silentkeyloggerfree.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_783458641\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_340301185\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\my\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\ca\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_1389887286\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5540_340301185\protocols.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Au_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silentkeyloggerfree.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	kl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silentkeyloggerfree.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silentkeyloggerfree.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	silentkeyloggerfree.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	unukfree.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5976	msedge.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000c00000001c5ed-403.dat	nsis_installer_1
behavioral2/files/0x000c00000001c5ed-403.dat	nsis_installer_2

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300607526463818"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	silentkeyloggerfree.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	silentkeyloggerfree.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	silentkeyloggerfree.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	silentkeyloggerfree.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{73B7F80E-2533-4D7A-92DC-7F588AE0D8D5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	silentkeyloggerfree.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	silentkeyloggerfree.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe

Suspicious use of FindShellTrayWindow 13 IoCs

pid	Process
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
5540	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
5104	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
3420	silentkeyloggerfree.exe
4872	silentkeyloggerfree.exe
4872	silentkeyloggerfree.exe
1568	silentkeyloggerfree.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 5104	5672	kl.exe	89
PID 3420 wrote to memory of 4160	3420	silentkeyloggerfree.exe	94
PID 4160 wrote to memory of 5384	4160	unukfree.exe	95
PID 5384 wrote to memory of 1568	5384	Au_.exe	97
PID 5384 wrote to memory of 5540	5384	Au_.exe	98
PID 5540 wrote to memory of 1292	5540	msedge.exe	99
PID 5540 wrote to memory of 4944	5540	msedge.exe	100
PID 5540 wrote to memory of 5976	5540	msedge.exe	101
PID 5540 wrote to memory of 4944	5540	msedge.exe	100
PID 5540 wrote to memory of 4944	5540	msedge.exe	100
PID 5540 wrote to memory of 4872	5540	msedge.exe	102
PID 5540 wrote to memory of 4872	5540	msedge.exe	102
PID 5540 wrote to memory of 4436	5540	msedge.exe	104
PID 5540 wrote to memory of 4436	5540	msedge.exe	104
PID 5540 wrote to memory of 4436	5540	msedge.exe	104
PID 5540 wrote to memory of 4972	5540	msedge.exe	105
PID 5540 wrote to memory of 4972	5540	msedge.exe	105
PID 5540 wrote to memory of 4972	5540	msedge.exe	105
PID 5540 wrote to memory of 2320	5540	msedge.exe	106
PID 5540 wrote to memory of 2320	5540	msedge.exe	106
PID 5540 wrote to memory of 2320	5540	msedge.exe	106
PID 5540 wrote to memory of 3736	5540	msedge.exe	107
PID 5540 wrote to memory of 3736	5540	msedge.exe	107
PID 5540 wrote to memory of 3736	5540	msedge.exe	107
PID 5540 wrote to memory of 2876	5540	msedge.exe	108
PID 5540 wrote to memory of 2876	5540	msedge.exe	108
PID 5540 wrote to memory of 5388	5540	msedge.exe	110
PID 5540 wrote to memory of 5388	5540	msedge.exe	110
PID 5540 wrote to memory of 4784	5540	msedge.exe	111
PID 5540 wrote to memory of 4784	5540	msedge.exe	111
PID 5540 wrote to memory of 4888	5540	msedge.exe	113
PID 5540 wrote to memory of 2500	5540	msedge.exe	116
PID 5540 wrote to memory of 2500	5540	msedge.exe	116
PID 5540 wrote to memory of 4196	5540	msedge.exe	117
PID 5540 wrote to memory of 4196	5540	msedge.exe	117
PID 5540 wrote to memory of 4856	5540	msedge.exe	118
PID 5540 wrote to memory of 4856	5540	msedge.exe	118
PID 5540 wrote to memory of 5312	5540	msedge.exe	120
PID 5540 wrote to memory of 5312	5540	msedge.exe	120
PID 5540 wrote to memory of 5680	5540	msedge.exe	121
PID 5540 wrote to memory of 3312	5540	msedge.exe	122
PID 5540 wrote to memory of 5504	5540	msedge.exe	123
PID 5540 wrote to memory of 2392	5540	msedge.exe	124
PID 5540 wrote to memory of 2392	5540	msedge.exe	124
PID 5540 wrote to memory of 1688	5540	msedge.exe	128
PID 5540 wrote to memory of 1688	5540	msedge.exe	128
PID 5540 wrote to memory of 3372	5540	msedge.exe	129
PID 5540 wrote to memory of 3372	5540	msedge.exe	129

C:\Users\Admin\AppData\Local\Temp\kl.exe
"C:\Users\Admin\AppData\Local\Temp\kl.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672
- C:\ProgramData\ukprfree\silentkeyloggerfree.exe
  "C:\ProgramData\ukprfree\silentkeyloggerfree.exe" /install
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5104

C:\ProgramData\ukprfree\silentkeyloggerfree.exe
"C:\ProgramData\ukprfree\silentkeyloggerfree.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3420
- C:\ProgramData\ukprfree\unukfree.exe
  "C:\ProgramData\ukprfree\unukfree.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe
    "C:\Users\Admin\AppData\Local\Temp\~nsuA.tmp\Au_.exe" _?=C:\ProgramData\ukprfree\
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5384
  - - C:\ProgramData\ukprfree\silentkeyloggerfree.exe
      "C:\ProgramData\ukprfree\silentkeyloggerfree.exe" /uninstall
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1568
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.silentkeylogger.com/uninstallpage/
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:5540
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffe8c0ec188,0x7ffe8c0ec194,0x7ffe8c0ec1a0
        5⤵
        
        PID:1292
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,13493210696440502409,16900999320380981177,262144 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
        5⤵
        
        PID:4944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,15924342977366700530,3033848959798975802,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:5976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,7776936449531267691,3020556726405842405,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:13
        5⤵
        
        PID:4872
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,13815638968981558740,8342428645334037994,2097152 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
        5⤵
        
        PID:4436
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,3773488902826377876,9851476097615301429,2097152 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
        5⤵
        
        PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,13932949186482537652,14729904809167591557,2097152 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
        5⤵
        
        PID:2320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,5584587004268553674,11895432649254409202,2097152 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
        5⤵
        
        PID:3736
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,8511581389169768172,9887368075694700027,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
        5⤵
        
        PID:2876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,13571498982213999728,9953991531212088489,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
        5⤵
        
        PID:5388
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,2246784419377438039,9655073128006378826,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
        5⤵
        
        PID:4784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,16485994726875444158,4318240193248719975,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
        5⤵
        
        PID:4148
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6152,i,16485994726875444158,4318240193248719975,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
        5⤵
        
        PID:4888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,4740398332390389392,2890215626439174418,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
        5⤵
        
        PID:2500
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,791457615054194775,15674955885207922553,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:14
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,14889014156890835045,17659650614904401299,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
        5⤵
        
        PID:4856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,14387803691191583180,15821900982496773949,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:14
        5⤵
        
        PID:5312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,4465951952152475858,3225378193846779121,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
        5⤵
        
        PID:5680
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,15779079784024461657,7765061126764098686,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
        5⤵
        
        PID:3312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,4868008055052593756,6976047537559281388,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:14
        5⤵
        
        PID:5504
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,4411148293778290041,17105447186852020494,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:14
        5⤵
        
        PID:2392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,7812692650192722232,14951184181951200198,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
        5⤵
        
        PID:1688
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,18053674394284268453,17500213696519416712,524288 --field-trial-handle=2036,i,2365997760481648227,10159184070991833043,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:14
        5⤵
        
        PID:3372

C:\ProgramData\ukprfree\silentkeyloggerfree.exe
C:\ProgramData\ukprfree\silentkeyloggerfree.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

55168.dat

Path C:\ProgramData\ukfree\55168.dat
Size 897B
SHA256 a950b1cf4b62c1a1e25774bd6a69569e3af149dd81cec6cbc207e0f3f759821c
MD5 0b2137debcb5fe6de928cd9ee5715ce9
SHA1 f803ec25786623cff12d84af481845fe36d46628
SHA512 345a9b3d5b2270fc0256257ac24cf8a0e938cd6a4c97e22255e63f4361a4c0d77a23fffa1990f02704e035da418464598f4645be23f842768bf50f80efffeef7
TLSH
T1F011CC346B0E686880C470AD2DB362492480BD448C30C9B49E252CFE3FDC9D3A79EF50
MD5 SHA1 SHA512 TLSH

Submit Download

55168.dat

Path C:\ProgramData\ukfree\55168.dat
Size 897B
SHA256 7f5da5a8a883c232d382dc86aa896098c0123c6388ffc9c0af4cb751cc24f6e9
MD5 0f1c82961634d95a423f0fd6f82e810b
SHA1 560507834fd37266389f7b5362b5c53677065655
SHA512 6226acaa2b6011352993f5c44b995fb311329a4973e3639d58f50c562e129ccd52bcb2d962ddf2db63427011a3992aa37e84d35456d0b62e0f192558fc242716
TLSH
T1121199346B0E686880C470AD2DB362192580BD448C30C9B49E256CFE7FD89D3A79EF50
MD5 SHA1 SHA512 TLSH

Submit Download

55168.dat

Path C:\ProgramData\ukfree\55168.dat
Size 897B
SHA256 768d7958a6d28fb417060a62e4e4698d78d28d969450bd0909777c852531841d
MD5 db7746823a24180e739deaab52f7d4ff
SHA1 76bdbf68177930cb5fdb3ed2296865d057d57f66
SHA512 58f674274ef6a889026268c894ed87bded8290e09518bb2c44c33176b1602ddfd13d61fc7d6712e3a8c91e79f2976bdd46d2b37cf1586853ae345a91e6aaac78
TLSH
T1BD1199342B0E686880C470AD2DB362192580BD448C30C9749E256CFE7FD89D2A79EF50
MD5 SHA1 SHA512 TLSH

Submit Download

55168.dat

Path C:\ProgramData\ukfree\55168.dat
Size 897B
SHA256 3d7bcfcc594b848c25dd606be840c61223c8d770b8bbe6e81be21ed98f9ef80f
MD5 246b62984e58342d45aa9f8c4fad6a10
SHA1 67f0a6dbb33c4ec0ba723ed2000ae866c7907828
SHA512 1cea12f05a476d856a565e37319a869bcd6915d1fdb9a88670c354a73a08a51b951279a278f05997c2bfd646246a5eb3f5b2ef19e4805e71115dca7968cfd787
TLSH
T1CE1199342B0E686880C470AD2DB362192580BD448C30C9749E256CFE7FD89D2A79AF50
MD5 SHA1 SHA512 TLSH

Submit Download

BMPScrTMP.bmp

Path C:\ProgramData\ukfree\logsstore\Admin\ScrnsStore\BMPScrTMP.bmp
Size 7.9MB
SHA256 f3d3eaa9d98981d49296a039e2097bcf3a88bc76b7320e4a86418e20d153981e
MD5 0743d9f54b0e29cbd905e638023d85a8
SHA1 6b2150ff3ff177e33339dc6544c0da1177bca56b
SHA512 85d90c52f8fc4e775fac0f45bfd16444daaf556913743a39d61305ee6e2d46d1fa8ce8f9ef57b53d8c998df89d166a0054c540ab2c24cac2a07b4fe8ea1f7016
SSDEEP 196608:jcvI0KmR+211O7hNdmQtNE9FSIXMW12V/eg/f8p++ME9HwU4jL4RMpsPlvpbm3kI:jcvI0KmR+211O7hNdmQtNE9FSIXMW12n
TLSH
T1EB86F6A87B085C199C33B3E1689AE5F814280ECEE754C3A86977BB93FFF18115D9B051
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

JPGScrTMP.jpg

Path C:\ProgramData\ukfree\logsstore\Admin\ScrnsStore\JPGScrTMP.jpg
Size 208KB
SHA256 7462966266091cf1a8f94a9e14180723f006fb64ef67e7e4651d9ba98dab14aa
MD5 301d0f507bb631c602f0b2f4bb3e6c4d
SHA1 52d33d46998ea1fb4225eec2ef1e9fadc97eb6b5
SHA512 8b2709cfc5eb3a7ee02b67208e7cf90438852a341c37ece84fcd11d92c0181d10f07b2ba642d9ebd08cc513edf2af5903acf1f6f1daf36c2f7f7dfdd3844f152
SSDEEP 6144:oaiTNTZQVRNSrtAEEtO4HfFJkTGvMaHx4JUB:ovIVKZdv4HQG1x4JUB
TLSH
T14D247D17CC1D8A83656D57FCBD070EAC6F196B0CE9963AFF41260EC63A606664C4F06E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

silentkeyloggerfree.chm

Path C:\ProgramData\ukprfree\silentkeyloggerfree.chm
Size 65KB
SHA256 f5568ff85d942a9f26bcd3d45b0b5ea0d1a546294afe9f04d73abc0693b5765d
MD5 fbe4d1bb3bfb2e5c2d206e58c157717a
SHA1 704a1e22af0016652c660a5163a397db8b705006
SHA512 978477d72c72efd26472da223d4a35ae28e181ad7d593613ed07707822e6cd605f1fe10331500f66a01555070c5ee2c3e86df1b40614af63eb38b87f7667c096
SSDEEP 1536:bUJdWX9TWv4gWFTWuyZTH1pOSNP6FAGTtqbruyJ1vMf:I3cEhWAuyFLmFAGTtqbD1q
TLSH
T11E5302F00D508276E8AE037B4FA4AEC45AA0DF059D2D5E44037EB9A6A5F734307D82BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

silentkeyloggerfree.exe

Path C:\ProgramData\ukprfree\silentkeyloggerfree.exe
Size 3.7MB
SHA256 66bc2781bed323d8f68be09c04427f79a2bd80ecc855a782bf398d06c99131f9
MD5 5fa4133b4d07cc5aecf6afe85f045835
SHA1 59202554877fb4bfbb8b01b0da855aabab27fa19
SHA512 fccbf9fd1675ea7d974f71837fb73862ab7a8057a2c2426c4376278691ab0d7457532d78d2bcc55be0a22683d929aad86d41085e9fd491be182fcef07acb8474
SSDEEP 49152:u3Lq+Q4wTAu+BWY2a14MsepwcjeF2QLhY6dKChtmmj+qV4hc84wyCAIjPzBwTW6M:o24I+kYt14MsepwkRUAt
TLSH
T160069DF1BEC059A7C3D30730690EF17832BCAEE45BF9919F63943B086DB529311159AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ulklfemon.dll

Path C:\ProgramData\ukprfree\ulklfemon.dll
Size 2.0MB
SHA256 9768fd324a5bbab21ae793ddacf398e2593578e1a8e46894e8fefba3b676e62b
MD5 bfff87d4246b9a68e04e7d3779b9544b
SHA1 49b717eb2a177c899748848b48534733356d70ee
SHA512 aaf139b631c36f315f1f79776b0a8783c7ce9c966c8b7f9494836b93548fdf473ed9ad4914ff33e860459efafebe74f9a8f483569688e150084b199200ab3a58
SSDEEP 49152:OpjOA3kxS8YwOvVL1LNP6j85Gr18Mrxq:OdOA3N8YTV1LNP6j8Mp8M
TLSH
T184A58D22BEE0857BC16F03314D1EF23C31FDA5230B7981CB67D85B2869306A2665976F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unukfree.exe

Path C:\ProgramData\ukprfree\unukfree.exe
Size 121KB
SHA256 bad07ed1f054dbc26f4216264f90e99bedbef92fd0ddf46f2db02c5e3272babc
MD5 548e555e793773eb8f28b1e884c73105
SHA1 742d4727e4949fdaa5111ad4e2ddc0f30d4bcca3
SHA512 05326ad4df74aaddfb4c4fd8f846188f9a2a0bc29ee54233575b645346c98f6625514c4e94a501720d62962e2a90f72a665d1cc1d485a1139f11e52edc537a9d
SSDEEP 3072:iPA6jXFN2McHqHH75KLs47XsZevYtwwU+FVh0:ihjmSHb5KRX0wuh0
TLSH
T1BAC3E012B3D0CCBBE56D167298BB97A443B1DC15121222972361BF7FEC76392891BB43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 16157f08fbc43b21935449d698053c71b14ae0a512929d81046d63c30d8086fc
MD5 8a77f82084d6d7df8ee50ef909552fc2
SHA1 74f4d569b690fcf21230d8f7c77d16b0d6317458
SHA512 b6816bb8f3dcbbd2929028d516974fa8a8dc4763002c8f5f670d3baa2fd2921621530e67de2c59e4331d7b872d4670821616ea6654dc34da79b4109fcc9b26ad
TLSH
T1E5518DB807B129F2CBA446765AD1E60A32F8889500B7DE5B40401DF55B07F6D16D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9c8f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a9c8f.TMP
Size 2KB
SHA256 0293028fd94d3bb46b68aad15541d5d3b4a1bad6474d61154d3264006efdbed6
MD5 4118992a6257245532bc21e944d70040
SHA1 d0b0ea8e9e347a80bb3f26cfc18021144ad8391c
SHA512 1083c8c081a71cd25363b976813edc09f473fdfb9c0da6f2d5e288cb4b5ea33368e7fd984c8b0ba2ad573a469c6bff8a8223461d8ffb3321962802df273e05b0
TLSH
T10551C0B807B129F2CBA446755AD0E20A32F8889900B7DE4B40401DF55F07F6D17D2FAB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e7db600574339793a165e1f1532a917ddb60ad38961728341ebc620f68c0f945
MD5 351668e938c6c39e321a893ac8cd04a5
SHA1 18a6ca9b012c9e5d368f292f57ee8279cbc03a4e
SHA512 6ed279e1e3057fc1b8007fd3528631b8be35b756a9742a5dc43fdaa783354fca2a51176b8428f40c150cb9f833174cea5d219f08c39ad43e1ad5a99c5dca87b0
TLSH
T1D351A0F3C7E8966D890156F0E7147E2BCE2D0914432C7D5AC9E4AF2BA3E2471D18299E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c7fcd426310ef731f5a8e23dc8b45e09addbe0badf623b6692bcfee2ae935c58
MD5 dbc65a1a12f068188e97e2426338a946
SHA1 36ad9777b0cac2d6ba48926db07f0314b5dc18af
SHA512 3b6c5268eee0ed8059b37361f4143ea951ec409ccd6841a993d2b87ad65180bc9058715315c3566f05d8f8eddab724b7ffa9c5ca51efc5c7f1959435195b63c8
SSDEEP 192:sxR5RuC2/f0sbdOKZ7wzoD8pkl/go6+WNgIE/l1CiuO7GrIgVY4GJ:sxR5r2/f0sJOc7wk/OA/ZKI
TLSH
T10F42D816AE689D3B9CC7D20DBB15BF63D6F9503291901E58EAFC971C00EB6DD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 45865dfa39fa07dd13bb84215d6aa8b4563f6bac94fed57483a7ad725717f3cb
MD5 c70e463d057fde1fc1693b9078ff9d2b
SHA1 b2cf70a89b6e0bfef8706718c8803cf19e19ad2c
SHA512 8884669cc8d894ccc00ef14ce9204ca3b9759a361c6ded46f7cba47c3431fd5cd5922ec6a56dad9ceabd529d967cfd49a7baa631232e36e157110874bb15d127
SSDEEP 192:sxR+RuC2/f0s5dwKZ7wzoD8pkl/go6+WNgIE/l1CNcuO7GrIgDUY4GJ:sxR+r2/f0sjwc7wk/OA/DKx
TLSH
T1DD42C816AE689D3B9CC7E20DBB55BF63D2F9503250901E58A7FC9B1C00EB6DE620740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 89b9cf3cb683eb3472974742386247a4892603bf253ce39d1e649b4dc657b8e9
MD5 fd645e7911a84167733c727d65978ab0
SHA1 dd2e216838587bd2b096cd4b9b2dd1bcb3a46b1c
SHA512 cdde7ed5aefef81eb0eca7a928a97230b17543d12936a82d882ed8d204863e14b3d03efb541e46268975f86835c19915b38bea6dcb9ed905768d5fa2c83a80d8
SSDEEP 192:sxR+RuC2/f0s5dOKZ7wzoD8pkl/go6+WNgIE/l1CiuO7GrIgDuY4GJ:sxR+r2/f0sjOc7wk/OA/ZKj
TLSH
T12142C816AE689D3B9CC7D20DBB55BF63D6F9503251901E58E6FC971C00EB6DD620340B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 6f048b04acaa4536dab887363e9d8b762d354cc637709bf848b7f1a63d6c184c
MD5 0c153f4854df0a7a85e8f7e288fb8dbf
SHA1 79f21226b8a0f8d8239bbd02027df8b12bb88fb7
SHA512 30df14c707060c22d7c530a918986b3f59bcbeefc4c034cc797af3c4f8ae011d371ffa84765709348da45a9d1917c155d2fe92e81fc4bc2261d05b39253fc940
SSDEEP 768:jC+vs77pLuLfDQWgQ+f4+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVC70QqcnroZj:jC+vsNEfDQWgQ+f4+u1ja970Vc0F
TLSH
T1A0D2FA7B640DCB7F4F800ADDAC197E9E6DA802CB9698CD5047FA941C02C6BEB52164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5b2c8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5b2c8b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 71be6760024fe501a8dff4f1c5231e5039b1b4b83dacd295e52d98c13ad3599b
MD5 5d797a20c9e5cd952d067c515d80e9ef
SHA1 d297d0cebb159575bfc61a84669e4d4229d8bd39
SHA512 ac8ca9e7ba613ef9a88608c8fe7494f1c7fc04f2ec52b5779d5948854d377475da94a2d897265defd8a4cf8ec46841de1126315216d1007794e9c30398b663fb
SSDEEP 768:Ub3yoLKnep8+p3bd66j+4BRv86aLIW52ewBKZOQ0W:Ub3iY8+p3Z6n4y/2evZPF
TLSH
T1C6F2AFB1E8699C738CE9D644B68637836FF810A3A5D01EA8D4DDBB1D105625E2B0BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 ac0b30516504629901b0778316634c562b3992b34f258efd36c1cbc3bd5c41af
MD5 da3124c2203ad0e04d09317bbcc51fac
SHA1 888141a36468a3fa0a3c7d7cc9a87d749483c1dd
SHA512 6e2176868077b29b30e4d8d7934741a768b853fb1f5f1aa603c68ab877c2e9da2a5fff182827973a8a6d37d084c42554e29910d34c9ec24432f4bf9af2ae49d4
SSDEEP 768:aFQK30wgHeQnVp8+p3bd66j+4BRv86aLIW52ewBKZOQ0W:BK3A8+p3Z6n4y/2evZPF
TLSH
T1C01328F198D78936D8ED8743A77D2E429EBCD0A3B5845994B7C86E0CCC421BFD70A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4870c2597fd57e9f07fd7d0202862509e8298be8d694f5e515b17ff7babbb813
MD5 3adbe1e9047df0f03fedc7c0e79fd6cc
SHA1 110f0e7259d953ffca2127a045439219fbd3c97f
SHA512 d0568d1b0de96ecf1be1c4628b603fc1188e774e7908f07729e240e2223a5908d7ce5fe5a1d9e5af660e4330a8a4b4c69ae834201d8e37381c4c79571c367d90
SSDEEP 768:Irv+4UNbdD3IcwNp8+p3bd66j+4BRv86aLIin2bwCl1:Ibsbp3gL8+p3Z6n4yZ0ww
TLSH
T10D03BE73F8A899739CE6C644B2467A437FF851A396C10EC4D4DD2B4E419A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 987f48af6841b2457a04e592cd3f3f0b0312c3c60c780a8b332b33bd48a61854
MD5 61f94a356565d36cfcc58cb2647bd7d9
SHA1 b448bc295df5aa4c728c717dd24bf32d83bcf462
SHA512 f49ad2fd001f09f4b01953e4d5879786788843442cd3f840a59274d3df7e74e2a361dba3b85be5cb461e8a46e024fb737c27ed2313eee053c49796d7871ee4f7
SSDEEP 768:srv+4UNbdE3prLKn6p8+p3bd66j+4BRv86aLIW5n:sbsbi3Uk8+p3Z6n4y/n
TLSH
T1F103AE71F8A9DD739CF6D644B1867B837FB810A399C00EE4D4D96B5E018A19E270F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fb8a68aa5983c747d69a7fa69bc3eea8d0483b1ba5edb7d29ec10be10373c940
MD5 6e2e82f934f2c36488e92bb1be3f8ea4
SHA1 5f464a4ce86f31e2a3ab7719f9eb986a5f92f7aa
SHA512 716679668312f9d20f1383d8e4bedbb3bc1ba0e2cc4156263c43417856a4b8bb72c572c660ea56a45bad5df14917a533467d692d456b2bc71d941b52e704246e
SSDEEP 768:Ib3poLKnep8+p3bd66j+4BRv86aLIW52ewBKZOQ0W:Ib3hY8+p3Z6n4y/2evZPF
TLSH
T18FF2AFB1E8699C738CE5D604B69637836FF810B3A5D01EA8D4DDBB1D105619E2B0BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5badd16-b1ec-440b-a416-7b3cb5bdf5e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e5badd16-b1ec-440b-a416-7b3cb5bdf5e7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5a68dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a68dd.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

7e305db5-a0bf-4550-9185-2238ad95a773.tmp

Path C:\Users\Admin\AppData\Local\Temp\7e305db5-a0bf-4550-9185-2238ad95a773.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nst651B.tmp\InstallOptions.dll
Size 14KB
SHA256 8f24c6cf0b06d18f3c07e7bfca4e92afce71834663746cfaa9ddf52a25d5c586
MD5 d753362649aecd60ff434adf171a4e7f
SHA1 3b752ad064e06e21822c8958ae22e9a6bb8cf3d0
SHA512 41bf41add275867553fa3bd8835cd7e2a2a362a2d5670ccbfad23700448bad9fe0f577fb6ee9d4eb81dfc10d463b325b8a873fe5912eb580936d4ad96587aa6d
SSDEEP 192:3Gs+dH4+oQOTgDbzuNfrigyULWsXXZF/01JJijnK72dwF7dBEnbok:3GvdH4qMebzPY2Vijn+BEnbo
TLSH
T1F0623B51638888F3DBD6013EB4523707AB595126B4925DE2CB271FCA6D3B18E3EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShellExecAsUser.dll

Path C:\Users\Admin\AppData\Local\Temp\nst651B.tmp\ShellExecAsUser.dll
Size 7KB
SHA256 27d61cacd2995f498ba971b3b2c53330bc0e9900c9d23e57b2927aadfdee8115
MD5 86a81b9ab7de83aa01024593a03d1872
SHA1 8fd7c645e6e2cb1f1bcb97b3b5f85ce1660b66be
SHA512 cc37bd5d74d185077bdf6c4a974fb29922e3177e2c5971c664f46c057aad1236e6f3f856c5d82f1d677c29896f0e3e71283ef04f886db58abae151cb27c827ac
SSDEEP 96:GFZf6PnleKYcBVGKLyhkrw0qyz/sRXQVgKXohw8FFtkqCp:Gnf6IKTAKLyGOCqQomItQ
TLSH
T167E1097A56D288A1E11E07746A975E7B13AD6A1203B00431CB471FCE2DF5456F42FA4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nst651B.tmp\System.dll
Size 10KB
SHA256 bb6df93369b498eaa638b0bcdc4bb89f45e9b02ca12d28bcedf4629ea7f5e0f1
MD5 56a321bd011112ec5d8a32b2f6fd3231
SHA1 df20e3a35a1636de64df5290ae5e4e7572447f78
SHA512 5354890cbc53ce51081a78c64ba9c4c8c4dc9e01141798c1e916e19c5776dac7c82989fad0f08c73e81aaba332dad81205f90d0663119af45550b97b338b9cc3
SSDEEP 192:uv+cJZE61KRWJQO6tFiUdK7ckK4k7l1XRBm0w+NiHi1GSJ:uf6rtFRduQ1W+fG8
TLSH
T127225C5893E0C1F3D6A0853C18A73A772729712445A18FE3CFA35841AE196D7BC7E336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst651B.tmp\ioSpecial.ini
Size 737B
SHA256 dcc627bc43e69851a82b87b46cb585b52f85102b128dedb1210b4dd02a8e1c09
MD5 5f3fafbd41f269a7cb7b9e664b0973a9
SHA1 baab6de5c1687ca0a2648e5d4bfc5882a5b7caed
SHA512 1f0e2f3f81c50d39c549f3845755c35f90607c581c5709d6716d7b56fa663d049f9e7656bc7f35ba7fd6b40b850abe2470ea2fb435643ae0bc5adbb670d87410
TLSH
T1DE01C08C410D42150C24954259FA3FD353D01C78CB4935F1F5B29C8B934EDD6D5E9A82
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst651B.tmp\ioSpecial.ini
Size 752B
SHA256 3f2b4a7f922ad80b7a842b90b41042035f9b482c24d4a6160a1e1e526d8e7623
MD5 a8607f892f23a5735a81951ec24c2707
SHA1 8b2ed19255107965bc08dbf591bf23fcfc922428
SHA512 7c63ef5c78593ac3864b47dbbbb07c82a5c02b35a227e1c7b43706589f3ed34189b528f20e04584e27739b1b0a8918545168fe20f198ddeee4bd7a563e8c3b74
TLSH
T188019CCC411E07150824868258FA3FD653D01C78CB4979F1F5B29C8B974EDD5D5E9A82
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst651B.tmp\ioSpecial.ini
Size 736B
SHA256 da77677a5c77bd58c7feae8026d60593e30b736a7d13657a3e37b83a66390700
MD5 74f05f6421dcfe488fb189fe8216bd02
SHA1 6eb59ee1d7e663e9cdf5da9e772c8d2611ba19aa
SHA512 75db96e28f82320fe5cbbee4909beb388bbfb374c6f0dfe9926c968eb29b4514d9422182b328ac05a92adb30d4322e040e2098b6a06ffa7b84982f97c9c7c82f
TLSH
T10601DC89801F93280820549AA4E937E247E02C6C4F513CF6B4A2888A534DDD38BEADD6
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nst651B.tmp\ioSpecial.ini
Size 775B
SHA256 aff7453d8b96cfcc6893133833be12a833cc96a3df92f486a63876e86943f80d
MD5 06de87678e4c891009455673a0c256db
SHA1 f062ef4b71eca9c21a1bfe51db5aba53d0490d0f
SHA512 f22dd7c936fb83fe59a9b84ebb19adfbc9f735db71af58507d160ec49e69efc1b27566373fd2431e55aff32ee1b21b83441151ec58ece77a3043fa123eb67c77
TLSH
T1EE01FD89401FD3580810148A50F937D357D02C2C8B553CF2F4A2888A534DDD38BDADC6
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu25FA.tmp\ioSpecial.ini
Size 721B
SHA256 4239f94d9d8b0bdff88e3ef7d7a60ba4873b5c0f52c5ab517c108e7a0c6f1e9b
MD5 94b1d3c77c2444417ed7ddbd9eb8b6e0
SHA1 c23d2999729420303e29b35f88f52dc987575973
SHA512 989b211f74c128221c71ccd0b258e34ef9e624140b203fb42b78607bb616e4c32273aa92d8b0569e94d25a87dac8ce06aa97524b60d1bea078aecb2601fb27da
TLSH
T1CB019CC9402D83342C04461B90EA37D673E01EA88F5179E5BCB34856424DCD68BD79C3
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu25FA.tmp\ioSpecial.ini
Size 721B
SHA256 2d08b186c122e7515c6ba6a77eea4b4ccfeddf4bb39415cb6dcbdfdc6792403a
MD5 baa07d01f85198ff57e427aeb1b01ee6
SHA1 fdc7e8becede217a6f9e8e3822a469f8ff52d914
SHA512 93b2025cf6134e9e5c8f26348a47313f51ecc5bf5b4a08ce29903222103ffa32ac63ef8d0c5220dab011f23ba160ebcf7b8b8e3d968dafbf6d723bede2d52a2f
TLSH
T1D5019CC9402D83342C04455A90EA37D673E01DA8CF5579E1ECB358565249CD68BD79C3
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsu25FA.tmp\ioSpecial.ini
Size 606B
SHA256 c3a2fb573e711780288227bdc3fff9b94bfa03ef13ac848a642166c01e7594e3
MD5 1183507162958890263e52f816e196de
SHA1 9412532f20dad64d6e38966d45f45ce711a46344
SHA512 879e1ccd3b31af1c83ec5746d3fa502bd0fe22ef1503d5f898c8f6d15c0a3bdd5e5683c3546fd469644769a554f4c60d20ad3f6e8218979316a623e9fc810148
TLSH
T178F00C8D400D431A1C244486A4FA3B8213D00D38CF063AB0F8728C9B8749DD0C9DAAC3
MD5 SHA1 SHA512 TLSH

Submit Download

modern-header.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsu25FA.tmp\modern-header.bmp
Size 25KB
SHA256 20132aa236c2483cee1a0ac97b43beb8587dd335d16e82597018a44ac5d6cd0e
MD5 8e70c812e41f7c3b8e8c7bf1a79f96da
SHA1 9700c97f267cab194b446c410f493fdc402f0500
SHA512 e60bb5121c6f367a8fecd43705326fb128c791033270e1a3ab29787f2fc612ebc46db3533a96bfa9a149d80d7267c608aea964c2e9489933f7b244a00b25e15d
SSDEEP 768:7qSsQ0s2fDmjjAUokZ68Ia54+Frl63Aw5Xqc:7YDmIba5Gn5
TLSH
T1CEC22A328781AA0DDD940BB5E84B168C04A07FAE683A61DF5F113F97CDF564B10A63F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsu25FA.tmp\modern-wizard.bmp
Size 150KB
SHA256 53ac2c38200b3a13a95ac234542feaa57e49dc1165e36d7a7a681f180cd3938a
MD5 c1f1c75c4c32374723da0eec8adc42c7
SHA1 df2e032ed90848ceb7da2bba8ef4229c2da080ce
SHA512 d860f52a5a46682fbe97c14463b2ad57df69974b9470a7c1799b51d1b46fbfa40e1360065ea33e73dd983c337c6e3eceb9cebdfd39c93f90007e13c920b4f58c
SSDEEP 1536:o9Tkni3l5Cl7GNNuSYOwU15vSA0HI5MoIRO3HeGy4gIiSydX2hZdd:s3l6eCLAbVgjS4mhZH
TLSH
T17EE3D8325944FC9AA4C3C66D190E63C55F9407F8B97C72AA1F10FB5A6D2669F2800EF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1568-491-0x0000000000400000-0x00000000007D5000-memory.dmp

Download

memory/3420-312-0x0000000000400000-0x00000000007D5000-memory.dmp

Download

memory/3420-406-0x0000000000400000-0x00000000007D5000-memory.dmp

Download

memory/3420-386-0x0000000000400000-0x00000000007D5000-memory.dmp

Download

memory/4872-259-0x0000000000400000-0x00000000007D5000-memory.dmp

Download

memory/5104-96-0x0000000000400000-0x00000000007D5000-memory.dmp

Download

memory/5104-98-0x0000000000586000-0x0000000000587000-memory.dmp

Download

memory/5104-100-0x0000000000400000-0x00000000007D5000-memory.dmp

Download

memory/5672-270-0x0000000003EA0000-0x00000000040A7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads