0ad87a1b2a2d6798f5cbb0601920136237ba9d03720f96290130b3f1db0e43eb

Analysis

max time kernel
320s
max time network
438s
platform
windows10-1703_x64
resource
win10-20230220-en
resource tags

arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
submitted
06-04-2023 18:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

kaspersky4win202121.9.6.465es_37946 (1).exe
Size

3.8MB
MD5

c1bb10b033eaec8ec8046e201959cd8d
SHA1

182b62bc1a3cb1ac25d4619ac044223a8a2f281d
SHA256

0ad87a1b2a2d6798f5cbb0601920136237ba9d03720f96290130b3f1db0e43eb
SHA512

5163d8e89acdd97135504fc31ad72a01fbf10685a320fdd3288b8f21a7641ea15279366561c663f53d946944ebb65ec0019721cba4dc960cfff2321dadd2c768
SSDEEP

98304:gQFKOopJ9QennbKgb/LcPOc/KmCPOHxFvSeVEQaJU7pByrcGw:TopfQenzbDcGc2mfJtm

Score

8^/10

bootkit discovery evasion persistence trojan

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

35 2300 msiexec.exe
Downloads MZ/PE file

flow	pid	process
35	2300	msiexec.exe

Drops file in Drivers directory 6 IoCs

Processes:

MsiExec.exe

description	ioc	process
File created	C:\Windows\system32\DRIVERS\Kaspersky4Win-21-9\SETE986.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\Kaspersky4Win-21-9\klif.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\Kaspersky4Win-21-9\SETE997.tmp	MsiExec.exe
File created	C:\Windows\system32\DRIVERS\Kaspersky4Win-21-9\SETE997.tmp	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\Kaspersky4Win-21-9\klflt.sys	MsiExec.exe
File opened for modification	C:\Windows\system32\DRIVERS\Kaspersky4Win-21-9\SETE986.tmp	MsiExec.exe

Executes dropped EXE 4 IoCs

Processes:

startup.exewindowsdesktop-runtime-6.0.10-win-x86.exewindowsdesktop-runtime-6.0.10-win-x86.exewindowsdesktop-runtime-6.0.10-win-x86.exe

pid	process
1872	startup.exe
1860	windowsdesktop-runtime-6.0.10-win-x86.exe
2000	windowsdesktop-runtime-6.0.10-win-x86.exe
3964	windowsdesktop-runtime-6.0.10-win-x86.exe

Loads dropped DLL 64 IoCs

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exestartup.exewindowsdesktop-runtime-6.0.10-win-x86.exe

pid	process
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
3628	kaspersky4win202121.9.6.465es_37946 (1).exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
1872	startup.exe
2000	windowsdesktop-runtime-6.0.10-win-x86.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

windowsdesktop-runtime-6.0.10-win-x86.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{9dd24b73-88e0-4f0f-882a-500e00d2bdef} = "\"C:\\ProgramData\\Package Cache\\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}\\windowsdesktop-runtime-6.0.10-win-x86.exe\" /burn.runonce"	windowsdesktop-runtime-6.0.10-win-x86.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1063

Processes:

startup.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast startup.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	startup.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

startup.exekaspersky4win202121.9.6.465es_37946 (1).exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	startup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kaspersky4win202121.9.6.465es_37946 (1).exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exestartup.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	kaspersky4win202121.9.6.465es_37946 (1).exe
File opened for modification	\??\PhysicalDrive0	startup.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exestartup.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	kaspersky4win202121.9.6.465es_37946 (1).exe
File opened (read-only)	\??\VBoxMiniRdrDN	startup.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-core-console-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\zh-Hans\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ko\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\zh-Hans\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\tr\PresentationCore.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pl\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\it\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\tr\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.ValueTuple.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\Microsoft.Win32.Registry.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\cs\PresentationUI.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\es\System.Windows.Forms.Design.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\zh-Hant\System.Windows.Forms.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Numerics.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.AppContext.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Core.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\es\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\it\System.Windows.Controls.Ribbon.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\tr\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\es\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\System.DirectoryServices.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\cs\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pt-BR\System.Xaml.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\cs\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\PresentationFramework.Aero2.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\Microsoft.Win32.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Diagnostics.Tracing.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\dotnet.exe	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\tr\UIAutomationTypes.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\cs\UIAutomationClient.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\PresentationFramework.AeroLite.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Reflection.Emit.ILGeneration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.IO.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Collections.Concurrent.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pt-BR\UIAutomationProvider.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pt-BR\System.Windows.Input.Manipulations.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\it\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\zh-Hant\WindowsBase.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Xml.XPath.XDocument.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Runtime.Serialization.Json.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Net.NetworkInformation.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\WindowsFormsIntegration.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\Microsoft.WindowsDesktop.App.runtimeconfig.json	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\tr\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-crt-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ja\PresentationFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\System.Diagnostics.PerformanceCounter.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ru\UIAutomationClientSideProviders.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ru\WindowsFormsIntegration.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pl\System.Windows.Forms.Primitives.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.IO.Compression.Brotli.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-core-timezone-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Threading.Channels.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pt-BR\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\pl\ReachFramework.resources.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Security.Cryptography.OpenSsl.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Diagnostics.Tools.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Drawing.Primitives.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\System.Numerics.Vectors.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.NETCore.App\6.0.10\api-ms-win-crt-convert-l1-1-0.dll	msiexec.exe
File created	C:\Program Files (x86)\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.10\ko\UIAutomationClientSideProviders.resources.dll	msiexec.exe

Drops file in Windows directory 52 IoCs

Processes:

msiexec.exeMsiExec.exestartup.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\MSIDCD2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EBD44C5E-F1AF-4955-AEDF-F15D06384A9C}	msiexec.exe
File created	C:\Windows\Installer\e5a8536.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a853b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC2C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a853f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID712.tmp	msiexec.exe
File created	C:\Windows\Inf\oem1.PNF	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIA3CE.tmp	msiexec.exe
File created	C:\Windows\Inf\oem2.PNF	MsiExec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI89D2.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a8537.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a8537.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA28.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a853f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE36C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a852f.msi	msiexec.exe
File created	C:\Windows\Installer\e5a8533.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAE8.tmp	msiexec.exe
File opened for modification	C:\Windows\installer	startup.exe
File created	C:\Windows\Installer\e5a8532.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID049.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID88A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC73D.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{98CA5A6B-4ECC-4E6D-BF18-6B20CBB6E5F4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9687.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a8533.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3B28977C-9163-48A5-A08C-C01327E18AE2}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA0FC.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a853b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC64F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE85F.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File created	C:\Windows\Installer\SourceHash{08465C0A-BB15-38BE-A9CC-6A501463B4DA}	msiexec.exe
File created	C:\Windows\Installer\e5a852f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9E4C.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a853a.msi	msiexec.exe
File created	C:\Windows\Installer\e5a853e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC6ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICAB8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID25D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID8BA.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9CB3.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0F3E4057-E2BB-4114-A646-F143DB5CE4C9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB08.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID2DB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE5A.tmp	msiexec.exe
File created	C:\Windows\Inf\oem0.PNF	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 9 IoCs

Processes:

msiexec.exe

description	ioc	process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exewindowsdesktop-runtime-6.0.10-win-x86.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\SourceList\PackageName = "dotnet-host-6.0.10-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7504E3F0BB2E41146A641F34BDC54E9C\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E5C44DBEFA1F5594EAFD1FD56083A4C9\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\SourceList	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.43.48869_x86	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\921C4EFB59257D250861C85A32B3DAC4	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\5A036181AE3507D45E36606F9464ED83	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\PackageCode = "6C59255ABF262124A8BF69A43D0A3882"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7504E3F0BB2E41146A641F34BDC54E9C\Provider	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7B6B3B3BDB85C274615B1EE3672D8E69	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\SourceList\PackageName = "dotnet-runtime-6.0.10-win-x86.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\Version = "808173285"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\7B6B3B3BDB85C274615B1EE3672D8E69\B6A5AC89CCE4D6E4FB81B602BC6B5E4F	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\ProductName = "Microsoft .NET Host FX Resolver - 6.0.10 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.43.48869_x86\Version = "48.43.48869"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.10 (x86)"	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86\Version = "48.43.48870"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Version = "48.43.48869"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\DisplayName = "Microsoft .NET Host - 6.0.10 (x86)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\ProductName = "Microsoft Windows Desktop Runtime - 6.0.10 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86\Dependents	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.43.48869_x86\DisplayName = "Microsoft .NET Host FX Resolver - 6.0.10 (x86)"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\E5C44DBEFA1F5594EAFD1FD56083A4C9\MainFeature	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86\DisplayName = "Microsoft Windows Desktop Runtime - 6.0.10 (x86)"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\921C4EFB59257D250861C85A32B3DAC4\E5C44DBEFA1F5594EAFD1FD56083A4C9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C77982B336195A840AC80C31721EA82E\Provider	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\7504E3F0BB2E41146A641F34BDC54E9C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_HostFxr_48.43.48869_x86\ = "{EBD44C5E-F1AF-4955-AEDF-F15D06384A9C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{EBD44C5E-F1AF-4955-AEDF-F15D06384A9C}v48.43.48869\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7504E3F0BB2E41146A641F34BDC54E9C\SourceList\PackageName = "windowsdesktop-runtime-6.0.10-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\PackageCode = "0F3235AA744CCE147A368B22C44B7831"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Dotnet_CLI_SharedHost_48.3.31210_x86\Dependents\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86\ = "{0F3E4057-E2BB-4114-A646-F143DB5CE4C9}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.43.48869_x86\ = "{98CA5A6B-4ECC-4E6D-BF18-6B20CBB6E5F4}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\windowsdesktop_runtime_48.43.48870_x86	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\{9dd24b73-88e0-4f0f-882a-500e00d2bdef}\ = "{9dd24b73-88e0-4f0f-882a-500e00d2bdef}"	windowsdesktop-runtime-6.0.10-win-x86.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E5C44DBEFA1F5594EAFD1FD56083A4C9\SourceList\PackageName = "dotnet-hostfxr-6.0.10-win-x86.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C77982B336195A840AC80C31721EA82E\PackageCode = "BD465DC7F0401D242BFA1EF363AFAE2C"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B6A5AC89CCE4D6E4FB81B602BC6B5E4F\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{98CA5A6B-4ECC-4E6D-BF18-6B20CBB6E5F4}v48.43.48869\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\dotnet_runtime_48.43.48869_x86\Version = "48.43.48869"	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	kaspersky4win202121.9.6.465es_37946 (1).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	kaspersky4win202121.9.6.465es_37946 (1).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	kaspersky4win202121.9.6.465es_37946 (1).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d4304000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	kaspersky4win202121.9.6.465es_37946 (1).exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c00000001000000040000000008000004000000010000001000000087ce0b7b2a0e4900e158719b37a893720300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	kaspersky4win202121.9.6.465es_37946 (1).exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

startup.exemsiexec.exeMsiExec.exe

pid	process
1872	startup.exe
1872	startup.exe
2300	msiexec.exe
2300	msiexec.exe
2300	msiexec.exe
2300	msiexec.exe
2300	msiexec.exe
2300	msiexec.exe
2300	msiexec.exe
2300	msiexec.exe
3924	MsiExec.exe
3924	MsiExec.exe
3924	MsiExec.exe
3924	MsiExec.exe

Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

640

pid	process
640

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

windowsdesktop-runtime-6.0.10-win-x86.exemsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeIncreaseQuotaPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSecurityPrivilege	2300	msiexec.exe
Token: SeCreateTokenPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeAssignPrimaryTokenPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeLockMemoryPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeIncreaseQuotaPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeMachineAccountPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeTcbPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSecurityPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeTakeOwnershipPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeLoadDriverPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSystemProfilePrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSystemtimePrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeProfSingleProcessPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeIncBasePriorityPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeCreatePagefilePrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeCreatePermanentPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeBackupPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeRestorePrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeShutdownPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeDebugPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeAuditPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSystemEnvironmentPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeChangeNotifyPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeRemoteShutdownPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeUndockPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeSyncAgentPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeEnableDelegationPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeManageVolumePrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeImpersonatePrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeCreateGlobalPrivilege	3964	windowsdesktop-runtime-6.0.10-win-x86.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe

Suspicious use of WriteProcessMemory 35 IoCs

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exestartup.exewindowsdesktop-runtime-6.0.10-win-x86.exewindowsdesktop-runtime-6.0.10-win-x86.exemsiexec.exe

description	pid	process	target process
PID 3628 wrote to memory of 1872	3628	kaspersky4win202121.9.6.465es_37946 (1).exe	startup.exe
PID 3628 wrote to memory of 1872	3628	kaspersky4win202121.9.6.465es_37946 (1).exe	startup.exe
PID 3628 wrote to memory of 1872	3628	kaspersky4win202121.9.6.465es_37946 (1).exe	startup.exe
PID 3628 wrote to memory of 2484	3628	kaspersky4win202121.9.6.465es_37946 (1).exe	kaspersky4win202121.9.6.465es_37946 (1).exe
PID 3628 wrote to memory of 2484	3628	kaspersky4win202121.9.6.465es_37946 (1).exe	kaspersky4win202121.9.6.465es_37946 (1).exe
PID 3628 wrote to memory of 2484	3628	kaspersky4win202121.9.6.465es_37946 (1).exe	kaspersky4win202121.9.6.465es_37946 (1).exe
PID 1872 wrote to memory of 1860	1872	startup.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 1872 wrote to memory of 1860	1872	startup.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 1872 wrote to memory of 1860	1872	startup.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 1860 wrote to memory of 2000	1860	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 1860 wrote to memory of 2000	1860	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 1860 wrote to memory of 2000	1860	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 2000 wrote to memory of 3964	2000	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 2000 wrote to memory of 3964	2000	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 2000 wrote to memory of 3964	2000	windowsdesktop-runtime-6.0.10-win-x86.exe	windowsdesktop-runtime-6.0.10-win-x86.exe
PID 2300 wrote to memory of 1464	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 1464	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 1464	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 2940	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 2940	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 2940	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 764	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 764	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 764	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 4332	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 4332	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 4332	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 3792	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 3792	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 3792	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 3924	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 3924	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 3924	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 2936	2300	msiexec.exe	MsiExec.exe
PID 2300 wrote to memory of 2936	2300	msiexec.exe	MsiExec.exe

C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe
"C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe"
1⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:3628

C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\au_setup_E745515F-D4BB-11ED-B673-E20AF1709ACB\startup.exe
"C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\au_setup_E745515F-D4BB-11ED-B673-E20AF1709ACB\startup.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe" /-self_remove -l=es-MX -xpos=270 -ypos=58 -prevsetupver=21.9.6.465.0.180.0
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1872

C:\Users\Admin\AppData\Local\Temp\61922B27-D4BC-11ED-B673-E20AF1709ACB\windowsdesktop-runtime-6.0.10-win-x86.exe
"C:\Users\Admin\AppData\Local\Temp\61922B27-D4BC-11ED-B673-E20AF1709ACB\windowsdesktop-runtime-6.0.10-win-x86.exe" /q /norestart
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\Temp\{9C8ACB80-9E63-4CB9-83E2-B66744D75AF0}\.cr\windowsdesktop-runtime-6.0.10-win-x86.exe
"C:\Windows\Temp\{9C8ACB80-9E63-4CB9-83E2-B66744D75AF0}\.cr\windowsdesktop-runtime-6.0.10-win-x86.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\61922B27-D4BC-11ED-B673-E20AF1709ACB\windowsdesktop-runtime-6.0.10-win-x86.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /q /norestart
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\Temp\{12DE7935-085B-4F1A-A1C2-F626EFAB9270}\.be\windowsdesktop-runtime-6.0.10-win-x86.exe
"C:\Windows\Temp\{12DE7935-085B-4F1A-A1C2-F626EFAB9270}\.be\windowsdesktop-runtime-6.0.10-win-x86.exe" -q -burn.elevated BurnPipe.{7FB65E12-AC1A-419E-AD57-F80BDDBB5D84} {24BEC717-00A0-4E1B-8840-C03D992936C1} 2000
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe
"C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC;3628"
2⤵
PID:2484

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 421B5051F791EFDEEDF32069E97BE14D
2⤵
PID:1464

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 2154E56FE4768EF04E4DBDE23C5D4A91
2⤵
PID:2940

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding E28A722AA096E20525698DF5A85DC5E1
2⤵
PID:764

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding DB3EAEB067C28068E6B9DA80424B4946
2⤵
PID:4332

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 058EB9A07E36190487B9FC578D9F8FCA
2⤵
PID:3792

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding B9D1D972F84FBFB74E20C9D3A138A500 E Global\MSI0000
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3924

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding E3BFA1076C59100477F31B2B85846AFD E Global\MSI0000
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
PID:2936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Security Software Discovery

T1063

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5a8531.rbs
Filesize
57KB

MD5
39d94fc0108178015edd1db3863567cb

SHA1
d60dbefec17d5d647a94b284474ae73a6e793aef

SHA256
71af1fd2e87f4acd2db497a914dc801245b7c3b9b05c80d63fe404ef65056307

SHA512
a0e2ea53f974aff55ac3f4cf052cbbd71a394f1b3c183be264fe8358075df3b5b59fcaadec9db781cef2ed226b709dbecfa9a7e8000bbefa06f76c41f1f8d9cc

Download Submit
C:\Config.Msi\e5a8535.rbs
Filesize
8KB

MD5
76a44c85b03d694ab7ef9a05fdf0be0c

SHA1
3b32830ef612d3cdcc6a686ad14d7a6f360cab96

SHA256
d9ce00b21aa71c564f385be684f9c672aaa5b5713fe978fbb99f6317a181729a

SHA512
ead6c8fb77bb0877f1181ffdf5bf03735737960a634ab2f92602940ecb5f8315b9d1d0bad8ae647447d37e26ee46ee618c01e104c06123de2ac233ad12e305c0

Download Submit
C:\Config.Msi\e5a8539.rbs
Filesize
9KB

MD5
f490897f6c43400c17434b195657ec30

SHA1
4a6429bbced79f6963b39e02c0f8a8a29d7afa76

SHA256
b4df920fffa20769b88b7d7d982a0890a62116df291c1738ce8b5439e7ac6c96

SHA512
5dbc16a064996af43b8970f6e1faf145628c86bd3b66db1fb2616ab0ab6ac2f4d3adb0b95bb960f9557f68c0209ff957fa39cc12a7d2b29bafba5eb097197c41

Download Submit
C:\Config.Msi\e5a853d.rbs
Filesize
90KB

MD5
50a7b41cbd20379843d04ee01e5e9be5

SHA1
5958894398ae12ecf6023f7005c27eae00689990

SHA256
76bddd0d3783e65bf66a6cf1a8b2a741e39a9c5ecfc7ed9d2a0987b52a03dde4

SHA512
47d59452c1821e971e849eff3da0491ae91d404c7bb1bb6023991c99ca682b4b074144be1e450f8c376946edfc94109b8ab4f8cf18acda66eab83a44c2bc725f

Download Submit
C:\Program Files (x86)\dotnet\LICENSE.txt
Filesize
9KB

MD5
31c5a77b3c57c8c2e82b9541b00bcd5a

SHA1
153d4bc14e3a2c1485006f1752e797ca8684d06d

SHA256
7f6839a61ce892b79c6549e2dc5a81fdbd240a0b260f8881216b45b7fda8b45d

SHA512
ad33e3c0c3b060ad44c5b1b712c991b2d7042f6a60dc691c014d977c922a7e3a783ba9bade1a34de853c271fde1fb75bc2c47869acd863a40be3a6c6d754c0a6

Download Submit
C:\Program Files (x86)\dotnet\ThirdPartyNotices.txt
Filesize
78KB

MD5
f77a4aecfaf4640d801eb6dcdfddc478

SHA1
7424710f255f6205ef559e4d7e281a3b701183bb

SHA256
d5db0ed54363e40717ae09e746dec99ad5b09223cc1273bb870703176dd226b7

SHA512
1b729dfa561899980ba8b15128ea39bc1e609fe07b30b283001fd9cf9da62885d78c18082d0085edd81f09203f878549b48f7f888a8486a2a526b134c849fd6b

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.180.0\kdscrl.rdb
Filesize
3KB

MD5
79a78149e4ef2e6e09cc061338c7b151

SHA1
99505d2461a18f16d4d185603887c60e226347ee

SHA256
e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd

SHA512
a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\au_setup_E745515F-D4BB-11ED-B673-E20AF1709ACB\dynamic.ini
Filesize
142B

MD5
066635a3a91d9616458cfd1ac7b4fe12

SHA1
d8b3d965ec621fc0fa2aaffa5c4b42f6dada45dc

SHA256
1772cf6ee1c00551266a47c3766dee1ab8068b483138c8705d71c48d733b3f6e

SHA512
749f7f3a5213ef01e15462ac91a880d5685da06bcedabc1d763bfe7b208933b0e5b006751a35767fa6a3ffcc65e3535fecdd6c96fe269f6affc629f3c01f10cc

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\au_setup_E745515F-D4BB-11ED-B673-E20AF1709ACB\startup.exe
Filesize
3.8MB

MD5
98ad877c844960b929e0c5e2c3b5d9fa

SHA1
aff5f32b349e219518fbf96063e8f2c46b48e90f

SHA256
1378c91424fc2f916046da9d4934923d7ad6c2718214afbea770b77a76cb2098

SHA512
e5b2626e1d3d45c440e4777fb1c3f9fe3b1e4ede97d50d41f066fba0b0f301b781c7d3fcbc112f22926d103ba425660eb3e3b05f2ad5bffbdf37ed2a1367e78d

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\au_setup_E745515F-D4BB-11ED-B673-E20AF1709ACB\startup.exe
Filesize
3.8MB

MD5
98ad877c844960b929e0c5e2c3b5d9fa

SHA1
aff5f32b349e219518fbf96063e8f2c46b48e90f

SHA256
1378c91424fc2f916046da9d4934923d7ad6c2718214afbea770b77a76cb2098

SHA512
e5b2626e1d3d45c440e4777fb1c3f9fe3b1e4ede97d50d41f066fba0b0f301b781c7d3fcbc112f22926d103ba425660eb3e3b05f2ad5bffbdf37ed2a1367e78d

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\au_setup_E745515F-D4BB-11ED-B673-E20AF1709ACB\startup.exe
Filesize
3.8MB

MD5
98ad877c844960b929e0c5e2c3b5d9fa

SHA1
aff5f32b349e219518fbf96063e8f2c46b48e90f

SHA256
1378c91424fc2f916046da9d4934923d7ad6c2718214afbea770b77a76cb2098

SHA512
e5b2626e1d3d45c440e4777fb1c3f9fe3b1e4ede97d50d41f066fba0b0f301b781c7d3fcbc112f22926d103ba425660eb3e3b05f2ad5bffbdf37ed2a1367e78d

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\au_setup_E745515F-D4BB-11ED-B673-E20AF1709ACB\static.ini
Filesize
624B

MD5
456d7a4fdb46d2c1fb82d903c79c5d8a

SHA1
086b341c4758a245712ad21c4562bc0f022e8c09

SHA256
0e43aa7c80ce6daf67c201e13855b38aa326c9c0a34ca37ccf799f58ec4703a5

SHA512
fc44849e8d7f77a20036f58514bd877983d9581dcd668f324dd95ac26e4411560c9067a756aea2dd57f6f33832dac346cff88ab123cf3f30bc32748cd58467aa

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\common.z
Filesize
11.0MB

MD5
7c60fbb95374bdcbb5b259c12143b796

SHA1
be16142ad168b3225b93e4b86303db4753c091aa

SHA256
1546f62bb98375fd9460b0544337c893fe5aa54720a23f1ce0c05fe6eb48cc5a

SHA512
f5a3e4542d00741f24e9341c00907705f8ff6553b19322e631252d1ff2e65300300e82371987e35d900fdc872bac10a6c8d49689481605d7f8020cd6e9024270

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\corebases.cab
Filesize
120.3MB

MD5
c126c32aacfcb0eda3cdc3ca690ca471

SHA1
9e252cfbffe2178ca590930f91371a1ec3b54d3a

SHA256
a3d64358dadf94f7fe59da192344f5db61e7902cca05416556564ad871aeb2f3

SHA512
f3ef645086702f25deb739f93697f587127888c66d5506b6010d09db4d596e95611f7c04357c6636c74c6943acff4aa72e11c2b9d6d9efd4994f0ecc0ac8c44b

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\corebasesx64.cab
Filesize
349KB

MD5
a791c93f0a9a7fe249c820cbb93da7f1

SHA1
914c27dfbc9c14a0642e09976830a60530418c68

SHA256
e2aee9966919a181f8e9fe7b0785d57e66621df8f8bfbf7afca2fcc47b7d33fc

SHA512
d181246304f6825f81cd4416fc8c6195d2d9c9d0644973ac6c1317fff742496a6f27805b2696ccf36c966a1666b4097fc4625a44292d829adf15f99a159ef0c9

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\coreproduct.z
Filesize
41.9MB

MD5
58382b69564d962109f76e463675bceb

SHA1
5afc07448249365effd143258c205ffda72328c3

SHA256
9ca07f914dd2026c45b80e6e2ef633a827760baa019c4f2ddb77820615ffb08f

SHA512
f5ec5b6f41e380c70cbc8a4e0266b178b0c2a4dc17726dee9253fe34092ed52995b46000ee828431de41238558716c7b3b2f667ab40658b6bd3f92c4519c79ee

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\coreproductgdpr.z
Filesize
73KB

MD5
396da7b24d24e774edace31d7fa86a26

SHA1
c34445c0897400f41237c86283808159f56d295a

SHA256
fab8943239b9995745381cffbb0755a555bc5b711ba07258124de6b12d6981ee

SHA512
8e9defdf436a83f032ae311abc9e51332144a07fcbc1886ed7fee2ab3a683b3f477ad543f84f47a8cdd6611965a9ae06016236983ab8043fa9550de070d13d0d

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\coreproductnogdpr.z
Filesize
71KB

MD5
c224ab9b4bce9fe7b104fef6c3365ff7

SHA1
72bcba37a347227e81f5396a5c7899aa4d123642

SHA256
919d2f3a43132344adf94622770c0e6cc58e0ad93b61f9327c85d58f58a51d52

SHA512
1e80ba7cd2f5393ea4889d5e60250fcb847a215445d0e10ac377e322198613e8a1e1c75b701757ae36e3688cf4db6a45f959f70bc3ac2b876cba6d9db4559438

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\coreproductx64.z
Filesize
8.7MB

MD5
3aaae9ccb49a830d7a6a00486d3c8267

SHA1
6ebb4c7dfaed89fa3ee1bcd7be017d3c0786fc14

SHA256
b5869ab1d3690ef13359ecb368a11d0f03ca252dfaaa462ae30e88682527facc

SHA512
001b5d3948d85bc0531dbe65982331832b3a349a9b7eaaf648e40f6ab9eefb82f51bbaa0efbd30ef02e77b9fc64fdb092ae6fe392ac3c7f1e8a4ca1dbcc8de0f

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\esb-win7x64.cab
Filesize
24KB

MD5
ca0507348575d47dc891be08b37be4ef

SHA1
55d632ecde304a10e691a31b9869761675255564

SHA256
ee9d7f1da2d41fdd8a0c756f58c0b76b28212d3beb7a66a8bdd6235b87349379

SHA512
d286cae62de011880bb785a820030d44d28ac33792dcbf48d1ebff0d97252baf92f8b92167eee58b44a5ef71314c2de3af9777efcd89fe4f4440e090f826b6f8

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\ipm.cab
Filesize
1.7MB

MD5
38bbbfe1567c324944b91063fff87b03

SHA1
1bd4785b6ca5685a4f186d007c14adcb3689c684

SHA256
1aa2364265367f66c934801e9ef704440109f89a90b5e3b9eba8dabef22b0f5e

SHA512
28fc461ea5ee2cf28d99097bc0aecc9b929c4e440bee0e3e2749dbea0816c52b1dfdf65302329f982577e12460cf43d80e97eee02c2d9328953868da4382afcc

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\kdscrl.rdb.z
Filesize
5KB

MD5
e3632de990337cccc1168eb09e3a8300

SHA1
b8c1944e97986feb7e83bc4ff38b489b680711b4

SHA256
7c80ff612cb434af5fca983672670ba92eebac8afc44e2c98dcd026c2769c010

SHA512
b3248557bbc6d2bcd8a2af6ad7a8fce7c8868d929754864c1bcb55d1092dfc94b00a219056f263de18dd481da0bb94d9524576e1e3073d19d3a495d19af3cb87

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\kleaner.cab
Filesize
2.9MB

MD5
163fc771f42966af9808c31bb40f57ad

SHA1
44bfab043e983caba154065acb2d96008e082714

SHA256
e64540f3ef6fce5bec367d079cd7a5c8e54d5e5c698b23cc25a73c43b780eba2

SHA512
f8a131df4264a875afddaaf7b3c2edd05784b677fe09c861df56ec79a7a4ab37a4d4e43e4cfcbf7556427177faecce0dc324dbbea41d3a519ebb3e6ef8ba4980

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\product.cab
Filesize
8.7MB

MD5
cbf2eee286f70521967645e8b9b65b97

SHA1
f0d4eb2d7373f406c3a2d5645d4c6ce17ee2d937

SHA256
c64ca729f5ce7faee13a99f07e6dd08ed1ca434622b14b46c9d79f5ea0c80814

SHA512
866a347947f7d6fc60bb942b3eb9f26fe6c4d2c3a677d08b5043fea3cfb68beeaeaff7c130714373c7c81608febc9292d0283338399c8bf0631501d1843eeb1d

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\product.msi
Filesize
15.1MB

MD5
e0b693eb416ab8ca544ddaacb1fb3247

SHA1
a8661f821af3954239ae3b544953d947f11a8af2

SHA256
8629777aa2c95fab5bc0fddc20ec6d2b9af2b8dd6bc20d3017ca0303d50d2315

SHA512
1a1b932c132965614a6b25810bf2e032f20f0b5a9ceca487c08a62a2f5817cf4389dc7b8653f6379cc6d673dc7a1a3d914192f0159268b1d95cfcd90fee4a8fe

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\productbases.cab
Filesize
1.5MB

MD5
e0b62638d40ad90233c8a9d99ea57773

SHA1
4a31aa46ca733ed81c804346de69a0cd49d2e0c0

SHA256
f5e1630ce1e7bb5de96e7a49ae5c569dfcb9a3921214548841649f35e993e0c0

SHA512
5c59c4c1c6f806795fedb1f485f78c03eddb7a563a645c8d663ea17f3b5876e6e06e74e31d97ea4589405b5012200ef997878b064c577f5b91c9019631674fd9

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\startup.bin
Filesize
3.8MB

MD5
13636d30ef5f2f38ee6adcc65ab61230

SHA1
7b4f1dae9e768b00f32b250529abaed03603c0f9

SHA256
aade7dd57a4976ff4099696361b05d40102cdd42a32627dc5682b9b4aa652a5f

SHA512
4ff3b7bc9d4cc1955765248efba0b05aa6e12809ad4c340c958b16a5a1260c21b74c2eca9793e27fd51de77972a369dd560c788838f936e3c36959feeeba6451

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\startup_m.bin
Filesize
3.8MB

MD5
a7d2accac658e5101db3e76040818329

SHA1
041dd3d9a571e281042bcad093973460e88f3034

SHA256
09383bf7a6ba8e60c16796305ad55696e519dae05aa97d26784c2c9699b6d1aa

SHA512
8666ab75f6c4db9585d2fe999d58a6ce5b5dfb69a5ac47f7c68d874bcecf22302cc5e7b1ed05e6bc4b37659e7aa25ef1d5cb04bc5d2a99810a8e67530c219045

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\startup_o.bin
Filesize
3.8MB

MD5
94c741743e5b2759bea629ef6ec4bbc4

SHA1
1f86ad4fc8f95c2c7082b2f0e9a91c23de33a02f

SHA256
cc3dfc48db2c3637d38342521f84fe58142bba798be549ee50a50597f76edf2d

SHA512
968bb402948980ea6343a3baa7662427f6ec41acfd33b2142186b381244ddef74bccc0424a9f8e65adb0470b9115c3fbfc59423c6baade1cfe11780d95740c43

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.9.6.465.0.569.0\x64.cab
Filesize
8.5MB

MD5
501c465398e4aa76dd2ddb835696034d

SHA1
931210f69d4c57dab4b847f0946d4471973c6750

SHA256
2c1d4050df9fa2fe331011ef3756faf433cb84f2ae3603355f1ce944ec1c3fbd

SHA512
bf8e9effdd94e301a1cb4de64906d4fcf8f51c0cc8e5e2531118fc5edd34705b36e7472cc6ff1d4194fbb40115890425ab27bafa0d76218cf5a4a6347c588542

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0B532F86F8BFE69BA8D4B6BCF6B9C594
Filesize
1KB

MD5
20e3005a9cdee6fed8c8d8f6084f56f8

SHA1
2793d37a791a591602c2b84d933ba487e15fa4af

SHA256
909fc5117d221585e0c933f4b08acabb01d193cc1c493b7fbbd8aa835833129b

SHA512
a92f5c8c10ebbd0bfa4df8fe942c5f0241a6200d43db887df219b0477d5759aa7406ded902f35db95965075801f85964416140e532950ef7202e32227d5cff22

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0B532F86F8BFE69BA8D4B6BCF6B9C594
Filesize
318B

MD5
106b4a6781516b535f826f087a90a8e6

SHA1
e835955b040554a430575f5024cb5a7bd7095bdb

SHA256
448c452617233669d7ce618e4675b1566665cb442ae6e28f0baed229da9056ce

SHA512
65df6bc5f8aee3dc1a5a29e2583cee8c509ce2b2c894190b7c608a3dd237afe42776b2239b7a596794980bd3a37c89b64fd7dd7ecd5d0ab58989b0edc5811221

Download Submit
C:\Users\Admin\AppData\Local\Temp\61922B27-D4BC-11ED-B673-E20AF1709ACB\windowsdesktop-runtime-6.0.10-win-x86.exe
Filesize
49.6MB

MD5
5a46d5bc818e9f289e79b313ec37b3b4

SHA1
e542a36db85bffb6f0f62ea99bb3608ffc6e692e

SHA256
a8227633b41e1f97f8b3d57368794bf7e1ea38f9baf590ffa3aeef0c28d1172e

SHA512
ac4a0b971a2829e0c16c18d37567397a89d56ce1c14b52414484982d467eb1f950a44047c27090dfd408a3783e2878777141ba7d3fbd97a7d52a5b899b030737

Download Submit
C:\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\setup.dll
Filesize
5.8MB

MD5
e564b323b3a74ba896cbc2cbb1cc6270

SHA1
091ad0addd0ed495ab7ed2de97f2c801568fb09a

SHA256
f95b29338b88aa79912f11bbe21dc34d9b575f6e678db3141727a2d3ebe2afc9

SHA512
f83bd650810694ee25924198ce78041e33b977edc015bb6eb739c1e41a94aed51b398f964909a4b5150d91ac9aae9eb1f13f53e6259e4678dff5da705987546d

Download Submit
C:\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
C:\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.interoplayer.dll
Filesize
61KB

MD5
2ffcd7fd37006c99f1f196a54e01e5d6

SHA1
2457a02267bc0f19baf761974fdca728c0605615

SHA256
df2fdab38b61328c080bd0ea9b520918351f042609336074646f1c921112a218

SHA512
70d8dd6d4152358135eb5b5d31016ba2bb7827bccaf23a29c61e1fc1365e173cfd65258f4f9ded4f28dd5f4000ff18bc5488dd4b8ccc1055f2a4e7f6abb05aab

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\GuiStrings.loc
Filesize
30KB

MD5
2812f2e0de7bb161cd7ee46c0d6a68dc

SHA1
bd872578cf3c6288c6d6368530b681e15868750a

SHA256
6e1f18b7db3ef6cbec961677ac60b6ee1e36eb4429deb4727d1baacfe0ef6466

SHA512
d4a87ef4d663078da75d7b8ac1bbdfc655daacd383a9019965c706ab02fd616dbd3015e202845e1120352b82256e55e951af566ee47c83e92008dec7b2b42d85

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\GuiStrings_KFA.loc
Filesize
585B

MD5
c9c0ad53c3306052e43635437e42957f

SHA1
03d6f60659e5c34ef1d28fe8da926cca3125fb76

SHA256
592ae0dfc01dc6afb25fb6dbb5201e86c71aaf1357cc84d2610bbbfd820612f1

SHA512
5296fc8606c3fec1edf7b0758eccf6b5170390cecc8fc8bd20b87194699910421edf112d087fd47372a727ce89692d311aae21185994fabc09b5c40f20dad272

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\GuiStrings_es-MX.loc
Filesize
43KB

MD5
395dc09d50a59773572a8cbc52971549

SHA1
648d9937a0073bd9519115ace55ba6414a4bf63e

SHA256
a93acb643769654c2213c8ffd8721d8819a94b95648c839e2b5615ef6b2c4373

SHA512
c3b05125bf9fcf9b45d87a2f6abf9542d3fbe2ef289214551f9d0f7716e303d61d046279ce151ec15df6a509a6e1b702923ec95bdb070550564beb6edb218f6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\GuiStrings_es-MX_KFA.loc
Filesize
587B

MD5
d1fa2ae9b681062f507a673c57facae3

SHA1
51ffd47256c6378834a2d7a1d4e8bcedbcbb0fdc

SHA256
2c425dd23a3d307f7c6dc32cb0cb75768857b37b1cf14c600d6a56b7ec4be815

SHA512
8eaa63b1414348ee966354f8d2ba0673957bddd128c300dd8bbca0d60940a9ae846278e3d2630aa31e206e30aaa6f1ae72b332f537244a2bc6e2f804d4fa3458

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\downloader_neutral.ini
Filesize
19KB

MD5
5c28b6fffb6cbca3c754875bb92fff93

SHA1
37daa2f7c5de1335fa4e80f0cad2bc189130c270

SHA256
5eb9198623d3c1a782073a344abd0789b8cd005af0e44fc623ec300ba28c2a1b

SHA512
6ed4965a27cc34b66da05c887700c843ef8d4954c7b7e755c52c4be18b6c94d4a97147ef1ffb0668b39a5d2ff1c0ea862fd4d55b2f83455512cb1ff4b767c755

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\downloader_neutral_KFA.ini
Filesize
1KB

MD5
2e10b2d4181d2f07d2dd305bd4285bd5

SHA1
9c05f3e03bae36da24a62b08729074cd12b0077e

SHA256
cbb72cdc1e461226c7d0e49e7ef955f77dfeef4f7fe12d0d8a8d0cf9658edc78

SHA512
a1bae84b8a9c0833bbadf29d4532b64f0216d7c1c13be2b4ebb75dd4d2b18244eb67fee52743745ed0a5818e745cb9aae9a8bfdc415ff59ee8aa7de77f122819

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\html\install_programm.png
Filesize
63KB

MD5
4c4ff2a5b22e51c9e362de1f6ddba31e

SHA1
5293e9882e31e8ca82f57a4b8b2539d187393148

SHA256
41c6a3c5eb79e1b74e7e5d415da6db58c8e77382c7ad08cffa34afc6ce4ccd2a

SHA512
6686794d0caddd44c8ff4a4f295fbf23020f19ecaf79bf8391877e2e5238bdc2eceb92b1db2a6041bd93bde417dc6840ffcbc722139f5c1c4b2bc8e829a47f70

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\html\product.png
Filesize
6KB

MD5
dde99df5896d764db2d26b5c4c485617

SHA1
d38320eeddb57170d6cd6f866fe22dabae7c8ce8

SHA256
ec8f4977dce0076aa4a71385dde57ae5c3f74a0427c8a6d020131fb33e173572

SHA512
a0ab3b8462d4f67d15c17b020f0864faafa18b18b92a6e571cabcdff092b68867cbe2aa0c3e2fcc101708f01f6bcc3ece317994a75d6a849e87a04e998cb0249

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\html\product.svg
Filesize
4KB

MD5
a41e5efeed8c4c2d5f6ca9163bf044de

SHA1
5b5f2355bc59985ce16edaf8b5f8a10eeea020d5

SHA256
4a2260f0d29925bbcf1191d3327ff50f610a5958ecd41bc7de15b3fbf9c759fc

SHA512
3f5e118ad2fae7d94323269b65b30f25029b758e3f0ea94c7d6abc823bf399c78766ff252446a76f401e465d8d37a65c7ec1a3d7dbff4faa2a9fdf743724f71b

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515D-D4BB-11ED-B673-E20AF1709ACB\mykasperskyfeatures_es-mx.txt
Filesize
5KB

MD5
c14a4c7b2df20483330a58de3cc50e58

SHA1
0e2c1a51a9587e78969939a96d7e285a94ccf9c4

SHA256
8b47df2808d2ba773d330cfd225d29b2bae4b4d58dd812fb89ee01870a911d56

SHA512
78912cda958a9b140adbfdf7e356fa4785a422f6ca63836af599037ba9c392ff4d3d53363c578cd2dfff24b2b30ab40976d13e3c221b2841b4b9a34e4b24dad0

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515E-D4BB-11ED-B673-E20AF1709ACB\kaspersky.svg
Filesize
3KB

MD5
28bb265a9a4dc39e815d94406224023f

SHA1
328e994796fcf44c35deafe4580946faa33f36a9

SHA256
8f70bfe695733cc07b5ae128b81a95cd2141f18c048477c7d8cc65840c07b412

SHA512
a4d4f55e88b95da95c0583d49bdbdf0057770534e2fb8307babb12df089cfdd86de15549589ee11544b8b4517d2e0a9f306ed43a4cb89dc3bdf99838313331e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515E-D4BB-11ED-B673-E20AF1709ACB\uikitradiobutton_icon.svg
Filesize
275B

MD5
2ca2f70dafb03e7a0fe853cb46cfe646

SHA1
66b454a1f272ed8825251e80e5586425189cff23

SHA256
85c05f45ffe21e56818571cf6ae93d6e20beddc42afa682c8506672f43fb0d58

SHA512
b1e16d91f5720e495d404bc402d87944359ef576719510702b88462c3d3f79a9493c7dd47f4c0a2af944ce74bf16fd5a1f2edd910a16881a66dd2ba036fd3d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\E745515E-D4BB-11ED-B673-E20AF1709ACB\uikitspinnerxsmall_icon.svg
Filesize
549B

MD5
9c0937f953c6e303c3f996a8d028f786

SHA1
2f30c354e71a3724942ee020d7972a643145b312

SHA256
e1281d04ced08a0d68b415a91c64f6fe96e9abd10b03a53f8b8dd9ade4a874a4

SHA512
b0c55bfb6bdc259264ef5550f4ff33b415e5a8447ef21af84e75f64cdac65887f0ff539b99c9a4d50da3ffdb0d8492e1de5a1bc7e13fffeebb8db974a9a37e13

Download Submit
C:\Users\Admin\AppData\Local\Temp\F014844A-D4BB-11ED-B673-E20AF1709ACB\downloader_es-MX.ini
Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\F014844B-D4BB-11ED-B673-E20AF1709ACB\moderninstallationprocess.svg
Filesize
14KB

MD5
eb0b44d892dd4c2dfe1560ef5882f01f

SHA1
81e43c5b32ea724168fa7faaa2221096a94c0fec

SHA256
4ef59574add804e6ec54a341f58883215d9eb6620127032c22a42cd8899ee181

SHA512
280c3ee33acf1736fd95b2a50d09390cc0e29a802da2e51a3c084997fe86b895f533fa7e9afb71e4a3a99cfb5445310ccc73d1c9463d5d1b30ff4ffbe03e316e

Download Submit
C:\Users\Admin\AppData\Local\Temp\F014844B-D4BB-11ED-B673-E20AF1709ACB\modernwelcomepage.svg
Filesize
11KB

MD5
22482cdd752aebe20d205b40faff8389

SHA1
9c00d2a3e782cc47afc58c5a558500148d9de393

SHA256
fec9b1118586c459512540bbde7ff1ddcc278f8fa77dbe63e64e91971c7445fb

SHA512
9731e92f2d3c04b6911423ed67b16a255209ddd30231e95e375b6298ec2b0730858e69b3937239bbf328dad2e22653f8b6f97b035e94f5713ab47903fb57fd50

Download Submit
C:\Users\Admin\AppData\Local\Temp\F014844B-D4BB-11ED-B673-E20AF1709ACB\uikitcheckbox_icon.svg
Filesize
499B

MD5
db1e07d540f02c0bbd0fc7363f935c17

SHA1
4b9c5581ad808374211f5e640bc8086589ab8ba5

SHA256
72c35d64fc5c7a37753990ac92580714ee595e262198f3a3e3c29e12397560fd

SHA512
2e7ea1536282e045ae2423b095cbb0a059889907db85739372885d1a0f0e4b62667256800eff9d3eff8b009047bc8a51bae175443bc4d67a50b3d8ae77d32b0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\F014844B-D4BB-11ED-B673-E20AF1709ACB\uikitcheckbox_iconpartial.svg
Filesize
283B

MD5
dc2f77dc04b3279d7b09a936997a1a9d

SHA1
097ffc362e513de54fc7c9636b384c6471fd8854

SHA256
777bd1bd3d35157a39339822092b9a7fdb7a170e30f93f354367d5d2d40652e5

SHA512
a3fe2fc9890ba92349684fa8ddca74db060df3837a72fe5091b64a9c5866f7e250a023b1f734e0ccf60b4029a078b0a0c28885511a5692a0ae67d41ae6829900

Download Submit
C:\Users\Admin\AppData\Local\Temp\F014844B-D4BB-11ED-B673-E20AF1709ACB\uikitspinnersmall_icon.svg
Filesize
559B

MD5
f4ca1299303e816f151991623f0301d3

SHA1
0165522ce78cf3981640a3692be9a5721a22837c

SHA256
2be6835af2b6c53b2e798e83e04c9ff5d44cbd0e94d443ae0547dc3cf027fe2c

SHA512
cb488207b4ed3592ca10be8af1300404db5fdb80f9f726a006f645334d97a103a8c23f8a21d431e5ad500348d8186a4452ef68547cbfabe1e874c0dcae04e351

Download Submit
C:\Users\Admin\AppData\Local\Temp\discovery.cfg
Filesize
29KB

MD5
1848091e6ad9f49ae936415a3fd3ddd1

SHA1
c4ab186d4fbb3411bce8611fa5e9bbbbe80bb020

SHA256
ed40c02c1ed8f3ee607610bcee4df39ae067d7b3eb00d1943f94d62ef6f6ba0a

SHA512
2292a51deec6fe3ea051d9629863dc4a67c44280a18877cd6f85741e401325f01a4344165d9c00bd7e4bc99ee4a33e95ca2845b07553398b432813858b05467b

Download Submit
C:\Users\Admin\AppData\Local\Temp\discovery.cfg
Filesize
29KB

MD5
1848091e6ad9f49ae936415a3fd3ddd1

SHA1
c4ab186d4fbb3411bce8611fa5e9bbbbe80bb020

SHA256
ed40c02c1ed8f3ee607610bcee4df39ae067d7b3eb00d1943f94d62ef6f6ba0a

SHA512
2292a51deec6fe3ea051d9629863dc4a67c44280a18877cd6f85741e401325f01a4344165d9c00bd7e4bc99ee4a33e95ca2845b07553398b432813858b05467b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{F62D41BE-1973-4F71-89F4-956C37301B4E}\msi_common.dll
Filesize
390KB

MD5
76a39a498d460c856bf3264f6584d311

SHA1
f2de7dfb0c8f0996b3b40ce863fd7f0bb33d9a90

SHA256
1c8e66bd1b598fd90d754f0d9d15b19b19766003bda0f9022e4ce872a5bb12d9

SHA512
d27f526653e97844ca57c79788b30ae50e35e27e47e3ad28782baa08a035d9b63bc07bcbcfe3d88b834eba138e5900a2960eda688475f695716d94f233659813

Download Submit
C:\Windows\Installer\MSIA3CE.tmp
Filesize
225KB

MD5
d711da8a6487aea301e05003f327879f

SHA1
548d3779ed3ab7309328f174bfb18d7768d27747

SHA256
3d855b58ce7da9f24f1bef8d0673ba4a97105a7fd88433de7fb4e156b4306283

SHA512
c6d1c938e8a0acf080dcab1276d78237e342a98772e23ac887b87a346878c376fb0af8364e52a36c5b949005aa3218308bc6193f8b580f622ef39d9955c7c681

Download Submit
C:\Windows\Installer\MSIC6ED.tmp
Filesize
147KB

MD5
d662f516aad66e7f6ff52f6baed03ab5

SHA1
9a4e363df4d12ac3117477485081d2489a65d850

SHA256
f168b9172c895483d2d0cd34b3b3c850bf83041098bacb1503b0f1c561fe619e

SHA512
8b95d07cf8b96b9251a082ac20c201160f3244b3eea3ee9ca0565e29b60bf01332c59eafdb4ae6ee54de70c1ce5162935d6b78a4f201d4aee6bf8fe6a4e32a9c

Download Submit
C:\Windows\Installer\MSICB08.tmp
Filesize
2.3MB

MD5
a2bc79c40e84f674f64f12a24b8c622e

SHA1
d83e4a377d57e53e8e6d8285b92a0c31dad1e3ad

SHA256
0414ba0ccefd041b59ae1a8054a51dd1fec954efdad316b2d85ae62180eb83c3

SHA512
8167da26aa3543b7d18bb8be80c9a11e620abae35d23e6c0c08d10ec914b736040173c84d09da6f6bfa21c3349ad2a2f9182a07b741d1b2029d191f5a2194879

Download Submit
C:\Windows\Installer\MSID8BA.tmp
Filesize
745KB

MD5
ecaa6c60aef2d088132ffb4bdbf15433

SHA1
5b9ca6084f0ac81a52b42e003c4c630b62bdd8d5

SHA256
cb40009d8fe10226bd849a52de97f78c4b998a4ddd9f18f1d3d81aa8d9003965

SHA512
2bd74b66003cf4d2c95261505dec1002ec4f0e83c0039ea6be376bafb8cf145925a868520963c429997382ae01f5ece5718fcc7b263d7ae3330401a35d5454d0

Download Submit
C:\Windows\Installer\e5a8532.msi
Filesize
23.2MB

MD5
7dbe9137d7d761755762601a655e1b97

SHA1
a030febd6708a538c36d6b9cab6baa36824d7e9b

SHA256
85a10c6bb16ed85961d645f1ab397e56692b411e3dee5d4aeec7b06cc4360efb

SHA512
9c6c412c32d51f9f2419db246f09b9a92922e1958d8b7b0100bb25c2d3937a1745ae8436132ecb205654614899a64ca284ddb6125c813dc66718ff2662b7bcef

Download Submit
C:\Windows\Installer\e5a8533.msi
Filesize
784KB

MD5
ad58f87e6ddbb9a8552da3fc9cf1c7c3

SHA1
9f80c34aaaa569f0d5dc0d03d678d66f094bc383

SHA256
7beeec5c2f26a676b9de96b3b05121dbe8c9aa83578dcc462d0233b34e88081a

SHA512
531c20b88f54146e9c8eda2ffe86c59f67aed2545c62c6f5d6f9b8e0013101c8545d969c6bff3312cabb16160fb407bc947006da0e02bdfe2cbcaa732d44a2b2

Download Submit
C:\Windows\Installer\e5a853e.msi
Filesize
25.9MB

MD5
4b28a252ff28536d7cbeaea8fa174f96

SHA1
015cd8a51914b909215d1709ff325ef40710e2df

SHA256
34dbf54f1dac4486a334a07dcb01c1e9b7dcecd49fa33ab3911354aa9c927f72

SHA512
7e959d7fbfb673897167a26ff5158fa955cd05576b9387e0d5f114e773d9bf8ac526cee0d6b4897e7b40175e68a9c072252121d7c3bc08a4510a26ca73a97bce

Download Submit
C:\Windows\Temp\{12DE7935-085B-4F1A-A1C2-F626EFAB9270}\.ba\bg.png
Filesize
4KB

MD5
9eb0320dfbf2bd541e6a55c01ddc9f20

SHA1
eb282a66d29594346531b1ff886d455e1dcd6d99

SHA256
9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79

SHA512
9ada3a1757a493fbb004bd767fab8f77430af69d71479f340b8b8ede904cc94cd733700db593a4a2d2e1184c0081fd0648318d867128e1cb461021314990931d

Download Submit
C:\Windows\Temp\{12DE7935-085B-4F1A-A1C2-F626EFAB9270}\.be\windowsdesktop-runtime-6.0.10-win-x86.exe
Filesize
610KB

MD5
561cfa68f4e6de36751f9718fdae9245

SHA1
7eaf86c638db3ded545978c8866292336b528608

SHA256
ef8aec83db931d14749e6e01dc90f706bb0337115b05ccb368b0142516fbb720

SHA512
4b476dfa869e6a5ded4b9daddb2023b6711396e4fb221f93f7ec92268a47461f76cc42bd7d3e0c6f1fccc95096f84d8b3e0cec3a45d8e1ac4a0408838b63599e

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.core.dll
Filesize
955KB

MD5
f0f19c0b71bb32234ed122b7be6a4913

SHA1
b709e3536012693b3c663acfaf3237334d5a72ec

SHA256
208449f0a472dd87463d12963747b0bf3a7256999a16364550240cebf7811239

SHA512
ab3e03d5c253f811dd623406df3746d9ca373b46dc688fd4358f7e048d501bb7bbeddcd0ec005282de2594460628ee860295734fec90d7ee1704796b389292d9

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.core.dll
Filesize
955KB

MD5
f0f19c0b71bb32234ed122b7be6a4913

SHA1
b709e3536012693b3c663acfaf3237334d5a72ec

SHA256
208449f0a472dd87463d12963747b0bf3a7256999a16364550240cebf7811239

SHA512
ab3e03d5c253f811dd623406df3746d9ca373b46dc688fd4358f7e048d501bb7bbeddcd0ec005282de2594460628ee860295734fec90d7ee1704796b389292d9

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.dll
Filesize
522KB

MD5
702111c2df837b460447d0dec7734ffd

SHA1
abbe1a37812ebbc399be8478d2e27da5dd70d6e6

SHA256
d79a3110bcea08ed15b040fd865ee201a7c8a82e44143110941a6a4c05e90745

SHA512
6e2fc00ca38a24d594202c43138b0a838acae82988da3c37226396e6aeeb937d0b530663742c4c85f5da01dacadac1b4b11303b3785244c3ef2a753bb03f958e

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.dll
Filesize
522KB

MD5
702111c2df837b460447d0dec7734ffd

SHA1
abbe1a37812ebbc399be8478d2e27da5dd70d6e6

SHA256
d79a3110bcea08ed15b040fd865ee201a7c8a82e44143110941a6a4c05e90745

SHA512
6e2fc00ca38a24d594202c43138b0a838acae82988da3c37226396e6aeeb937d0b530663742c4c85f5da01dacadac1b4b11303b3785244c3ef2a753bb03f958e

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.interoplayer.dll
Filesize
61KB

MD5
2ffcd7fd37006c99f1f196a54e01e5d6

SHA1
2457a02267bc0f19baf761974fdca728c0605615

SHA256
df2fdab38b61328c080bd0ea9b520918351f042609336074646f1c921112a218

SHA512
70d8dd6d4152358135eb5b5d31016ba2bb7827bccaf23a29c61e1fc1365e173cfd65258f4f9ded4f28dd5f4000ff18bc5488dd4b8ccc1055f2a4e7f6abb05aab

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.interoplayer.dll
Filesize
61KB

MD5
2ffcd7fd37006c99f1f196a54e01e5d6

SHA1
2457a02267bc0f19baf761974fdca728c0605615

SHA256
df2fdab38b61328c080bd0ea9b520918351f042609336074646f1c921112a218

SHA512
70d8dd6d4152358135eb5b5d31016ba2bb7827bccaf23a29c61e1fc1365e173cfd65258f4f9ded4f28dd5f4000ff18bc5488dd4b8ccc1055f2a4e7f6abb05aab

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.ui.core.localization.dll
Filesize
342KB

MD5
f23bdd57e3e147e50126939ea61e051a

SHA1
89064be79760b107264f1f732e808c39f752ac60

SHA256
ae8bf314cdab6d0cfd6f61bb0beedc65b94de92accd8b060c1ad7d1631dbf7bf

SHA512
06ef7f6823d14b366328d1d30f1be7e53389fe622a149cf5906fbbf564e2323eaf6112b3a85fb03c64f64e757babeca04c8f21f28ad1f523931c981c89497337

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\kasperskylab.ui.core.localization.dll
Filesize
342KB

MD5
f23bdd57e3e147e50126939ea61e051a

SHA1
89064be79760b107264f1f732e808c39f752ac60

SHA256
ae8bf314cdab6d0cfd6f61bb0beedc65b94de92accd8b060c1ad7d1631dbf7bf

SHA512
06ef7f6823d14b366328d1d30f1be7e53389fe622a149cf5906fbbf564e2323eaf6112b3a85fb03c64f64e757babeca04c8f21f28ad1f523931c981c89497337

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\setup.dll
Filesize
5.8MB

MD5
e564b323b3a74ba896cbc2cbb1cc6270

SHA1
091ad0addd0ed495ab7ed2de97f2c801568fb09a

SHA256
f95b29338b88aa79912f11bbe21dc34d9b575f6e678db3141727a2d3ebe2afc9

SHA512
f83bd650810694ee25924198ce78041e33b977edc015bb6eb739c1e41a94aed51b398f964909a4b5150d91ac9aae9eb1f13f53e6259e4678dff5da705987546d

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectorconverterswpf.dll
Filesize
144KB

MD5
a833005803dd9e54246689d1c55a6328

SHA1
a5c8560bc1e43a97dbd6bc9b7479d8691276c507

SHA256
c2d7235dde2fb938e4f393c1ccad9b2eccee55df3eacd00bf9f87c9054e04180

SHA512
98960663fdcb7b9ec8f8fb6db618af8868d8f951e21bbcad2f2cde64b6486343eda6634d10f3839c937b65e1225edb92caee6c37763f36e2abae2c63dc76ad1f

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectorconverterswpf.dll
Filesize
144KB

MD5
a833005803dd9e54246689d1c55a6328

SHA1
a5c8560bc1e43a97dbd6bc9b7479d8691276c507

SHA256
c2d7235dde2fb938e4f393c1ccad9b2eccee55df3eacd00bf9f87c9054e04180

SHA512
98960663fdcb7b9ec8f8fb6db618af8868d8f951e21bbcad2f2cde64b6486343eda6634d10f3839c937b65e1225edb92caee6c37763f36e2abae2c63dc76ad1f

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectorcore.dll
Filesize
207KB

MD5
2861ed9add07691e5941f6a5d611f1a7

SHA1
c22749f867c4b69ebe845f36e116a4ab7c5179a8

SHA256
d7d5da8fae44090c52ec5ab4e9e098364893dea4a18a1946fa7cbde7d61c39c8

SHA512
60ecee18c8557f3a5c94778f270ff0caf87fc6e894ea78e3a80574cb48bc7c142773d8a4c1ec0b8c515122355acc4d93532a1e89dc9868b9e927aff33b454b1d

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectorcore.dll
Filesize
207KB

MD5
2861ed9add07691e5941f6a5d611f1a7

SHA1
c22749f867c4b69ebe845f36e116a4ab7c5179a8

SHA256
d7d5da8fae44090c52ec5ab4e9e098364893dea4a18a1946fa7cbde7d61c39c8

SHA512
60ecee18c8557f3a5c94778f270ff0caf87fc6e894ea78e3a80574cb48bc7c142773d8a4c1ec0b8c515122355acc4d93532a1e89dc9868b9e927aff33b454b1d

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectorcss.dll
Filesize
115KB

MD5
e3a99719caf5d115b481d8954c51643b

SHA1
e9711ecfe27f173e6ae35db413f6786aaf406d2e

SHA256
151c750f0cb7c555d20f615e899f3dcdfa153b7b9ad8fdf40572bfcefb4d2582

SHA512
dc9852b642f21c41454be769875510bf66d91ebb5480c248621cd9c0e6c4e6f9e554ae902a168ff8b31ec85088158f48b9786fadb71756041cde66a49e707e11

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectormodel.dll
Filesize
1014KB

MD5
57795c20bc3bd9f149e26739f253bc85

SHA1
8b3148602ce583a7e5ce56c0fe21c0e7ac5e3e64

SHA256
0ef85c9a40166b78c6c50d47156e9b5f519a55696d3ee27455cd12993fea7daa

SHA512
c31cdae53aa4a0c7c3b3a415882441ed53a9c46f7f057a71264581acb2bcd587a010f21578f558672c5675550efeaf109a3522daecfe37b1c8e1b7a7012dd241

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectormodel.dll
Filesize
1014KB

MD5
57795c20bc3bd9f149e26739f253bc85

SHA1
8b3148602ce583a7e5ce56c0fe21c0e7ac5e3e64

SHA256
0ef85c9a40166b78c6c50d47156e9b5f519a55696d3ee27455cd12993fea7daa

SHA512
c31cdae53aa4a0c7c3b3a415882441ed53a9c46f7f057a71264581acb2bcd587a010f21578f558672c5675550efeaf109a3522daecfe37b1c8e1b7a7012dd241

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectorrenderingwpf.dll
Filesize
210KB

MD5
946920ddad0ddd57957c27a6d4dfa04e

SHA1
2871bc3aa85a0fa2d0e71f8a0061f9a218e4cd2f

SHA256
f316e5ad21c028e425afb13771f32b15b123baf521a2069da7188e44d25df234

SHA512
2f0a3b4d526becddcae6e0714b1b3cfa03a4870a31f4a8ba5457cd740073f1b4491b69864e92f95dd789c529899b2f19041d194e3e6935d6d31f0f6a303d3bc8

Download Submit
\Users\Admin\AppData\Local\Temp\9448410FBB4DDE116B372EA01F07A9BC\sharpvectorrenderingwpf.dll
Filesize
210KB

MD5
946920ddad0ddd57957c27a6d4dfa04e

SHA1
2871bc3aa85a0fa2d0e71f8a0061f9a218e4cd2f

SHA256
f316e5ad21c028e425afb13771f32b15b123baf521a2069da7188e44d25df234

SHA512
2f0a3b4d526becddcae6e0714b1b3cfa03a4870a31f4a8ba5457cd740073f1b4491b69864e92f95dd789c529899b2f19041d194e3e6935d6d31f0f6a303d3bc8

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\System.Windows.Interactivity.dll
Filesize
39KB

MD5
3ab57a33a6e3a1476695d5a6e856c06a

SHA1
dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

SHA256
4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

SHA512
58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.common.dll
Filesize
41KB

MD5
66c728175710a0c3c949063d0b372bda

SHA1
bc02becbe07529e0ca2a9f927e732d2e6e0aab1e

SHA256
f3f8171e8d009b3df8e5ee09a1e938760cfde88b47f3e24537295089461ecbd8

SHA512
69f2b837730fa561c2fbabd54105f31ce915f240c729fc60987aa323a71bbbbff66fc8c4d5a8e39164f3a545fe56cf3f1db02e1feb73401dfdd54818ca484fe3

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.core.dll
Filesize
955KB

MD5
f0f19c0b71bb32234ed122b7be6a4913

SHA1
b709e3536012693b3c663acfaf3237334d5a72ec

SHA256
208449f0a472dd87463d12963747b0bf3a7256999a16364550240cebf7811239

SHA512
ab3e03d5c253f811dd623406df3746d9ca373b46dc688fd4358f7e048d501bb7bbeddcd0ec005282de2594460628ee860295734fec90d7ee1704796b389292d9

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.core.dll
Filesize
955KB

MD5
f0f19c0b71bb32234ed122b7be6a4913

SHA1
b709e3536012693b3c663acfaf3237334d5a72ec

SHA256
208449f0a472dd87463d12963747b0bf3a7256999a16364550240cebf7811239

SHA512
ab3e03d5c253f811dd623406df3746d9ca373b46dc688fd4358f7e048d501bb7bbeddcd0ec005282de2594460628ee860295734fec90d7ee1704796b389292d9

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.dll
Filesize
522KB

MD5
702111c2df837b460447d0dec7734ffd

SHA1
abbe1a37812ebbc399be8478d2e27da5dd70d6e6

SHA256
d79a3110bcea08ed15b040fd865ee201a7c8a82e44143110941a6a4c05e90745

SHA512
6e2fc00ca38a24d594202c43138b0a838acae82988da3c37226396e6aeeb937d0b530663742c4c85f5da01dacadac1b4b11303b3785244c3ef2a753bb03f958e

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.dll
Filesize
522KB

MD5
702111c2df837b460447d0dec7734ffd

SHA1
abbe1a37812ebbc399be8478d2e27da5dd70d6e6

SHA256
d79a3110bcea08ed15b040fd865ee201a7c8a82e44143110941a6a4c05e90745

SHA512
6e2fc00ca38a24d594202c43138b0a838acae82988da3c37226396e6aeeb937d0b530663742c4c85f5da01dacadac1b4b11303b3785244c3ef2a753bb03f958e

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.interoplayer.dll
Filesize
61KB

MD5
2ffcd7fd37006c99f1f196a54e01e5d6

SHA1
2457a02267bc0f19baf761974fdca728c0605615

SHA256
df2fdab38b61328c080bd0ea9b520918351f042609336074646f1c921112a218

SHA512
70d8dd6d4152358135eb5b5d31016ba2bb7827bccaf23a29c61e1fc1365e173cfd65258f4f9ded4f28dd5f4000ff18bc5488dd4b8ccc1055f2a4e7f6abb05aab

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.setup.ui.interoplayer.dll
Filesize
61KB

MD5
2ffcd7fd37006c99f1f196a54e01e5d6

SHA1
2457a02267bc0f19baf761974fdca728c0605615

SHA256
df2fdab38b61328c080bd0ea9b520918351f042609336074646f1c921112a218

SHA512
70d8dd6d4152358135eb5b5d31016ba2bb7827bccaf23a29c61e1fc1365e173cfd65258f4f9ded4f28dd5f4000ff18bc5488dd4b8ccc1055f2a4e7f6abb05aab

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.ui.core.localization.dll
Filesize
342KB

MD5
f23bdd57e3e147e50126939ea61e051a

SHA1
89064be79760b107264f1f732e808c39f752ac60

SHA256
ae8bf314cdab6d0cfd6f61bb0beedc65b94de92accd8b060c1ad7d1631dbf7bf

SHA512
06ef7f6823d14b366328d1d30f1be7e53389fe622a149cf5906fbbf564e2323eaf6112b3a85fb03c64f64e757babeca04c8f21f28ad1f523931c981c89497337

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\kasperskylab.ui.core.localization.dll
Filesize
342KB

MD5
f23bdd57e3e147e50126939ea61e051a

SHA1
89064be79760b107264f1f732e808c39f752ac60

SHA256
ae8bf314cdab6d0cfd6f61bb0beedc65b94de92accd8b060c1ad7d1631dbf7bf

SHA512
06ef7f6823d14b366328d1d30f1be7e53389fe622a149cf5906fbbf564e2323eaf6112b3a85fb03c64f64e757babeca04c8f21f28ad1f523931c981c89497337

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\setup.dll
Filesize
5.8MB

MD5
0f3e0cd86996f84c115688b81436244c

SHA1
248eccfbae0e8976cfeaac6e371f1370557e9343

SHA256
f50ff16feb252855c2afb26789033ad96e8aa45e605cc4821523c8b9d6024d50

SHA512
0f2c13ec4ccf8e0527beea70e5bc6647f955f753f340b8155c2958c050a440e7bae7e898668a35ec713279f0b2415d773bc69f4a1a3fba3289710a0e70afbf18

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorconverterswpf.dll
Filesize
144KB

MD5
a833005803dd9e54246689d1c55a6328

SHA1
a5c8560bc1e43a97dbd6bc9b7479d8691276c507

SHA256
c2d7235dde2fb938e4f393c1ccad9b2eccee55df3eacd00bf9f87c9054e04180

SHA512
98960663fdcb7b9ec8f8fb6db618af8868d8f951e21bbcad2f2cde64b6486343eda6634d10f3839c937b65e1225edb92caee6c37763f36e2abae2c63dc76ad1f

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorconverterswpf.dll
Filesize
144KB

MD5
a833005803dd9e54246689d1c55a6328

SHA1
a5c8560bc1e43a97dbd6bc9b7479d8691276c507

SHA256
c2d7235dde2fb938e4f393c1ccad9b2eccee55df3eacd00bf9f87c9054e04180

SHA512
98960663fdcb7b9ec8f8fb6db618af8868d8f951e21bbcad2f2cde64b6486343eda6634d10f3839c937b65e1225edb92caee6c37763f36e2abae2c63dc76ad1f

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorcore.dll
Filesize
207KB

MD5
2861ed9add07691e5941f6a5d611f1a7

SHA1
c22749f867c4b69ebe845f36e116a4ab7c5179a8

SHA256
d7d5da8fae44090c52ec5ab4e9e098364893dea4a18a1946fa7cbde7d61c39c8

SHA512
60ecee18c8557f3a5c94778f270ff0caf87fc6e894ea78e3a80574cb48bc7c142773d8a4c1ec0b8c515122355acc4d93532a1e89dc9868b9e927aff33b454b1d

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorcore.dll
Filesize
207KB

MD5
2861ed9add07691e5941f6a5d611f1a7

SHA1
c22749f867c4b69ebe845f36e116a4ab7c5179a8

SHA256
d7d5da8fae44090c52ec5ab4e9e098364893dea4a18a1946fa7cbde7d61c39c8

SHA512
60ecee18c8557f3a5c94778f270ff0caf87fc6e894ea78e3a80574cb48bc7c142773d8a4c1ec0b8c515122355acc4d93532a1e89dc9868b9e927aff33b454b1d

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorcss.dll
Filesize
115KB

MD5
e3a99719caf5d115b481d8954c51643b

SHA1
e9711ecfe27f173e6ae35db413f6786aaf406d2e

SHA256
151c750f0cb7c555d20f615e899f3dcdfa153b7b9ad8fdf40572bfcefb4d2582

SHA512
dc9852b642f21c41454be769875510bf66d91ebb5480c248621cd9c0e6c4e6f9e554ae902a168ff8b31ec85088158f48b9786fadb71756041cde66a49e707e11

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorcss.dll
Filesize
115KB

MD5
e3a99719caf5d115b481d8954c51643b

SHA1
e9711ecfe27f173e6ae35db413f6786aaf406d2e

SHA256
151c750f0cb7c555d20f615e899f3dcdfa153b7b9ad8fdf40572bfcefb4d2582

SHA512
dc9852b642f21c41454be769875510bf66d91ebb5480c248621cd9c0e6c4e6f9e554ae902a168ff8b31ec85088158f48b9786fadb71756041cde66a49e707e11

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectordom.dll
Filesize
62KB

MD5
09058878d8b8d043fe56d4be0afe25f3

SHA1
81bf34fada95ea8b50161c005ecae6422de6c3fa

SHA256
db6fd8f5f8b2fbd442c9fc7c11fcd505b2b13e8fc20d2c0e38a5186f2ed26983

SHA512
435ba51c2569f61fc5c5e41898ced22374431b16c7a79a8f77d22b48b74951190f62f20328b22d6a6b62bedea8603c8b714e7cad4f9bf42aca3a0a07f0b5345a

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectordom.dll
Filesize
62KB

MD5
09058878d8b8d043fe56d4be0afe25f3

SHA1
81bf34fada95ea8b50161c005ecae6422de6c3fa

SHA256
db6fd8f5f8b2fbd442c9fc7c11fcd505b2b13e8fc20d2c0e38a5186f2ed26983

SHA512
435ba51c2569f61fc5c5e41898ced22374431b16c7a79a8f77d22b48b74951190f62f20328b22d6a6b62bedea8603c8b714e7cad4f9bf42aca3a0a07f0b5345a

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectormodel.dll
Filesize
1014KB

MD5
57795c20bc3bd9f149e26739f253bc85

SHA1
8b3148602ce583a7e5ce56c0fe21c0e7ac5e3e64

SHA256
0ef85c9a40166b78c6c50d47156e9b5f519a55696d3ee27455cd12993fea7daa

SHA512
c31cdae53aa4a0c7c3b3a415882441ed53a9c46f7f057a71264581acb2bcd587a010f21578f558672c5675550efeaf109a3522daecfe37b1c8e1b7a7012dd241

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectormodel.dll
Filesize
1014KB

MD5
57795c20bc3bd9f149e26739f253bc85

SHA1
8b3148602ce583a7e5ce56c0fe21c0e7ac5e3e64

SHA256
0ef85c9a40166b78c6c50d47156e9b5f519a55696d3ee27455cd12993fea7daa

SHA512
c31cdae53aa4a0c7c3b3a415882441ed53a9c46f7f057a71264581acb2bcd587a010f21578f558672c5675550efeaf109a3522daecfe37b1c8e1b7a7012dd241

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorrenderingwpf.dll
Filesize
210KB

MD5
946920ddad0ddd57957c27a6d4dfa04e

SHA1
2871bc3aa85a0fa2d0e71f8a0061f9a218e4cd2f

SHA256
f316e5ad21c028e425afb13771f32b15b123baf521a2069da7188e44d25df234

SHA512
2f0a3b4d526becddcae6e0714b1b3cfa03a4870a31f4a8ba5457cd740073f1b4491b69864e92f95dd789c529899b2f19041d194e3e6935d6d31f0f6a303d3bc8

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorrenderingwpf.dll
Filesize
210KB

MD5
946920ddad0ddd57957c27a6d4dfa04e

SHA1
2871bc3aa85a0fa2d0e71f8a0061f9a218e4cd2f

SHA256
f316e5ad21c028e425afb13771f32b15b123baf521a2069da7188e44d25df234

SHA512
2f0a3b4d526becddcae6e0714b1b3cfa03a4870a31f4a8ba5457cd740073f1b4491b69864e92f95dd789c529899b2f19041d194e3e6935d6d31f0f6a303d3bc8

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorruntimewpf.dll
Filesize
76KB

MD5
b71b63e66d7f964432adad4c368618e0

SHA1
0eeb4825e855baddf86fe6c02de5a829470f835c

SHA256
ae7fa416e2d99aec2afd182e5ef9e5ac64d2ae8e0b54a2010a40d67c5eab0d29

SHA512
13d816fd0deaae0487d5dd6438ad4e648bd9e7fb48fc2a75121a14495fb1dedae9b47f6157f00f88901bf73a9cc0b2e825bc79d4d7b1b92a1a63cd9b2391ed58

Download Submit
\Users\Admin\AppData\Local\Temp\C515547EBB4DDE116B372EA01F07A9BC\sharpvectorruntimewpf.dll
Filesize
76KB

MD5
b71b63e66d7f964432adad4c368618e0

SHA1
0eeb4825e855baddf86fe6c02de5a829470f835c

SHA256
ae7fa416e2d99aec2afd182e5ef9e5ac64d2ae8e0b54a2010a40d67c5eab0d29

SHA512
13d816fd0deaae0487d5dd6438ad4e648bd9e7fb48fc2a75121a14495fb1dedae9b47f6157f00f88901bf73a9cc0b2e825bc79d4d7b1b92a1a63cd9b2391ed58

Download Submit
memory/1872-398-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/1872-397-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/1872-491-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/1872-490-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/1872-489-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/1872-460-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/1872-940-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/1872-941-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/1872-396-0x00000000771E0000-0x00000000771F0000-memory.dmp

Filesize
64KB

Download
memory/1872-939-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/1872-942-0x0000000007970000-0x0000000007980000-memory.dmp

Filesize
64KB

Download
memory/2484-937-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/2484-938-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/2484-936-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/3628-373-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download
memory/3628-392-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download
memory/3628-366-0x00000000098A0000-0x00000000098A8000-memory.dmp

Filesize
32KB

Download
memory/3628-367-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/3628-309-0x00000000097B0000-0x00000000097C2000-memory.dmp

Filesize
72KB

Download
memory/3628-305-0x0000000008170000-0x000000000817E000-memory.dmp

Filesize
56KB

Download
memory/3628-301-0x00000000081D0000-0x00000000081EC000-memory.dmp

Filesize
112KB

Download
memory/3628-372-0x000000000D3A0000-0x000000000D3AA000-memory.dmp

Filesize
40KB

Download
memory/3628-297-0x0000000009920000-0x0000000009A1C000-memory.dmp

Filesize
1008KB

Download
memory/3628-121-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/3628-293-0x0000000008190000-0x00000000081C2000-memory.dmp

Filesize
200KB

Download
memory/3628-288-0x00000000080B0000-0x0000000008142000-memory.dmp

Filesize
584KB

Download
memory/3628-287-0x0000000007FE0000-0x0000000008002000-memory.dmp

Filesize
136KB

Download
memory/3628-322-0x000000000DD30000-0x000000000DD68000-memory.dmp

Filesize
224KB

Download
memory/3628-283-0x0000000007FA0000-0x0000000007FD4000-memory.dmp

Filesize
208KB

Download
memory/3628-393-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download
memory/3628-269-0x0000000007F50000-0x0000000007F58000-memory.dmp

Filesize
32KB

Download
memory/3628-251-0x0000000007F40000-0x0000000007F50000-memory.dmp

Filesize
64KB

Download
memory/3628-235-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download
memory/3628-233-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download
memory/3628-203-0x0000000008F50000-0x0000000008FA4000-memory.dmp

Filesize
336KB

Download
memory/3628-199-0x00000000086D0000-0x00000000087BE000-memory.dmp

Filesize
952KB

Download
memory/3628-168-0x0000000007BC0000-0x0000000007C42000-memory.dmp

Filesize
520KB

Download
memory/3628-164-0x00000000077A0000-0x00000000077B0000-memory.dmp

Filesize
64KB

Download
memory/3628-157-0x0000000005380000-0x000000000538E000-memory.dmp

Filesize
56KB

Download
memory/3628-122-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download
memory/3628-120-0x00000000771B0000-0x00000000771C0000-memory.dmp

Filesize
64KB

Download