Overview

overview

8

Static

static

3

2024-05-22...er.exe

windows7-x64

8

2024-05-22...er.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-05-2024 02:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe

  • Size

    4.3MB

  • MD5

    ed3a87eafd5bc16bc86d46c5d0627b7b

  • SHA1

    64267d8958a84fa386ecd7c76776ea1426a0ae27

  • SHA256

    6e6b500282215f414c256b268d605d45129b183b3acfb3b386f6580979e5e388

  • SHA512

    40b9cef634df8e3819d517d915926a172da4809a587d3c5c974dfc66f89c01fe254eb20a4bc5e84d35ae800e02b8dce72c1d3eb8909c624cfdf210d4f9ac1adf

  • SSDEEP

    98304:fO/RG67kIN84klIci68xyDC2YmoieSoaSiHFnI6ts3/:i724kDi6s2YBieS96/

Score
7/10
bootkitevasionpersistencetrojan

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
    evasionspywaretrojan
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1816
    • C:\Windows\temp\986E2DF94E71FE112A1DA666E51EE36B\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe
      "C:\Windows\temp\986E2DF94E71FE112A1DA666E51EE36B\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:1248
      • C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.2.0\au_setup_9FEACF1C-17E4-11EF-A2D1-6A665EE13EB6\startup.exe
        "C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.2.0\au_setup_9FEACF1C-17E4-11EF-A2D1-6A665EE13EB6\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe" /-self_remove -l=ru-RU -xpos=270 -ypos=58 -prevsetupver=21.16.6.467.0.5.0
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:3048
        • C:\Windows\temp\8CA8839A4E71FE112A1DA666E51EE36B\startup.exe
          "C:\Windows\temp\8CA8839A4E71FE112A1DA666E51EE36B\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe" /-self_remove -l=ru-RU -xpos=270 -ypos=58 -prevsetupver=21.16.6.467.0.5.0
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          PID:4080
      • C:\Windows\temp\986E2DF94E71FE112A1DA666E51EE36B\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe
        "C:\Windows\temp\986E2DF94E71FE112A1DA666E51EE36B\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B;1248"
        3⤵
        • Executes dropped EXE
        PID:3444

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

1
T1542

Bootkit

1
T1542.003

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Kaspersky Lab Setup Files\KFA21.16.6.467.0.5.0\kdscrl.rdb
    Filesize

    3KB

    MD5

    79a78149e4ef2e6e09cc061338c7b151

    SHA1

    99505d2461a18f16d4d185603887c60e226347ee

    SHA256

    e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd

    SHA512

    a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e

    Download Submit
  • C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.2.0\au_setup_9FEACF1C-17E4-11EF-A2D1-6A665EE13EB6\dynamic.ini
    Filesize

    4B

    MD5

    e36958bcec33d3c12c6e505707acfedb

    SHA1

    4133ec0e83e4c69b6c0094b47bfd1408f0c8d4c5

    SHA256

    b7f560303ee2cca55615b53fcff87c6ab2c55f9e71a6cea93c61b572213e7075

    SHA512

    a6313c15506f91f41084508420b7072f641df7419d8f280f0307aae9a2fd0c0d4ec3fa60ac10f8ac46e949de6478737727c45bb629dde19a060d905f0beeb7f9

    Download Submit
  • C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.2.0\au_setup_9FEACF1C-17E4-11EF-A2D1-6A665EE13EB6\startup.exe
    Filesize

    4.3MB

    MD5

    17e399ee04b420ba28c8d252cb8f10e4

    SHA1

    ffc9cc3e03764d6ee335226ecc74a1a7333df667

    SHA256

    70ef2156702f2b2c93e2281087b5ba291e00046e8488cdfc234fea08163c3704

    SHA512

    9d61795a2d0289ccc1ee0325119825398d62bcbd6cec41eea25d698018bdaf7353aa547769c0664e999aa7080819c6eeabd80b330c34f760203c5034bfe75db7

    Download Submit
  • C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.2.0\au_setup_9FEACF1C-17E4-11EF-A2D1-6A665EE13EB6\static.ini
    Filesize

    622B

    MD5

    2fbc0b592b02ad301f112d8d2606210c

    SHA1

    55c148b688f6dc13adfe311a706071c238a4acd0

    SHA256

    26f3f704206d5ae9953786e1e22ff52a2513d8e996c050c7649d8823dc4dd8d1

    SHA512

    a3e7d3f198b7f2a68231063992bc3b263bfc018221b8b01aab1d2628b406125d20901a8e8a0108bf192415cb86e802a7342ae747459a5f7971ef7f29cdda1ad9

    Download Submit
  • C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.2.0\kdscrl.rdb.z
    Filesize

    5KB

    MD5

    b43238ae7dbb06a3b839c2dee3a15bcd

    SHA1

    b2655b7d6e75e6705578b5990d139b8e3bdea717

    SHA256

    b15f2121c213e19a799cadc9f397276159ccedad77d6287728ffb89c66db6851

    SHA512

    b8782eab9d1f5be9ee966e87e171724ad933a41ff34ee4747aab4f689b00a3f5790b7f56a22ab580b3c9888235d7a62f99e797bdef582b934619aab06b0a2c50

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\kl.setup.ui.core.dll
    Filesize

    89KB

    MD5

    2c8f5ec07cb84d844e3fdee32b2a8e00

    SHA1

    2e27daffed27a7e6ee3adc50eef1710da318ca32

    SHA256

    8d5bd8184fbc3f79ea9edc2c25e1a5a935514518c3fba89bde308c06722375f9

    SHA512

    ef37109b456a68d55dee8a45340e25cb9901909b30f9f882f62060951bec20d838561dbe5ebe0480aa2feb668c6ffbb2137ed2f69cd3d6337c6f38cf395f6eca

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\kl.setup.ui.dll
    Filesize

    278KB

    MD5

    1bebc399a1b31eabc3361169df0316d1

    SHA1

    56091143fafa680dc65dd5f2b5d6fafa94590041

    SHA256

    894914e74da8c8faf8bb9b34e0f9b586db3cb248c3f6edb715a7cb8c930dd66b

    SHA512

    d0d1fb7e23391a352f6bb3d5756dbbcd5a3558e0c477b265453931940a223dfa31cafe20232a9d08fbb127158bce325dd8b769e7bb62907be89019cd3f02f1ac

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\kl.setup.ui.interoplayer.dll
    Filesize

    56KB

    MD5

    baf69d3c6977161e0c2b631b3f9958d4

    SHA1

    a1b2982c11811c4e5f6bce95f3072a855d11c369

    SHA256

    e6392d0cf3a5984034ca0b346476d7482243550ddd0c65a8c0ff2f03a15867bc

    SHA512

    2fb765d07638d239b666d4043f9ae75e91dc271ddf399dfe5bfd1c894bcabb95e6e965b478f5208687d9ebaa18cdafd6fc3400cd47694fd9db4ac30f3f1d5839

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\kl.setup.ui.visuals.dll
    Filesize

    420KB

    MD5

    6181240bc579d2dfb176a1ca260f5a90

    SHA1

    eb13b6cd4a242c8399396795d1863954b8d79507

    SHA256

    b07c4d99d4cbb62b31a425e60c993b809c7043518a9ef0b7b561abd180a1b768

    SHA512

    f5bb4bdd05836c494a560dc9aa16d62d29b90df7c5854d4a97b8e274890dd1476de955637237867a666c1f08785f5dc06d571e023b124530ee87cf6fdb98689f

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\kl.ui.framework.dll
    Filesize

    264KB

    MD5

    2ad2ab4f8517da8e2efdfed22ad49f1e

    SHA1

    55916e3e5c4c40cf2e5644fbad07baf31459673e

    SHA256

    6efe8efc6701c80d59ad33bd139aeca1b47a27f49d3ccc16ed01a49da9bfc2e7

    SHA512

    12800c7d475af627c98cecb6e6c2de8247094166126978e24bd8be3f7193828781e853ee10b3133c989d625f0e2860ce4551369d864748b70db4ec220c515bbd

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\kl.ui.framework.localization.dll
    Filesize

    283KB

    MD5

    079ac68d4beb2ab9602d754b09ff652b

    SHA1

    90032834cc5cffd0b00119e4e38b5f4c5f877e4c

    SHA256

    9377c35b19c30ee75c010b1e592796daf1d3493b397ef9d61a1c63a5ab30a88e

    SHA512

    53782adc516950888ec69b21e744fe4d7f8567223e7c067e362800c78e3621dc148d5aa19f6011962bece1ada3691ef1ef40838a8072480c54aeedb2f4e0c9b9

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\kl.ui.framework.uikit.b2c.dll
    Filesize

    631KB

    MD5

    445e34aa976419cae54e13ede8d41ce5

    SHA1

    98ca3ee808f97ae16970b0fcefd3387bd07278eb

    SHA256

    a255bb5dfaa685d7443dbc8bb7fca71417c8f0b1f617ade7077ee437a23a9b24

    SHA512

    86b4084cf781d4efbb814fce3ed6ca48addbf4c15c5ed3630673350cf65056a80e2a9bc00581a45ae370a64f0bc720d506622eccd9d7ef170814faab1cce14c4

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\kl.ui.framework.uikit.dll
    Filesize

    2.7MB

    MD5

    18defb1e3b7460f592a8ca61e4b40ff0

    SHA1

    8f8f7d7d1ee8a048d162603cc21a0f4c40b9036b

    SHA256

    02a884babc5584fec80b227eb1c52dc800c516f1117ff9637617ad84c632da9d

    SHA512

    7cbdc0c113a0c7ff9628674a8a23f4224290455d4a9a41a66889d01baf1f28b0175197c3078a791ecf6b2052c3fdfc35cf38cfae5bf5917bde80f82499d40b12

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\0B31249A4E71FE112A1DA666E51EE36B\setup.dll
    Filesize

    5.6MB

    MD5

    3278c1155c263b1feed37a4485e07464

    SHA1

    25c405c0c4b39b3542874bdd927db147caa4a645

    SHA256

    c3794a5439c3b67facfde818d9f08ef9913c08fca2fe658f84bc22133ce1711b

    SHA512

    da08c6ea3e994ad452a6343a1f3029fff5dc122421b8a7006762a357e94691efb1c21f3e5a39635d64b82b49290227ba9524cf7b8b12f572ff3cc8e9aebc0145

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\System.Windows.Interactivity.dll
    Filesize

    39KB

    MD5

    3ab57a33a6e3a1476695d5a6e856c06a

    SHA1

    dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

    SHA256

    4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

    SHA512

    58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\kl.setup.ui.core.dll
    Filesize

    89KB

    MD5

    78fb3f1e9f69beca863af1ff7713249c

    SHA1

    65e00f042db34b385d9bfd0100a3b13efd79df5e

    SHA256

    323aa8d8707a030bf245d6031b7fb439c929a3a24c5621a03276114691e45aac

    SHA512

    79bcfa36dfb3b1a6e04d06a5d85fce6574831d5684ae55c9e08784ee6a585bde5c649438103d40edd85da3bb8fd1d27b00be16fd421d32502da3587468ee8ced

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\kl.setup.ui.dll
    Filesize

    279KB

    MD5

    bb9df6ed16bad5bbcde9b106e11dff6f

    SHA1

    5a18c06282442a241e42ea45eb636cc77bf7d95c

    SHA256

    dc5f2821548e5a660fc920224846994da0169972f18a15e04fc9943a6a08f734

    SHA512

    12d3c0ec2cc0224614cd8dcc81bb0f5610a0b836420628722d3409775f1c186b9d7cadb9a61bf5ce5f5ae1c99fa408ad14900f7f8b83c0b5073180786f9123a6

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\kl.setup.ui.interoplayer.dll
    Filesize

    56KB

    MD5

    a54a9d1185edd71b120010d131f0dbea

    SHA1

    e24ebb90da9840cb2b813bac4409c9525258d864

    SHA256

    a7d59379fdfa59c21b114b087b16028480f976efa12e3a197fff3729f28f3bb3

    SHA512

    c16e90afa3c9d49c6fb8af03e027e927c6ae582f28ffd6cbcb79178a47346327bef6ee8791cc0c04643ca7204c964c19c270f6c8609f1225bdcaf7d5f3c94c49

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\kl.setup.ui.visuals.dll
    Filesize

    417KB

    MD5

    5bcc51f3bb85949e37ffc08cf1501f70

    SHA1

    f2d6067c3084e5c0af33b6e4bb9837b3f05a8f83

    SHA256

    fdcbe09d8c6ee7681e88bbf7bbcc6c87f089d034e00df6a422c3482f4a99a2bd

    SHA512

    950d8bf52222c1ba6c5173b3a9385737b4b414a259d72adee921b524b790113f473e00b5961972b19ad5dd2349fc1ba5c7b3541086c5b93a11238992a0e3c8a5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\kl.ui.framework.dll
    Filesize

    235KB

    MD5

    aeb7ba2ce5574025a985313bdde99cfb

    SHA1

    7e7d4d90a11c317c5d3b5065d47ef4209296cdaa

    SHA256

    92d7b5ad2e92e72804223e71cde8350ba7f0561e5e1b8c0002ce88e3e88f6ef0

    SHA512

    bd0aa5b5ac94076d6d6607cf704bcd89cabf43d3f99042fee8b653a0674c315ac9e464f0aef091998152f6b107a47034b541021efaf759bf250f6f99a91ba572

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\kl.ui.framework.localization.dll
    Filesize

    281KB

    MD5

    ccf2531b77412b4eb5410888bd3eeb42

    SHA1

    ccc53ff2ac5b21d2a026b9f3431a016aee08dcb6

    SHA256

    170a04a3141b1c4f2606c3ba78d687972db6319d85d7a45f59958cc9f1fd05bd

    SHA512

    6eefd54ed14076cbd391e95817ce53c4bf69bae7d3c6f75f682d8e26f236cb2e4b9153c54fe358e1f833e9661cdc010686a2a5136fa70d77ca7f81cd59e32909

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\kl.ui.framework.uikit.b2c.dll
    Filesize

    543KB

    MD5

    fb389c9c3c063163f5609608405f66bc

    SHA1

    0d2d249335b82941aaa7aeb58947c12cadf04ff8

    SHA256

    7e97138fe069a260a05bad7beddc31fc54d0909f36728ab0efa761e7580393df

    SHA512

    c169b1e6fecd432517f58bac541820c4fde5fefd847b9dd4544d290f95334b8fc392b26cd02eebeb30aaddb87885bd35b1f0c46644b1e5b9e9c84115afebf0f7

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\kl.ui.framework.uikit.dll
    Filesize

    2.5MB

    MD5

    7076c5eb43353580a88554a458c393dc

    SHA1

    74d9ec58d4ef5d0a7a69fe6500b47c6873ed87ba

    SHA256

    294055db0edebad0b62f5690d65c401ff3c859bb2ce913c7840142ea344f0f24

    SHA512

    81c88f67e55c415a5fe48c07d020069cd494c7eaafb8c79475093121121d7360c9a72e79f9f64c6700f4a90a923ae876064d0a942c2cda3a6914c1b07a218515

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\setup.dll
    Filesize

    5.6MB

    MD5

    986033838280c8d36c4fcc14b03caa35

    SHA1

    ac082f683dbbf4537dccee380b802055b2cf60df

    SHA256

    42abfb0fd3d1fba8832f5eb2aa0e0d42a10b60f4a033c1b3838668287a4e88d6

    SHA512

    4245f331953fd6661d75349e229e012fdce8fdf85de5f3666468f9b6198d678292ecd1970a6eb0101c02c3609d2116d7a609b9341509478de1b4e03c9614d65e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\sharpvectorconverterswpf.dll
    Filesize

    137KB

    MD5

    ca5e6167b66c384f62e56fe0e1757af3

    SHA1

    4d8912deab579d0ad3bfa7477f7377d03260ec1f

    SHA256

    a9edc78bc8dd9e6ab098c96d2f26949bf8cc7c1f1071c5d96154022dac685979

    SHA512

    53d2828ea80ba1c9726240859c42deddf3b384bfdc173763804d5c0e59bc531de519720c8f396cba3851768be14ebed5f8f6ed501d2a99055f2abab9c920ce5a

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\sharpvectorcore.dll
    Filesize

    201KB

    MD5

    f6004bd10ff1bced912d389a48138323

    SHA1

    349d4f7bb69dec14ce5051c1ce4d7aaf33ce9ab8

    SHA256

    fa2c2216181125daaf69ce4c7e2addc9df98e09845a27292b9775ff8d568ac39

    SHA512

    550af5c8d54f4987a7c05347c9fa21a6cac5817ed410c5f9358bed6d13648c0c55be2426ea3b221f82b635e91f2a2c505f07703ae93392754c870853073536d5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\sharpvectorcss.dll
    Filesize

    109KB

    MD5

    25e40483458b8083eb12d38b6cead136

    SHA1

    9158642854dcdc9b2610272e181d98526b3547cc

    SHA256

    1a87d710b34b187f75e9213c95ab5eb129da63906f122035e7badf7044c929c9

    SHA512

    381ba47f815cfc4fe665913a49f8e53121dcad53c8e63ffc3d61663a2b5db0fc3fb2e3e8784fe5a0fd058ccb0687317c11e01debf4c596795f7cae5fd45dcadb

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\sharpvectordom.dll
    Filesize

    55KB

    MD5

    b97a47906b78413d18249eaa15c0933b

    SHA1

    ccf1951838e20c52cdc440cea34f88101310dbb3

    SHA256

    5fd8cfbe80ec610463ab092b74e2c22b2651f30dd0660849d09210e70eca7254

    SHA512

    b490641ca358c270e77e587c5ecff4ad60848384348603d576212e4da133d30087aa32ed11037d19de8f3f6777711255f5a6a9a66ddfa0abb87d893d72619af5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\sharpvectormodel.dll
    Filesize

    997KB

    MD5

    ff09404438a1aaf5bafa792a504e7631

    SHA1

    7e78ad564aba274bf70c5320e39ae5061b30572a

    SHA256

    ccf8359d7862330ebb1dd0a5f50b9e12e43b1763ef64cde5417960774d1dcf11

    SHA512

    8b90210aa69b69b9e4e06a721a444ca9e50bcb87648fffdd2f47f2056ad52c55a2228547c45757a804b3b76ced8bf8899918f5c4a23f2139061bdff1dcf23db5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\sharpvectorrenderingwpf.dll
    Filesize

    203KB

    MD5

    619044935bd3151b6d1fef1e06ce5323

    SHA1

    f5d5e2b4171465ef022ed85ea7ff1e70c7b2a581

    SHA256

    5b6dc4ff32972e022a3a457d319ffc756c915b8f9be4fa62a550f2e361aca5f2

    SHA512

    d5f4cc32d6ccecd4accdb78913badc5190adea1df1e173d5b47ef2c522cadf4d2f198deb25440aa1360c03ba90fe734f3f8a3b63b38e7b7c54b8d3ecaad06cd4

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\91FCAEF94E71FE112A1DA666E51EE36B\sharpvectorruntimewpf.dll
    Filesize

    69KB

    MD5

    cef0c0a808a94ef99fc4dc3472691a21

    SHA1

    637ea1d4def4e840d73af915d0118db2c8c9f2bc

    SHA256

    186fb849e9284fda5ed5ea84b1bb7a73b4321afa063df2fa4812b7f0dd857761

    SHA512

    0f764d85f76fe2fdcf094120f379e0841b74f710b6857722687334bd7a01329d79ab653e825c323110c9e67999429c70efe2c213b7a6a77d1d939f1829f5ad67

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\GuiStrings.loc
    Filesize

    22KB

    MD5

    09c4e9f41c4b8bfdb6bf8916af730ecd

    SHA1

    a215913aa718b459d8e3c13dfd22e5246dcff38c

    SHA256

    57bf969d3c10d5be0a4b31b8e530c1e005622c8dc809ee4fbd4c214f3b3e9a37

    SHA512

    7767639c5e068fd3e83a527dfce0345c902673e50102a6c5ba3998ffa2d16f0417a74bee15fce9b6825eabe94f6d36c4528cc70c4541294415b26b9f0f64937e

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\GuiStrings_KFA.loc
    Filesize

    3B

    MD5

    ecaa88f7fa0bf610a5a26cf545dcd3aa

    SHA1

    57218c316b6921e2cd61027a2387edc31a2d9471

    SHA256

    f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

    SHA512

    37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\GuiStrings_ru-RU.loc
    Filesize

    56KB

    MD5

    e537843eea492ad205e49f434641708a

    SHA1

    e37ce9708261c4f144b67c2075c8c5ee36291274

    SHA256

    d6efc6134a0dcd65959341962e55633525ed0bdf48de7a9ceb7933eaec44321b

    SHA512

    ceb12dd551d848d768516dd6cd8a8624a39d22ca9bc1cc9439657c4e5edea7e4cb1438c54b60ff8653908395670102e7377000b1123824b84a55e6b43be02970

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\GuiStrings_ru-RU_KFA.loc
    Filesize

    732B

    MD5

    b7902cb23b80b84f5cf8e1444e1c6683

    SHA1

    847a1d98df8dd5237aa8562b28984cff6b2fe155

    SHA256

    54b4bbab13686976afa58916170cbce73c81bb3740f3a279bcfd318bb16a6c93

    SHA512

    b452ca8c689c4c23d64859c41555ed9ee5f24ec70f03e9c6c62e7e0d6db05a143c84a0589daed4114dd16d5b9b02fa2d5b6adf7a5bb4aade7eb35e96abbcf81c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\downloader_neutral.ini
    Filesize

    18KB

    MD5

    1224967a336a831fc3d44d58bb3b471e

    SHA1

    14b50d80646db3b078fe3cd98bd376a8421c52d1

    SHA256

    20019da9afbee4e3e2a9a1f9d32ad53dd4e3bc23368fc8e5e5f77758026f812a

    SHA512

    388b8ef1148fc7b1be8fde2faad7e6c95f563d7ca8ba8d200cdc82ce27c92b956a2896e3972a7f5518e80d93c2ee943f4abb1b0930dc7d56dc76c344ef893703

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\downloader_neutral_KFA.ini
    Filesize

    1KB

    MD5

    2e10b2d4181d2f07d2dd305bd4285bd5

    SHA1

    9c05f3e03bae36da24a62b08729074cd12b0077e

    SHA256

    cbb72cdc1e461226c7d0e49e7ef955f77dfeef4f7fe12d0d8a8d0cf9658edc78

    SHA512

    a1bae84b8a9c0833bbadf29d4532b64f0216d7c1c13be2b4ebb75dd4d2b18244eb67fee52743745ed0a5818e745cb9aae9a8bfdc415ff59ee8aa7de77f122819

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\downloader_ru-RU.ini
    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\downloader_ru-RU_KFA.ini
    Filesize

    228B

    MD5

    7779fd995969e9fa9eaf7a4726d1a11d

    SHA1

    1d9d8f9a9ca13affd712f09241c8a0ab6e5e5e0e

    SHA256

    ab597eab4bd1bdcfc150e793b3e9c32bf9134e6ba5f6a0dac2bf8fe421c58356

    SHA512

    919f10e01eb4f66fc4cd48b493d08843dfa8c451b1d7f651570755fa3d6734439cdc332fec6bf1b53a29242cf1ef8a64c432fb56233c04ca362c57c2a0106727

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\html\yandex-logo.png
    Filesize

    10KB

    MD5

    799d56127b9caf682da75955b17148cb

    SHA1

    3ce8f4ee0a252aa5ec3207596ede45a164e2d70f

    SHA256

    1f9bbad0dacaab3b0ad5da494ce69cd4eb042aeecd5a33842f5f5523fc651b65

    SHA512

    544582c7fbaebb295c447e32e56ababc33f3b05c344039cdad4d11c98f0db27d3e50caab3efd0d20c8c588789da88a7a75cf4ea1db90fdb68c1c15bc5cae7772

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\9FEACF1A-17E4-11EF-A2D1-6A665EE13EB6\mykasperskyfeatures_ru-ru.txt
    Filesize

    8KB

    MD5

    a38563bc8e31f082e2d8fe9124c83973

    SHA1

    01f77a024b4a128520ba62b0b13108c15a71bf45

    SHA256

    f1ac5f177a4183463b655c7eb1afbac13c5955ceec1a512d16a89c9d77fc931e

    SHA512

    4b5ebb658e5d1ee04310f926b37765f7b6e658f6a66687ece3b935cbe2e3ce2d60f33bc57881a70db9e669b8174881db14d28da004db4a3c06196355a07f9f3c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\discovery.cfg
    Filesize

    30KB

    MD5

    3fa19a8557ed744aec4ef2ec5a811cc6

    SHA1

    e1b9fd36e09a08288faeab2b118cdec6cc0f6af8

    SHA256

    d49e70514b13ea14956073482d1e763a538e5ffbd48e0ffade7daf558fdfa74a

    SHA512

    38f1cd871001dd1a3d8e7e07a28a6e696d6dfdabe0b1ef9bb94f7886e0dd0f344a6b17729938699652eed0009d6e60ba677037bd5826e309be1adb4879207efb

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\discovery.cfg
    Filesize

    30KB

    MD5

    0791a1abf0cf4e7f36d2637f24dad244

    SHA1

    8928899ce4fb63b9dcf960f84d3b92d7d3c2b547

    SHA256

    35deae832278c47afbcb6e8c940f5bfc66d5b3fceba6ef6c2411b2c5065a70eb

    SHA512

    9e507bcd5054d9952319ea0795fd796f6915263a3251db10b632df6eacdf419d5f1c101f91cb9d39768f07fea3af1156af10e5b34792bf9378da840f78a30613

    Download Submit
  • C:\Windows\Temp\986E2DF94E71FE112A1DA666E51EE36B\2024-05-22_ed3a87eafd5bc16bc86d46c5d0627b7b_avoslocker.exe
    Filesize

    4.3MB

    MD5

    ed3a87eafd5bc16bc86d46c5d0627b7b

    SHA1

    64267d8958a84fa386ecd7c76776ea1426a0ae27

    SHA256

    6e6b500282215f414c256b268d605d45129b183b3acfb3b386f6580979e5e388

    SHA512

    40b9cef634df8e3819d517d915926a172da4809a587d3c5c974dfc66f89c01fe254eb20a4bc5e84d35ae800e02b8dce72c1d3eb8909c624cfdf210d4f9ac1adf

    Download Submit
  • memory/1248-94-0x0000000007AF0000-0x0000000007B58000-memory.dmp
    Filesize

    416KB

    Download
  • memory/1248-89-0x0000000007430000-0x00000000076B8000-memory.dmp
    Filesize

    2.5MB

    Download
  • memory/1248-158-0x0000000008090000-0x00000000080A2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/1248-150-0x0000000006510000-0x000000000652C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/1248-164-0x000000000D080000-0x000000000D0B8000-memory.dmp
    Filesize

    224KB

    Download
  • memory/1248-165-0x000000000C120000-0x000000000C12E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1248-142-0x00000000064C0000-0x00000000064F2000-memory.dmp
    Filesize

    200KB

    Download
  • memory/1248-146-0x0000000008610000-0x000000000870A000-memory.dmp
    Filesize

    1000KB

    Download
  • memory/1248-52-0x0000000005F50000-0x0000000005F96000-memory.dmp
    Filesize

    280KB

    Download
  • memory/1248-331-0x0000000074460000-0x0000000074C10000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1248-48-0x0000000074460000-0x0000000074C10000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1248-138-0x00000000062E0000-0x0000000006372000-memory.dmp
    Filesize

    584KB

    Download
  • memory/1248-132-0x00000000080D0000-0x0000000008104000-memory.dmp
    Filesize

    208KB

    Download
  • memory/1248-45-0x00000000039E0000-0x00000000039EE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1248-202-0x0000000074460000-0x0000000074C10000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1248-491-0x0000000074460000-0x0000000074C10000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1248-154-0x00000000064A0000-0x00000000064AE000-memory.dmp
    Filesize

    56KB

    Download
  • memory/1248-41-0x000000007446E000-0x000000007446F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1248-53-0x0000000074460000-0x0000000074C10000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1248-195-0x000000007446E000-0x000000007446F000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1248-137-0x0000000006210000-0x0000000006232000-memory.dmp
    Filesize

    136KB

    Download
  • memory/1248-77-0x0000000006850000-0x000000000688C000-memory.dmp
    Filesize

    240KB

    Download
  • memory/1248-120-0x0000000007C80000-0x0000000007C90000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1248-113-0x0000000074460000-0x0000000074C10000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1248-7-0x0000000077E20000-0x0000000077E30000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1248-104-0x0000000007BF0000-0x0000000007C78000-memory.dmp
    Filesize

    544KB

    Download
  • memory/1248-11-0x0000000077CC2000-0x0000000077CC3000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1248-93-0x0000000074460000-0x0000000074C10000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1248-81-0x0000000006CE0000-0x0000000006CF6000-memory.dmp
    Filesize

    88KB

    Download
  • memory/1248-9-0x0000000077E20000-0x0000000077E30000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1248-8-0x0000000077E20000-0x0000000077E30000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1248-323-0x0000000074460000-0x0000000074C10000-memory.dmp
    Filesize

    7.7MB

    Download
  • memory/1248-85-0x0000000007150000-0x0000000007196000-memory.dmp
    Filesize

    280KB

    Download
  • memory/1816-3-0x0000000077CC2000-0x0000000077CC3000-memory.dmp
    Filesize

    4KB

    Download
  • memory/1816-2-0x0000000077E00000-0x0000000077E10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1816-0-0x0000000077E00000-0x0000000077E10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/1816-1-0x0000000077E00000-0x0000000077E10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3048-203-0x0000000077CC2000-0x0000000077CC3000-memory.dmp
    Filesize

    4KB

    Download
  • memory/3048-192-0x0000000077E00000-0x0000000077E10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3048-193-0x0000000077E00000-0x0000000077E10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3048-194-0x0000000077E00000-0x0000000077E10000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3444-490-0x0000000077E30000-0x0000000077E40000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3444-489-0x0000000077E30000-0x0000000077E40000-memory.dmp
    Filesize

    64KB

    Download
  • memory/3444-488-0x0000000077E30000-0x0000000077E40000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4080-210-0x0000000077CC2000-0x0000000077CC3000-memory.dmp
    Filesize

    4KB

    Download
  • memory/4080-316-0x0000000007CA0000-0x0000000007CB2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/4080-322-0x000000000BC60000-0x000000000BC68000-memory.dmp
    Filesize

    32KB

    Download
  • memory/4080-312-0x00000000078F0000-0x000000000790C000-memory.dmp
    Filesize

    112KB

    Download
  • memory/4080-314-0x0000000007790000-0x000000000779E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/4080-310-0x0000000007D50000-0x0000000007E4A000-memory.dmp
    Filesize

    1000KB

    Download
  • memory/4080-308-0x00000000078B0000-0x00000000078E2000-memory.dmp
    Filesize

    200KB

    Download
  • memory/4080-306-0x0000000006100000-0x0000000006122000-memory.dmp
    Filesize

    136KB

    Download
  • memory/4080-304-0x00000000060C0000-0x00000000060F4000-memory.dmp
    Filesize

    208KB

    Download
  • memory/4080-294-0x0000000007910000-0x00000000079AE000-memory.dmp
    Filesize

    632KB

    Download
  • memory/4080-288-0x0000000007800000-0x000000000786A000-memory.dmp
    Filesize

    424KB

    Download
  • memory/4080-286-0x0000000006F40000-0x0000000007200000-memory.dmp
    Filesize

    2.8MB

    Download
  • memory/4080-283-0x0000000006C30000-0x0000000006C78000-memory.dmp
    Filesize

    288KB

    Download
  • memory/4080-279-0x00000000068C0000-0x00000000068D6000-memory.dmp
    Filesize

    88KB

    Download
  • memory/4080-275-0x0000000006710000-0x0000000006752000-memory.dmp
    Filesize

    264KB

    Download
  • memory/4080-265-0x0000000005B20000-0x0000000005B66000-memory.dmp
    Filesize

    280KB

    Download
  • memory/4080-259-0x0000000003490000-0x000000000349E000-memory.dmp
    Filesize

    56KB

    Download
  • memory/4080-206-0x0000000077E10000-0x0000000077E20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4080-207-0x0000000077E10000-0x0000000077E20000-memory.dmp
    Filesize

    64KB

    Download
  • memory/4080-208-0x0000000077E10000-0x0000000077E20000-memory.dmp
    Filesize

    64KB

    Download