f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d

Analysis

max time kernel
435s
max time network
438s
platform
windows11-21h2_x64
resource
win11-20240709-en
resource tags

arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
submitted
25/07/2024, 16:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

startup.exe
Size

4.3MB
MD5

5aad72df3124c0114273a68064b10835
SHA1

a29b8a22b34b417b8a63a6321535b535708ec66b
SHA256

f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d
SHA512

5da9d1cef6ff4f8514118c92fd36e321fab3b527a24651ff8481cb7da01f7fbd3cff1a4afde5ab395dd8933f9a32eb088f73a56e81b8f63880f3f5fda15d2c3a
SSDEEP

98304:Apq/d8kCBWlMyQjujDW9tBcg2jGqwwArl6zwRGaTfdQ5ekB3tiXn6:hcV5ujyp8jGqww2l6wRGaTfmfNtmn6

Score

7^/10

bootkit discovery evasion persistence trojan

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
1744	startup.exe
1336	startup.exe
3920	startup.exe
4676	startup.exe

Loads dropped DLL 64 IoCs

pid	Process
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
1744	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe
3920	startup.exe

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	startup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	startup.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	startup.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\VBoxMiniRdrDN	startup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	startup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	startup.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	startup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	startup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	startup.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 1744	3724	startup.exe	81
PID 3724 wrote to memory of 1744	3724	startup.exe	81
PID 3724 wrote to memory of 1744	3724	startup.exe	81
PID 1744 wrote to memory of 1336	1744	startup.exe	83
PID 1744 wrote to memory of 1336	1744	startup.exe	83
PID 1744 wrote to memory of 1336	1744	startup.exe	83
PID 1336 wrote to memory of 3920	1336	startup.exe	84
PID 1336 wrote to memory of 3920	1336	startup.exe	84
PID 1336 wrote to memory of 3920	1336	startup.exe	84
PID 1744 wrote to memory of 4676	1744	startup.exe	85
PID 1744 wrote to memory of 4676	1744	startup.exe	85
PID 1744 wrote to memory of 4676	1744	startup.exe	85

C:\Users\Admin\AppData\Local\Temp\startup.exe
"C:\Users\Admin\AppData\Local\Temp\startup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\temp\C549DC4F8AA4FE119AFCA5B12E77DC76\startup.exe
  "C:\Windows\temp\C549DC4F8AA4FE119AFCA5B12E77DC76\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\startup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:1744
- - C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.321.0\au_setup_F5020A8A-4AA8-11EF-A9CF-5A1BE277CD67\startup.exe
    "C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.321.0\au_setup_F5020A8A-4AA8-11EF-A9CF-5A1BE277CD67\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\startup.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\startup.exe" /-self_remove -l=fr-FR -xpos=270 -ypos=54 -prevsetupver=21.17.7.539.0.75.0
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\temp\5225BADF8AA4FE119AFCA5B12E77DC76\startup.exe
      "C:\Windows\temp\5225BADF8AA4FE119AFCA5B12E77DC76\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\startup.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\startup.exe" /-self_remove -l=fr-FR -xpos=270 -ypos=54 -prevsetupver=21.17.7.539.0.75.0
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks whether UAC is enabled
      System Location Discovery: System Language Discovery
      PID:3920
- - C:\Windows\temp\C549DC4F8AA4FE119AFCA5B12E77DC76\startup.exe
    "C:\Windows\temp\C549DC4F8AA4FE119AFCA5B12E77DC76\startup.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76;1744"
    3⤵
    - Executes dropped EXE
    PID:4676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.321.0\au_setup_F5020A8A-4AA8-11EF-A9CF-5A1BE277CD67\dynamic.ini

Filesize
142B

MD5
d815a348f721b02625eb84afcc345d6e

SHA1
6bb66b9a62a5dc9bf1233e858c38d5e41ef1eaf7

SHA256
b3161f45d5806508ffea8a1b1f6168d8287c038ffce451f6517a5f79fcf8f88e

SHA512
fd2c2cd29c849e47d364e11446a68132e4892d077ca00106fe9ac603ee0b16fb0b778d58ca62a41c1345d55dfd6434cdb3feb6247224b92837731cadd76cf68e

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.321.0\au_setup_F5020A8A-4AA8-11EF-A9CF-5A1BE277CD67\startup.exe

Filesize
4.3MB

MD5
8e11e449e5e6e112ec4096f4d7094bf5

SHA1
70badfe008f078c2262e436c56a0f189c62e4691

SHA256
929fa744f639d5dc148d96e9f1a0d0f9c603584a7e6cbfeea719a7ad86fe0002

SHA512
be2fa0e957ea4b53024599456ccf54ffe06d17ffa176447e7e6abb17378681fddffde17c8f711689fdb190582f729748b160bd82b27bfbfe4a5b865717a0b4ad

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.321.0\au_setup_F5020A8A-4AA8-11EF-A9CF-5A1BE277CD67\static.ini

Filesize
582B

MD5
ead60c1d3055bd5acb718adcc4252b33

SHA1
dcee3a2e100020612c4c51bb8f6899b4e8a041f3

SHA256
dca00ca0c0279b3beef4b9fc61ded7631673deec84452273a2453be9a1b9a08a

SHA512
94b913b7fe94709f9ac2441a378afbb5eb2091eef67f43cae881c9c8729e70e2bc8e9f29d09be407f12b4b009c7d7ddb51b06e3f699b8fffc690a8bc99c00c31

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.321.0\kdscrl.rdb.z

Filesize
5KB

MD5
f0f9ff7ad4dc83a2d90d3e48520722d8

SHA1
981927cf5f8812fc63266e95405b1c871529a641

SHA256
75a6ec35a339d064d6b2ca342dadb5ea24c7e4751c758cfab2f1a73e1d564a4c

SHA512
54629396adc6ea3366d5fd0a0d078fd25e54e43e0df448eadfaba43afd27267dc4557357f9dc87263b75a662b9421954ec570eca5467db08848d6f621c525fd3

Download Submit
C:\ProgramData\Kaspersky Lab Setup Files\KFA21.17.7.539.0.75.0\kdscrl.rdb

Filesize
3KB

MD5
79a78149e4ef2e6e09cc061338c7b151

SHA1
99505d2461a18f16d4d185603887c60e226347ee

SHA256
e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd

SHA512
a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0B532F86F8BFE69BA8D4B6BCF6B9C594

Filesize
318B

MD5
71bece9b4bcb0e538f43833e90ce8ab1

SHA1
de143e22f8681f3cb65e80afca279d1f1088745b

SHA256
c16cc2aebaf548f45f31127e0884f2f9c1f20f6397e233b62987e1421690aeca

SHA512
dacd8c3a83e776e92ed3f41a5d5a819286b3eabbe6aa185f9b1aeced692b4e4ba4927861b3ab5a91bc7b6496bf7049af8279df83b1c632aa7f70c074eeb4cb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\66722EDF8AA4FE119AFCA5B12E77DC76\setup.dll

Filesize
5.5MB

MD5
4aa1564586c4595889750d22df0d5678

SHA1
89051a7f1021278b7826e177f27f6344bb06c10d

SHA256
a405d44b3eb79276b1dad1232632464e97814a8ac9da8d969adc7b97632d933d

SHA512
5ef9fdf9092fb8cdd884a86a4536962288a3c41d484cd9664c04db1d4465a71677cda87f41bd31bb9a502b93f77c45c5b1d1163e0da1f7423a8aa5d3213496e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\kl.setup.ui.core.dll

Filesize
89KB

MD5
2c8f5ec07cb84d844e3fdee32b2a8e00

SHA1
2e27daffed27a7e6ee3adc50eef1710da318ca32

SHA256
8d5bd8184fbc3f79ea9edc2c25e1a5a935514518c3fba89bde308c06722375f9

SHA512
ef37109b456a68d55dee8a45340e25cb9901909b30f9f882f62060951bec20d838561dbe5ebe0480aa2feb668c6ffbb2137ed2f69cd3d6337c6f38cf395f6eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\kl.setup.ui.dll

Filesize
278KB

MD5
1bebc399a1b31eabc3361169df0316d1

SHA1
56091143fafa680dc65dd5f2b5d6fafa94590041

SHA256
894914e74da8c8faf8bb9b34e0f9b586db3cb248c3f6edb715a7cb8c930dd66b

SHA512
d0d1fb7e23391a352f6bb3d5756dbbcd5a3558e0c477b265453931940a223dfa31cafe20232a9d08fbb127158bce325dd8b769e7bb62907be89019cd3f02f1ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\kl.setup.ui.interoplayer.dll

Filesize
56KB

MD5
baf69d3c6977161e0c2b631b3f9958d4

SHA1
a1b2982c11811c4e5f6bce95f3072a855d11c369

SHA256
e6392d0cf3a5984034ca0b346476d7482243550ddd0c65a8c0ff2f03a15867bc

SHA512
2fb765d07638d239b666d4043f9ae75e91dc271ddf399dfe5bfd1c894bcabb95e6e965b478f5208687d9ebaa18cdafd6fc3400cd47694fd9db4ac30f3f1d5839

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\kl.setup.ui.visuals.dll

Filesize
420KB

MD5
6181240bc579d2dfb176a1ca260f5a90

SHA1
eb13b6cd4a242c8399396795d1863954b8d79507

SHA256
b07c4d99d4cbb62b31a425e60c993b809c7043518a9ef0b7b561abd180a1b768

SHA512
f5bb4bdd05836c494a560dc9aa16d62d29b90df7c5854d4a97b8e274890dd1476de955637237867a666c1f08785f5dc06d571e023b124530ee87cf6fdb98689f

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\kl.ui.framework.dll

Filesize
264KB

MD5
2ad2ab4f8517da8e2efdfed22ad49f1e

SHA1
55916e3e5c4c40cf2e5644fbad07baf31459673e

SHA256
6efe8efc6701c80d59ad33bd139aeca1b47a27f49d3ccc16ed01a49da9bfc2e7

SHA512
12800c7d475af627c98cecb6e6c2de8247094166126978e24bd8be3f7193828781e853ee10b3133c989d625f0e2860ce4551369d864748b70db4ec220c515bbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\kl.ui.framework.localization.dll

Filesize
283KB

MD5
079ac68d4beb2ab9602d754b09ff652b

SHA1
90032834cc5cffd0b00119e4e38b5f4c5f877e4c

SHA256
9377c35b19c30ee75c010b1e592796daf1d3493b397ef9d61a1c63a5ab30a88e

SHA512
53782adc516950888ec69b21e744fe4d7f8567223e7c067e362800c78e3621dc148d5aa19f6011962bece1ada3691ef1ef40838a8072480c54aeedb2f4e0c9b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\kl.ui.framework.uikit.b2c.dll

Filesize
631KB

MD5
445e34aa976419cae54e13ede8d41ce5

SHA1
98ca3ee808f97ae16970b0fcefd3387bd07278eb

SHA256
a255bb5dfaa685d7443dbc8bb7fca71417c8f0b1f617ade7077ee437a23a9b24

SHA512
86b4084cf781d4efbb814fce3ed6ca48addbf4c15c5ed3630673350cf65056a80e2a9bc00581a45ae370a64f0bc720d506622eccd9d7ef170814faab1cce14c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\kl.ui.framework.uikit.dll

Filesize
2.7MB

MD5
18defb1e3b7460f592a8ca61e4b40ff0

SHA1
8f8f7d7d1ee8a048d162603cc21a0f4c40b9036b

SHA256
02a884babc5584fec80b227eb1c52dc800c516f1117ff9637617ad84c632da9d

SHA512
7cbdc0c113a0c7ff9628674a8a23f4224290455d4a9a41a66889d01baf1f28b0175197c3078a791ecf6b2052c3fdfc35cf38cfae5bf5917bde80f82499d40b12

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\setup.dll

Filesize
5.5MB

MD5
0aa12d4ad90f02f8dd6e90df9d3ebc12

SHA1
8d0f0b39725799a80afda7e9d07ffbffed0e39e5

SHA256
03c2e0033b5e56335d735c46eb529825437c7cd922d34dda011e92589753b059

SHA512
6aef22c54d7c3457d4c03e3eb4df801f7901d38035cf52f4cb4d778a636f6f8b629a496ded708a326a3e762065ea39db774af94c6142983e08131916531b60e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\sharpvectorconverterswpf.dll

Filesize
137KB

MD5
a56a73b39703d5ff85b5cf12f9b00009

SHA1
e6448c87f969e19ae4c6514d69d8286d26a2b5db

SHA256
bb5966185017d904d2d7fd952bcc6d5c19fdf6bbbe34ab29c63a3784cd1074c7

SHA512
7fa07a1fcc0735186ee71b3c123b1c4076f04dba5ad319588ea695ef117ab7c39918593e4ee42f18cbd3fe01d043e896981ca6f07293fc2fb0a9bce5d66992b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\sharpvectorcore.dll

Filesize
201KB

MD5
24e3b7177eeabdf085a01796b49c8e55

SHA1
6916a0bb98892252f59692fd0405e6da62af0f8b

SHA256
eab963926cf2d62b575c6f33804372fea04db328b2b3f0adfb45fee3f27e5386

SHA512
5e377e609673f3d84e22d070012578b8a18fce848a3815d9da05e10043d3e9fde8070094d1841acb44a4f876d8741e371a5fbcc86cce80cdf826131370a41e64

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\sharpvectorcss.dll

Filesize
109KB

MD5
726d04bbe783a3510b18a491adac05c0

SHA1
11a01c68204dd80b32c01dcdb2e51f5b0ee34d98

SHA256
639e091c9e87986eaf9fe00f0f401834e14878ebc48084697fd4307713a065ca

SHA512
90592ddef83b6640cf8f28f0818098f95acc4139c7b3f5e8afa63bb873530be1613d42ee02dae12160737ee612187fc0139e19ee4a7f1abb3fec1fcaee1ae297

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\sharpvectordom.dll

Filesize
55KB

MD5
e4f6efef27708458ecda4ee22edf3cef

SHA1
07ccb5fa980dead816737ad83802cbfed18e4a4f

SHA256
413e485d8dd07231d70107d86ee1a17ce705517aed8346b4701747d1fdbfdfc3

SHA512
4920e508304df14041df1189938a1102e4a71e2e57ac4b9b804b6b0405c89c8292012a5ff4dae21268204ed6d9b56a279f4ce18d709074d1cba71cc9d5e11a1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\sharpvectormodel.dll

Filesize
998KB

MD5
225a73e5a0cf87453832b578db6daddb

SHA1
a36717a1b2c7eb2ba160fec5fa80e48b9e57c4ac

SHA256
0499708762c56b9339c980e731ffab294e9b18362af3dcb4ad4481f1c7bd60c1

SHA512
565ee2105bd626650857e0e6f9c8f7d87a68c3ec41923de119a3b710038a4785e16ccf79feb4c1c4f8a308f682163089228ac4ac81295cea754ae1189311c965

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\sharpvectorrenderingwpf.dll

Filesize
203KB

MD5
faec58e7785c287a7c688f274207048d

SHA1
66c038c720035b7212a7d3733da4520e3b95d63b

SHA256
4c76dd0441a8021a308be24cf0c1957bee280451abcc1467acf47f1a6f7f5dce

SHA512
9269a91a5bab01f076d8e9fde2991463fb224dc6382f8cde3a118e83cb35bdf580b4ea7686f2ea767a2a9c04650222edfc3a8b2569978b734c51b7135915448e

Download Submit
C:\Users\Admin\AppData\Local\Temp\78A0205F8AA4FE119AFCA5B12E77DC76\sharpvectorruntimewpf.dll

Filesize
69KB

MD5
0e203d24d04e89779638dd70d5335b39

SHA1
98ffc3718c6e34bd6d696bbcce605db666f99b01

SHA256
f15b5199850b8ed98d2202972ada759823a17893a68d60ca3a0f76ee31aeb204

SHA512
a07f54cce2add948340807b8ecf430e72c07032332046e5dd05d9da90f7d732921c0ff628592ff0710914ec9d9b7188b46377e1594a9f9809a107a022de1cfee

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5020A88-4AA8-11EF-A9CF-5A1BE277CD67\GuiStrings.loc

Filesize
22KB

MD5
09c4e9f41c4b8bfdb6bf8916af730ecd

SHA1
a215913aa718b459d8e3c13dfd22e5246dcff38c

SHA256
57bf969d3c10d5be0a4b31b8e530c1e005622c8dc809ee4fbd4c214f3b3e9a37

SHA512
7767639c5e068fd3e83a527dfce0345c902673e50102a6c5ba3998ffa2d16f0417a74bee15fce9b6825eabe94f6d36c4528cc70c4541294415b26b9f0f64937e

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5020A88-4AA8-11EF-A9CF-5A1BE277CD67\GuiStrings_KFA.loc

Filesize
3B

MD5
ecaa88f7fa0bf610a5a26cf545dcd3aa

SHA1
57218c316b6921e2cd61027a2387edc31a2d9471

SHA256
f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5

SHA512
37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5020A88-4AA8-11EF-A9CF-5A1BE277CD67\GuiStrings_fr-FR.loc

Filesize
43KB

MD5
eb070f3e74cbecb55bb9a6b4026401d1

SHA1
3dfd739a0b9715db241e0329d8b41969dc5bebbc

SHA256
88e43778dc4c185e607d4899d19f06984425a04b92b9338ce1d3bb73e94d4c53

SHA512
83d45736a30bccb155f075d435a0e29df531555a1bd92263b80cee3e4255fbda0c6c675c3ae722f581eddef1435ef05d1ae51db3cca9c25a1e55a4e7a142ff9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5020A88-4AA8-11EF-A9CF-5A1BE277CD67\GuiStrings_fr-FR_KFA.loc

Filesize
572B

MD5
6da71a4b595314665da5358ad9f44afa

SHA1
e7daeaa8c6e21f2d52e5d00be8b7a6beae77f416

SHA256
c6b3493df45a217723fb8ff013112f462e9c0194b799402dcfb2f21ae9a83a3a

SHA512
0798116c835276da59d218910970d28cc1c12ea59cfc55bb4086bfdef264d9c8f6a4daa79bf0b7779a6a9dd66c668e8f5c2fac787d988fc4decbc6655a9a10d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5020A88-4AA8-11EF-A9CF-5A1BE277CD67\downloader_neutral.ini

Filesize
18KB

MD5
66388e1c536028a65914bfdcf6b27ba8

SHA1
6cd300498c354dbd55432e8983c4ec31a00d499e

SHA256
10dc4d10376b8b19bc8f15cdc221c06c59680b5cb3855b23440dc2be64c4a5b2

SHA512
19a84e9628b662636c4fd80c8139669dab78a071bcb9ec30a3954a9892b3e65c2497b34e2666fe26ea589bc7e7b2b4a0b3735994a872b3c86bb71297494c176e

Download Submit
C:\Users\Admin\AppData\Local\Temp\F5020A88-4AA8-11EF-A9CF-5A1BE277CD67\downloader_neutral_KFA.ini

Filesize
1KB

MD5
2e10b2d4181d2f07d2dd305bd4285bd5

SHA1
9c05f3e03bae36da24a62b08729074cd12b0077e

SHA256
cbb72cdc1e461226c7d0e49e7ef955f77dfeef4f7fe12d0d8a8d0cf9658edc78

SHA512
a1bae84b8a9c0833bbadf29d4532b64f0216d7c1c13be2b4ebb75dd4d2b18244eb67fee52743745ed0a5818e745cb9aae9a8bfdc415ff59ee8aa7de77f122819

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDE22767-4AA8-11EF-A9CF-5A1BE277CD67\downloader_fr-FR.ini

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Local\Temp\FDE22767-4AA8-11EF-A9CF-5A1BE277CD67\mykaspersky_fr-fr.txt

Filesize
5KB

MD5
c2cf0180611261cb27eeae2b579ffbdb

SHA1
f7fd00a12e0e44c3df89e82381f7ab7c5d493042

SHA256
c7ccf09e79b0a7b322708e369eb4724d29b2c436fed76bdc3906cd986a7d841e

SHA512
9999c66028ff6b552f71fb3ad5c384e2258dbc2c167908dc06761793967adaa3e0b150e193c4e487339f42f4ca41e0002b8ca39004f5692970d92abd22a3d036

Download Submit
C:\Users\Admin\AppData\Local\Temp\discovery.cfg

Filesize
30KB

MD5
8e4080fdeb0c1c02c7697efe69edca7c

SHA1
a7503be947fff11671f1b8b7126bde5af7d00828

SHA256
ba80be9d85b93b21afef1eb30c67ff9acb01bd2c1dfa7cbf80287db991b26668

SHA512
3a9dcb338a65593f1613740a9f23c0e0527b8b80af5ad7c8995f79b1b0c17c495fe01d555d8c1307fed28febbbb97b737a254bf3e7d10b63681a4020bc8b5118

Download Submit
C:\Windows\Temp\C549DC4F8AA4FE119AFCA5B12E77DC76\startup.exe

Filesize
4.3MB

MD5
5aad72df3124c0114273a68064b10835

SHA1
a29b8a22b34b417b8a63a6321535b535708ec66b

SHA256
f58b07195184337a73c5936fbdd0467800657d4b8890c4329e7291bd2834792d

SHA512
5da9d1cef6ff4f8514118c92fd36e321fab3b527a24651ff8481cb7da01f7fbd3cff1a4afde5ab395dd8933f9a32eb088f73a56e81b8f63880f3f5fda15d2c3a

Download Submit
memory/1336-191-0x0000000077480000-0x0000000077490000-memory.dmp

Filesize
64KB

Download
memory/1336-193-0x0000000077480000-0x0000000077490000-memory.dmp

Filesize
64KB

Download
memory/1336-200-0x0000000077324000-0x0000000077325000-memory.dmp

Filesize
4KB

Download
memory/1336-192-0x0000000077480000-0x0000000077490000-memory.dmp

Filesize
64KB

Download
memory/1744-118-0x0000000007CE0000-0x0000000007D14000-memory.dmp

Filesize
208KB

Download
memory/1744-84-0x0000000006890000-0x00000000068A6000-memory.dmp

Filesize
88KB

Download
memory/1744-135-0x0000000007FF0000-0x000000000800C000-memory.dmp

Filesize
112KB

Download
memory/1744-140-0x00000000738F0000-0x00000000740A1000-memory.dmp

Filesize
7.7MB

Download
memory/1744-139-0x0000000007FD0000-0x0000000007FDE000-memory.dmp

Filesize
56KB

Download
memory/1744-144-0x0000000008170000-0x0000000008182000-memory.dmp

Filesize
72KB

Download
memory/1744-131-0x0000000008270000-0x000000000836A000-memory.dmp

Filesize
1000KB

Download
memory/1744-127-0x0000000007F90000-0x0000000007FC2000-memory.dmp

Filesize
200KB

Download
memory/1744-123-0x0000000007DF0000-0x0000000007E82000-memory.dmp

Filesize
584KB

Download
memory/1744-158-0x000000000C160000-0x000000000C198000-memory.dmp

Filesize
224KB

Download
memory/1744-159-0x0000000008250000-0x000000000825E000-memory.dmp

Filesize
56KB

Download
memory/1744-122-0x0000000007D20000-0x0000000007D42000-memory.dmp

Filesize
136KB

Download
memory/1744-96-0x0000000007830000-0x000000000789A000-memory.dmp

Filesize
424KB

Download
memory/1744-113-0x00000000738F0000-0x00000000740A1000-memory.dmp

Filesize
7.7MB

Download
memory/1744-106-0x0000000007940000-0x00000000079DE000-memory.dmp

Filesize
632KB

Download
memory/1744-92-0x0000000006F10000-0x00000000071D0000-memory.dmp

Filesize
2.8MB

Download
memory/1744-88-0x0000000006C00000-0x0000000006C48000-memory.dmp

Filesize
288KB

Download
memory/1744-10-0x0000000077324000-0x0000000077325000-memory.dmp

Filesize
4KB

Download
memory/1744-80-0x00000000066B0000-0x00000000066F2000-memory.dmp

Filesize
264KB

Download
memory/1744-488-0x00000000738F0000-0x00000000740A1000-memory.dmp

Filesize
7.7MB

Download
memory/1744-9-0x0000000077470000-0x0000000077480000-memory.dmp

Filesize
64KB

Download
memory/1744-8-0x0000000077470000-0x0000000077480000-memory.dmp

Filesize
64KB

Download
memory/1744-7-0x0000000077470000-0x0000000077480000-memory.dmp

Filesize
64KB

Download
memory/1744-206-0x00000000738FE000-0x00000000738FF000-memory.dmp

Filesize
4KB

Download
memory/1744-52-0x00000000738F0000-0x00000000740A1000-memory.dmp

Filesize
7.7MB

Download
memory/1744-51-0x0000000005C60000-0x0000000005CA6000-memory.dmp

Filesize
280KB

Download
memory/1744-47-0x00000000738F0000-0x00000000740A1000-memory.dmp

Filesize
7.7MB

Download
memory/1744-44-0x0000000003110000-0x000000000311E000-memory.dmp

Filesize
56KB

Download
memory/1744-311-0x00000000738F0000-0x00000000740A1000-memory.dmp

Filesize
7.7MB

Download
memory/1744-40-0x00000000738FE000-0x00000000738FF000-memory.dmp

Filesize
4KB

Download
memory/3724-2-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download
memory/3724-3-0x0000000077324000-0x0000000077325000-memory.dmp

Filesize
4KB

Download
memory/3724-0-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download
memory/3724-1-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download
memory/3920-204-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download
memory/3920-325-0x000000000DAA0000-0x000000000DAA8000-memory.dmp

Filesize
32KB

Download
memory/3920-203-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download
memory/3920-208-0x0000000077324000-0x0000000077325000-memory.dmp

Filesize
4KB

Download
memory/3920-205-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download
memory/4676-487-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download
memory/4676-486-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download
memory/4676-485-0x0000000077460000-0x0000000077470000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads