Analysis

  • max time kernel
    132s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/08/2024, 07:05

General

  • Target

    2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe

  • Size

    4.2MB

  • MD5

    ef448f267cf7fac57dcce7550f6d796a

  • SHA1

    f7b9cf313308c9f9c488f9766639dc4c20d77c1e

  • SHA256

    6ba2943ecf2a54ce7301741a157fd330ff9300db436e104094ca7b687dffdc00

  • SHA512

    26b0b68215af9f7708c0d26b8cccdc9d83abab7afa91ebd417f7eafbb0ad7eb228d3cf38c993c77011013340d65639fdce4a5107c321b9c84d6d9f34ff6ae3fb

  • SSDEEP

    98304:M54Z69F/gO6/JTTI0623OCyKHTiLcI/YZaYacQ25d:UF/gO6/JTTo4Hp0Y4Ya

Malware Config

Signatures

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4256
    • C:\Windows\temp\3C0412770B26FE1118E82DBE33F05354\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe
      "C:\Windows\temp\3C0412770B26FE1118E82DBE33F05354\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Checks whether UAC is enabled
      • Writes to the Master Boot Record (MBR)
      • Checks for VirtualBox DLLs, possible anti-VM trick
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of WriteProcessMemory
      PID:532
      • C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.321.0\au_setup_7736B6A7-62B0-11EF-818E-D2EB330F3545\startup.exe
        "C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.321.0\au_setup_7736B6A7-62B0-11EF-818E-D2EB330F3545\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe" /-self_remove -l=fr-FR -xpos=270 -ypos=58 -prevsetupver=21.14.5.462.0.241.0
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2192
        • C:\Windows\temp\3EF5F3080B26FE1118E82DBE33F05354\startup.exe
          "C:\Windows\temp\3EF5F3080B26FE1118E82DBE33F05354\startup.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe" -auto_update_mode="C:\Users\Admin\AppData\Local\Temp\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe" /-self_remove -l=fr-FR -xpos=270 -ypos=58 -prevsetupver=21.14.5.462.0.241.0
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • System Location Discovery: System Language Discovery
          PID:3592
      • C:\Windows\temp\3C0412770B26FE1118E82DBE33F05354\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe
        "C:\Windows\temp\3C0412770B26FE1118E82DBE33F05354\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354;532"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4868

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\Kaspersky Lab Setup Files\KIS21.14.5.462.0.241.0\kdscrl.rdb

    Filesize

    3KB

    MD5

    79a78149e4ef2e6e09cc061338c7b151

    SHA1

    99505d2461a18f16d4d185603887c60e226347ee

    SHA256

    e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd

    SHA512

    a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e

  • C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.321.0\au_setup_7736B6A7-62B0-11EF-818E-D2EB330F3545\dynamic.ini

    Filesize

    166B

    MD5

    b76eb4425ada6a91f58627528cb9e1f4

    SHA1

    b53b02073a04541bb32d8f4dad9b709f0af7a966

    SHA256

    a10dfc974e268d0b02ee4af2a0a67221895eae2c9daba837ca5eebc6c5edf2a1

    SHA512

    5283e25322e3ba837783770c55fc9cc1ff9700ed68ffbd3f1747005dd9fb6eeae7bd9110d130d41e18dbef43669d7700020ddd2c81ef121b83d09350a1e9e716

  • C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.321.0\au_setup_7736B6A7-62B0-11EF-818E-D2EB330F3545\startup.exe

    Filesize

    4.3MB

    MD5

    8e11e449e5e6e112ec4096f4d7094bf5

    SHA1

    70badfe008f078c2262e436c56a0f189c62e4691

    SHA256

    929fa744f639d5dc148d96e9f1a0d0f9c603584a7e6cbfeea719a7ad86fe0002

    SHA512

    be2fa0e957ea4b53024599456ccf54ffe06d17ffa176447e7e6abb17378681fddffde17c8f711689fdb190582f729748b160bd82b27bfbfe4a5b865717a0b4ad

  • C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.321.0\au_setup_7736B6A7-62B0-11EF-818E-D2EB330F3545\static.ini

    Filesize

    650B

    MD5

    6bc61c54b3036cc62bd77366cc4417a7

    SHA1

    dc658e19b4e5953ac524be062849dec9cecf1be1

    SHA256

    0a8a9b5fa7de9778e685f7365814a0a5526f7159088ba99d2f151546efbfd2d4

    SHA512

    ee23bb4b5ab2056d69a4206786a50c0d4f4f6413fa41b2a4edd0d487fc7251999b6811fcd5f684c23c2528ebf7ed0d91cb8160f5b5636c33bd73331ffec4a9e1

  • C:\ProgramData\Kaspersky Lab Setup Files\KIS21.17.7.539.0.321.0\kdscrl.rdb.z

    Filesize

    5KB

    MD5

    ddd1ccffb71631c06fbecd620777aea5

    SHA1

    c9efc33b68616d95875fb433852d7834aeb9c4b7

    SHA256

    10bac95728f7def4465c41aba0c54fd3c4d971b6ae55af9af23c86c7b2044eda

    SHA512

    799501393967e679b258f18f2922300eddc82a8d381e2f05c719de2d1619cd09a96d591cf6b8920a5cd0a6ad449d73dc5654785f3f8b5945cd343c97e3a59ba8

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0B532F86F8BFE69BA8D4B6BCF6B9C594

    Filesize

    318B

    MD5

    42c7372b5b20c0188212a913ba75e0ed

    SHA1

    2f79dbf6046fd0448b89cc0168dfa4d1539ea3bc

    SHA256

    ae77fd077caacf494b3240dce2415c389b7d61745c3c63a384facc80fff1f85f

    SHA512

    70ec5948a79508c2003b4360a1d661331725ff2269e704ba01fcd68961c896b6e3f1fd18c9c7f70042ffa37d1f93f99868b2c901deb717a69d89feb07dbfa651

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\System.Windows.Interactivity.dll

    Filesize

    39KB

    MD5

    3ab57a33a6e3a1476695d5a6e856c06a

    SHA1

    dabb4ecffd0c422a8eebff5d4ec8116a6e90d7e7

    SHA256

    4aace8c8a330ae8429cd8cc1b6804076d3a9ffd633470f91fd36bdd25bb57876

    SHA512

    58dbfcf9199d72d370e2d98b8ef2713d74207a597c9494b0ecf5e4c7bf7cf60c5e85f4a92b2a1896dff63d9d5107f0d81d7dddbc7203e9e559ab7219eca0df92

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\kasperskylab.setup.ui.core.dll

    Filesize

    126KB

    MD5

    4eed4912f1b75081a4c73654f15c4f9f

    SHA1

    1d1245a5272f2acb6424b47a6894f614d36bdb87

    SHA256

    13a47495c38c7a3dcddd162c02649f2e4a8c2eebcf2c77502d7a5087134f9853

    SHA512

    05c570f3a4735091e8ae1dfb2ea9e4dcd5117940258fb34cfcc11f5442b3b622915e93f640879547b8d042dd5fc4e24deaac9a21a6e0ba9755baa4ffa80c23fd

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\kasperskylab.setup.ui.dll

    Filesize

    269KB

    MD5

    9d2762eaa4c731568be5ca35485db1d9

    SHA1

    47c5a412e1910a24ec397cb17c46ca026d47bacb

    SHA256

    88de26ddc2d370bcf16a09419a432bbedc347c2586e9fefa6ebf29be75319c8e

    SHA512

    75e579bd49cb9078610fb58b901cfca48bb6e52630670ffb937653d08db02fff9460cd01d5523dafd8d982665a87e9c6ca564fa900ca3d90d5533d05739fd12b

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\kasperskylab.setup.ui.interoplayer.dll

    Filesize

    54KB

    MD5

    1b04066796d433257699921e5171ef9c

    SHA1

    0514df44ba945fdf080476d9991c06c78fffef75

    SHA256

    ba545cf9e14569f8b13e3ec9523a1cb5ea0b9270c173be4051aa88ffd025ba89

    SHA512

    951108afc0af83bc5c5b3cb282593cb310c756d3999b94d644f16df64d16280815783e1d6d8c102c128527c17c47de385d6527a57b5f162dc48aeb37d117cd49

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\kasperskylab.setup.ui.visuals.dll

    Filesize

    111KB

    MD5

    290ad1387d14831c4d2e354ef6278d8b

    SHA1

    3ba7153ea7cfb8e6b451276b718372133a90289c

    SHA256

    b1f443629bab7b8dc80175a27f7c456d167598f05ed87d793d852983aa852c02

    SHA512

    ff533ef12037fd06021660877969f74521bb638cc48401a77b3b5bb0f9ce65dabd4c488c3b631fe21ce76b3213e0cc20add05721db8b667e0f6d5445114cf56a

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\kasperskylab.ui.framework.dll

    Filesize

    197KB

    MD5

    b16d2bfca8427797a7f96bcd3e3b163a

    SHA1

    8b3f0ad8a067fa084cbe957e499a6fb4c453afd9

    SHA256

    35f16bdc3f15d9742a407c075722d30e88799600cfa37d99d7e1ebf869e27fdc

    SHA512

    9a6701ca55564a6f70f3270cf2dcf615dba5dd8020a4c165a986c15d57694f84f96cd750c3ca624c65b48c66b52e5cfa83d0e02c2a78193699775bf327b37e2b

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\kasperskylab.ui.framework.localization.dll

    Filesize

    277KB

    MD5

    c497bac28c180dc8cf2ff3d03dd914ec

    SHA1

    a908e8afe99ea62e18a6ed9ba3a4d2293ddb2ea3

    SHA256

    922d5d2ad940d5a812a7f7a1cf1bd81bc6b972acb3eb6e7afaa24fc597d9ddc6

    SHA512

    52f60c30b539e05667544b9a6a2e9b4c9617730a00ffd5cb438e5937cb1ea3d1d1a0cfdbe87e74fff767f4a383baa3ad22be109a72e11839576bc2198a06f249

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\kasperskylab.ui.framework.uikit.b2c.dll

    Filesize

    1.2MB

    MD5

    ce27ebb2ce3b659322811e5f2bae03e7

    SHA1

    166c8374d24f9e4c0bc0d91d5a15ea4860551ad7

    SHA256

    c1c5cdfbdc19f84f35f3a5eeadfc8eb52386c11e74f9edc3349830137c4f297d

    SHA512

    61dbeda532011f0371b51305acdc5b5b34db84733e55ca3a00bb6e08ab5aca110d18a869b44d4ccbda9cbc45f4f4f823b808884cb265ee4c3c6dca1d057c1ef3

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\kasperskylab.ui.framework.uikit.dll

    Filesize

    1.1MB

    MD5

    a9f715ae9d15efb5c20e968749bed408

    SHA1

    c3654cef80aca3dba7d99d373d947ec8a20481ba

    SHA256

    2f07d489f432d2f553ba6b8c1846c45b9a8c9847e2c1cf81bf352909d1e2746e

    SHA512

    33ad44d01f5341ed4ffa11502dd62c6f3b5060d88c7cacfe93d8a6d4fc9f80c26b91b2e295b631b4b83714a15870c604c8a9aa4f4bdd0859a16d817c906f3c2f

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\setup.dll

    Filesize

    5.9MB

    MD5

    fb0d4bded8c259e25003ad1a40937629

    SHA1

    79afba90e19306fae100450194bc307c7eb44215

    SHA256

    868ef6866d79b9d2f56784c55e52c48289899aed712c3643908092f7178d190a

    SHA512

    a0e48a87955cc65dbdfc437d71d4cdf40ada46662177b6568c871f9fbe73dd43f05c9de1d129f447050e4b33b95bfebfa47ee068fd7a3d0daf1920fc4e430ec9

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\sharpvectorconverterswpf.dll

    Filesize

    135KB

    MD5

    a16860177631160003651393c827f6b5

    SHA1

    f83172a0ba17fa82cbc103fb5191e7688d0928ee

    SHA256

    c5143e6f38230ed7e9a3b0d877bbe31b6fd18e66d8e4295904f6b063461514f2

    SHA512

    13f101a0d916005f48dd989521c572d55e5e53e9d66d20ad51deae3c2e569925a033c65308a9009647b61d0a3a02ddbaa8f67fdafe56d64ecce6f22fca9872e5

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\sharpvectorcore.dll

    Filesize

    198KB

    MD5

    6ff1879d6224baf4efc697c1989b474f

    SHA1

    0bf453d2c201e252f518db7c16d095eeb3ea17b8

    SHA256

    feed80fa5f9850ba3fc7a23c1071e35acebc44abb4fe35f93a51b1c95f4b304c

    SHA512

    0d16eb248afe65ab40f7a38af397df879db84d78246c972bfe89189eb7e4425c193ee350791efba3e156ca11d79784ba06330ed977b41c598573619e603e07f2

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\sharpvectorcss.dll

    Filesize

    106KB

    MD5

    0a55ecae176cbbbecacf9f009f429ba9

    SHA1

    3ad22f70e4f0360ca76b236cc8c285a099a68811

    SHA256

    e5915aae343b795392e3b4e695c89f0a2dadaa24d69f9a423e50d3f0d2d44786

    SHA512

    c207687d337e309b554231e503b0126d0d49129d8605db7efb60afe08bb7cf0d7585d221f4188d68d467eb3ac5d92a3faf038f905fea8a9d1dbbc2b0ac798286

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\sharpvectordom.dll

    Filesize

    52KB

    MD5

    b0a5181c52bdba8a5c7ba75e4dd0cb75

    SHA1

    619302666e9a2e7ef111ba1b137f5292cb903f5b

    SHA256

    9bd3ee71cc3f4426a570de2f2443196a94c3a0a3fce2b55231908194a3c488af

    SHA512

    25cc968bedacbd0811c558ee85480364666931035083daa5b91d21aa0b207049bae328ecacf79f61678049c281fb1c1e0289a892513b8f20e443627c0b656f86

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\sharpvectormodel.dll

    Filesize

    1003KB

    MD5

    93e4542cc2b69040f64fd7fb797bc2c4

    SHA1

    3a10dd6885e5516e4a31f0c6d73e8e421c18822d

    SHA256

    24695c0de9858448e5c32bf9a2f6eb49f5792cb8bf933fcbb6a39bb145b68c84

    SHA512

    74cc7de7244fafae592b95e569e432f7c91d049f33534d28181452e9bf4aecbbcc55eec41aa437c3a477814216a27f33c7b43e100d1c860011bbb100f590d131

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\sharpvectorrenderingwpf.dll

    Filesize

    200KB

    MD5

    ebcdc4d364b6d827cb294b3f19afaaef

    SHA1

    cd7119c2e550a67963c5b5129534532729d56505

    SHA256

    5a8fe28f53d2c256520a90eaedf0acac6dc16b23b8f679b65fe98ff50a8d62e1

    SHA512

    fb39344ef8651c3e3ba700868d49c72e1e62f7c8f99bb1fe20355693ba1f1bef547750fb5837adb03c242b12038686bc682fe3903805360e88b2a2f8e0ee24df

  • C:\Users\Admin\AppData\Local\Temp\4A6B63770B26FE1118E82DBE33F05354\sharpvectorruntimewpf.dll

    Filesize

    66KB

    MD5

    ef03937e84e8ba90c1cfc232794572de

    SHA1

    a8bd800fa405243dbdd098b6b1866ff0359dcc14

    SHA256

    947760a34d4cec1da0d0c03fcd2d1b6d6b04bc2d3f20793276a886a123f66377

    SHA512

    1b8f5892167ce3ecc1c0511fae7534426f774d182b8468f36ef01fb60de031d2ae220524e9dc47c0f5a1a53be4d4be3521e809f11322ab2b9b1d71fb5310f34a

  • C:\Users\Admin\AppData\Local\Temp\7736B6A5-62B0-11EF-818E-D2EB330F3545\GuiStrings_fr-FR_KIS.loc

    Filesize

    580B

    MD5

    eb1ba8e7e15e13758307a7155812cb0e

    SHA1

    fa2c7b3429e5477c8396eb91ba5f50a0c8da64ee

    SHA256

    be57aa7f08cbc8dc00ddd179f99737dc3b1b6bc9ac6ad6fe9574ad1fe1d5f452

    SHA512

    38f51652a2a895ed7b8c099a92eaa9e776433f7fa1950becb86bdb02a6f07f0db5dbdb9d599bc7ebb69267fa9e4f17369ac667d9c8f2bcff56b52efc9e1a8f5e

  • C:\Users\Admin\AppData\Local\Temp\7736B6A5-62B0-11EF-818E-D2EB330F3545\downloader_neutral_KIS.ini

    Filesize

    1KB

    MD5

    7d1ebecb49a1abddf80e36bcab9c4924

    SHA1

    08192de10aee08ae3cbfc3cb9063563466eeef91

    SHA256

    cc52c7f0764052ae08b0b0ff54212de04a76487d7ed548d3825524ad18bc955c

    SHA512

    a47f1d0089cef93a92b3dd30a98bc79b7587846f73c7220a9d91ab54fca0abbd61ed9bc01d029d948cfb783dc91efcce805aff675adb6a295b5689e348c9a708

  • C:\Users\Admin\AppData\Local\Temp\7736B6A6-62B0-11EF-818E-D2EB330F3545\install_programm.png

    Filesize

    67KB

    MD5

    92c2792890f65f1acec488d61ceea7ef

    SHA1

    de8363acd5050e369e192bda7e403ea50247f1ca

    SHA256

    c70eea5dc7403b9f786fab442e51186d6dac559ee7cbb3f9e47f97192126dba5

    SHA512

    081ba025f432810a4de08f96f33ea2aa23f23b49c500751a9eb288cfec2311c1270133ed13cccfc4aac410123af47da77cc33b9676f0c74756226d36696c263f

  • C:\Users\Admin\AppData\Local\Temp\7736B6A6-62B0-11EF-818E-D2EB330F3545\modernwelcomepage.svg

    Filesize

    11KB

    MD5

    22482cdd752aebe20d205b40faff8389

    SHA1

    9c00d2a3e782cc47afc58c5a558500148d9de393

    SHA256

    fec9b1118586c459512540bbde7ff1ddcc278f8fa77dbe63e64e91971c7445fb

    SHA512

    9731e92f2d3c04b6911423ed67b16a255209ddd30231e95e375b6298ec2b0730858e69b3937239bbf328dad2e22653f8b6f97b035e94f5713ab47903fb57fd50

  • C:\Users\Admin\AppData\Local\Temp\7736B6A6-62B0-11EF-818E-D2EB330F3545\product.png

    Filesize

    4KB

    MD5

    6463cd25f9a8e7d2033261cf51e3f0a7

    SHA1

    ee9b2b487f9ecb74f58c45a60322ac5bf63d7073

    SHA256

    9ab10f152a0cb996fb5c38ef36ceabc28cea766b30f8071a2a2ab9804d4c9465

    SHA512

    f6fdeb19059ecc44452386c381b22e66ebdbcb01ceb1e44ad88c875d9790be5faea6384ce30259855fba624de27c8df16c72522104adb1a86176f7a06ea3bce7

  • C:\Users\Admin\AppData\Local\Temp\7736B6A6-62B0-11EF-818E-D2EB330F3545\product.svg

    Filesize

    4KB

    MD5

    fc2634cdfe821b5089e5da928d8a32f7

    SHA1

    e0f48c7e51462d9329c45077098c9e59107be237

    SHA256

    5ceb5e2683438a5890b47e67c8f8b329e73cbdf354497c85afc887d7e2179f63

    SHA512

    7e03bfc4cad05de87dc596b61eb9610f4f79313508b4f0115c1dcd805d7ac08bb46301b176d6c87a4feb35efc6ade935073a015f653b45936a0fd482f844e695

  • C:\Users\Admin\AppData\Local\Temp\805E5E1B-62B0-11EF-818E-D2EB330F3545\downloader_fr-FR.ini

    Filesize

    2B

    MD5

    f3b25701fe362ec84616a93a45ce9998

    SHA1

    d62636d8caec13f04e28442a0a6fa1afeb024bbb

    SHA256

    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

    SHA512

    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\kl.setup.ui.core.dll

    Filesize

    89KB

    MD5

    2c8f5ec07cb84d844e3fdee32b2a8e00

    SHA1

    2e27daffed27a7e6ee3adc50eef1710da318ca32

    SHA256

    8d5bd8184fbc3f79ea9edc2c25e1a5a935514518c3fba89bde308c06722375f9

    SHA512

    ef37109b456a68d55dee8a45340e25cb9901909b30f9f882f62060951bec20d838561dbe5ebe0480aa2feb668c6ffbb2137ed2f69cd3d6337c6f38cf395f6eca

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\kl.setup.ui.dll

    Filesize

    278KB

    MD5

    1bebc399a1b31eabc3361169df0316d1

    SHA1

    56091143fafa680dc65dd5f2b5d6fafa94590041

    SHA256

    894914e74da8c8faf8bb9b34e0f9b586db3cb248c3f6edb715a7cb8c930dd66b

    SHA512

    d0d1fb7e23391a352f6bb3d5756dbbcd5a3558e0c477b265453931940a223dfa31cafe20232a9d08fbb127158bce325dd8b769e7bb62907be89019cd3f02f1ac

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\kl.setup.ui.interoplayer.dll

    Filesize

    56KB

    MD5

    baf69d3c6977161e0c2b631b3f9958d4

    SHA1

    a1b2982c11811c4e5f6bce95f3072a855d11c369

    SHA256

    e6392d0cf3a5984034ca0b346476d7482243550ddd0c65a8c0ff2f03a15867bc

    SHA512

    2fb765d07638d239b666d4043f9ae75e91dc271ddf399dfe5bfd1c894bcabb95e6e965b478f5208687d9ebaa18cdafd6fc3400cd47694fd9db4ac30f3f1d5839

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\kl.setup.ui.visuals.dll

    Filesize

    420KB

    MD5

    6181240bc579d2dfb176a1ca260f5a90

    SHA1

    eb13b6cd4a242c8399396795d1863954b8d79507

    SHA256

    b07c4d99d4cbb62b31a425e60c993b809c7043518a9ef0b7b561abd180a1b768

    SHA512

    f5bb4bdd05836c494a560dc9aa16d62d29b90df7c5854d4a97b8e274890dd1476de955637237867a666c1f08785f5dc06d571e023b124530ee87cf6fdb98689f

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\kl.ui.framework.dll

    Filesize

    264KB

    MD5

    2ad2ab4f8517da8e2efdfed22ad49f1e

    SHA1

    55916e3e5c4c40cf2e5644fbad07baf31459673e

    SHA256

    6efe8efc6701c80d59ad33bd139aeca1b47a27f49d3ccc16ed01a49da9bfc2e7

    SHA512

    12800c7d475af627c98cecb6e6c2de8247094166126978e24bd8be3f7193828781e853ee10b3133c989d625f0e2860ce4551369d864748b70db4ec220c515bbd

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\kl.ui.framework.localization.dll

    Filesize

    283KB

    MD5

    079ac68d4beb2ab9602d754b09ff652b

    SHA1

    90032834cc5cffd0b00119e4e38b5f4c5f877e4c

    SHA256

    9377c35b19c30ee75c010b1e592796daf1d3493b397ef9d61a1c63a5ab30a88e

    SHA512

    53782adc516950888ec69b21e744fe4d7f8567223e7c067e362800c78e3621dc148d5aa19f6011962bece1ada3691ef1ef40838a8072480c54aeedb2f4e0c9b9

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\kl.ui.framework.uikit.b2c.dll

    Filesize

    631KB

    MD5

    445e34aa976419cae54e13ede8d41ce5

    SHA1

    98ca3ee808f97ae16970b0fcefd3387bd07278eb

    SHA256

    a255bb5dfaa685d7443dbc8bb7fca71417c8f0b1f617ade7077ee437a23a9b24

    SHA512

    86b4084cf781d4efbb814fce3ed6ca48addbf4c15c5ed3630673350cf65056a80e2a9bc00581a45ae370a64f0bc720d506622eccd9d7ef170814faab1cce14c4

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\kl.ui.framework.uikit.dll

    Filesize

    2.7MB

    MD5

    18defb1e3b7460f592a8ca61e4b40ff0

    SHA1

    8f8f7d7d1ee8a048d162603cc21a0f4c40b9036b

    SHA256

    02a884babc5584fec80b227eb1c52dc800c516f1117ff9637617ad84c632da9d

    SHA512

    7cbdc0c113a0c7ff9628674a8a23f4224290455d4a9a41a66889d01baf1f28b0175197c3078a791ecf6b2052c3fdfc35cf38cfae5bf5917bde80f82499d40b12

  • C:\Users\Admin\AppData\Local\Temp\A1E5E5080B26FE1118E82DBE33F05354\setup.dll

    Filesize

    5.5MB

    MD5

    4aa1564586c4595889750d22df0d5678

    SHA1

    89051a7f1021278b7826e177f27f6344bb06c10d

    SHA256

    a405d44b3eb79276b1dad1232632464e97814a8ac9da8d969adc7b97632d933d

    SHA512

    5ef9fdf9092fb8cdd884a86a4536962288a3c41d484cd9664c04db1d4465a71677cda87f41bd31bb9a502b93f77c45c5b1d1163e0da1f7423a8aa5d3213496e6

  • C:\Users\Admin\AppData\Local\Temp\discovery.cfg

    Filesize

    29KB

    MD5

    fce7ac1559d4be532444244a38507e3b

    SHA1

    e5877c2322bd1e36b1cff83a288425387ebbbae0

    SHA256

    24fd0e0cf40d2bd71bb196634f9862afe4d8385f80f906bbd99ba6ae4b428d15

    SHA512

    9dc8328a846b44a4c171ec4d0ef4927e75950bda6c795cc7e1c0b90c46a8bec44061eb20925a0539c800cb78e88fdd44391ff6cf18fecaac450fdd48d92ecb7b

  • C:\Users\Admin\AppData\Local\Temp\discovery.cfg

    Filesize

    30KB

    MD5

    8e4080fdeb0c1c02c7697efe69edca7c

    SHA1

    a7503be947fff11671f1b8b7126bde5af7d00828

    SHA256

    ba80be9d85b93b21afef1eb30c67ff9acb01bd2c1dfa7cbf80287db991b26668

    SHA512

    3a9dcb338a65593f1613740a9f23c0e0527b8b80af5ad7c8995f79b1b0c17c495fe01d555d8c1307fed28febbbb97b737a254bf3e7d10b63681a4020bc8b5118

  • C:\Windows\Temp\3C0412770B26FE1118E82DBE33F05354\2024-08-25_ef448f267cf7fac57dcce7550f6d796a_avoslocker.exe

    Filesize

    4.2MB

    MD5

    ef448f267cf7fac57dcce7550f6d796a

    SHA1

    f7b9cf313308c9f9c488f9766639dc4c20d77c1e

    SHA256

    6ba2943ecf2a54ce7301741a157fd330ff9300db436e104094ca7b687dffdc00

    SHA512

    26b0b68215af9f7708c0d26b8cccdc9d83abab7afa91ebd417f7eafbb0ad7eb228d3cf38c993c77011013340d65639fdce4a5107c321b9c84d6d9f34ff6ae3fb

  • memory/532-190-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-91-0x0000000006B60000-0x0000000006B80000-memory.dmp

    Filesize

    128KB

  • memory/532-161-0x00000000060A0000-0x00000000060BC000-memory.dmp

    Filesize

    112KB

  • memory/532-157-0x0000000008820000-0x000000000891C000-memory.dmp

    Filesize

    1008KB

  • memory/532-169-0x0000000006120000-0x0000000006132000-memory.dmp

    Filesize

    72KB

  • memory/532-150-0x0000000008210000-0x0000000008242000-memory.dmp

    Filesize

    200KB

  • memory/532-177-0x0000000008610000-0x000000000861E000-memory.dmp

    Filesize

    56KB

  • memory/532-176-0x000000000C260000-0x000000000C298000-memory.dmp

    Filesize

    224KB

  • memory/532-188-0x00000000744AE000-0x00000000744AF000-memory.dmp

    Filesize

    4KB

  • memory/532-189-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-614-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-191-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-192-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-145-0x00000000082B0000-0x0000000008342000-memory.dmp

    Filesize

    584KB

  • memory/532-144-0x0000000007930000-0x0000000007952000-memory.dmp

    Filesize

    136KB

  • memory/532-9-0x0000000077EA0000-0x0000000077EB0000-memory.dmp

    Filesize

    64KB

  • memory/532-140-0x0000000007970000-0x00000000079A4000-memory.dmp

    Filesize

    208KB

  • memory/532-126-0x0000000007BA0000-0x0000000007BB0000-memory.dmp

    Filesize

    64KB

  • memory/532-10-0x0000000077D42000-0x0000000077D43000-memory.dmp

    Filesize

    4KB

  • memory/532-8-0x0000000077EA0000-0x0000000077EB0000-memory.dmp

    Filesize

    64KB

  • memory/532-7-0x0000000077EA0000-0x0000000077EB0000-memory.dmp

    Filesize

    64KB

  • memory/532-44-0x00000000744AE000-0x00000000744AF000-memory.dmp

    Filesize

    4KB

  • memory/532-48-0x0000000003430000-0x000000000343E000-memory.dmp

    Filesize

    56KB

  • memory/532-49-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-52-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-121-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-103-0x0000000006F70000-0x0000000006F8C000-memory.dmp

    Filesize

    112KB

  • memory/532-105-0x00000000744A0000-0x0000000074C50000-memory.dmp

    Filesize

    7.7MB

  • memory/532-56-0x0000000005DE0000-0x0000000005E24000-memory.dmp

    Filesize

    272KB

  • memory/532-114-0x0000000007570000-0x00000000076A2000-memory.dmp

    Filesize

    1.2MB

  • memory/532-87-0x00000000069A0000-0x00000000069D2000-memory.dmp

    Filesize

    200KB

  • memory/532-99-0x0000000006F00000-0x0000000006F46000-memory.dmp

    Filesize

    280KB

  • memory/532-95-0x0000000006FA0000-0x00000000070BE000-memory.dmp

    Filesize

    1.1MB

  • memory/532-165-0x0000000006090000-0x000000000609E000-memory.dmp

    Filesize

    56KB

  • memory/2192-209-0x0000000077E90000-0x0000000077EA0000-memory.dmp

    Filesize

    64KB

  • memory/2192-218-0x0000000077D42000-0x0000000077D43000-memory.dmp

    Filesize

    4KB

  • memory/2192-211-0x0000000077E90000-0x0000000077EA0000-memory.dmp

    Filesize

    64KB

  • memory/2192-210-0x0000000077E90000-0x0000000077EA0000-memory.dmp

    Filesize

    64KB

  • memory/3592-309-0x00000000076D0000-0x000000000773A000-memory.dmp

    Filesize

    424KB

  • memory/3592-333-0x00000000077A0000-0x00000000077BC000-memory.dmp

    Filesize

    112KB

  • memory/3592-306-0x0000000007100000-0x00000000073C0000-memory.dmp

    Filesize

    2.8MB

  • memory/3592-294-0x00000000066C0000-0x0000000006702000-memory.dmp

    Filesize

    264KB

  • memory/3592-222-0x0000000077E80000-0x0000000077E90000-memory.dmp

    Filesize

    64KB

  • memory/3592-315-0x00000000077E0000-0x000000000787E000-memory.dmp

    Filesize

    632KB

  • memory/3592-223-0x0000000077E80000-0x0000000077E90000-memory.dmp

    Filesize

    64KB

  • memory/3592-224-0x0000000077D42000-0x0000000077D43000-memory.dmp

    Filesize

    4KB

  • memory/3592-325-0x00000000060D0000-0x0000000006104000-memory.dmp

    Filesize

    208KB

  • memory/3592-327-0x0000000006110000-0x0000000006132000-memory.dmp

    Filesize

    136KB

  • memory/3592-329-0x0000000007740000-0x0000000007772000-memory.dmp

    Filesize

    200KB

  • memory/3592-331-0x0000000007D20000-0x0000000007E1A000-memory.dmp

    Filesize

    1000KB

  • memory/3592-335-0x0000000007780000-0x000000000778E000-memory.dmp

    Filesize

    56KB

  • memory/3592-221-0x0000000077E80000-0x0000000077E90000-memory.dmp

    Filesize

    64KB

  • memory/3592-337-0x0000000007A50000-0x0000000007A62000-memory.dmp

    Filesize

    72KB

  • memory/3592-343-0x000000000BB30000-0x000000000BB38000-memory.dmp

    Filesize

    32KB

  • memory/3592-279-0x00000000030F0000-0x00000000030FE000-memory.dmp

    Filesize

    56KB

  • memory/3592-302-0x0000000006DF0000-0x0000000006E38000-memory.dmp

    Filesize

    288KB

  • memory/3592-285-0x0000000005B40000-0x0000000005B86000-memory.dmp

    Filesize

    280KB

  • memory/3592-298-0x0000000006A80000-0x0000000006A96000-memory.dmp

    Filesize

    88KB

  • memory/4256-2-0x0000000077EB0000-0x0000000077EC0000-memory.dmp

    Filesize

    64KB

  • memory/4256-3-0x0000000077D42000-0x0000000077D43000-memory.dmp

    Filesize

    4KB

  • memory/4256-0-0x0000000077EB0000-0x0000000077EC0000-memory.dmp

    Filesize

    64KB

  • memory/4256-1-0x0000000077EB0000-0x0000000077EC0000-memory.dmp

    Filesize

    64KB

  • memory/4868-613-0x0000000077E80000-0x0000000077E90000-memory.dmp

    Filesize

    64KB

  • memory/4868-612-0x0000000077E80000-0x0000000077E90000-memory.dmp

    Filesize

    64KB

  • memory/4868-611-0x0000000077E80000-0x0000000077E90000-memory.dmp

    Filesize

    64KB