Overview
overview
8Static
static
1kaspersky_...hi.rar
windows10-2004-x64
8kaspersky_...hi.rar
windows11-ltsc_2024-x64
1Kaspersky ...22.exe
windows10-2004-x64
6Kaspersky ...22.exe
windows11-ltsc_2024-x64
6Kaspersky ...У.url
windows10-2004-x64
1Kaspersky ...У.url
windows11-ltsc_2024-x64
1Kaspersky ...ч.txt
windows10-2004-x64
1Kaspersky ...ч.txt
windows11-ltsc_2024-x64
1Analysis
- user interaction
yes - max time kernel
165s - max time network
180s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/07/2026, 19:34
Static task
static1
Behavioral task
behavioral1
Sample
kaspersky_premium_21_22_klyuchi.rar
Resource
win10v2004-20260513-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
kaspersky_premium_21_22_klyuchi.rar
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
Kaspersky Premium 21.22/Kaspersky Premium 21.22.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
Kaspersky Premium 21.22/Kaspersky Premium 21.22.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
Behavioral task
behavioral5
Sample
Kaspersky Premium 21.22/ВОТ-СОФТ.РУ.url
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
Kaspersky Premium 21.22/ВОТ-СОФТ.РУ.url
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
Kaspersky Premium 21.22/Ключ.txt
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Kaspersky Premium 21.22/Ключ.txt
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target kaspersky_premium_21_22_klyuchi.rar
- Size 615.2MB
- Sample260723-x98nfstyay
- SHA256 046a092fa17dd66e94089a15b53e47c4c2b439222461910621bed31ffc42b1dd
- MD5 dd91cb4fa3f73c2160b8cfac2213e941
- SHA1 c95a485308fe12a8147c728089fe1f31a7f4d655
- SHA512 0be64d73e94ddd219c08e2c57a6d9155ff55b8099ad78af1a45c03812b6f68217b0ec914270c137832ab647917c6ed16f69240ff832fb00079edb52a11030a37
- SSDEEP 12582912:7VKBPWuK/+8p+wS2am9OMZykynX2d7ai2N4iR+m+Q/M7+fhSkRMwsICEuTk3:4Z9j2am9mRnGVaiwZRf+ST2wZX
- TLSH T1D66933C90634C9E5AC64937F81FDCAD2D5FBBB75574790AB0253E343898887C20629EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in Drivers directory 6 IoCs
description ioc Process File opened for modification C:\Windows\system32\DRIVERS\K4W-21-22\SETC092.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\K4W-21-22\SETC092.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\K4W-21-22\klif.sys MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\K4W-21-22\SETC093.tmp MsiExec.exe File created C:\Windows\system32\DRIVERS\K4W-21-22\SETC093.tmp MsiExec.exe File opened for modification C:\Windows\system32\DRIVERS\K4W-21-22\klflt.sys MsiExec.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation Kaspersky Premium 21.22.exe - Executes dropped EXE 3 IoCs
pid Process 3712 Kaspersky Premium 21.22.exe 4488 Kaspersky Premium 21.22.exe 1952 setup_ui.exe - Loads dropped DLL 58 IoCs
pid Process 4488 Kaspersky Premium 21.22.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 1952 setup_ui.exe 4488 Kaspersky Premium 21.22.exe 4488 Kaspersky Premium 21.22.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 3824 MsiExec.exe 4720 MsiExec.exe 4720 MsiExec.exe 2200 MsiExec.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 62 2208 msiexec.exe - Checks for any installed AV software in registry 1 TTPs 64 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.14 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM6.0.1 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Properties Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\data\FlushedMsiCriticalSettings msiexec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.15 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\settings msiexec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.6 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.16 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP15.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\Data msiexec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP15.0.2 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP19.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP20.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.4 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.21 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP15.0.1 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\settings\PasswordProtectionSettings msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\environment MsiExec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.7 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.20 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM6.0.2 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\klim6\Parameters MsiExec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.3 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\12382f32302a10372a2d383535b3c3b36362d93c373d30373e Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\Kleaner Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\environment msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\Data\RegretPage msiexec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.2 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\data\FlushedMsiCriticalSettings\PasswordProtectionSettings msiexec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP16.0.1 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP16.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP17.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\settings MsiExec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.8 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.17 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.19 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\settings\PasswordProtectionSettings msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\settings msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\Installer msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\settings MsiExec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM2.5.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM3.5.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM4.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM6.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\KLeaner Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\environment msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\LicStrg msiexec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.5 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM3.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM5.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\Data\FlushedMsiCriticalSettings\PasswordProtectionSettings msiexec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.1 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.9 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.18 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\Data\ContainersDb msiexec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.13 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP21.22 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\SM7.0.0 Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVP21.22\Data\FlushedMsiCriticalSettings msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\AVPXX.XX_not_exists\data msiexec.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\KasperskyLab\protected\LicStorage MsiExec.exe Key opened \REGISTRY\MACHINE\Software\WOW6432Node\KasperskyLab\AVP18.0.0 Kaspersky Premium 21.22.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Kaspersky Premium 21.22.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Kaspersky Premium 21.22.exe - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN Kaspersky Premium 21.22.exe - Drops file in Windows directory 30 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIBA0C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9D63.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI99A7.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSIB5E4.tmp msiexec.exe File created C:\Windows\Installer\e5a8fae.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9607.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9968.tmp msiexec.exe File opened for modification C:\Windows\installer Kaspersky Premium 21.22.exe File opened for modification C:\Windows\Installer\MSIB47C.tmp msiexec.exe File created C:\Windows\Inf\oem1.PNF MsiExec.exe File created C:\Windows\Installer\SourceHash{FF0ECA80-ADCD-34E8-B5A9-C334BF4C80F4} msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log MsiExec.exe File opened for modification C:\Windows\Installer\e5a8fae.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI9763.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9A35.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAC98.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAFE5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB11E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI96C4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAC2A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIB12F.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI9703.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9D14.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI9714.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIBFE9.tmp msiexec.exe File created C:\Windows\Inf\oem0.PNF MsiExec.exe File created C:\Windows\Inf\oem2.PNF MsiExec.exe - System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Kaspersky Premium 21.22.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup_ui.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD Kaspersky Premium 21.22.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0280f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Kaspersky Premium 21.22.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 5c000000010000000400000000080000190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab040000000100000010000000c5dfb849ca051355ee2dba1ac33eb0282000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f Kaspersky Premium 21.22.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4488 Kaspersky Premium 21.22.exe 4488 Kaspersky Premium 21.22.exe 4720 MsiExec.exe 4720 MsiExec.exe 4720 MsiExec.exe 4720 MsiExec.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2716 7zFM.exe - Suspicious behavior: LoadsDriver 1 IoCs
pid Process 660 Process not Found - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2716 7zFM.exe Token: 35 2716 7zFM.exe Token: SeSecurityPrivilege 2716 7zFM.exe Token: SeShutdownPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeIncreaseQuotaPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeSecurityPrivilege 2208 msiexec.exe Token: SeCreateTokenPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeAssignPrimaryTokenPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeLockMemoryPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeIncreaseQuotaPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeMachineAccountPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeTcbPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeSecurityPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeTakeOwnershipPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeLoadDriverPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeSystemProfilePrivilege 4488 Kaspersky Premium 21.22.exe Token: SeSystemtimePrivilege 4488 Kaspersky Premium 21.22.exe Token: SeProfSingleProcessPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeIncBasePriorityPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeCreatePagefilePrivilege 4488 Kaspersky Premium 21.22.exe Token: SeCreatePermanentPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeBackupPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeRestorePrivilege 4488 Kaspersky Premium 21.22.exe Token: SeShutdownPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeDebugPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeAuditPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeSystemEnvironmentPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeChangeNotifyPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeRemoteShutdownPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeUndockPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeSyncAgentPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeEnableDelegationPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeManageVolumePrivilege 4488 Kaspersky Premium 21.22.exe Token: SeImpersonatePrivilege 4488 Kaspersky Premium 21.22.exe Token: SeCreateGlobalPrivilege 4488 Kaspersky Premium 21.22.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe Token: SeTakeOwnershipPrivilege 2208 msiexec.exe Token: SeRestorePrivilege 2208 msiexec.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2716 7zFM.exe 2716 7zFM.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2716 wrote to memory of 3712 2716 7zFM.exe 95 PID 3712 wrote to memory of 4488 3712 Kaspersky Premium 21.22.exe 97 PID 4488 wrote to memory of 1952 4488 Kaspersky Premium 21.22.exe 98 PID 2208 wrote to memory of 3824 2208 msiexec.exe 101 PID 2208 wrote to memory of 4720 2208 msiexec.exe 103 PID 2208 wrote to memory of 2200 2208 msiexec.exe 104
Processes
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\kaspersky_premium_21_22_klyuchi.rar"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Local\Temp\7zOC9AACFC9\Kaspersky Premium 21.22.exe"C:\Users\Admin\AppData\Local\Temp\7zOC9AACFC9\Kaspersky Premium 21.22.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3712 -
C:\Windows\temp\85959DEAEC681F119B592FC3A42BEDF8\Kaspersky Premium 21.22.exe"C:\Windows\temp\85959DEAEC681F119B592FC3A42BEDF8\Kaspersky Premium 21.22.exe" -initialNonSecureSetupPath="C:\Users\Admin\AppData\Local\Temp\7zOC9AACFC9\Kaspersky Premium 21.22.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4488 -
C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\setup_ui.exe"C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\setup_ui.exe" -cp=objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAADMhK0Z5jdxpw9Kn6gksq9DAoQAAIgR//+XWvbH+4CEPS4AGAAHAFQAaQBnAG0AZwBvAGwAbQAAAAcAMQAwAC4AMQAyADcALgAwAC4AMQA0AAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==:4⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1952
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Badlisted process makes network request
- Checks for any installed AV software in registry
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2F79CFF5ADBDEC134CCDBD9E045371472⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
PID:3824
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 11713555D11D91DD3A9D66A4FE5F7812 E Global\MSI00002⤵
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 289AF4DC8112209B46C139543A9CB8E6 E Global\MSI00002⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Drops file in Windows directory
PID:2200
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.22.7.466.0.4.0\BB8F460E-86CE-11F1-B995-F23C4AB2DE8F\kdscrl.rdb
- Size 3KB
- SHA256 e6c0da20fc5d9eda24e4128faa5641f8b2d39951e0a0236c013e1f1efcbf83fd
- MD5 79a78149e4ef2e6e09cc061338c7b151
- SHA1 99505d2461a18f16d4d185603887c60e226347ee
- SHA512 a3baf55b373b943f8f1c8840cdc2f02a94aed436c54fdcb8cf6eeac9b5840a5e1a11be0c70460da0c17f6fda1b01b87f4e2a688abb5ddeb7819301a1354d688e
- TLSH T14A5191D64838FA05CF89AA79887A4C076FF463C10B63AA1A7710DC9A1664772D80342E
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.22.7.466.0.4.0\BB8F460E-86CE-11F1-B995-F23C4AB2DE8F\kleaner.cab
- Size 2.8MB
- SHA256 a31ad9bbc37bc29d2426de08cd88da420b15630a33c4bdc269181b79411ced73
- MD5 c1b453fb85d041ce0712b673599e2cfa
- SHA1 b5142b8cadf7ad256ffe15101e7f2c80926d0a0c
- SHA512 c233bc2a3646fa5e4478cec3058559b83a2288aa7a4c9228d021013e0264d72b99ac46b3ea2da40006d0c959561127f6d6ef369b6525a7273435bac528332b0b
- SSDEEP 49152:yS0ZPqvU9QFkYr4iRQlOafHGfTvQ2n7kAIyi3Ygx6wWAPPBAcG94NFgXv9GLUu5U:YPqvU9skk44SJ097kAI/Lx6wWAPPigNW
- TLSH T124D5234FDFD35E5CAE8582EA221E74392AA783A1784DC08C8DF6D873AD023D1476E4D5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.22.7.466.0.4.0\BB8F460E-86CE-11F1-B995-F23C4AB2DE8F\netcoredistr_8_x86.z
- Size 25.8MB
- SHA256 655c069d2b79d055218d658dc01d92da75b264073e69c5507b9f39d96d334f7d
- MD5 fc5909bd4e39f300c5843032aa0ac7d3
- SHA1 1dba519943d42bd0c5c417222eec2f33d97f0856
- SHA512 97ef85f046f8d62628d80567e75e28be469bc8c507a686e612184eb03f995b3d07d8e423fa9c0ad373ad7ac75ee7ccf0f625b526863dea9c82eed60f6a457854
- SSDEEP 786432:j7ICNJs6y9ygs5S8EGSCbmpxjaxuqMDfVzEOktS2:vDNSvVs5GlCbmpxj8WD9ze
- TLSH T1204733BC4B058F92CCE4AEB577C5528352A126B940B61039C86F7CD07DCFAB709A6D87
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.22.7.466.0.4.0\BB8F460E-86CE-11F1-B995-F23C4AB2DE8F\product.cab
- Size 8.0MB
- SHA256 236aa10379640a3a9d72cc915f9198eb2ad2e1815723b0f4703d669d29db974d
- MD5 941583ac657d2d27fe9791b8997ac20b
- SHA1 5523d1c390c34148d803f0ce00215ba90c0f61cf
- SHA512 66be49bce3c55687909154ec4e29d55a6542f3f5364b67ec0d49ef3abbc1bf129914e0bc4ee12ec8f9195d4d01e5bd8b00ba364f54e9a09cf1c2635dfc75c190
- SSDEEP 98304:UZhUD8v9eFZGY7BQa8+NST29SOmxeF5uZwKOJNDYbi3+utX8o9SHcK9iPko:mUDMY7BAURU6KOfDYbi3+utX8BH9lo
- TLSH T1D8869E372648C035D79B003CB9E9A7B593BC9F2A476249C763C47B292A706C1B67DB43
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.22.7.466.0.4.0\BB8F460E-86CE-11F1-B995-F23C4AB2DE8F\product.msi
- Size 17.0MB
- SHA256 06f698aeaf4e38b5784d4047d54167adec5b1140c159febcd62d6089ed2c38eb
- MD5 f74469883501383d0e4db5a4f567fcab
- SHA1 c2a8e6cc16781c0f17ba4658768fdcb96b655c7d
- SHA512 50c7f2a7130b4c00ff8561a668d2d59e25883178a7476c7cdecf6e14391c8774593b460bbb3457579c79da1e49ac552e813d659c29dc41e51f4def7165724b4b
- SSDEEP 393216:5BU/uxRrcTqfo0XirZtCUzQ5lmubBDFlZ/o:rUmpo08ZtfQffbBBlt
- TLSH T12C079D227EB48436F0AA423555799633D67BBF210B2389DB63807B2F1E716C1A635733
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Kaspersky Lab Setup Files\KIS21.22.7.466.0.4.0\BB8F460E-86CE-11F1-B995-F23C4AB2DE8F\x64.cab
- Size 8.1MB
- SHA256 17d69d346a8932b7d11bca328ae8bfb62c71922c75eb8bf16714774077b6c82f
- MD5 8f357cf2e1a9fc30853020c885136ffa
- SHA1 735e4cfebd4904b153c64bf4da0c7dbe34c701b1
- SHA512 9a86e946a34fd9a1cd551d7b7c87a7bef02042873af762747f8caaf2aaa12d17c907508c6fbdb5e27df6525f67143910638c844d5700075f035ab17797da8470
- SSDEEP 49152:2/puNuBbdehgdGJJiQsEq0U0tISVh4OjWU/gbesniaTYmocBpelM/EWNQpZk6Ch1:AJCLWq9cXJP43Q21grhkGQTwPZ
- TLSH T126865C3ED1A850E0D96AD0388893977BEBB33E18436091C757629B66EF337F4553A342
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BB8F460F-86CE-11F1-B995-F23C4AB2DE8F\Cleaner\cleanapi.dll
- Size 3.7MB
- SHA256 eb19d819ae9654f0826209669936fef7886c6e74f0a9d246ac4e6995f9ca548c
- MD5 615549ac93acb56cf5e3fb44ebe051e4
- SHA1 aeb1ad34cd3eef41c447ad9c03bb6289e652682b
- SHA512 9a766ff4327415017948b04c1e4028d8a01b4be5649b5e0e197339a564db91b1dd9f98764ae70f7476f7164daaaa6d274c1300bbaac91591950aaa49d58dd648
- SSDEEP 98304:18zVXmab82nl/fwOzw2qFnMkP5Bnnfri2W3XKtjbK:4VXmab3QOzw2q95B/j2
- TLSH T1BF06BE327681C072D6BF02305968EAA596BEF5700F3185EB5398126E3F305D2EF36A57
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\BB8F4610-86CE-11F1-B995-F23C4AB2DE8F\cbi.dll
- Size 134KB
- SHA256 bb75946091663758e26b7898eeb8a2b1f220cc34700e3086d52610327a4889fe
- MD5 0720e3242d93bfd03c01c8a6a7ffc5e7
- SHA1 b6b8ad3f5070215c0eb734cf1431b7563d930e5e
- SHA512 4cd7d99a69ed709acae6490b30c0ed5c7dd977f8998e19b7327161ca9fbd75c38810efd81432c3c5a9d8ce7262c858109650cdbe881741b924c4f34d7fb397fb
- SSDEEP 3072:hUjt5lxQdfgbBLwZq9+KugEqFuwYsu4uwrflmME/CzM3LT9UnNd:ijt5lKdoyZhRku4uwrflmMCC8LT9UNd
- TLSH T147D35C0AEBC498F2FDB26E3A4C709511593DF6501B719C9B7F0C0A6D0BA02D19376A6F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\kl.setup.ui.core.dll
- Size 84KB
- SHA256 3a0c4dda5435673fd3ebbb8115726c20edaac2397e5e51866e948983001de9b5
- MD5 0c95c9e9fe37a28bcf421381e218a8b2
- SHA1 188aa4b8e0bbd30df10934736568e5c20cf7d8b1
- SHA512 78296d00c8ad00a34783d3f422cb56c479e1063494137e54b84d8ad1f81a46abc7a4a621134848fa49fed0a20efa6a8863a6026387dac0333009e0e860883546
- SSDEEP 1536:Us5PUltUWpFDnfYUkh8bctSWZ53nsl7yzqYgjRKnxr:JNUUWpFS8JWZ53nslUqN8
- TLSH T118836C0297FC0301F9FB4FB4A8B292504E72B7A6FC42D39F9588A1CC1A7175095A2B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\kl.setup.ui.dll
- Size 298KB
- SHA256 5283dee2475eb6131f22b16e9256cdd46bede478204caf80d701194e9579c48f
- MD5 43186b940be9c8560d45cd56b1ba59ad
- SHA1 fe8103128455e7acdbbde2f3c669490523a5a32b
- SHA512 13fbd99a16f712cf84facaa7c50540197a032b990c3e8befe101c5a72cd5d7038caec1a02f8ff319fdccd4b581f905a09e83d5748411896e856ef803b76c9b12
- SSDEEP 3072:TM6CmkSxMj9apW7qiVtHzWaLJOrrnztc2ePcPfRvMLT5ePquA:I63xCaI3dkrzz/MLT5eSuA
- TLSH T1D254498124AD5530EE6A87BDF0F25880AFFA65877E57C70D1A41788C2EA774747023BB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\kl.setup.ui.interoplayer.dll
- Size 57KB
- SHA256 31eef2cae4278f8b2b1042fd5533cf23e579c2d99d51da6b72dd8eb59d1fad79
- MD5 e0ab534fac26126acc965f4f309f4198
- SHA1 5c885d6b6271caf78cd973bf6b184491af6e2211
- SHA512 30de1bba5963c5ab8a2f08efdbecd78c1981a4d1360e93f5d4c70d31bad6c1364c746e538fa11712bda1a6ed535c5d98f0ed9bcf73937f496b270e5a78a9b961
- SSDEEP 768:Khjs3IJ3gqpvQjDcIBCvikSFv7mZE1sLsJQr2fnxNI5ALir5ALY4:KO3GR8DcItkS0ZEqgJgKnxN2g
- TLSH T1D3439D428BE84A03EEBB4F7DF8F559110FB0E2575982F28E164C90994B533506BE637E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\kl.setup.ui.visuals.dll
- Size 68KB
- SHA256 4ed9cb5293ee31f6b98c865800f6925bfb3e52231fb8ba7dfc1224ffd8643630
- MD5 ab528a52be58f4d1fe726b27a1ae3ce8
- SHA1 828481d4d37148a4def6ed0320db4ea2775b5230
- SHA512 127de02366a18400ebdda488f6df9bcb986edc114dfce1638b27c3cfcc55a54b0a6081c5d1141657392cbd15ace37f62cac668ee00b858902d88a6e4f3aec362
- SSDEEP 1536:j/yq8ekH3BWdkc5tH3VvCGvx1+orTB6tqhgLR+Knx6WA:j/yqzewx1p2q9fWA
- TLSH T106636DD213B89414ED278F74B0F2A8D5B5B516476FA3C68E1198991C8FA130F8B076BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\kl.ui.framework.dll
- Size 354KB
- SHA256 11e50aa5097f719625d93392a8bdcf0db6e1b5c8f7994e031844a2edfca54e7d
- MD5 0cab21599926650e413cdca6ac33841e
- SHA1 3bc2b3284b44e5a036016e4044c99c95f57124a9
- SHA512 d3cb6d7c6693cdc11695a717222487e63f8ba758d5bb78578496480459ee94e87c118a19a49e6c03ef4bb88c0e88f704223b7d97251c49d291a93657cc9a5b57
- SSDEEP 6144:u+dUSCCJRQ1MMsM8aMYMMMMMMMMMMMMMMMMMMMMMMMMMMMMMVMMMMMMMMMMMMMM7:zlXJR1SguscYFHQmX
- TLSH T19074594AE3940813ED9D2778ACA2160DBF70AC153417B34F2A14916EDCEEFD4CA51BDA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\kl.ui.framework.uikit.b2c.dll
- Size 689KB
- SHA256 0a0133decd4d246eb257738595bcf2557195200292fd48f054e9b5ffdeb64c93
- MD5 02c6d005c30b9fe1b2e4cef3f2a2afc6
- SHA1 7388e74525dba26ff5c38d494707b6bfbe6b2fb0
- SHA512 fe1ad05ba60fd026ed239c8a90e13167089e4e62a6343015f5cd93a8e3f58007265a430649e44152b23b2bf56688c4cbb245ad01fc93220346005c5c7953b0c2
- SSDEEP 3072:IrkCU7Ag3V3ozghrenJ7CJJ1gHPkLJIbrc91pNFpsuYGEAgNjZGObbwXvZPsvP+k:IvU7CzgiHPkLcnG9AxP
- TLSH T1DBE41DD422446A2CE713D93AF1AD8D507A312427F6126FCF275EE07C96E14C18E93B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\kl.ui.framework.uikit.dll
- Size 3.4MB
- SHA256 b2aee69ce6f1368693677523e16b928ba3625947b2262748b39d3ebdc3a3625c
- MD5 55c07ade93edb64efca8f59a515e5183
- SHA1 457313df273630b6b07c36d4d5338ad9fcfc7423
- SHA512 ae3e1ff1a170e1e2bec10e1b3d3038d1a5f371e8f7fe2442b55e916c43e24f8ccb8a711c00e972b75e0927c77de7bcff57fe33ab14935b3c4c1f2d99a0bd966e
- SSDEEP 24576:urrQOJ3DbhqaDfBFU7pKkWT01B38fBRDlFtUOqIFd0eIIloUoRbrMtB+L/2:krQOJ3DNfBhneuaIlK/2
- TLSH T1AAF57CE1539C468DED6BCF3CDE7A51A0573EF0BAB62CC34C596E92785883789C813216
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\kl.ui.framework.uikit.media.setup.dll
- Size 256KB
- SHA256 9e05dfc47aed698ed68ecc377b87618875a1cbb73799ad7ea003ef39b3052de7
- MD5 86572fc8f25c10cab4de11a052aed9b1
- SHA1 cd58cd929ceed7ba28e3ea2cc2f6cd82239825a0
- SHA512 2c575b4201ba9c027902ec459003037fb5c8d914f397599618be9930458e5c2f3c7908ff1fbd0f6d54ed8e57ade3e0edd1eb995bb1591d7a38a5e26e1bf3ea05
- SSDEEP 1536:FSHcp7kD2z5PkT5pM1l2MwYngF6WS+WSN2YJRskkosrhkk91J6EWpMQsQMwsgipi:Q+n4Okw3nbx15Ytd9
- TLSH T1AA4419D56738B2B4ECD34BFDEF2964E4344AB4FD45A542D8D1294A3826C2BCEF849C90
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\setup.dll
- Size 6.1MB
- SHA256 9498efe416b2e863bc7da4d577ebf39521161b655189f1134143250f6eb69cba
- MD5 740791991dec38d16825862a979fcf0a
- SHA1 b197fe01a6fe5c5774d1e586f5cce1a5290c6fad
- SHA512 775e88e96ddc9c1043361e39cde528044a6c5412be14fee33b6df613f13252d74beace9d31b05b9caaef22a7da9d1cbe362c0bb1710e6f427f76db6843449ff4
- SSDEEP 98304:dEIQ3e843RJXs71jdvHlK41U2Z42ESoLvfm05r9sbX1vQDrKjoSY+URzk6EJ+vl3:Q43RJyLqsWJ9sbQrPSYldkjJr0
- TLSH T18F569EB3A6AD847DE25F1175B9ACA695C3AC93330B3144C3EB94D94E2A784C15733B83
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\setup_ui.exe
- Size 662KB
- SHA256 e84db45899033f50a15c70a880e7b6a940f1386550d64621472a3337bd27a519
- MD5 64ada7eadc0e0a45a338b99b14a40c54
- SHA1 dc5d9784776479996ce69c77411f1db5d9d5bf6a
- SHA512 96a82ab1abc3020e0e00317fbe23985aff753a1728f39f67fb72b59d497989cbd2cc3976defd0a27ae0ee76d63946bffa977a2ea281be0246490d4cd6c0cfb38
- SSDEEP 6144:ZE2kZ6lw8JHWIy3mPAqoySZAO5rdJBYvMxg:ZEoGIHWIymAZjZYvM2
- TLSH T1D2E48D106EBC8422F422853D056C9573D57BBBECBB1F459722B42A3B8B63381992D773
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\sharpvectorconverterswpf.dll
- Size 110KB
- SHA256 b31fd4a2956b058b569f39cd4f655e28d0359f5ab3f34f0e287120fa7fa2e762
- MD5 68503fa4eed05f52e69905c849ae9c23
- SHA1 2d8480a7b8fa557d713ce7d85e036ff0b5eb7544
- SHA512 010dbb870cec7d9a01e8e02ed89c6ab346be2db01e05117a794566970def513eb9dc365449acbf3781307112360b4b980b63d4d3823983e4a5ccc3c96be5428b
- SSDEEP 1536:yYc2yyXTXXi8+TXAhWJtKH1pcMAnHp3vlOcm7FMLsMp38ipZe5nJ4+8g8KyKnxn:j48X8tKVpsZvkL2Lsy8iTSnJTUI
- TLSH T172B38E0936D48A06E57F4B79A8B455144B34B3039693E34D0F82A19F1DB3390AE5EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\sharpvectorcore.dll
- Size 204KB
- SHA256 65ffeac50e6afd5ca6f73292d36de86bc002874567658e7517fd0f77f1101a02
- MD5 e2ca0fc300257a3ad7bed0672fce10a6
- SHA1 be23b231fd367b9ebb6afe36885edc0ac9eb18ba
- SHA512 4a735099fcea8291984dfec2f49ce0f6e9b408c99199529daaa92bfe7db827e9400b82f4c1100c5831e85ae029197ebdd6ad37aec735847c5a5f0ef3d7586343
- SSDEEP 3072:iKJtMhUnTKuNrQGJrBf2xXxLpJxgW2pOnLHX0tMb6FZhC5l8nzT6l1aw0BQOOm1g:VP+g7U7LpJxgW2pw0tTFZhTM0mhmFQh
- TLSH T169143B1AA3A4C139EEFB1B3FBC71141CA97EF7012617DB9F08245C1C686BB958454BA3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\sharpvectorcss.dll
- Size 124KB
- SHA256 8b10c6b43355f1fcbbe080d2fd8839cf2b0065faa71bdac0c3f2f7c29f4c143f
- MD5 07d046fb38316487855ade1155c9054e
- SHA1 85d52b8e4d2d78b6de95829e061cfbac34679a14
- SHA512 1b6c7f4647f06597f64ea105ef5312713eb953eaa7ac74269e8be8fb81230903961e863f5cd1d612a1cb62a6615d81f09e3002f5ae87e24f0bdc5dbe4037370a
- SSDEEP 3072:tKYbx7QPy8QTcuxn3OPPycAT9Xt/XD0qh3:tWP5Q4uboqh3
- TLSH T101C32A2C7BE41855E7BECF78E8F450045B72B75A2E23DB1E1E8850AD29733618A10F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\sharpvectordom.dll
- Size 61KB
- SHA256 977f1f891bda1c3150f0a3b952534d73d72b5cfa70829b9cd0a4a859041d8a6b
- MD5 95819d7c28040ef570a358420efdde86
- SHA1 04dfea5d4d768c33ce8b78aaf631930f6c2542fc
- SHA512 fd6d23959fdd3a3bebfd89fd2194f12fbdad83b3604a669575470f45183bab26c3a1e21ef1b8b5519708a84cfab19bfa78e52a2364d4e985483e76fa5597b4bf
- SSDEEP 768:I0LR8/Jdru/GwjZPA1nx8ip86HCNpgl4rqxSzawnD446kkQldZW/8H5CZXhsLsUI:7/R+lcqC556Q5CZX2gUbJKnxV
- TLSH T1D4535B1C0BE81423EE5F177DE8E2020A07B0F247E993D79B2B5495752E363529A932DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\sharpvectormodel.dll
- Size 720KB
- SHA256 f0ab369bfa84dd267202fd067c17f56b22eeba1daae56cdb975e28448dcd1e91
- MD5 aabf59cf3b05653405e0a65c30e09aec
- SHA1 538ce577f181ac8fcdf5808103dce6c619ea66e8
- SHA512 dacacdfd421b14fea1a4085fb6129c81e262627a4265dbbb24d63ed3bd66c1a493bade8fdd4aff9e901a9697d416d3e6866a0d3168261f32195fcec81a17b007
- SSDEEP 12288:ip4NaUj3POuqL6I34qYCCOXKcDT4qp/uq:/gUbOuqH2DOXKcDn/P
- TLSH T107F480416BF84224F5FF6F7AA8B504244E75BE126D7BE74E229150AE0CB2B20CC61777
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\sharpvectorrenderingwpf.dll
- Size 287KB
- SHA256 74a8560b0c2048c39eb2e925d78136e533d28e76c82ae371899c8339aa74588c
- MD5 7a4e7c56e428b01167acf0638f6a070b
- SHA1 73e338e3c5a7e37bbb071bcc90bf54b1232e9a4c
- SHA512 a003beb5955da224b0eb109d4a1edc10c9cfeb3600b36b09bbfef886e1ddcc6f990ac5c207b0c9e092791004aaec43912b1d8427e4651445e80e53c001725a3b
- SSDEEP 6144:JPmVFTR8CpwGFNP7p+Ed1iHnbG9V+xMGt3kFisrXvJpfqimp:JPmuGwGfP7kGiHYGmr/J4Vp
- TLSH T184546C0C66E4CA05C97F5B79A1F011182378A212D68BEB590EC4A5FA1DF7390CF4DEA7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\C99CA6FAEC681F119B592FC3A42BEDF8\sharpvectorruntimewpf.dll
- Size 85KB
- SHA256 f7bbad2e4c47c6fcf04872943521555ca91aa3a50bdba922d2382543d3da2049
- MD5 2e49ba2d9ce3879c1db35d209d3444b1
- SHA1 dfd2b9ec8d8ae973ce052e6623172f154bec36f1
- SHA512 2ad1a4611ef5873e0ba79aab2ad05b727867945b09d57c2006488e4d32ba9cd657f794ce7512af00c52f6152ba7d80970402d70ecf69e27b551e4d911cdb92f4
- SSDEEP 1536:xpdXaVBEXt+QIBfrmGmGmGmGmGmGmGmGmGXXGmGmGmGmGmGmMOjFV6NVvKHg32du:xpdXaVuXtNI9EOjF4VGc4PJm
- TLSH T1EE838E1597E48903DD9F1FBAA4E306015730D742AA23F34A2B85E1F92E9335287857DB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kl-install-2026-07-23-20-43-17_KIS.21.22.7.466.log
- Size 1KB
- SHA256 83adb021b20f7754617bbb7e3a8e11921482d03609d1fede8877065f08969afe
- MD5 7598153f2caf1e269ddb7145d3b170ff
- SHA1 1037b63b754cc3c413fc0a1eb446a4d62eb58237
- SHA512 74153640a4bbf7803cb02336bc6621b2f2defb0633cdf6daedc2c5f9c58a4b28924e13c71915af840efd626681afb5f31417a3db6a5d95e385968cfec53377de
- TLSH T1D141FAA92AE50D06F2B39647EEF3C4515A33FC925834DB0C23854219066FD0AAD597BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\{44C45251-DD47-4C76-B5CF-8F380C51997D}\msi_common.dll
- Size 655KB
- SHA256 f2f527149591dbcf5d08d6efa0826802df821ddcd40cdb192adcd872e2e129f8
- MD5 07c733242013de2238133885d727554c
- SHA1 0635b3bd938cb43cbe7c7bf0275b5928d8d1d940
- SHA512 bbd7c1dbb9cbad066b900f9423af884e910aaf1959ed900ec7f424737d6230a435e40687ad055988b6f08c835633ecb53938f8214a59651741661b7be93c253c
- SSDEEP 6144:3uMj7iu8uNv9417w6AVC//AM00GtQYCPotGTd4t60XZaAOcwUgw8mG3TUkkQlOCW:3uMjPm7OcAMetQYCPo8Tlanys8ZwEXk
- TLSH T1E1E49E62B9D18076F0BA013015B87A655ABDBA300F22C9DFA3D4B67E5EF09C1A734753
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9607.tmp
- Size 184KB
- SHA256 7dfa31457ce79862edf4ef0c9fa570be466a12312c1647bea5a496b1b1cbe441
- MD5 795c4ae3d463c34e0b9a29aee8d15573
- SHA1 acca18d5915ac748d3c8331ee2f11a51b77943a8
- SHA512 b2b13a164430de94d7eed1aa2cde1c56ffa3b43d49842f3b5ff8810dbf4631a86753972cd2b38cf56eceb9f097f867a48f422607dac9c252314847bcbbf5db59
- SSDEEP 3072:jxzHp7Lyj+z97n9wot+xo7fgUKUUe1ye8zG8bS+Bow/hO/h6UyxDXkTi:jXyyzVFwxovKHev8zhGw90Ti
- TLSH T186049D12B1C0C076E67F16351AB49A625E7E79204FB08DCB33545E6E5F702C0EE39A6B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSI9968.tmp
- Size 2.5MB
- SHA256 442871813d41e34981616cddc776e6135457d21e0307ea6e9651d62fbc73cdc4
- MD5 96ac47ebf14b9b425862f9446a96ea9f
- SHA1 87e1505a404a63b54d9edbcec6d406ca3cd9de15
- SHA512 7529ae5d197519faba0693c4d2c8039ad4a3bc429728db5a1befaf1e5e5ccd41cb1a43da370352cd969532866aedd3e0e5628f15ad36b1c74dc6d6a7f6630a32
- SSDEEP 49152:N7RnRNSlc9GR2nDsMiK4n1NkYWhAM8Z3LEMAtUOyEf0tKlVc54CXn7TiPL71wwds:jnRNSl0GRstiKs1Nkh6M8Z3zAqKlVc5D
- TLSH T152C59F327AC48076F1AE0337696DA75482B9F9310F2145DBB390AF0EADB09C1A775B47
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSIB12F.tmp
- Size 719KB
- SHA256 df02ef55ad5860e8cd388999bf1be7405261d3301ed33e71f4af4eec532f892c
- MD5 ec680eed8667dc919413c09ba5e63cb5
- SHA1 becaeb87e32bb3fac511eec50259c6acd339b75f
- SHA512 d999fe75969df30ffe9e19775f68c3a8dc1b58f0a50352534e1f8b7ce78ee893930f82b8c5bdc7471d354a3c4844e2f15537a020ce3630c71b23647306e57ec2
- SSDEEP 12288:1w5Xscr9awgmPxJrWjCFficpf0irrzj8zY2LPQYaOD:i55M3S7kMf0mCY2L4Yaq
- TLSH T1D4F41722A6E9C036F1FF0631683D866618BA7C624F7496DF63908A3D5DF0AC29570F53
- MD5 SHA1 SHA512 SSDEEP TLSH