0c193e71ab699dedcf9a9233af8553eba42eccea2ada296bbe5359ceafa49d09

Analysis

user interaction
yes
max time kernel
158s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ABBYY FineReader PDF v16.0.exe
Size 699.0MB
Sample260701-exj58aes2p
SHA256 0c193e71ab699dedcf9a9233af8553eba42eccea2ada296bbe5359ceafa49d09
MD5 a51b59abdf8ebf002cf3a1546ceb6f10
SHA1 cde0a15c974998ca5effa6e26b62b4940551876c
SHA512 0d25e00722fe30bfbb323dce204edef43d599420300cb040064231a36294fcecba4b073836d99c71fe22a624c316de4300884ec2cc769b403b1086fc64fb6bdd
SSDEEP 12582912:rXo43j4fSrWBhCQJNVr2XTO0s1Nq94i2b9JJba8mjMZA9loKlMlsqtl2jRlrh9Vu:rXhEYW1nVGg+GNTMLprasqtlwDzE0k/H
TLSH
T135793332195DC583FAC9C730DE8A655CF0653DB5C22648EB6BF83769D0BEAC592324C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence privilege_escalation ransomware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
5864	NetworkLicenseServer.exe

Loads dropped DLL 43 IoCs

pid	Process
2988	MsiExec.exe
2988	MsiExec.exe
2988	MsiExec.exe
2988	MsiExec.exe
2988	MsiExec.exe
2988	MsiExec.exe
2988	MsiExec.exe
5028	MsiExec.exe
5028	MsiExec.exe
5028	MsiExec.exe
5028	MsiExec.exe
5028	MsiExec.exe
5028	MsiExec.exe
5400	MsiExec.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5864	NetworkLicenseServer.exe
5028	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\L:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\R:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\S:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\T:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\J:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\K:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\P:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\D:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\G:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\M:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\Y:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\N:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\O:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\V:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Q:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\U:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\W:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\Z:	ABBYY FineReader PDF v16.0.exe
File opened (read-only)	\??\B:	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\ABBYY FineReader 16\Engine64.dll	msiexec.exe
File created	C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing9.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\TaskAutomation4.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\FineUI16.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\AInfo2.dll	msiexec.exe
File created	C:\Program Files\SharePoint Client Components\Scripts\SP.Translation.debug.js	msiexec.exe
File created	C:\Program Files\SharePoint Client Components\Scripts\sp.search.apps.debug.js	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\OldBatchConverter.dlp	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\ssrcore0.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Image.OrientationPostProcessor.cnnmodel	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\comparator8.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Scan15.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\pdfengine22.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\handwrite.clc	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\StdAdbFnt.mtr	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\FRIntegration62.dll	msiexec.exe
File created	C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\AbbyyZlib.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Langpack\Formal\payload.zmd	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\ServerScan1.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\CMap\GBpc-EUC-UCS2	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\RusOS.amt	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\SignatureFonts\BadScript-Regular.ttf	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\TranscriptionEnglish.amd	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Image.PatchLanguageGroupsClassifier.cnnmodel	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\AInfo5.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Nogay.amd	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\registrator.exe	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\CMap\ETen-B5-V	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\TrainingUI62.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\HotFolder23.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\PdfTools.IndependentRenderer.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\French.amt	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\FineUpdate16.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\CMap\Hojo-EUC-H	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\CMap\HKgccs-B5-H	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Xhosa.amd	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\SndToWP21.wcm	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\OldItalian.amt	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Latvian.amd	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\CMap\Adobe-Korea1-1	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\image.format.pcx.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\DocumentAnalysis.PageServices.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\x86\FRIntegration64.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\pdftools.encryption.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\TileImages\scale-180\CMPLogo.contrast-black.png	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\HandwrittenText.TextLineSeparator.dnn	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Courier.0.4.fch	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\TileImages\scale-100\HFLogoSmall.contrast-black.png	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\SendToSupport2.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Khakas.amd	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Romany.amd	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\FineUpdate17.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Latin.amt	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\clusters.gistis.2000.1.icp	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\fineuires.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Barcodes.Code39Recognizer.e2e	msiexec.exe
File created	C:\Program Files\Common Files\microsoft shared\Web Server Extensions\15\ISAPI\Microsoft.SharePoint.Client.DocumentManagement.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\CMap\ETen-B5-UCS2	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\EULA5.rtf	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Scan4.dll	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Synthesis.ParagraphAlignment.pat	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\CMap\Adobe-GB1-0	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Japanese.amd	msiexec.exe
File created	C:\Program Files\ABBYY FineReader 16\Ojibway.amd	msiexec.exe

Drops file in Windows directory 47 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\screenshotreader.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\finereaderocr.exe	msiexec.exe
File created	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\FineReader_1.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8C64.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1D78.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI343F.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.Client.Publishing\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Client.Publishing.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\FineReader_1.exe	msiexec.exe
File created	C:\Windows\Installer\e5ae63d.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37AB.tmp	msiexec.exe
File created	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\FineReader.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\comparator.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DF64D51C4ADF44AC10.TMP	msiexec.exe
File created	C:\Windows\Installer\e5ae63b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B36.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5459621028C23999.TMP	msiexec.exe
File created	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\FineReader_2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8CA3.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.WorkflowServices.Activities\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.WorkflowServices.Activities.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Client.Education\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.Office.Client.Education.dll	msiexec.exe
File created	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\screenshotreader.exe	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBEF69A036E9F8B06.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1CCB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E06.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5C5E340416AA27E8.TMP	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Client.Policy\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.Office.Client.Policy.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.Client.TranslationServices\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.Office.Client.TranslationServices.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.Client\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Client.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\HotFolder.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.Client.UserProfiles\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Client.UserProfiles.dll	msiexec.exe
File created	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\HotFolder.exe	msiexec.exe
File created	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\comparator.exe	msiexec.exe
File created	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\finereaderocr.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\FineReader_2.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI98CA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5ae63b.msi	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.Client.Taxonomy\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Client.Taxonomy.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.Client.Search.Applications\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Client.Search.Applications.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.Client.DocumentManagement\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Client.DocumentManagement.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.Client.Runtime\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Client.Runtime.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.SharePoint.Client.Search\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.SharePoint.Client.Search.dll	msiexec.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Office.SharePoint.Tools\v4.0_15.0.0.0__71e9bce111e9429c\Microsoft.Office.Sharepoint.Tools.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\FineReader.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ABBYY FineReader PDF v16.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000611f050cfb2bdaef0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801611f050c0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101611f050c000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3611f050c00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6611f050c00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B6848A99-A851-4D21-B0B6-B98B368965CE}\ = "IDocumentLibrary"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FD6C312-06AD-405D-A870-AD4F68232834}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{219215E2-0529-410A-9A9F-47C260D289E5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{CFDFDF82-2B16-4E17-B54D-3B33F0A00BC9}\10.0\HELPDIR\ = "C:\\Program Files\\ABBYY FineReader 16\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C9A2BEECF5D359E409DBE77B630501C5\ProductIcon = "C:\\Windows\\Installer\\{CEEB2A9C-3D5F-4E95-90BD-7EB73650105C}\\FineReader_2.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{68754701-F6E7-4D98-A7C0-D89B1F7E7A2B}\TypeLib\Version = "10.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A9F0DC6-AB0E-4977-BDF2-76C34CFC05FA}\TypeLib\ = "{381AEC03-7984-42BA-AF52-DB07F7967860}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4167BBD7-025A-4E6C-8D54-8044C029EE07}\TypeLib\Version = "10.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B82BD9EC-6C1B-42C9-B682-F631E30727AF}\Programmable\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80660DC3-BF88-4915-95FA-A332DB92A453}\ProgId	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B6848A99-A851-4D21-B0B6-B98B368965CE}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2CE205F1-E1A6-4A0E-802D-9A824679D662}\10.0\ = "FineUpdateAutomation"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\HAM\AUI\WebExperienceHost\V1\LU\PCT = "133357937048801138"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7851AEF4-4408-456F-8A5B-CECA3F1EA559}\ = "IFileStatus"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DCACA03D-01CA-410C-8F35-FBEB05CA8BF0}\InprocServer32\ = "C:\\Program Files\\ABBYY FineReader 16\\x86\\FRIntegration.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{80660DC3-BF88-4915-95FA-A332DB92A453}\InprocServer32\16.0.14.7295\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5B4931A0-2EF7-448C-A294-78CCF22EB362}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F6D3A2B-10E2-4096-92A5-B7C802DBD394}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A02A162A-CDEE-442C-BC0C-A9798055CAC1}\TypeLib\ = "{381AEC03-7984-42BA-AF52-DB07F7967860}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B7FB3943-15DB-4CDE-B29A-330D119EA609}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SPConnectorLib.ConnectorInfo\ = "SPConnectorLib.ConnectorInfo"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FineReaderPDF.Viewer16\shell\open\command\ = "\"C:\\Program Files\\ABBYY FineReader 16\\FineReader.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ABBYY.FineReader16.Comparator.Integration\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{032B01C8-B3FB-4087-9E45-F6A316D4AD44}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A9F0DC6-AB0E-4977-BDF2-76C34CFC05FA}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FD6C312-06AD-405D-A870-AD4F68232834}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ABBYY.FineReader16.OCR.ScanButton\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0FCACF0-127F-4EE8-BB6B-00CAA5FF94C2}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A02A162A-CDEE-442C-BC0C-A9798055CAC1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5909E15D-4FB4-4869-B9A9-3427EC589EAB}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{56D770DA-E9C0-4C3F-8706-6AA82BF1D310}\TypeLib\ = "{381AEC03-7984-42BA-AF52-DB07F7967860}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D4AAF1DA-1416-43AF-9B97-2470265ECD11}\ = "FineReader.Integration16"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{581F0637-EF98-428C-9042-7422205D078F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DB0A0174-EC5C-4CF9-B7D4-3C92860137CD}\TypeLib\ = "{381AEC03-7984-42BA-AF52-DB07F7967860}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{27CE279A-B3A0-4CA4-AE9E-8431207B6EE7}\ = "ITransformerStiScanButtonHandler"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C9A2BEECF5D359E409DBE77B630501C5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5909E15D-4FB4-4869-B9A9-3427EC589EAB}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{635B3EAB-0E5B-4C83-B3C1-BF95FB6D9950}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DB0A0174-EC5C-4CF9-B7D4-3C92860137CD}\TypeLib\Version = "10.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{43DDA87F-E927-4AB8-93DB-ABE2635D7367}\ = "ISubsites"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F24682FC-9098-4807-9FD1-A1537BA33689}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A33CD78F-0A2F-3943-826C-5BA6F54DC5BC}\16.0.14.7295\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{6F762EBF-80A4-368A-9A06-B85154CD59D9}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{43DDA87F-E927-4AB8-93DB-ABE2635D7367}\TypeLib\Version = "10.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFB2A2A7-BB8F-4AD4-8366-E4154A41A316}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{148B7323-5C68-4217-9BC6-286130D48A3D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84D3CF00-9D25-4F1A-A4DA-5CAB86D616B7}\10.0\FLAGS\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A614EBD4-9418-4C6F-992F-07972F4FACDA}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DB1D794B-F2EE-4B41-985A-A1A3F2A8009F}\InprocServer32\16.0.14.7295\Class = "SPConnectorLib.ObjectFactory"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{43DDA87F-E927-4AB8-93DB-ABE2635D7367}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{82C5FFAA-BB3C-4874-8EDA-76AF3CC87A60}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1b683729-78ee-444b-b869-7f88e55fca03}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4DE5248-3EEC-4173-8B65-E7D73324243F}\TypeLib\ = "{381AEC03-7984-42BA-AF52-DB07F7967860}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5B4931A0-2EF7-448C-A294-78CCF22EB362}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62D45251-73BE-44B4-8F8C-4650B9FFBDB4}\VersionIndependentProgID\ = "ABBYY.FineReader16.PDF.DebugAutomation"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Record\{A33CD78F-0A2F-3943-826C-5BA6F54DC5BC}\16.0.14.7295\Assembly = "SPConnectorLib, Version=16.0.14.7295, Culture=neutral, PublicKeyToken=2e1e7aca5d298f96"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{288077D2-B05C-465B-ADC5-C6C08AEFB1DC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C586726-144D-4FD0-A67B-FAC7BA069EDB}\TypeLib\Version = "10.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B2C9417B-B276-495C-8BA2-D37D10AF4DAD}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF67747E-640C-4552-AD6A-9D0BA6183C37}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{86299283-D911-4866-91DD-0D5600C86F9C}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C9A2BEECF5D359E409DBE77B630501C5\PackageCode = "59E43DF89CE664546AA318693FB45E86"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B82BD9EC-6C1B-42C9-B682-F631E30727AF}\InprocServer32	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2136	msiexec.exe
2136	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeIncreaseQuotaPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSecurityPrivilege	2136	msiexec.exe
Token: SeCreateTokenPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeAssignPrimaryTokenPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeLockMemoryPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeIncreaseQuotaPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeMachineAccountPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeTcbPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSecurityPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeTakeOwnershipPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeLoadDriverPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSystemProfilePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSystemtimePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeProfSingleProcessPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeIncBasePriorityPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeCreatePagefilePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeCreatePermanentPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeBackupPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeRestorePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeShutdownPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeDebugPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeAuditPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSystemEnvironmentPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeChangeNotifyPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeRemoteShutdownPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeUndockPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSyncAgentPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeEnableDelegationPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeManageVolumePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeImpersonatePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeCreateGlobalPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeCreateTokenPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeAssignPrimaryTokenPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeLockMemoryPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeIncreaseQuotaPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeMachineAccountPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeTcbPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSecurityPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeTakeOwnershipPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeLoadDriverPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSystemProfilePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSystemtimePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeProfSingleProcessPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeIncBasePriorityPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeCreatePagefilePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeCreatePermanentPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeBackupPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeRestorePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeShutdownPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeDebugPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeAuditPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSystemEnvironmentPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeChangeNotifyPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeRemoteShutdownPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeUndockPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeSyncAgentPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeEnableDelegationPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeManageVolumePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeImpersonatePrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeCreateGlobalPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeCreateTokenPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeAssignPrimaryTokenPrivilege	2468	ABBYY FineReader PDF v16.0.exe
Token: SeLockMemoryPrivilege	2468	ABBYY FineReader PDF v16.0.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2468	ABBYY FineReader PDF v16.0.exe
2468	ABBYY FineReader PDF v16.0.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2136	msiexec.exe
2988	MsiExec.exe
5028	MsiExec.exe
5400	MsiExec.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2136 wrote to memory of 2988	2136	msiexec.exe	93
PID 2136 wrote to memory of 2012	2136	msiexec.exe	99
PID 2136 wrote to memory of 5028	2136	msiexec.exe	101
PID 2136 wrote to memory of 5400	2136	msiexec.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ABBYY FineReader PDF v16.0.exe
"C:\Users\Admin\AppData\Local\Temp\ABBYY FineReader PDF v16.0.exe"
1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2468

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6CE4EDECD2EEB33D3DD5FA8FF0DCCA1E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2988
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B68C6C403E126F0822C05098A1754FFA
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5028
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 190BBBF8D7E8D9E87307763B0A300BC6 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5400

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3812

C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\NetworkLicenseServer.exe
"C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\NetworkLicenseServer.exe" -service
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5ae63c.rbs

Path C:\Config.Msi\e5ae63c.rbs
Size 2.4MB
SHA256 192595b5a9af7078c7334ca6f55f90426435eaf315b3f8b3864338447dec31b4
MD5 11d35c59c3dd7208b011248db223713b
SHA1 654d68cb6adb3eb5e5b1e0245db485870d17029b
SHA512 3859477d1802f9823497e0994dab644c4f27c82aba04867d332bc7151939317480362448594a2fbfd7f19d1dd292ac3a4af0aaf5d2f62090da1f13c9a7f63081
SSDEEP 49152:tu5EC4qQAWRKoRTxaUZF9HsdBp1vZxarORLG6rQZ5aTIsBFAofauqxuzx1oxpiai:6
TLSH
T139C5B9E4764240E0F2528C67F22CFE596174FAAFCECDC6241268C135E7E77864E548BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EULA9.rtf

Path C:\Program Files\ABBYY FineReader 16\EULA9.rtf
Size 53KB
SHA256 1fe356657676c5a10abf0aef908253f5100e0678edd0ee111a405257d286439b
MD5 3ac27bbb047c29077f93f683fabf8dfe
SHA1 5a2a1f5b203867ef35222272653ad3fa38bb2e97
SHA512 54c0bc75b7514be7013ece788eba60da3324076978f0ed284695e42bb40483874aaaf89b10c382c11e5fd0a6043aaeee82ff178ae573fe7898444e8c6f843eca
SSDEEP 768:pOalnhDnEC4daNsaPLUa3cyksG4rXjcnxIe2Ja6JL8yxm4HSQddn:pZVPoacsQ8/XzS+p
TLSH
T16433A95AB34713B20AC60262265B90E1FB1FC1FDBFF992D15859C0193306D78A3BB9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FineReader.exe

Path C:\Program Files\ABBYY FineReader 16\FineReader.exe
Size 7.5MB
SHA256 cf56367ea8897da61174fb749ec4ccdf329b7c289f1db853e4ee000980ae2e55
MD5 f4ea5db537a768893d56cb4b5ddc4130
SHA1 9b41e675ff9f6f4096dd411ce69a9eaf99611509
SHA512 f1d3c0f618d49fd889c6679bae40661e91c0bc1dafb5b4c2e6607eec8e39814388875ee221f2e957ee40c3f189735055e9dba8d3603fdd0e6967c36ecf7745d9
SSDEEP 49152:WCixgKeu2gmBXyzhISFnUxNgNQckTmODRdGppHXM6K0AcevlaFwXfXSlMoj5V5i7:FQLzODyH6v/T2FP3q3udFTtL6+A/9wQ
TLSH
T1F1864C62339942D4E1B2D678CFC6C506F3713CA187269AEB0831766E9F376E44D7AB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AbbyyZlib.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\AbbyyZlib.dll
Size 269KB
SHA256 aa6155c2b648a4d5a337db52d774755c95e9799e579095a2500bd5d7277bbde1
MD5 d9103bd31f0f7fb30f553c7f26eead7d
SHA1 8349f7aeda8eb53db23870e886b0fa4504238905
SHA512 bd3ae3a7bd4fd8dff28962a9d8aff5147afac59436ca9269800826ab3430de6d1df6bd32e4b74a760c4f4ba12dbb1497e1cb56fcef665d250f335d616b28b52e
SSDEEP 6144:tO0z/KIioVfvdk+IZJlWfFobM0Pg+NOG1N:rTEYf25JleIPg+LN
TLSH
T106447C65B6690DAAEEB7C039D6D7855AD6B3B4420310CBDB4224831B1F13BE0BD357AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FineNet.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\FineNet.dll
Size 404KB
SHA256 77eb829fc8f7d533845d8e05b748f5c2bf15ed746334970396a44131ecdd3e4b
MD5 6e9c9e449bdcd4c8379e281ef8d54bba
SHA1 ce717aef7c86d471b9de243ab6836c1d0ba0b9a9
SHA512 5599ef9bde666609424f42481196f5b4d33518440dd2e3f00c3ce70e8eca55d8451e1adc982c168101082c277c4ef39d447b44491b38c44c9cf05910e198e936
SSDEEP 6144:oNSHf/KSgou08js7ohP3piN9FRbiTXaFlinLfoDVc1DlyjSA14b:oA/0ozGKQpiTFuatBc1ur4b
TLSH
T12794292AF6680465E1F6E478C7A7C906E7B234960771DADF6154834E6F2BBE0ED38304
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FineObj.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\FineObj.dll
Size 726KB
SHA256 eed5860986ec79c06383c23ca301ed3d2f140394bd7a30ba08f530700ae66567
MD5 9ff2d8322c0e3edb3ae560911c0d6fca
SHA1 c20706ce64ad262dcaa655c2f4ad50cf91f3ffe1
SHA512 33e8b69f5667d6dffe431f3d880b6894b1e10e2fd4457f6d5fbc2f8b7f59f24cc2cdf9c8c5ca787b352cded4c8dae7cf1bc2869052795cccece8e3e9fef490ea
SSDEEP 12288:ofc743Ers8PK5hooyceBbagqZk2NM1YK/xGKuJXqtc:Ac73P6ioRibagqOqKXtc
TLSH
T146F45C15BAAA535DC5B9A17DE9C7801AFBB2B00247228FDF413443696E237E4DB3E704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NetworkLicenseServer.exe

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\NetworkLicenseServer.exe
Size 1.5MB
SHA256 73b7116dd1286a91181b13da99828442b69d56e0508afe375f6572fc600b7572
MD5 f7d505b19f238d70b7ff88321546f5a4
SHA1 ce77e5f12dd534d26d963230f8d9e38ff69e11cf
SHA512 c8d61e589031ab783349d1230e1e848cb3290c3519c34bc63629042fadb177e8b3c2e06f9e354523d0a5509f71aeee79f443ae49ff44e2cc9ab786b0135e2176
SSDEEP 24576:LJfeybeLPTl0zJQdmfWmV+4zSseJJJZnigYAkrZghAK0Cj4:LJfHyPTl0zWdmfRV3zp2digYlgO04
TLSH
T13B655A2B729941F5D1FAD479C7968843E27078028B399EFF56518A2A1F37BE1CD78B00
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing0.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing0.dll
Size 231KB
SHA256 e085dd40ea353a156282a424d072a053215bb9c31a40272e5010f0109d95dc64
MD5 db3ce11077a3e0fe5a64db5b925fe757
SHA1 0fe53c27dbe21616c9f1c5cf4d64b6d3de8239b9
SHA512 aa06e2fb70c19d3afe8316761f467cb452916e3dedc24235a7fd3cc765ca7a603fee7bf9a37ad2a481ae47855536ef4a8f058242ab77984a7e37d5510998ea6c
SSDEEP 1536:XSo2pzeplxJCaYZcfnT/+9VV2bjswxw2SVs1X/HDgYibuMrmP9YzpA4cRcjgLCEF:CtWlYze4cRcjgLCEjZfktHP0t
TLSH
T1463459517AEC6108F2B73FF16FBAD698CB67BCE9E936C20E1161108F4561A418F61732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing1.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing1.dll
Size 239KB
SHA256 07294500e0ee04565808ae95128adc891454e5afb8823fe9b5c5950a35df643c
MD5 cf592f207f69b0e7ae760031c591b3b7
SHA1 6d473bf0b110108e2e1895f8d7ec0d137ba5882e
SHA512 119d14de7a7571f9369c8c80ebb57c568440077552011c5ca53c437f35d17eaeb62e6ee2a244c7f189a757f6aafc151de9272e65e2bac6e0173b20ec569cb9bb
SSDEEP 1536:RpHygCJmjVufKJCaYZcfnT/+9VV2bjswxw2SVs1X/HDgYibuMrmPVa9NJ4LQ8lNh:TCJmjVA4LQ8lNCjLXFNAK6/gTHlAP0k
TLSH
T14B34CC0FBDFCA008F654B7F10F8ACADA8266F2E46313428F516F6D9B5159A313B11672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing14.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing14.dll
Size 229KB
SHA256 b3625167252d2ce6076bf467e3f94551cb7b2b5585b8776d272e921260c6cec7
MD5 10b417b8a15eed133024c1c40e12942a
SHA1 f31738e0690095d221d29290df8e7cc3a39a8890
SHA512 973812583e7b1ccc2357fb8f233d028b36653eca72905a37aa38ced6d3a070ef3758358156efe5e57ca99f9b92232d8070d957f459b83c4fa78906268e5bef9a
SSDEEP 3072:o9cq0+jxY4yYYlyaOd+Drigk1f82aHXgLi5e5P0W:AFveHW
TLSH
T156348B1036FC640AF2B77FB56FF9C6D98B77B8E9A536820F5161428B0561E809F60732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing15.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing15.dll
Size 228KB
SHA256 c353f1c3dfc0a45d5f1da900831adac338da87b411f41599d38d5310760f5f19
MD5 b26f30b4eb520c77106a37af0dce2317
SHA1 3dfaef69c1e2119f64bd318754d2bc861f3fee92
SHA512 b59dd949123014602d5e77db622120512d189c7710ea993c13071949fccd83160dabbf12bcab6a9d04eda7f138a8d2634dbcdc7f74c570f173ee0c314a042fb9
SSDEEP 1536:4i2MnJCaYZcfnT/+9V/2bjswxw2SVs1X/HDgYiluMrmPj6RMWSbf3lSJ1ESuWwUO:j2DRMWSbsqaelQfaTLpJghfrcP0c
TLSH
T1743477007AE86508F2F77FB59FFAE3CD8B67B8F5A536824F1161114B0661A818F61732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing16.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing16.dll
Size 226KB
SHA256 8c9163187df89e07c1b3a204fa53a1769572813b32da46eb6ec65d8ee657e248
MD5 9852d84f7272210770854ba36f6b99b2
SHA1 c17980223cafa9782432f271a8aa5d1a98a6ae4c
SHA512 75a22c10c9ba9e7b44ba8bdf047e0b8a6fd8286d0d6870d0bd7bf78810bcb88cfbf7e32867f88b1afa297da1edc2c44f954cf6b5b5db3a0c2a13f13c1d427445
SSDEEP 3072:V309L/mXVz1ZKnj6IL1L0oHBK8icdIuYW89hDOjIoplQU3TXAHiXyysP09:VoL2Y9
TLSH
T153347A1139FC6519F2B77FB15FFAD6D9CB77B8E5AA32820F1160028B05A1A809F51732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing17.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing17.dll
Size 229KB
SHA256 ca05746e59bbd5562850264e2dea1cc689a6c61a12ec51ae40e7859989f0fb74
MD5 48cf1b9d088efa1d06431ec77abca1b4
SHA1 b2958341300482bb9ebf6e30433f20bcff0d5f46
SHA512 117448f5a6076daa45698bc6a534db063784ec0e9e6815343ff04029c29c7f55db104787d692208d361cf50c92d94f3ba140dc8d9404a0db63eb4cd5a0391a5b
SSDEEP 3072:KdHvWyqW/N2JZSxu/plc1QPoSl0rrsDJy/fCO6fCI32rM9OHB+0l+UGgKsJszJxn:K5evWs
TLSH
T14B348E0076ECB519F6B36FB26FF5D7C98762F8E8A936C20E9150518F0562A85CF60B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing2.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing2.dll
Size 238KB
SHA256 16100d59e40c441aa1482e36781b6ca0502bb71022a1b497fbc411ba756c8a52
MD5 d5dfbb067c063029594eece9aca9cf02
SHA1 9df1b807816f8227de8eac51ba6d876287b81c23
SHA512 06fd23c95d44c32c35221d196c299411eb6153255b8b7b488b3c3a58faa25d4c1bc435896ca4564bbb0360b4406c979b81cc1f176852038142f74ec36ee894f0
SSDEEP 3072:tuq+vFjMkVShftO9AIK3E8eLRZrzdnc+zU4+XNVu6WUfnVcaCw/xr1Y/2PYSW8Rs:tuqyWC
TLSH
T1F63458107BD8A519F2F27FB56FF9D2998B63BCE9A976820F1260118B0571B418F31B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing22.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing22.dll
Size 244KB
SHA256 ddeb068cb7fb3b2ce166a10ceddfea2df7a345aa98df0738c98fd3fb71945b79
MD5 ff98f24a522ffae6f5f482539043c383
SHA1 a847a90beeee3ef9d3f3c571d1b3e3a05983e2f8
SHA512 7f609767b2c43752ff43df3be306ab9417a2cbca89696fc18c716b796538e4daa79486c49cace73ebddbf81386e8c5b333eed5d6f0193e9be867c1d4a4894b23
SSDEEP 6144:oiRy9eEp9QEd8OYg8ngpMkPzIUDEIJHMvv9oou0081:or9eEp9QEd8OYg8ngpMkPzIUDEIJHMvx
TLSH
T19634988838EF7114FB957AF15EA7C69AC76FF4E95021DA2F32B1304A954E9014FC2A31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing23.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing23.dll
Size 230KB
SHA256 7ea20cf5b9956bbc5dda61fa6b89bf5ec5e0f3605ec151dbb117c19d1ac46a74
MD5 02db7aa1a8a110da0c07cbfee638168d
SHA1 a7a0b35ebe30723ef7e00dcce5cc6672d46fa468
SHA512 157f26dbb25d0849eb027cbe6fd41f188b32eb1ab09d4a190b807e52801b49179f3294a7d9641b6e44c5c3d1b9061e8ec3723203a9e633de0e1fbc362af3f5d1
SSDEEP 1536:u8nEF4RUO2JCaYZcfnT/+9V/2bjswxw2SVs1X/HDgYibuMrmPmkpeSrhpNOUFhhI:xnE+REePU/2CAm4Ni8RNP06f
TLSH
T1CF347B0FB8FCA008F744B7B54F9AC6DA9376B7E46322028F426F7D9721596312B11672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing24.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing24.dll
Size 227KB
SHA256 d018dd3a94d3ce5a73129a287494a1b138911bec66673ccfc5e6a64267679757
MD5 5506e1f7ce43bd52601e34e42f75be47
SHA1 97b52c32d987a709d4b91b0d5d98426581583789
SHA512 b5ad2db3cf43756e06deac21636092d935ad3a523d96efe41a6064f87474d78ee9a18fc5773a6de48f3196d4116419dfa1c0b6119ef066c4f77f22d40f5e0d20
SSDEEP 3072:bCJmkQZm/frRqTXcqrl2Zz3cXe9Whgw3ND5gYDImehJaT+TrHpu1DFvjK+mhPEeL:XwXce9RUc
TLSH
T168346A107ADCA019F6F33FB56FFAE2CA8767BCF5B932420F116111871565A818B25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing26.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing26.dll
Size 193KB
SHA256 401c842c4067564d5ec97adf770fab01b9c185465ffef664aa9f20264ec189c3
MD5 4929cfe1d1eef0e13f7403f26660a159
SHA1 c6e92aff6a5dd7e9294ed7f9b38c4b75b24fb744
SHA512 2d6ec1dcf8ecf660aa2acc6e07b03cf4d2cf5c3e30c55ae5f2413674e8078bc21dc807fd0c9ae37025c9cbac18f0944f6fba3588385e2dea09fad9261806b5bd
SSDEEP 1536:fTctG0WTJCaYZcfnT/+9V/2bjswxw2SVs1X/HDgYibuMrmPN4qYQmJl3eMkJ+353:otG00YlJ5OJ+JiYiQDXf1fTeP0L
TLSH
T14E141C043DE9B11CF2A27BF28FDAF6EDC76BF4F8A163024F016555871246A4A4B15B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing27.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing27.dll
Size 233KB
SHA256 b5d215edc2673a044d4c9d6880b3ca96e86ad1a559514f152e05e3eba9c77093
MD5 ea6f87d5370992590860f743083596f7
SHA1 9910f748af86a1e8dace3eff4565581cdb3168d9
SHA512 f0a01d5ddf1d63f9e2b5b2124f764e51f618ea4252e86a30e9b7ce95a91f7c2ce7e984a941a63adf226142bb0b229662bb5aa8abec951eab9edc7e49578c4f53
SSDEEP 1536:Zf67JCaYZcfnT/+9V/2bjswxw2SVs1X/HDgYiluMrmPCMFIutoBRkJ6U5PWzTFYM:xuIutoBGJT50j4o/pzGP01
TLSH
T1343459507AFD6208F6F37FB25FB99699CB37B8E5A936821E0120118B1971B448F64733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing3.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing3.dll
Size 239KB
SHA256 85b52328131b7711122040c7ff96c456ad562b72aefce7282838845cc7e889d1
MD5 cd987b77277a00cf1462d06368f1eb7b
SHA1 e2bde47b3d9fa003b321397b2ff6fc91c57187b0
SHA512 43be58fa6aba3d4d14c0123aff32c7159333ae1e5bc80c657d1fdc6c254a62af8d632bfe7466ea60742222dc0dc89b9436efc49e94a90ea7b27672eea7961075
SSDEEP 1536:/1ExozL7JCaYZcfnT/+9V/2bjswxw2SVs1X/HDgYiluMrmPbn3+yQal9VcDfQWz3:9ExoP3+yQalzcDfjR1ngUP0c
TLSH
T17A34461077E86109F3F23FB16EBA96998F27BCEAD932C20E1161518F1961F448F65732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing4.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing4.dll
Size 237KB
SHA256 12a2d27572201f87a15166a327d6a786be06601e2b92d0795bda6e295b00bb2b
MD5 26d7532c37abb8e451cc38b3d9cb6b9e
SHA1 4da97913678525dd3fb327ed828bfd5dce219687
SHA512 3b0c7461dc0cac1c172afe0bfacbe4b98e60169c72fb4354e68720e8ab1daafb68bb89c50cc07d196923b25e10dccc940b3bf5bc604fd0dfe2dc9aebe0e61e3c
SSDEEP 3072:N32f9c7XKC4E3LUr7eKSvuW4vylARAeP0+:NcCuFqug+
TLSH
T1BB34DB0F7CF8A018F744B7F14FC6C6CB8366F6E86392428E616F796711696312B116B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing5.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing5.dll
Size 238KB
SHA256 83d4c2d23e534b98782c0a00e4609cdeb9ef4269437e4974e74ecf2d1804fa1e
MD5 419eafa7d1e3e8b945bd435be88692d5
SHA1 d58ddfe64f15327dcec38d33954108559264d833
SHA512 8773a8f6a4fe111307d66c58f329d265b48129bf173becf1ed38e1ab9392cf94d19365d18f941a1cde1ae9036b419efbb6e0b6eb2782df7040743a80a247d074
SSDEEP 3072:faPqtlhcDxlulBgobSBubTztbSxzgpFP0Z:faP/WBtbTbTOZ
TLSH
T1F63439007AE96209F2F37BB55FBA96998F37BCE5E936820E1121118B0971F448F65733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing6.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing6.dll
Size 234KB
SHA256 7cfe992e4f8274911b694ed60fe4a9cabdaaa124f5f7002c312f4563c212eb56
MD5 4633a6c4875f17fe8defd8cf1264b20b
SHA1 615723a19a897e0b115d84df43ebe087517a28bf
SHA512 6c3a2c0321c51ec87fd6dbb6467df78da167f90b766ed3edb63c96badda9d4507d616d1a668085f904626f6db86253ea14e67fe095f912bafdbe31d569d0c0cc
SSDEEP 1536:Otww6XLJCaYZcfnT/+9V/2bjswxw2SVs1X/HDgYiluMrmPnfTfLY1JOlsooRhSBA:xw6XbfLflsooRhSBBpXAshh33nblP0t
TLSH
T1C93449107AF8A518F2F37BB16FBAD6998B37FCE5A936821E0161118F0571A458F60733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing62.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing62.dll
Size 245KB
SHA256 90d5f18d17ec682f42f780a2e902c64566ada95cf3d794d72c72c1668ae8330c
MD5 149b87168580dac115794ceb33155e2e
SHA1 fee9505f9286d6576e5b9dc1220d3aadaf62a350
SHA512 11375b01e42f9baf9485fa478e1934d95eceaca1002a3fcd3e6fa08574a2f4695267ab483a925c357482cf0fcf5fe9fb64679c0a1845451967e2287076981318
SSDEEP 3072:NSlNR/9cquQf3tlOc0jjQG2gVdRqbZ5LP0N:N8/9ougQZiN
TLSH
T1A734DC20F9EF700CF3B27BF15F9AD2998B56F9E8A133A30F9125668B0255A015F51B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing63.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing63.dll
Size 183KB
SHA256 32268ff6d16f1684bc1b4f511096b17267f121a55c53bc5afddc698946398175
MD5 6e2bd22ecac1c4a1e2e9fbb272ac7c4f
SHA1 e41a5a358d331a873537be635edc56d9bae13dc9
SHA512 e400ff3ca37d4779535195f47b30084e06047391a053ca443e01e4b3fd2d26e7a32b5bc8f867de7b40310071563a3e4cebc3b08a37821dc14ceab5a66a015ef6
SSDEEP 3072:ZrZZSoMrCQ3+sKMJOIebNRJTGwm2mf/fvP0t:LZzvt
TLSH
T174040C1078E9F019F215BBF29FDBCBDEC363F0E8A293064F527556871696B418B22670
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing64.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing64.dll
Size 170KB
SHA256 82e3d4dccd72fb4846e37da44f8cb59181c6376a1b8d94e53d0a8fe444873920
MD5 99c85d10c9150cf2cdca772b3398d125
SHA1 fb2ff3bcec1a227bfcdc0123f2a724a97f255f09
SHA512 b69e140df36125efff024913156c4678a3c5b7945862d6b13d12df103e29977bc991ba2346ca6a6b465ba19ad3414df9b2d87715ee67eac36405ef6631c32c55
SSDEEP 1536:2k3gdntbXvJCaYZcfnT/+9V/2bjswxw2SVs1X/HDgYibuMrmPskiv24XOSBju7xL:jwTbe124XOSBmEwff/4NTP0n
TLSH
T1F104D8107CD9B01DF295BBF29FDED6DEC362F0E8A163071F11A65687128AA125F16630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing65.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing65.dll
Size 170KB
SHA256 4feeb3a820e82b9df29357ebc540d48483d661d1cf942b4c484aa2b23a6268e8
MD5 b7e5e88d1fb3dbb1fb0e2245fe7a1b3f
SHA1 b5c82e0bd2990f97f01c6bcc4881138e475bc4f7
SHA512 8fdd2a29a767419080b7890ef6d39513a41d5f47043ac4ff830e3ea03ee6cc712dd7707721a6a1468eaa7a9bc74f1c00dfdcc230751ab86ec4e261395b515715
SSDEEP 1536:Nq343bPJCaYZcfnT/+9V/2bjswxw2SVs1X/HDgYibuMrmPNkSe75inVIqW0TFYBE:N243bK5inVIFc/PkaFP04
TLSH
T148040A147ED9B019F3627BF29FCAD6DEC3A3F0E8A253031F15B656871296A424F16630
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing7.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing7.dll
Size 230KB
SHA256 3ca7a4f172e1fda745141c73ab587c859b0da2897b2650e740e242b70457839e
MD5 6097a43aa5de0ec4164d9627a193c4d7
SHA1 d9bda825857901952bf6e14e322a6c8137178605
SHA512 c3a5c4d8b8569fd1b5917a03dadc358859f851ad750d02e904ad797bd49150be62c722a74b3a13bd68239967c4095c71846d51bdbb73c8b0ac102dbdad841ab6
SSDEEP 3072:ch3OOPWXf0jENXZL1AJijd4PQ9pnmFrmrm7ZCBWM/qZzq9yvjDQDP0kD:gOok
TLSH
T1253458107AE8A508F6F23BB56FFAD699CB77FCE9A572820E1160118F1571B408F61732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensing8.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensing8.dll
Size 224KB
SHA256 537d66547e5e55558ffff06f739dfdf0168df768c4b3d45ce41a9dd180fd3f86
MD5 c924c8201987a0fabf84b0659ad631b6
SHA1 b817fa4cd8ebb824538911d032eb2f587993a20c
SHA512 5b741a1b04e5802588f1d3b4f2ea41009130c6d15f654eb314815e3d4e73fc73b9168528d66660657ffaf40e762cfe6c08df00561b5a0cd214946c510b2ee998
SSDEEP 3072:pHK2VVYVryeVULznlf2pR8xkPootLaydIm1GYnegX8rQt/VJJwZpOP0e:LLYmIYe
TLSH
T128246B107BD8650DF6F63FB16FFAC2C98766FCE9A936820E1164114B0972B858B71B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductLicensingShared.dll

Path C:\Program Files\Common Files\ABBYY\FineReader\16\Licensing\ProductLicensingShared.dll
Size 120KB
SHA256 2c56ef8d1e21905b333d052f2160e2c8bc1c25f18e66a021042ca6a422fe7585
MD5 7e0eb6211397e3c1de88f5f3afafa784
SHA1 1dc746675cd53cbdee5cda4d641e993198495bbc
SHA512 17b3af500b3a08a3ecea718ae504d75a8603c9d8e5c5d1bc8ef68c00d791421fad4d70a423f8827a551495d4a13fdb68d47249e056d2128e251977bcfc41aa71
SSDEEP 768:l1JCSmwLwXSGh3A4UiGyM4SiFIHZ8IakIXTTWgX5Y1JQYY2Ob6l0x29LB9LWGSVP:l1JCTwMXzEyXpTWzTFYr29LB9LYP0dk
TLSH
T1ADC3518235DCD418F1A17632CEBB99EC476BFCA5E931410F22A63E6F75B26402B12375
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI5BFC.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI5BFC.tmp
Size 588KB
SHA256 aec9f4cb37604c67c69fc0fee1dc630db016e1471212006ed787dd9432158e69
MD5 fe647318c4cc7f18012bdf5f8f96c468
SHA1 82e516c4247ca5eac3365bf80120d8a1f30e3042
SHA512 2ab40a563fa4afe48ba74067653a244bdd53f9c04cd3764f29c5f80349f68b2126c6442e0a75ffb3c207f8c9267d4fae7b407ca7d1d5e31d729b84b0edea817c
SSDEEP 6144:2aFYTdIO9QmvIeVKVhaxkSBULBA4tKSM3BZC4o4AOl4mN9ysU5p/s8g73W:jYL9HXVW0xOA+KlZC4v65ps8g73W
TLSH
T123D44A21369AC036D56D05B02DACDBAB516EBE760B3658DBA3D81E7F84F08C25731E13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2B36.tmp

Path C:\Windows\Installer\MSI2B36.tmp
Size 191KB
SHA256 27fd6b8afa3dfbf18fcc5765006d7cb1e1a64fb904481e3dd9fa178c21e31bac
MD5 a0c6461f6565d1394a2717a35f64a011
SHA1 8f697776ee098332ccba822e4f9efb565b79e3e1
SHA512 225aa6387c31357af8d4cfcccb511f35cdd08fc99803a017a1352687b9cd2f8efa263ad452b746a42c5933ef0bc60b7cf32d4488bcbe9cf1dd1e7f774aff88a3
SSDEEP 3072:Pf5uZbg6THP4MnU6xNPq3zd+TEIR7LyOAg0FuDNoC5mP5wA6Cs2Y:IWMHxoDdUjlAOh95U2PCQ
TLSH
T1ED148D107593C577C97E1B340838DA9B6B3E6A608F7088EB63D56E6A0E706C09F35D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 5547743ae8b19723cdd18ef84b8ac214cb5a65ecfba1eda6c190d04ac9d9ec27
MD5 c6a1519b9d1972788053d566c906f3a2
SHA1 a3e5d561b39e0054e6a1ef42d24305e062f15902
SHA512 94557389de2c39041b633c0d9a33c935cfb6788e364018d839a88a21b3044b2e8b2672b064c477bbef65cef0651cf10f09b74c4d40de6e6f4b43dcc6a8ac8fc8
SSDEEP 24576:MFo3DMPwdoO/vvTL/CAkESlgPbu+vrjXUZiW9J6syxKaZzlE8YBmkd+lgue:ZHo
TLSH
T13357A32436F92200E7F79E3CA8F06A274D397D5B9C15DE8D45411B8E0922F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{4d587060-a472-444a-b949-dd4d8d4e6a50}_OnDiskSnapshotProp

Path \??\Volume{0c051f61-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{4d587060-a472-444a-b949-dd4d8d4e6a50}_OnDiskSnapshotProp
Size 6KB
SHA256 472aea844a5895220a2d55361c5e1b69e055e962fadfceba28e82ef8129032e3
MD5 537351bd3d60240f204ecc38ee94a31c
SHA1 5ec563061d5e791abaa7f6bd7bd3f39adc67fecf
SHA512 4e8d01378da5282ccf65447f3f06f2b3f3b01de34f2ecc3556579b8c84e265dc19add340e95f78e90cb7279e917588dcfac93e30da48d9bdbc28c1202c327518
SSDEEP 96:Fd5okqvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:zEb++uVm
TLSH
T1FED188181AE54311E2B3AB3129F18557A477B911FF33CB8E0298238E6670A10F835F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2136-65-0x00000247AC940000-0x00000247AD2E4000-memory.dmp

Download

memory/2468-9-0x0000000000400000-0x000000000048C000-memory.dmp

Download

memory/2468-1798-0x0000000000400000-0x000000000048C000-memory.dmp

Download