55029a813c7e218233c727dfed69677abe79fb2e3828d0acf0a6bf74587c08cc

Analysis

max time kernel
165s
max time network
168s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe
Size 18.1MB
Sample260717-wvsg9adv91
SHA256 55029a813c7e218233c727dfed69677abe79fb2e3828d0acf0a6bf74587c08cc
MD5 d7bbd874bd3d8804ccd762f1cd5be9fe
SHA1 1aa853b39d322648172008d37ceff8064651b741
SHA512 9597b4e65a7ceea70b0ea1094f088bfede85445fea90614916c8a9adb268c53dbbe08ffc9406f8cb0f5dd0b28f04af2fb5d885ae2b2135c77e0307f47e7522d5
SSDEEP 393216:ncy9la3xhVcs7MfdCzFIAp/ek3Y8dk39lHVPG:ncyfBs7MdTDxntl1
TLSH
T12217232336C1C03EE6A255719C5F8EA842A4BC634F3141D7B594FE2C2FF4582B527E6A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware stealer trojan

Malware Config

Signatures

Detects executables manipulated with Fody 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c596-131.dat	INDICATOR_EXE_Packed_Fody
behavioral2/memory/5796-148-0x0000000000890000-0x00000000012CE000-memory.dmp	INDICATOR_EXE_Packed_Fody

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
1244	MSI3ABE.tmp
4224	RemoveTresoritTemp.exe
4872	MSI7008.tmp
5444	MSI7577.tmp
5796	Tresorit.exe
5152	Tresorit.exe

Loads dropped DLL 21 IoCs

pid	Process
2968	MsiExec.exe
3808	MsiExec.exe
5796	Tresorit.exe
5796	Tresorit.exe
688	regsvr32.exe
984	regsvr32.exe
5664	regsvr32.exe
5152	Tresorit.exe
5152	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe
5152	Tresorit.exe
5152	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\RemoveTresoritTemp = "\"C:\\Users\\Admin\\AppData\\Local\\RemoveTresoritTemp.exe\" /tempPath C:\\Users\\Admin\\AppData\\Local\\Temp\\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\""	MSI3ABE.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Tresorit = "\"C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\Tresorit.exe\" /tray"	Tresorit.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5180	MSIEXEC.EXE

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	MSIEXEC.EXE
File opened (read-only)	\??\K:	MSIEXEC.EXE
File opened (read-only)	\??\P:	MSIEXEC.EXE
File opened (read-only)	\??\T:	MSIEXEC.EXE
File opened (read-only)	\??\Y:	MSIEXEC.EXE
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	MSIEXEC.EXE
File opened (read-only)	\??\X:	MSIEXEC.EXE
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	MSIEXEC.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	MSIEXEC.EXE
File opened (read-only)	\??\I:	MSIEXEC.EXE
File opened (read-only)	\??\S:	MSIEXEC.EXE
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	MSIEXEC.EXE
File opened (read-only)	\??\N:	MSIEXEC.EXE
File opened (read-only)	\??\V:	MSIEXEC.EXE
File opened (read-only)	\??\W:	MSIEXEC.EXE
File opened (read-only)	\??\Z:	MSIEXEC.EXE
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	MSIEXEC.EXE
File opened (read-only)	\??\L:	MSIEXEC.EXE
File opened (read-only)	\??\R:	MSIEXEC.EXE
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	MSIEXEC.EXE
File opened (read-only)	\??\J:	MSIEXEC.EXE
File opened (read-only)	\??\O:	MSIEXEC.EXE
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e5967b9.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{73DE3149-DAFA-4E7D-AAE0-475236B8DAB4}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCEFF74A59CB5AD69.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA5BB856B9FD8DAFA.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6B73.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6AD6.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE66B4B588C47CBBF.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7008.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7577.tmp	msiexec.exe
File created	C:\Windows\Installer\e5967b9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5967bb.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4244A25B966E521D.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2624	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tresorit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tresorit.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2624	cmd.exe
4104	PING.EXE

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\tresorit	Tresorit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\tresorit\WarnOnOpen = "0"	Tresorit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File\shell\open\ = "Open with &Tresorit ppdf viewer"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}\ = "TresoritExt"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\TresoritExt86_2.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\shellex\ContextMenuHandlers\TresoritExt\ = "{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\shellex\ContextMenuHandlers\TresoritExt\ = "{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\*\shellex\ContextMenuHandlers\TresoritExt	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\tresorit\URL Protocol	Tresorit.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}\ = "TresoritExt"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\TresoritExt86_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\TresoritExt64_2.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\tresorit\shell	Tresorit.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\tresorit\shell\open	Tresorit.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\TresoritExt	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\TresoritExt	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.ppdf	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\tresorit\ = "URL:Tresorit protocol (Tresorit%20protocol)"	Tresorit.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\shellex\ContextMenuHandlers\TresoritExt	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}\ = "TresoritExt"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\*\shellex\ContextMenuHandlers\TresoritExt	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\TresoritPdfViewer.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.ppdf\ppdf.File	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File\DefaultIcon\ = "%APPDATA%\\Microsoft\\Installer\\{73DE3149-DAFA-4E7D-AAE0-475236B8DAB4}\\_26F8FD87_9780_4467_9B3A_6D558CF7A26D,0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\tresorit\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\Tresorit.exe \"%1\""	Tresorit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\TresoritExt\ = "{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}\ = "TresoritExt"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\*\shellex\ContextMenuHandlers\TresoritExt\ = "{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\TresoritExt64_2.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\*\shellex\ContextMenuHandlers\TresoritExt\ = "{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\TresoritExt\ = "{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32	regsvr32.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ppdf.File\shell\open\command\command = 4a005f00480038004d00750072004100370041004d0062006e004d0042005100250068002d0063003e0060005f0072002c003900640037007d006c0038003d007400740074005a00590029007200670044002000220025003100220000000000	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\Background\shellex\ContextMenuHandlers\TresoritExt	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\TresoritExt64_2.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.ppdf\ppdf.File\ShellNew	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\tresorit\shell\open\command	Tresorit.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\*\shellex\ContextMenuHandlers\TresoritExt	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Directory\shellex\ContextMenuHandlers\TresoritExt	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\.ppdf\ = "ppdf.File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\tresorit	Tresorit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}\ = "TresoritExt"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Tresorit\\v0.8\\TresoritExt86_2.dll"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485A-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{822B485B-CCDD-476C-ABDF-7F7A894A3CB7}\ = "TresoritExt"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{822B4859-CCDD-476C-ABDF-7F7A894A3CB7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Modifies system certificate store 2 TTPs 3 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Tresorit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0	Tresorit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18	Tresorit.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4104	PING.EXE

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1244	MSI3ABE.tmp
1532	msiexec.exe
1532	msiexec.exe
5796	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe
5152	Tresorit.exe
5152	Tresorit.exe
5796	Tresorit.exe
5796	Tresorit.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5180	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5180	MSIEXEC.EXE
Token: SeSecurityPrivilege	1532	msiexec.exe
Token: SeCreateTokenPrivilege	5180	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	5180	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	5180	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5180	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	5180	MSIEXEC.EXE
Token: SeTcbPrivilege	5180	MSIEXEC.EXE
Token: SeSecurityPrivilege	5180	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	5180	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	5180	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	5180	MSIEXEC.EXE
Token: SeSystemtimePrivilege	5180	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	5180	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	5180	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	5180	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	5180	MSIEXEC.EXE
Token: SeBackupPrivilege	5180	MSIEXEC.EXE
Token: SeRestorePrivilege	5180	MSIEXEC.EXE
Token: SeShutdownPrivilege	5180	MSIEXEC.EXE
Token: SeDebugPrivilege	5180	MSIEXEC.EXE
Token: SeAuditPrivilege	5180	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	5180	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	5180	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	5180	MSIEXEC.EXE
Token: SeUndockPrivilege	5180	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	5180	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	5180	MSIEXEC.EXE
Token: SeManageVolumePrivilege	5180	MSIEXEC.EXE
Token: SeImpersonatePrivilege	5180	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	5180	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	5180	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	5180	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	5180	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	5180	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	5180	MSIEXEC.EXE
Token: SeTcbPrivilege	5180	MSIEXEC.EXE
Token: SeSecurityPrivilege	5180	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	5180	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	5180	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	5180	MSIEXEC.EXE
Token: SeSystemtimePrivilege	5180	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	5180	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	5180	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	5180	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	5180	MSIEXEC.EXE
Token: SeBackupPrivilege	5180	MSIEXEC.EXE
Token: SeRestorePrivilege	5180	MSIEXEC.EXE
Token: SeShutdownPrivilege	5180	MSIEXEC.EXE
Token: SeDebugPrivilege	5180	MSIEXEC.EXE
Token: SeAuditPrivilege	5180	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	5180	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	5180	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	5180	MSIEXEC.EXE
Token: SeUndockPrivilege	5180	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	5180	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	5180	MSIEXEC.EXE
Token: SeManageVolumePrivilege	5180	MSIEXEC.EXE
Token: SeImpersonatePrivilege	5180	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	5180	MSIEXEC.EXE
Token: SeCreateTokenPrivilege	5180	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	5180	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	5180	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5180	MSIEXEC.EXE
5180	MSIEXEC.EXE
5796	Tresorit.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
5796	Tresorit.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5180	MSIEXEC.EXE
1532	msiexec.exe
2968	MsiExec.exe
3808	MsiExec.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 5180	1288	2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe	87
PID 1532 wrote to memory of 2968	1532	msiexec.exe	89
PID 5180 wrote to memory of 1244	5180	MSIEXEC.EXE	90
PID 4224 wrote to memory of 2624	4224	RemoveTresoritTemp.exe	93
PID 2624 wrote to memory of 4104	2624	cmd.exe	95
PID 1532 wrote to memory of 3808	1532	msiexec.exe	97
PID 1532 wrote to memory of 4872	1532	msiexec.exe	98
PID 1532 wrote to memory of 5444	1532	msiexec.exe	99
PID 5180 wrote to memory of 5796	5180	MSIEXEC.EXE	101
PID 5796 wrote to memory of 984	5796	Tresorit.exe	102
PID 5796 wrote to memory of 688	5796	Tresorit.exe	103
PID 984 wrote to memory of 5664	984	regsvr32.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Windows\SysWOW64\MSIEXEC.EXE
  MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\TresoritInstaller.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe"
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5180
- - C:\Users\Admin\AppData\Local\Temp\MSI3ABE.tmp
    "C:\Users\Admin\AppData\Local\Temp\MSI3ABE.tmp" /tempPath "C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    PID:1244
- - C:\Users\Admin\AppData\Local\Tresorit\v0.8\Tresorit.exe
    "C:\Users\Admin\AppData\Local\Tresorit\v0.8\Tresorit.exe" /silentinstall 5 /lazyinvite "2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:5796
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Tresorit\v0.8\TresoritExt64_2.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:984
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Users\Admin\AppData\Local\Tresorit\v0.8\TresoritExt64_2.dll"
        5⤵
        Loads dropped DLL
        Modifies registry class
        
        PID:5664
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Tresorit\v0.8\TresoritExt86_2.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:688

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EFC88E746522C625423F599C1E785D25 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2968
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8F0E112E5205F8A07124B14EC6F6DBE9
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3808
- C:\Windows\Installer\MSI7008.tmp
  "C:\Windows\Installer\MSI7008.tmp" /silentinstall 5 /lazyinvite "2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe" /tresoritlocation "C:\Users\Admin\AppData\Local\Tresorit\v0.8\Tresorit.exe"
  2⤵
  - Executes dropped EXE
  PID:4872
- C:\Windows\Installer\MSI7577.tmp
  "C:\Windows\Installer\MSI7577.tmp" /lazyinvite "2026-07-17_d7bbd874bd3d8804ccd762f1cd5be9fe_elex_stop.exe" /silentinstall 5 /tresoritlocation "C:\Users\Admin\AppData\Local\Tresorit\v0.8\Tresorit.exe"
  2⤵
  - Executes dropped EXE
  PID:5444

C:\Users\Admin\AppData\Local\RemoveTresoritTemp.exe
"C:\Users\Admin\AppData\Local\RemoveTresoritTemp.exe" /tempPath C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del "C:\Users\Admin\AppData\Local\RemoveTresoritTemp.exe"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:2624
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 3000
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4104

C:\Users\Admin\AppData\Local\Tresorit\v0.8\Tresorit.exe
"C:\Users\Admin\AppData\Local\Tresorit\v0.8\Tresorit.exe" /tray
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5967ba.rbs

Path C:\Config.Msi\e5967ba.rbs
Size 17KB
SHA256 5e12ffbb046a98bfdf4b533dea5476de68bbd8512a7696cd255757639da35b31
MD5 1041ebbb0a4fe6c4f84300b1fcba6161
SHA1 b21a5fd5103bb47aeca919f4d22504a49b492184
SHA512 bc35fb348f87ba4b69386ff35ef2bb7df04ccb1604ad05004be297daec504c0628cf04f2d1bb6f53bf4dd02766b9177e8f0449c355b872faae4f487b3e2f59ac
SSDEEP 384:vFy6rBzXBIUUEGVw6rGhrGv6zsXbQBOfQ4pSvdk6Ic+3Gt86syZcAmAA77kLS:vnVzRIUUEGVw6g9zsLQkooeC6Ic+Wt8V
TLSH
T12F722043B598D292D8251732C7531F2CB3B787EDD751A7AF0A89C4380F83F98E66518A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DABB55AEBD8EE118C20603B589704E10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DABB55AEBD8EE118C20603B589704E10
Size 1KB
SHA256 cf55fdcb04c2a068c6cc7e08eff8ddbe6ce12cb4133cb2616fe5bfe33c051aed
MD5 4fcc2c33f38f305cc61bfb9cfa49a78b
SHA1 8f9e349e6935d82f8b4f71c15bf7c19eba70abc7
SHA512 14eb63ca9b3b3d40ad6cad7119421ceb5edb8d535409045eb2440c9ee104eb2c31385805b132ef69f5f8f2191406dadfd103efdf380958ecd3958c1886398b66
TLSH
T1AD21E7515D0044B6DEDAC0A6E6DB802CDC2148497C311B69A8FD74A836A8C06982E6C3
MD5 SHA1 SHA512 TLSH

Submit Download

F48CF10297FC7649CD37DD86FA628AE7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F48CF10297FC7649CD37DD86FA628AE7
Size 1KB
SHA256 e8d0f043fb1663d7e0fae8050d652e08817343e92c0e5c42c6e0a53fc4675352
MD5 68ecfe6d8d0b312c7273309ec5484506
SHA1 cf9b2747f74891cb3402c39fb4c76a1dd1bcc3e5
SHA512 79bab86c5e86dc4b53be5c8b328d96091920060c51b8ddfd7a8c4b12697c46cb4377e39cccfabe50b67705d43d8f320b11045dccaf7330acaa88157ab0dd9932
TLSH
T1B621231BDE830E55C056A2D6C649FED5C1A4051ADEFEF8592D5D35D41014F9400DDCCD
MD5 SHA1 SHA512 TLSH

Submit Download

DABB55AEBD8EE118C20603B589704E10

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DABB55AEBD8EE118C20603B589704E10
Size 214B
SHA256 9e09a123514511085817bb5882f0d5964c805885227886b46f204734f86e881a
MD5 88b3be0d085ea6648f33e3b3053ec3da
SHA1 d5c13f9a006b0cd13e8f02dbe9f1306f2c782978
SHA512 99ff48c63622ab83899b6f544985fa563b2caad89f1dc7f14fd3edaaf67ff4106186061197ab87cb7e2f360f49efd321b69cba9698e7af0d6afadc06f6114780
TLSH
T12FD09B20DF5D0202E1330E7E6D5552116D967965BD44CF5505780D5CD839D01DCF1D04
MD5 SHA1 SHA512 TLSH

Submit Download

F48CF10297FC7649CD37DD86FA628AE7

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F48CF10297FC7649CD37DD86FA628AE7
Size 222B
SHA256 c096311357788d8d98e8d30f66061f33be3c821d76cf68066aa3d040d07824a0
MD5 3672c51d58cd4efbbf34d7bfa433577c
SHA1 b84afbaaa0fd9d7ea5f229c55a8389f56c6034d3
SHA512 94ea05f3f34fb7a943386c073cccd8a15045728981f19ebb5ea7e35221dc7ffb7a28e4f73509b2c9bc876d731913881e5e878ba876506cc7f6de8eeb2271eb1d
TLSH
T1ACD01200AF4E4234F129153B6DA302264EA9A93C8906CB5A0B65098C5A7DD818C75D18
MD5 SHA1 SHA512 TLSH

Submit Download

RemoveTresoritTemp.exe

Path C:\Users\Admin\AppData\Local\RemoveTresoritTemp.exe
Size 8KB
SHA256 619f1109e826eb98fee8573ee325033d6f6afa37fd94b49817826613cb79dda4
MD5 7b57a17276535cdb73fb246bc5a85cd7
SHA1 025e2d6db6237010c2256539e42005a646e97218
SHA512 55a2add737b41efc918e124f2f6d8f34a53bd2704b6ad3ed9894a7a27029a6b3a4b6a225d1bfe5a63fc13293307de93e6bc678a548624fc44695f949ecdb2410
SSDEEP 192:61okw0EClw0iQmkJp96bCkY/miqvpPmC5cDHM1O:0okVEBkP9dksmiqvpPmC5cDM1
TLSH
T1A802B710FBE74231EAB64F7A6C365A100271F7159A11EB3E4CCD4A8B1E27B088D61B63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI39A4.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI39A4.tmp
Size 151KB
SHA256 3a2eb487237d36b6da8cc21eb39afdb890a84bf2e29fadf3182e44b1ef114fb8
MD5 778d0941fb9b969ab90b81c9b91086d7
SHA1 02b755be2046f5b34f5884af9137ed014023e2e1
SHA512 e6b384b3c958d597b9d842e50627ee5ea52dffc5776a876e2bed3027c242a7184248e734c7204e56dcc325efba24d4f14a1b8f0df073190b51db21e06aa2c018
SSDEEP 3072:6x1vI8koSXMXm3o1dSjr+MEwW1nd0DOT6Tt:6TvioSXDof8rCp6Tt
TLSH
T12AE3291137A18070E5EF163869759A264B7EBC72DB74D9CBB394064E1E70AC0EE35B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3ABE.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI3ABE.tmp
Size 48KB
SHA256 fd1e9061bd34f7d3ccee82a7caa5f9689903961f30849bf71046b5d7be5b9526
MD5 1b5c115ebad3276629be0b8064340bcf
SHA1 e56648c23f3d50e0158789170f96b0ca1fe1d2c1
SHA512 441452a1c4a63a9bbedb7399b2c0d85e78876859fa8567d8f0134eec99dbe066f8a73aedbc052686fbb927e21df7a742fdd89ffca98a30d9ea1c38802904774e
SSDEEP 768:5O24fTjbSF6oHRjCkP9Tmi6PmCQ+LXN8l5IJL+D/Q8mCBD5bB8YsrMowNU3qF/CD:5O24AZCkP9TAL98l5IJLRPCBDpeYZodb
TLSH
T1C2235B00B7D8C632D76E0779AC7152600371D3CB6916DB8A9DC8E4AA1DBB7C449607FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0x0409.ini

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\0x0409.ini
Size 21KB
SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
MD5 be345d0260ae12c5f2f337b17e07c217
SHA1 0976ba0982fe34f1c35a0974f6178e15c238ed7b
SHA512 77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff
SSDEEP 384:CTmyuV//BiTbh/G4AwC2WrP2DBWa/Oa0Mhs+XVgv:CT6V//BiXh/z/lWr0aa0Mhs+XVgv
TLSH
T1FBA2B95667F94219F6F77F50FDB802221E7ABC82AC38D25C1280499D09F1E84D8B1B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft .NET Framework 4.0 Client (Web Download).prq

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\Microsoft .NET Framework 4.0 Client (Web Download).prq
Size 3KB
SHA256 ec8065aeb347578039370de31df81e4fe952f45662eb0ee5890bfe58c1500bd8
MD5 0b1046b4a20cc3495eff473b2e41f67a
SHA1 5ab3fb9ae72b5358ae90f534a8c1ace21d9b9be6
SHA512 694659ffbafccf5e96e5a6ea9ae34eb32c38a0a9270d32ec780d1601e5987414524910ff5246c2b671e84896e31484456d6ffb439661d370433c4e3da2016641
TLSH
T1FB61CF9960397572172AABD387F1354A3BF66706C51A000D50824279E3972AE3F3CFBD
MD5 SHA1 SHA512 TLSH

Submit Download

TresoritInstaller.msi

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\TresoritInstaller.msi
Size 18.0MB
SHA256 1317a2fda6d8121c7275947e60b5a876cb359e9bcb1d110069f72ba1b6ebd9a9
MD5 7acfaa46f098a3b876616d0bac09deb9
SHA1 08e09ec47e2a7e0ffc6dcfaf1117a6003297781f
SHA512 39efaeb0974d77ce3ae74a5168658cd5e9a2f1157db7c4fc047d20ae2b6f1ac148c665f4febb30f4a96d208d7cc68dcc22c51914a9f0ba4ba9bfc0df4ad7465b
SSDEEP 393216:NcAC0SLYgPZXGC7naeDNSdzR0UR3FtmjKXjRN5/zhWhNngwkUZMK:JC0eNxJszR0UlOeXDahNW3
TLSH
T1EE1723246E42C671D349B2F594B1F6D88A36FC245B3904D7AA3F70AD12B6A83DC7710E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Windows Imaging Component (x64).prq

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\Windows Imaging Component (x64).prq
Size 1KB
SHA256 48bf0bd3f2288621bffe796a0cfdb2f6c8c513cbaa06a5aae502164abca419d4
MD5 d62628e0ff64047b5062b039c9ed483c
SHA1 949b132cdf5dc9df82aa026b889b44f003dd7c80
SHA512 237500d7409db2619d54658537dba691f4c21fe50bba7e759a56505108fcd3efb3f72d8213ec280703dbe8be255c43d6392143dfee7dc1db0f9087cab9e3f0ee
TLSH
T1EF21115960189A750F4DA7C203F27B4A73FBA34BC622400DD1820275F34311E7B75DB9
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Imaging Component (x86).prq

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\Windows Imaging Component (x86).prq
Size 1KB
SHA256 f30ee3c5f50eb8fe2fe29e173fd7b6e08d324d9753d995ed5d21f4e430a3db3f
MD5 62b69af9596fe2d6998eec9d7fedb365
SHA1 8eeeca5b614904ea2820e86688a263e9cce1b612
SHA512 a53480d5368f6129d77b5f5910e64e6b5c840ef38ec2b15f06cc4674ae373abb462235bf99d6daa739f638df0edb0c55415a3ae1ceab59812391e58096fda0a6
TLSH
T106211199605899714B9EBE8243F23A4977BBA34A8536000CD0C34275E34325DBFB5DFE
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Installer 3.1 (x86).prq

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\Windows Installer 3.1 (x86).prq
Size 1KB
SHA256 7c452695e76e194d70eeaaf791b5a29354c268918169da3f849d87eebad5f4c3
MD5 2cee8889ab159e0071065b7b01a04a54
SHA1 fe0d3e5b4078e15e98e98176d74ae414359f1f48
SHA512 5139b28e5b47c971204aaa4407576603c683b0c6c39a7ebd30f652fcf94ea64d3ac7c54a3e9aaf992e56362d6f6ccd3db111e14659ab2198fb25856107756f21
TLSH
T1F331FE55602495B15A5EA7D203F72E4777BBA20F4927040C90C70336F78326E3B76EBA
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\Windows Installer 3.1 for Windows Server 2003 SP1 (x64).prq
Size 1KB
SHA256 894135be3be0a5d032914ddb15798688ba3483bea3c123d6de69e78239328f49
MD5 5c28ca116fb3211283b6504816106ea7
SHA1 47689a09eb12def4421faa358806b75f25df57a9
SHA512 8372332b41f5b24c1afeb730c41bef8b9e0a4e4d91df8e325d801854ea355207b38d1de0f1720aa39069a4b3bc846abac422272e5355ebf6c441918a36087206
TLSH
T10E2120A431149AB12E5EABE203B76F86737AD24E80360005D4C25277E69301E37E5D79
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Installer 3.1 for Windows Server 2003 SP1 (x86).prq

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\Windows Installer 3.1 for Windows Server 2003 SP1 (x86).prq
Size 1KB
SHA256 76995e5a1d80bc2fb6b30c15959e5e1af21fa3f3f3f70e400da5883a69fb3026
MD5 af1ff99ca81c5b047afc94171a4ca7cb
SHA1 56fc62e456b7c7edaaee2b4e253c5262b169d051
SHA512 8db8bd40c2f08dafc9ef9a8344a618ccb929ffdea88ca9d1cdfd234c6872377bb0cb6364791f7a01fb94634dd08c46f50e7a19815304337b635a4585f9623cda
TLSH
T1FC21FDA4301599B12D5EEBE203BB6F86777BD14E803B0005C1C68277EB9301A77A6D7D
MD5 SHA1 SHA512 TLSH

Submit Download

Windows Installer 3.1 for Windows XP (x64).prq

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\Windows Installer 3.1 for Windows XP (x64).prq
Size 1KB
SHA256 a80c401ee3fdc648442bfc1343bdbc0d555528673d53e215cae41e1803c358b8
MD5 86eb07bad3e63e1b967f6c6f04ca7432
SHA1 3bca6243d594160394bc3df617c58e8c857eb6e0
SHA512 25fcbd21e91796358b7c874bd61eed4f303850b05990e07b5dae915ce1371daf4a7af05b798882c8738b053524aaa2be7fe5f2b37800ae8c5b1357bb143798a5
TLSH
T17921E0647154D9B11D9DABE103BB2F47777BD24E81370005C0831276E76322B366ADB9
MD5 SHA1 SHA512 TLSH

Submit Download

_ISMSIDEL.INI

Path C:\Users\Admin\AppData\Local\Temp\{9F45508A-A12E-41B4-9D8D-FB867F397DB3}\_ISMSIDEL.INI
Size 2KB
SHA256 bde88aa33806ebc08de92cf6cf12906f7a5593ca7b7fdafd4781f0f7bc9d3ee7
MD5 d3dfc4fe2bd117e605e3bcbb0d1d2e2e
SHA1 545d2da8f1725dd6be3b34859c018af4f6442d32
SHA512 5e431be83df586846de4bd05904125002a67ce29c17a6ff04f60d580074137c7414ba57b7df0389168061235f972d235ea1a11e6f36edcd5f9a4a28b44ba252a
TLSH
T1A55195A17FFC4129F37FAF1CAFF160225678B9616E34AF0E011181090972D65D9B6F2A
MD5 SHA1 SHA512 TLSH

Submit Download

~1B00.tmp

Path C:\Users\Admin\AppData\Local\Temp\~1B00.tmp
Size 5KB
SHA256 96e533446a7e1336403029c03167a088954d6efe08a08434f6e18db0c8f68036
MD5 a4189708781cd7204c658e14ba6edd8e
SHA1 b31d1dc60b8ad2ccf1ac11645d692ccf53de72d5
SHA512 6d7feff4b6cafffc98520bf5f48db42c53e801c463fe6f83eb0f6f03e956818e49dbac727ac157e28f7a45fb3f85abd0ffc649dd8bebe520e616c998cbf147fb
SSDEEP 96:rEhkMaEnvYBRffZON/XsEbFWaEPRhS+gWPQPgWRGTwQbPrvnp6kY05w7tCYOvln7:YhcMABRfIcuQaEZhdxoIWRGcQbPr/p0I
TLSH
T177C1BD172FF6411EF6F35B44DAF0543B97263D11292CDA0C56D0835A18F2D868A27BEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CoreManagedWrapper.dll

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\CoreManagedWrapper.dll
Size 16.0MB
SHA256 e1b769a9e25d041b30196d4dc16af0ad3a0310f6fbd6bf854270ab7f445e6c21
MD5 83de1de443584778a08091de76ff13c6
SHA1 ec27a4e9a75efe5c4c6d7ab739079de879ed5fc6
SHA512 a23059e7471bca465538ab58adcbbe6a4ba0d1b584fb6a23a64c36248a457e7fb8cdef4cb48f9b85641ba2001f348dd90518743d281e72e0daf80bc04b42c9c2
SSDEEP 98304:iKAtsDOSlYJf37rl9IWmRzq/sWqITv6p8dFZzECO5X21bDj8s9P3z5Mm2f7CrfDk:itufUvwTU6p8dLzEdijfhDuCrDTKIzMD
TLSH
T122077E20B60D8063D96E42F29F6E9B7D102896301F199EC7F2D54F592DA33C3AE35A47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DotNetApiInterface.dll

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\DotNetApiInterface.dll
Size 131KB
SHA256 76b4d921fe8669720eca144e57c69a6d057228eadce63cce6446be8760613dbe
MD5 f9a2104581c92d05b2c48a636659c095
SHA1 7d613fe7b5ba3627f4cf67d12a6df0725547b9db
SHA512 d2f1b3ef9a3ecf59c2721ac1fbdf6f00183a55257474c10eb80c6c72de0c8a042e8f606f8f7da380747f57750a1e27b7316fdc355eab4a4d30246f8ebcfd4b85
SSDEEP 1536:ld9gTXiM3TPAgweb2MOqAgii+wk+a5VOfOyq505343/YFfoAw:loTXr3T/2MTA5i+wkv7mJq505qMfdw
TLSH
T13ED31903A315C61FC88B2574BC22592203BD8AC5A251F3FA7B10DD9B7A8F7C1B9456E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSVCR120.dll

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\MSVCR120.dll
Size 948KB
SHA256 86e39b5995af0e042fcdaa85fe2aefd7c9ddc7ad65e6327bd5e7058bc3ab615f
MD5 034ccadc1c073e4216e9466b720f9849
SHA1 f19e9d8317161edc7d3e963cc0fc46bd5e4a55a1
SHA512 5f11ef92d936669ee834a5cef5c7d0e7703bf05d03dc4f09b9dcfe048d7d5adfaab6a9c7f42e8080a5e9aad44a35f39f3940d5cca20623d9cafe373c635570f7
SSDEEP 12288:LBmFyjLAOQaYkxGXPfY7eiWWcpOKnpTVOIxhK765qlRRb6x4pI23IbJQV:dmFyjLF847eiWWcoGZVOIxh/WxIAIbGV
TLSH
T10F25BE12B982C0B2C57202B1152DE772197FBA71443598B7BBD98F0E1DB46C0FB67A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\Newtonsoft.Json.dll
Size 493KB
SHA256 ffda4515abe2c653a52456f14d12c5601f07460bd4e441d7e69d11581eb6def6
MD5 7e59d21dbad0674567ce7732766f8eb2
SHA1 4f0853a7c7f54d04c326dec10230d5c846dd0d8a
SHA512 e0b0d32e66cf6186800ce97a9d39c9ea6daac43b2efafd0b01cb84960142d29f11e0bf056f8e3ab8f5904c1cc091bf6db23a1a8f39621a8ac9f3f43ae2dcf9af
SSDEEP 12288:1MjhriRE72737tn4B3l5AHm0hZ2jLba69Q0Fo5y+d:1MsRE7c37tn4B3l5AHR2jLba69Q0Fo5h
TLSH
T13CB4190027EC8667F9AE5735E434660487F5F856F2BEDB4F5900AAEB4C837818E413A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ThreadLocalHelper.dll

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\ThreadLocalHelper.dll
Size 26KB
SHA256 80ad43634cb04ee36a501616b2f23df6c72d50338c83729a3b5a053327b3941c
MD5 36d6971d790bc9d4ed1d7235003c95e1
SHA1 8cdb2ecb95ac72b2fbf90a17fcc1535a48631d89
SHA512 1dc616e267b93f59bf1b02c54ded3ba1c29901a65d7453590a66fed02cdc3ec0da96514dd17910b8ed4be2ec88b06bc0d2c64e92f4dd0af11bcbb319db3abc8d
SSDEEP 768:rrWg4hL8eID0KKsAOFapj9j89P+xbhmGF:r6g4h4eIIKbm99Ao9
TLSH
T187C27D56771600F2EA9F92B019D7A31A5935FE410FE552C3BEC7CB550E603C36EB6602
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tresorit.exe

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\Tresorit.exe
Size 10.2MB
SHA256 9a184fd1673a9af2ee66d4763d096f1fb5a44a3f99e53f80ceddf34060c495d2
MD5 b53b533904c9c83367e8e135ed592165
SHA1 ab86251c3f0ebaf4f5b87bd0a9508dfb29a98569
SHA512 6e78df1fff214be1d4515030547e1fa921c02842780fe4c4a0eec371e28a6135f582d756132848acc5e58abbf7290ce721d2054fb6cb207ff87c3725bc4f0ff9
SSDEEP 98304:Gu0gS1E1ZFYpR884p1r2oN3UgGBNXdFl4QZRnXOLdwQYNdeElJAqf0K1:Gu0gS6nFYhSp3y9REKQglJAqP
TLSH
T140B6DF057FD4C919E276B2F8803197654672FC251756C38B6ABE302D9A7B393CE2234E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tresorit.exe.config

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\Tresorit.exe.config
Size 3KB
SHA256 fc6585906c2d35eb5153836a68d35ad6af7223205d4b5c6c3f232a2b6cc7be79
MD5 e3a58b3ee27a064d959ad6f0e8823012
SHA1 957e0cb379e00a1d17da21df0c0b76abb9248ac2
SHA512 41c6a3aaab75bfebe30c84278e2ce8ca62c8e10ba5b040dd8f351653c631d43004b22870d805f55d6cf84188ee3a5b83451add46541d00b860645fec65e42e68
TLSH
T11F613A18B1C0AFDA06735A71EA365194DFB40273256A60E8B4FD32579F31C9B07933B6
MD5 SHA1 SHA512 TLSH

Submit Download

TresoritExt64_2.dll

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\TresoritExt64_2.dll
Size 769KB
SHA256 2afd6c25698ddbd8afbb4dc4b5375db4ad0db516f7af5d93fd5377cc8870907d
MD5 9638a424508f76b1354b7a00afba522e
SHA1 f6aaa04dcbc611a0eba8912a0100b4c0a958dbe4
SHA512 f13ad68b0b580266a86bebadb3ab5ddb11b6f7790b4ca8363c0cbe835f93859d5f4978abb9e5c401080e0d6f35ce28e6ca7632e6a4917671cfdb1333088c8604
SSDEEP 12288:tzgxaUYucrZuBXV76iIqiZ2iaVQiYJFTGTz98uzUSQsYcYNoM6ShcR2O91iSBF3q:tzgxaUYuYZUtUjcB7B94h
TLSH
T186F45C0A7AA44274E137C23DC5974A56F7B274065B20ABCF17A503AE5F37BE04A3E361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

TresoritExt86_2.dll

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\TresoritExt86_2.dll
Size 589KB
SHA256 cb62a255fca061fa92abdb9c33be4a808ad2f1a109bc2934f88cb282685871a9
MD5 8f089658899749f684c154c231a53d10
SHA1 96bbc0a1a52d40ada62f87d301068e93c598532f
SHA512 f2874dfa7f86cab078bfd63867cded5ba13408cd058c5119f860a613c57d65cfc1d52200d7167d35194c6250b570c53489d22629b7c1a41e79af579ec3bbcc7d
SSDEEP 12288:Oc6R3QTwbZ94yeufIuAqMYCFCauTQ9APCBDfc6qtV/RM2A:J6ouAqfTeQCBjcXtVZM2
TLSH
T131D47C127AC0C076D67F03725529B72945FEB9724BB16AD7ABDC0A0E2FB44C39732642
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp120.dll

Path C:\Users\Admin\AppData\Local\Tresorit\v0.8\msvcp120.dll
Size 444KB
SHA256 87c42ca155473e4e71857d03497c8cbc28fa8ff7f2c8d72e8a1f39b71078f608
MD5 fd5cabbe52272bd76007b68186ebaf00
SHA1 efd1e306c1092c17f6944cc6bf9a1bfad4d14613
SHA512 1563c8257d85274267089cd4aeac0884a2a300ff17f84bdb64d567300543aa9cd57101d8408d0077b01a600ddf2e804f7890902c2590af103d2c53ff03d9e4a5
SSDEEP 12288:uZ/8wcqw2oe+Z3VrfwfNOOoWhUgiW6QR7t5ss3Ooc8DHkC2e77/:W/8wVwHZFTwFOOos3Ooc8DHkC2e77/
TLSH
T11AA45B237B864CF2D19E53B231C9531557FAFC6441B1F343ABEEE1692FA6282E123611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6AD6.tmp

Path C:\Windows\Installer\MSI6AD6.tmp
Size 104KB
SHA256 78e2bdd0224d165d7021ae683946fb08865f3073b38f61f7f0d96d8e964de249
MD5 ff43cabba151dba4c92800eefce66c37
SHA1 5ee3357684d123f1333f510c46ab79fc20e2120b
SHA512 12315eca59df4e76e2e4f0f8d9e52438a99799f0d87fe6e357c11ed709d29cc5ecccdfdbfcad57cfbf9ba1d18cceedf0abc0f76ed9f7357cc65310c4bd417cab
SSDEEP 1536:KiHb2Mi1xSAN9B8Ia0X2cAZsB5VvCq+DxcjcwSsWjcd390c1FBbW4:1cckB5tCq+Dh43acDpW4
TLSH
T141A34B5036E08075D9EE0A3958B4DB154B7E7A72CBB0A8CBB795064E5EB07C0AF35723
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7008.tmp

Path C:\Windows\Installer\MSI7008.tmp
Size 13KB
SHA256 60cda8d3c1447cf2d05400ccba891b01761c24d8885a74a77a4e7be4aef39a59
MD5 362af21459226fda87b169fbcc5bca4a
SHA1 f318620faf5b1a0d746449978ed6430e3e9381a8
SHA512 55b984a7d3cb4f03a885a595a9bda2a0bc753e995b8395f8815ba2af2dc868a23b98c8c9e436e250305ed68d7f36c7b1bbd4169793a942d785cf028619ea6dcc
SSDEEP 192:3ln9MBMbQGzSt5L2ROnVgSrOzDpTbOnegNJdVsstmefoOuL4L:3ln9cTtV2MNOPZlgNJdVsskc
TLSH
T11452D806E7568236DD6E8379ACB37A1083B0F3405AD3CF5E5D4A870ED823B4916537A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7577.tmp

Path C:\Windows\Installer\MSI7577.tmp
Size 6KB
SHA256 03b9651e15211e4c8f1e39c3e3fa822673103b4ddb4ebde5447ef013cf7c8bc4
MD5 1d7538cecbd8e6071021b442a22e62fd
SHA1 8742c376711dedcd0def02eb708cd9ebc1fa3187
SHA512 3e80fc605d706ffd4aed24bf76c53f72c14dc8c3bfad3d8cdd54130cce0b47b3010c5617d47c1d9943ddb20af5f136748c12c2b0e2128ca8aa1d3d5319aa3360
SSDEEP 192:jfu4KwEWRO5WAvXebDRs5Fos+fc/9mW5Fcz5Fzmk:jfmZrvX2DReFoXU1mUFcNFzm
TLSH
T180D1C625E7FC0A32DD764B32AC3363511674FB50E867CA6E98C5021F4EB27684672B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-77-0x0000000000E00000-0x0000000000E12000-memory.dmp

Download

memory/4224-81-0x00000000006E0000-0x00000000006E8000-memory.dmp

Download

memory/4872-130-0x0000000000B10000-0x0000000000B1A000-memory.dmp

Download

memory/5152-188-0x0000000006690000-0x0000000006710000-memory.dmp

Download

memory/5152-189-0x0000000006640000-0x0000000006662000-memory.dmp

Download

memory/5152-190-0x00000000076D0000-0x0000000007A2B000-memory.dmp

Download

memory/5444-138-0x0000000000040000-0x0000000000048000-memory.dmp

Download

memory/5796-211-0x000000000ED60000-0x000000000EDA0000-memory.dmp

Download

memory/5796-154-0x0000000006280000-0x0000000006312000-memory.dmp

Download

memory/5796-168-0x000000000ACF0000-0x000000000B308000-memory.dmp

Download

memory/5796-205-0x000000000E170000-0x000000000E178000-memory.dmp

Download

memory/5796-206-0x000000000E240000-0x000000000E248000-memory.dmp

Download

memory/5796-184-0x000000000C6E0000-0x000000000C746000-memory.dmp

Download

memory/5796-212-0x000000000E410000-0x000000000E418000-memory.dmp

Download

memory/5796-213-0x000000000EDE0000-0x000000000EE1E000-memory.dmp

Download

memory/5796-214-0x000000000EDB0000-0x000000000EDBE000-memory.dmp

Download

memory/5796-153-0x0000000006660000-0x0000000006C1A000-memory.dmp

Download

memory/5796-152-0x0000000005CD0000-0x0000000005CF6000-memory.dmp

Download

memory/5796-148-0x0000000000890000-0x00000000012CE000-memory.dmp

Download

memory/5796-174-0x000000000B310000-0x000000000C31F000-memory.dmp

Download