Analysis
-
max time kernel
130s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-04-2023 13:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://download.pdfforge.org/download/pdfcreator/PDFCreator-stable
Resource
win10v2004-20230220-en
General
-
Target
https://download.pdfforge.org/download/pdfcreator/PDFCreator-stable
Malware Config
Signatures
-
BazarBackdoor
Stealthy backdoor targeting corporate networks, believed to be developed by Trickbot's authors.
-
Bazar/Team9 Backdoor payload 1 IoCs
Processes:
resource yara_rule C:\ProgramData\PDF Architect 9\Installation\pdf-architect9-startup-9.0.42.20931-x64.msi BazarBackdoorVar3 -
Downloads MZ/PE file
-
Office macro that triggers on suspicious action 2 IoCs
Office document macro which triggers in special circumstances - often malicious.
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\PDFCreator-5_0_3_48775-Setup_x64.msi office_macro_on_action C:\Windows\Installer\e573374.msi office_macro_on_action -
Registers new Print Monitor 2 TTPs 14 IoCs
Processes:
PrinterHelper.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\Program = "C:\\Program Files\\PDFCreator\\PDFCreator-cli.exe" PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\AdditionalParameters = "NewPrintJob" PrinterHelper.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\pdfcmon PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\pdfcmon\Description = "PDFCreator printer port" PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\pdfcmon\Type = "PS" PrinterHelper.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\pdfcmon\NoWindow = "1" PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\Type = "PS" PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\TempFolderName = "PDFCreator" PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\pdfcmon\Program = "C:\\Program Files\\PDFCreator\\PDFCreator-cli.exe" PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\pdfcmon\AdditionalParameters = "NewPrintJob" PrinterHelper.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\Description = "PDFCreator printer port" PrinterHelper.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\NoWindow = "1" PrinterHelper.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\pdfcmon\Ports\pdfcmon\TempFolderName = "PDFCreator" PrinterHelper.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
PDFCreator-5_0_3-Setup.exePDFCreatorSetup.exeplayanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation PDFCreator-5_0_3-Setup.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation PDFCreatorSetup.exe Key value queried \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe -
Executes dropped EXE 17 IoCs
Processes:
PDFCreator-5_0_3-Setup.exe7z.exePDFCreatorSetup.exeplayanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exeOperaSetup.exeOperaSetup.exeConhost.exeOperaSetup.exeOperaSetup.exeSetupHelper.exeSetupHelper.exeAssistant_96.0.4693.50_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exePrinterHelper.exearchitect-setup.exePDF_Architect_9_Installer.exepid process 2308 PDFCreator-5_0_3-Setup.exe 1132 7z.exe 1324 PDFCreatorSetup.exe 2512 playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe 2576 OperaSetup.exe 4788 OperaSetup.exe 4760 Conhost.exe 4336 OperaSetup.exe 4824 OperaSetup.exe 4872 SetupHelper.exe 1288 SetupHelper.exe 2316 Assistant_96.0.4693.50_Setup.exe_sfx.exe 2336 assistant_installer.exe 4924 assistant_installer.exe 4852 PrinterHelper.exe 1940 architect-setup.exe 1652 PDF_Architect_9_Installer.exe -
Loads dropped DLL 38 IoCs
Processes:
MsiExec.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exeMsiExec.exerundll32.exeOperaSetup.exeOperaSetup.exeConhost.exeOperaSetup.exeOperaSetup.exerundll32.exeRegAsm.exerundll32.exeRegAsm.exerundll32.exepid process 4268 MsiExec.exe 4576 rundll32.exe 4268 MsiExec.exe 412 rundll32.exe 4268 MsiExec.exe 3632 rundll32.exe 4268 MsiExec.exe 2924 rundll32.exe 4268 MsiExec.exe 2964 rundll32.exe 4948 MsiExec.exe 3944 rundll32.exe 2576 OperaSetup.exe 4788 OperaSetup.exe 4760 Conhost.exe 4336 OperaSetup.exe 4824 OperaSetup.exe 4948 MsiExec.exe 2636 rundll32.exe 1964 RegAsm.exe 1964 RegAsm.exe 1964 RegAsm.exe 1964 RegAsm.exe 4948 MsiExec.exe 384 rundll32.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 3412 RegAsm.exe 4948 MsiExec.exe 4308 rundll32.exe 988 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Registers COM server for autorun 1 TTPs 36 IoCs
Processes:
RegAsm.exeRegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\5.0.3.0\RuntimeVersion = "v4.0.30319" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\Assembly = "PDFCreatorShell, Version=1.4.2.0, Culture=neutral, PublicKeyToken=156d9970edfc2e96" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\Assembly = "PDFCreator.COM, Version=5.0.3.0, Culture=neutral, PublicKeyToken=fc6825f92a0342e2" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\5.0.3.0 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\5.0.3.0\Assembly = "PDFCreator.COM, Version=5.0.3.0, Culture=neutral, PublicKeyToken=fc6825f92a0342e2" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\5.0.3.0\RuntimeVersion = "v4.0.30319" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\ = "mscoree.dll" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\1.4.2.0 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\Assembly = "PDFCreator.COM, Version=5.0.3.0, Culture=neutral, PublicKeyToken=fc6825f92a0342e2" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\ThreadingModel = "Both" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\RuntimeVersion = "v4.0.30319" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\5.0.3.0\CodeBase = "file:///C:/Program Files/PDFCreator/PDFCreator.COM.DLL" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\5.0.3.0 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\1.4.2.0\CodeBase = "file:///C:/Program Files/PDFCreator/PDFCreatorShell.DLL" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\Class = "pdfforge.PDFCreator.UI.COM.PdfCreatorObj" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\CodeBase = "file:///C:/Program Files/PDFCreator/PDFCreator.COM.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\RuntimeVersion = "v4.0.30319" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\CodeBase = "file:///C:/Program Files/PDFCreator/PDFCreatorShell.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\RuntimeVersion = "v4.0.30319" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\1.4.2.0\Class = "pdfforge.PDFCreatorShell.ContextMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\1.4.2.0\RuntimeVersion = "v4.0.30319" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\ = "mscoree.dll" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\5.0.3.0\Assembly = "PDFCreator.COM, Version=5.0.3.0, Culture=neutral, PublicKeyToken=fc6825f92a0342e2" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\ThreadingModel = "Both" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\Class = "pdfforge.PDFCreatorShell.ContextMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\ = "mscoree.dll" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\ThreadingModel = "Both" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\Class = "pdfforge.PDFCreator.UI.COM.Queue" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\CodeBase = "file:///C:/Program Files/PDFCreator/PDFCreator.COM.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\5.0.3.0\Class = "pdfforge.PDFCreator.UI.COM.Queue" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\5.0.3.0\CodeBase = "file:///C:/Program Files/PDFCreator/PDFCreator.COM.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\1.4.2.0\Assembly = "PDFCreatorShell, Version=1.4.2.0, Culture=neutral, PublicKeyToken=156d9970edfc2e96" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\5.0.3.0\Class = "pdfforge.PDFCreator.UI.COM.PdfCreatorObj" RegAsm.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe upx behavioral1/memory/4760-1256-0x0000000000A30000-0x0000000000F68000-memory.dmp upx behavioral1/memory/4336-1718-0x0000000000A90000-0x0000000000FC8000-memory.dmp upx -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exeOperaSetup.exeOperaSetup.exedescription ioc process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\D: OperaSetup.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\D: OperaSetup.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe -
Drops file in System32 directory 7 IoCs
Processes:
PrinterHelper.exedescription ioc process File opened for modification C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.HLP PrinterHelper.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\PDFCREAT.PPD PrinterHelper.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\PS_SCHM.GDL PrinterHelper.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT.NTF PrinterHelper.exe File opened for modification C:\Windows\system32\pdfcmon.dll PrinterHelper.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT5.DLL PrinterHelper.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\PS5UI.DLL PrinterHelper.exe -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exePDFCreatorSetup.exedescription ioc process File created C:\Program Files\PDFCreator\Com Scripts\JS Scripts\Basics\TestPage2Tif.js msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\gs_wl1_e.ps msiexec.exe File created C:\Program Files\PDFCreator\Languages\da\LC_MESSAGES\messages.mo msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\gsndt.bat msiexec.exe File created C:\Program Files\PDFCreator\itext.styledxmlparser.dll msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\pdf2ps msiexec.exe File created C:\Program Files\PDFCreator\PDFCreator.Ghostscript.dll msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\bj8pa06n.upp msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\gs_lgx_e.ps msiexec.exe File created C:\Program Files\PDFCreator\PDFCreator-cli.exe.config msiexec.exe File created C:\Program Files\PDFCreator\PDFCreator_english.chm msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\cdj690.upp msiexec.exe File created C:\Program Files\PDFCreator\PDFCreator.Presentation.dll msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\C++\CppCOMTest\CppCOMTest\ReadMe.txt msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\JS Scripts\Basics\TestPage2JPG.js msiexec.exe File created C:\Program Files\PDFCreator\PrinterHelper.exe PDFCreatorSetup.exe File created C:\Program Files\PDFCreator\NLog.dll msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2ai.ps msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2ps.cmd msiexec.exe File created C:\Program Files\PDFCreator\System.Runtime.CompilerServices.Unsafe.dll msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\VB.Net\COM_TestForm\COM_TestForm\Form1.vb msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\gsnd msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\st640p.upp msiexec.exe File created C:\Program Files\PDFCreator\pdfforge.Mail.dll msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2pdf msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ras4.upp msiexec.exe File created C:\Program Files\PDFCreator\Languages\kn\LC_MESSAGES\messages.mo msiexec.exe File created C:\Program Files\PDFCreator\Languages\gl\LC_MESSAGES\messages.mo msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2pdf13.cmd msiexec.exe File created C:\Program Files\PDFCreator\SimpleInjector.dll msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\JS Scripts\How To\AttachmentPage.js msiexec.exe File created C:\Program Files\PDFCreator\LicenseValidator.dll msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\st640ihg.upp msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\stcolor.ps msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\unix-lpr.sh msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\gslj msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\necp2x.upp msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2ascii msiexec.exe File created C:\Program Files\PDFCreator\Sentry.dll msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\JS Scripts\How To\CoverPage.pdf msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\VB.Net\COM_TestForm\COM_TestForm\Form1.resx msiexec.exe File created C:\Program Files\PDFCreator\Obsidian.dll msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\Fontmap.ATB msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2pdf12.cmd msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\stc600pl.upp msiexec.exe File created C:\Program Files\PDFCreator\System.Memory.dll msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\VB.Net\COM_TestForm\COM_TestForm\My Project\Application.myapp msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2pdf14 msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2ps2.bat msiexec.exe File created C:\Program Files\PDFCreator\PdfProcessingInterface.dll msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\stc640p.upp msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\stcinfo.ps msiexec.exe File created C:\Program Files\PDFCreator\CustomScriptAction.dll msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\gsdj500.bat msiexec.exe File created C:\Program Files\PDFCreator\Languages\es\LC_MESSAGES\messages.mo msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\C#.Net\COM_TestForm\COM_TestForm\Program.cs msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\ps2pdf13.bat msiexec.exe File created C:\Program Files\PDFCreator\Ghostscript\lib\Fontmap.Sol msiexec.exe File created C:\Program Files\PDFCreator\SystemInterface.dll msiexec.exe File created C:\Program Files\PDFCreator\Microsoft.CodeAnalysis.CSharp.Scripting.dll msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\JS Scripts\Basics\MultipleFiles2Tif.js msiexec.exe File created C:\Program Files\PDFCreator\Com Scripts\C#.Net\COM_TestForm\COM_TestForm\Properties\Settings.settings msiexec.exe File created C:\Program Files\PDFCreator\ITextProcessing.dll msiexec.exe File created C:\Program Files\PDFCreator\Languages\co-FR\LC_MESSAGES\messages.mo msiexec.exe -
Drops file in Windows directory 64 IoCs
Processes:
rundll32.exerundll32.exerundll32.exerundll32.exemsiexec.exerundll32.exerundll32.exerundll32.exerundll32.exerundll32.exedescription ioc process File opened for modification C:\Windows\Installer\MSI5C00.tmp-\WixSharpHelpers.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIACC3.tmp-\WixSharpHelpers.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7209.tmp-\System.Security.AccessControl.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55C5.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI5C00.tmp-\System.Security.AccessControl.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIACC3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIACC3.tmp-\Microsoft.Win32.Registry.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5C00.tmp-\Optional.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7209.tmp-\FluentCommandLineParser.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI3BC1.tmp-\Optional.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4084.tmp-\System.Security.AccessControl.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7209.tmp-\LicenseValidator.Interface.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7209.tmp-\Shared.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8A36.tmp-\CustomAction.config rundll32.exe File opened for modification C:\Windows\Installer\MSI3BC1.tmp-\SystemWrapper.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4A49.tmp-\LicenseValidator.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI5C00.tmp-\System.Security.Permissions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIACC3.tmp-\Optional.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp-\Microsoft.Win32.Registry.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp-\PDFCreator_setup.exe rundll32.exe File opened for modification C:\Windows\Installer\MSI7209.tmp-\Optional.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp-\SystemWrapper.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4A49.tmp-\SystemInterface.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4084.tmp-\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4084.tmp-\LicenseValidator.Interface.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4A49.tmp-\LicenseValidator.Interface.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8A36.tmp-\ProjectConstants.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55C5.tmp-\WixSharpHelpers.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp-\pdfforge.Communication.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4A49.tmp-\FluentCommandLineParser.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp-\System.Security.Permissions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55C5.tmp-\Optional.dll rundll32.exe File created C:\Windows\Installer\e573377.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55C5.tmp-\ProjectConstants.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI7209.tmp-\WixSharp.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIACC3.tmp-\PDFCreator_setup.exe rundll32.exe File opened for modification C:\Windows\Installer\MSI4A49.tmp-\Shared.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55C5.tmp-\NLog.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIACC3.tmp-\Translatable.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8A36.tmp-\Shared.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8A36.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp-\ProjectConstants.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI3BC1.tmp-\SystemInterface.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI3BC1.tmp-\WixSharp.UI.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI517E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4A49.tmp-\ProjectConstants.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8A36.tmp-\WixSharpHelpers.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55C5.tmp-\LicenseValidator.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4084.tmp-\PDFCreator_setup.exe rundll32.exe File opened for modification C:\Windows\Installer\MSI8A36.tmp-\NLog.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8A36.tmp-\System.Security.Principal.Windows.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIACC3.tmp-\FluentCommandLineParser.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIACC3.tmp-\LicenseValidator.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4084.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4084.tmp-\Translatable.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4A49.tmp-\Microsoft.Deployment.WindowsInstaller.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55C5.tmp-\SystemInterface.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI8A36.tmp-\Translatable.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4084.tmp-\Microsoft.Win32.Registry.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI4084.tmp-\Optional.dll rundll32.exe File opened for modification C:\Windows\Installer\MSI55C5.tmp-\System.Security.Permissions.dll rundll32.exe File opened for modification C:\Windows\Installer\MSIBD4E.tmp-\CustomAction.config rundll32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
vssvc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027c70fafd0cbe6b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027c70faf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090027c70faf000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 575ec7859e45d901 iexplore.exe -
Processes:
iexplore.exeIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\download.pdfforge.org\ = "44" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "432541088" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\download.pdfforge.org\ = "70" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\pdfforge.org\Total = "102" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31027722" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31027722" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\pdfforge.org\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d000000000200000000001066000000010000200000000946426d38c7ac0be18c71062f91a51c2052366c7e492c1f0e3facbc1fd7609b000000000e8000000002000020000000d48dc63a99dfd8d5fa7dc8611ba2fc799ef263d10965249554722dc3783b6e0f20000000d18caddadef652973a3ecca21e23c48e4d0cedfc7d56ecc80aebc26f740248af4000000052b859116f4d996f3b56cf5d2b98318cca85a3b31b19436b3fec06f45333c9c994c7fcacd16b646883929bfec4e5ba99835bdfd06e0936b6fbddc0869432d6b6 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e007161e0a72d901 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\pdfforge.org\Total = "70" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "421446670" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000753e36929dd31d0add915f7a8cef537c9ee92721708299c7075bf606bd56216b000000000e800000000200002000000075b1ff4595b44379d3c549f8e60078f14396ee32cfb368274f2e7e18178ac5f7200000004e38bb224d87dff40e9e3a546e68d12ab4a77e2d1e6a48ee26642d4e71bc120f40000000f9b0d949f85a9af8b5eb5dcb0c8aadb1a14b2ffbe2cdc3bdf029f81ab11eb4d6e073f54bd41272390da958d3e308635868cdf58b4a4473a4d5bfeaefd37eb4ac iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "44" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{4418B641-DDFD-11ED-B7D7-660D1B6B73D3} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\download.pdfforge.org\ = "154" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\download.pdfforge.org\ = "102" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\RepId iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "154" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "102" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\pdfforge.org IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\pdfforge.org\Total = "44" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "388596517" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{D7366566-BC01-492E-B7C9-E9838570FCCF}" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "421446670" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31027722" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\pdfforge.org\Total = "154" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 80d1f71d0a72d901 iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\pdfforge.org IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\download.pdfforge.org IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "70" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
rundll32.exeRegAsm.exeRegAsm.exeSetupHelper.exemsiexec.exeRegAsm.exeRegAsm.exeSetupHelper.exerundll32.exedescription ioc process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" SetupHelper.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ SetupHelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SetupHelper.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" SetupHelper.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SetupHelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates RegAsm.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" SetupHelper.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" SetupHelper.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs RegAsm.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates RegAsm.exe -
Modifies registry class 64 IoCs
Processes:
RegAsm.exePDF_Architect_9_Installer.exeRegAsm.exemsiexec.exeRegAsm.exeRegAsm.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\ = "pdfforge.PDFCreator.UI.COM.Queue" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\Class = "pdfforge.PDFCreator.UI.COM.Queue" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\RuntimeVersion = "v4.0.30319" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1F6647E-8C19-4A3E-89DF-7FDFAD2A0C30}\ = "IPDFCreator" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C76D62DC-F23F-4307-832D-3276A3D620BF} PDF_Architect_9_Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFCreator.Shell2\CLSID\ = "{D9CEA52E-100D-4159-89EA-76E845BC13E1}" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DDCF06984D6608141A27A10DDDA170A5\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\4r2jcna2.yqv\\" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D3812FE5-F09C-475F-B0E0-26D4F76DDB80}\LaunchPermission = 010014804c0000005c000000140000003000000002001c0001000000110014000400000001010000000000100010000002001c0001000000000014000b0000000101000000000001000000000102000000000005200000002002000001020000000000052000000020020000 PDF_Architect_9_Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C76D62DC-F23F-4307-832D-3276A3D620BF}\ProxyStubClsid32 PDF_Architect_9_Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C76D62DC-F23F-4307-832D-3276A3D620BF}\TypeLib\ = "{EB2A5816-0275-4E5B-A8A2-9F4EF2E3772A}" PDF_Architect_9_Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\1.4.2.0 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\PDFCreator.ShellContextMenu RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\ = "mscoree.dll" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0F6B8E7-8E89-400C-B623-67EFB0A7A9A0}\ProxyStubClsid32 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\5.0.3.0\Class = "pdfforge.PDFCreator.UI.COM.PdfCreatorObj" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EB2A5816-0275-4E5B-A8A2-9F4EF2E3772A}\1.0\FLAGS\ = "0" PDF_Architect_9_Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{489689FE-E8AF-41FF-8D5A-8212DF2F013C}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3803F46C-F5AA-4B86-8B9C-6EFFAC9CDCFA}\ = "IQueue" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\5.0.3.0 RegAsm.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DDCF06984D6608141A27A10DDDA170A5\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0844C86B-623E-4E33-BEEB-F547ECCA9D4B}\LocalServer32\ServerExecutable = "C:\\ProgramData\\PDF Architect 9\\Installation\\PDF_Architect_9_Installer.exe" PDF_Architect_9_Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0F6B8E7-8E89-400C-B623-67EFB0A7A9A0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E0F6B8E7-8E89-400C-B623-67EFB0A7A9A0}\TypeLib\ = "{8B8D2928-EAAF-492D-8DA5-E06B358D8826}" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFCreator.Shell2\CLSID\ = "{D9CEA52E-100D-4159-89EA-76E845BC13E1}" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\1.4.2.0\CodeBase = "file:///C:/Program Files/PDFCreator/PDFCreatorShell.DLL" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8B8D2928-EAAF-492D-8DA5-E06B358D8826}\5.0\0\win64\ = "C:\\Program Files\\PDFCreator\\PDFCreator.COM.tlb" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{489689FE-E8AF-41FF-8D5A-8212DF2F013C} RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E0F6B8E7-8E89-400C-B623-67EFB0A7A9A0}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\DDCF06984D6608141A27A10DDDA170A5\SourceList\PackageName = "PDFCreator-5_0_3_48775-Setup_x64.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\5.0.3.0\CodeBase = "file:///C:/Program Files/PDFCreator/PDFCreator.COM.DLL" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8B8D2928-EAAF-492D-8DA5-E06B358D8826}\5.0\ = "PDFCreator_COM" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC64BF81-0A5C-4EC9-9EF4-31DFF3ABD92C}\TypeLib\Version = "5.0" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3803F46C-F5AA-4B86-8B9C-6EFFAC9CDCFA}\ProxyStubClsid32 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0844C86B-623E-4E33-BEEB-F547ECCA9D4B}\ = "Installer Class" PDF_Architect_9_Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFCreator.Shell2\CLSID RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\InprocServer32\1.4.2.0\Class = "pdfforge.PDFCreatorShell.ContextMenu" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\Class = "pdfforge.PDFCreator.UI.COM.PdfCreatorObj" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{489689FE-E8AF-41FF-8D5A-8212DF2F013C}\TypeLib RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01E51AAE-D371-469A-A556-FC491A81778D}\ProxyStubClsid32 RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3803F46C-F5AA-4B86-8B9C-6EFFAC9CDCFA}\TypeLib RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0844C86B-623E-4E33-BEEB-F547ECCA9D4B}\TypeLib PDF_Architect_9_Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFCreator.JobQueue\CLSID\ = "{66A9CAB1-404A-4918-8DE2-29C26B9B271E}" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC64BF81-0A5C-4EC9-9EF4-31DFF3ABD92C}\ProxyStubClsid32 RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3803F46C-F5AA-4B86-8B9C-6EFFAC9CDCFA}\ = "IQueue" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3803F46C-F5AA-4B86-8B9C-6EFFAC9CDCFA}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3803F46C-F5AA-4B86-8B9C-6EFFAC9CDCFA}\TypeLib\ = "{8B8D2928-EAAF-492D-8DA5-E06B358D8826}" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\ProgId\ = "PDFCreator.PDFCreatorObj" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFCreator.JobQueue\ = "pdfforge.PDFCreator.UI.COM.Queue" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\Assembly = "PDFCreator.COM, Version=5.0.3.0, Culture=neutral, PublicKeyToken=fc6825f92a0342e2" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3803F46C-F5AA-4B86-8B9C-6EFFAC9CDCFA}\TypeLib\Version = "5.0" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC64BF81-0A5C-4EC9-9EF4-31DFF3ABD92C}\TypeLib RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01E51AAE-D371-469A-A556-FC491A81778D}\ = "IPrintJob" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1} RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\ProgId\ = "PDFCreator.Shell2" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9CEA52E-100D-4159-89EA-76E845BC13E1}\Implemented Categories RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29} RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\InprocServer32\5.0.3.0\Class = "pdfforge.PDFCreator.UI.COM.Queue" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{66A9CAB1-404A-4918-8DE2-29C26B9B271E}\Implemented Categories RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\Assembly = "PDFCreator.COM, Version=5.0.3.0, Culture=neutral, PublicKeyToken=fc6825f92a0342e2" RegAsm.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{69189C58-70C4-4DF2-B94D-5D786E9AD513}\InprocServer32\RuntimeVersion = "v4.0.30319" RegAsm.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\DDCF06984D6608141A27A10DDDA170A5 msiexec.exe -
Processes:
PDFCreator-5_0_3-Setup.exeOperaSetup.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 040000000100000010000000d5e98140c51869fc462c8975620faa780f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df153000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b0020004300410000006200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e1400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f71d0000000100000010000000e3f9af952c6df2aaa41706a77a44c20303000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1900000001000000100000001f7e750b566b128ac0b8d6576d2a70a52000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c PDFCreator-5_0_3-Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E\Blob = 5c0000000100000004000000000800001900000001000000100000001f7e750b566b128ac0b8d6576d2a70a503000000010000001400000007e032e020b72c3f192f0628a2593a19a70f069e1d0000000100000010000000e3f9af952c6df2aaa41706a77a44c2031400000001000000140000000876cdcb07ff24f6c5cdedbb90bce284374675f76200000001000000200000005c58468d55f58e497e743982d2b50010b6d165374acf83a7d4a32db768c4408e0b0000000100000034000000430065007200740075006d002000540072007500730074006500640020004e006500740077006f0072006b002000430041000000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000006500000030633021060b2a84680186f6770205010130123010060a2b0601040182373c0101030200c03021060b2a84680186f6770205010730123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000a8569ccd21ef9cc5737c7a12df608c2cbc545df1040000000100000010000000d5e98140c51869fc462c8975620faa782000000001000000bf030000308203bb308202a3a00302010202030444c0300d06092a864886f70d0101050500307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b204341301e170d3038313032323132303733375a170d3239313233313132303733375a307e310b300906035504061302504c31223020060355040a1319556e697a65746f20546563686e6f6c6f6769657320532e412e31273025060355040b131e43657274756d2043657274696669636174696f6e20417574686f72697479312230200603550403131943657274756d2054727573746564204e6574776f726b20434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e3fb7da372bac2f0c91487f56b014ee16e4007ba6d275d7ff75b2db35ac7515faba432a66187b66e0f86d2300297f8d76957a118395d6a6479c60159ac3c314a387cd204d24b28e8205f3b07a2cc4d73dbf3ae4fc756d55aa79689faf3ab68d423865927cf0927bcac6e72831c3072dfe0a2e9d2e1747519bd2a9e7b1554041bd74339ad5528c5e21abbf4c0e4ae384933cc76859f3945d2a49ef2128c51f87ce42d7ff5ac5feb169fb12dd1bacc9142774c25c990386fdbf0ccfb8e1e97593ed5604ee60528ed4979134bba48db2ff972d339cafe1fd83472f5b440cf3101c3ecde112d175d1fb850d15e19a769de073328ca5095f9a754cb54865045a9f9490203010001a3423040300f0603551d130101ff040530030101ff301d0603551d0e041604140876cdcb07ff24f6c5cdedbb90bce284374675f7300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100a6a8ad22ce013da6a3ff62d0489d8b5e72b07844e3dc1caf09fd2348fabd2ac4b95504b510a38d27de0b8263d0eede0c3779415b22b2b09a415ca670e0d4d077cb23d300e06c562fe1690d0dd9aabf218150d906a5a8ff9537d0aafee2b3f5992d45848ae54209d774022ff789d899e9bc27d4478dba0d461c77cf14a41cb9a431c49c28740334ff331926a5e90d74b73e97c676e82796a366dde1aef2415bca9856837370e4861ad23141ba2fbe2d135a766f4ee84e810e3f5b0322a012be6658114acb03c4b42a2a2d9617e03954bc48d376279d9a2d06a6c9ec39d2abdb9f9a0b27023529b14095e7f9e89c55881946d6b734f57ece399ad938f151f74f2c PDFCreator-5_0_3-Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e PDFCreator-5_0_3-Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\07E032E020B72C3F192F0628A2593A19A70F069E PDFCreator-5_0_3-Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 OperaSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 OperaSetup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 OperaSetup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 PDFCreator-5_0_3-Setup.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e PDFCreator-5_0_3-Setup.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
7z.exePDFCreatorSetup.exemsiexec.exeplayanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exerundll32.exedescription pid process Token: SeRestorePrivilege 1132 7z.exe Token: 35 1132 7z.exe Token: SeSecurityPrivilege 1132 7z.exe Token: SeSecurityPrivilege 1132 7z.exe Token: SeDebugPrivilege 1324 PDFCreatorSetup.exe Token: SeShutdownPrivilege 1324 PDFCreatorSetup.exe Token: SeIncreaseQuotaPrivilege 1324 PDFCreatorSetup.exe Token: SeSecurityPrivilege 4028 msiexec.exe Token: SeCreateTokenPrivilege 1324 PDFCreatorSetup.exe Token: SeAssignPrimaryTokenPrivilege 1324 PDFCreatorSetup.exe Token: SeLockMemoryPrivilege 1324 PDFCreatorSetup.exe Token: SeIncreaseQuotaPrivilege 1324 PDFCreatorSetup.exe Token: SeMachineAccountPrivilege 1324 PDFCreatorSetup.exe Token: SeTcbPrivilege 1324 PDFCreatorSetup.exe Token: SeSecurityPrivilege 1324 PDFCreatorSetup.exe Token: SeTakeOwnershipPrivilege 1324 PDFCreatorSetup.exe Token: SeLoadDriverPrivilege 1324 PDFCreatorSetup.exe Token: SeSystemProfilePrivilege 1324 PDFCreatorSetup.exe Token: SeSystemtimePrivilege 1324 PDFCreatorSetup.exe Token: SeProfSingleProcessPrivilege 1324 PDFCreatorSetup.exe Token: SeIncBasePriorityPrivilege 1324 PDFCreatorSetup.exe Token: SeCreatePagefilePrivilege 1324 PDFCreatorSetup.exe Token: SeCreatePermanentPrivilege 1324 PDFCreatorSetup.exe Token: SeBackupPrivilege 1324 PDFCreatorSetup.exe Token: SeRestorePrivilege 1324 PDFCreatorSetup.exe Token: SeShutdownPrivilege 1324 PDFCreatorSetup.exe Token: SeDebugPrivilege 1324 PDFCreatorSetup.exe Token: SeAuditPrivilege 1324 PDFCreatorSetup.exe Token: SeSystemEnvironmentPrivilege 1324 PDFCreatorSetup.exe Token: SeChangeNotifyPrivilege 1324 PDFCreatorSetup.exe Token: SeRemoteShutdownPrivilege 1324 PDFCreatorSetup.exe Token: SeUndockPrivilege 1324 PDFCreatorSetup.exe Token: SeSyncAgentPrivilege 1324 PDFCreatorSetup.exe Token: SeEnableDelegationPrivilege 1324 PDFCreatorSetup.exe Token: SeManageVolumePrivilege 1324 PDFCreatorSetup.exe Token: SeImpersonatePrivilege 1324 PDFCreatorSetup.exe Token: SeCreateGlobalPrivilege 1324 PDFCreatorSetup.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeDebugPrivilege 2512 playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeDebugPrivilege 412 rundll32.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe Token: SeTakeOwnershipPrivilege 4028 msiexec.exe Token: SeRestorePrivilege 4028 msiexec.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
iexplore.exepid process 1916 iexplore.exe 1916 iexplore.exe -
Suspicious use of SetWindowsHookEx 17 IoCs
Processes:
iexplore.exeIEXPLORE.EXE7z.exeOperaSetup.exeOperaSetup.exeConhost.exeOperaSetup.exeOperaSetup.exeAssistant_96.0.4693.50_Setup.exe_sfx.exeassistant_installer.exeassistant_installer.exearchitect-setup.exePDF_Architect_9_Installer.exepid process 1916 iexplore.exe 1916 iexplore.exe 4424 IEXPLORE.EXE 4424 IEXPLORE.EXE 4424 IEXPLORE.EXE 4424 IEXPLORE.EXE 1132 7z.exe 2576 OperaSetup.exe 4788 OperaSetup.exe 4760 Conhost.exe 4336 OperaSetup.exe 4824 OperaSetup.exe 2316 Assistant_96.0.4693.50_Setup.exe_sfx.exe 2336 assistant_installer.exe 4924 assistant_installer.exe 1940 architect-setup.exe 1652 PDF_Architect_9_Installer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exePDFCreator-5_0_3-Setup.exePDFCreatorSetup.exemsiexec.exeMsiExec.exeMsiExec.exeplayanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exeOperaSetup.exeOperaSetup.exerundll32.exeSetupHelper.exerundll32.exeSetupHelper.exedescription pid process target process PID 1916 wrote to memory of 4424 1916 iexplore.exe IEXPLORE.EXE PID 1916 wrote to memory of 4424 1916 iexplore.exe IEXPLORE.EXE PID 1916 wrote to memory of 4424 1916 iexplore.exe IEXPLORE.EXE PID 1916 wrote to memory of 2308 1916 iexplore.exe PDFCreator-5_0_3-Setup.exe PID 1916 wrote to memory of 2308 1916 iexplore.exe PDFCreator-5_0_3-Setup.exe PID 2308 wrote to memory of 1132 2308 PDFCreator-5_0_3-Setup.exe 7z.exe PID 2308 wrote to memory of 1132 2308 PDFCreator-5_0_3-Setup.exe 7z.exe PID 2308 wrote to memory of 1132 2308 PDFCreator-5_0_3-Setup.exe 7z.exe PID 2308 wrote to memory of 1324 2308 PDFCreator-5_0_3-Setup.exe PDFCreatorSetup.exe PID 2308 wrote to memory of 1324 2308 PDFCreator-5_0_3-Setup.exe PDFCreatorSetup.exe PID 1324 wrote to memory of 2512 1324 PDFCreatorSetup.exe playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe PID 1324 wrote to memory of 2512 1324 PDFCreatorSetup.exe playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe PID 1324 wrote to memory of 2512 1324 PDFCreatorSetup.exe playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe PID 4028 wrote to memory of 4268 4028 msiexec.exe MsiExec.exe PID 4028 wrote to memory of 4268 4028 msiexec.exe MsiExec.exe PID 4268 wrote to memory of 4576 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 4576 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 412 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 412 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 3632 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 3632 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 2924 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 2924 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 2964 4268 MsiExec.exe rundll32.exe PID 4268 wrote to memory of 2964 4268 MsiExec.exe rundll32.exe PID 4028 wrote to memory of 4948 4028 msiexec.exe MsiExec.exe PID 4028 wrote to memory of 4948 4028 msiexec.exe MsiExec.exe PID 4948 wrote to memory of 3944 4948 MsiExec.exe rundll32.exe PID 4948 wrote to memory of 3944 4948 MsiExec.exe rundll32.exe PID 2512 wrote to memory of 2576 2512 playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe OperaSetup.exe PID 2512 wrote to memory of 2576 2512 playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe OperaSetup.exe PID 2512 wrote to memory of 2576 2512 playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe OperaSetup.exe PID 2576 wrote to memory of 4788 2576 OperaSetup.exe OperaSetup.exe PID 2576 wrote to memory of 4788 2576 OperaSetup.exe OperaSetup.exe PID 2576 wrote to memory of 4788 2576 OperaSetup.exe OperaSetup.exe PID 2576 wrote to memory of 4760 2576 OperaSetup.exe Conhost.exe PID 2576 wrote to memory of 4760 2576 OperaSetup.exe Conhost.exe PID 2576 wrote to memory of 4760 2576 OperaSetup.exe Conhost.exe PID 2576 wrote to memory of 4336 2576 OperaSetup.exe OperaSetup.exe PID 2576 wrote to memory of 4336 2576 OperaSetup.exe OperaSetup.exe PID 2576 wrote to memory of 4336 2576 OperaSetup.exe OperaSetup.exe PID 4336 wrote to memory of 4824 4336 OperaSetup.exe OperaSetup.exe PID 4336 wrote to memory of 4824 4336 OperaSetup.exe OperaSetup.exe PID 4336 wrote to memory of 4824 4336 OperaSetup.exe OperaSetup.exe PID 4948 wrote to memory of 2636 4948 MsiExec.exe rundll32.exe PID 4948 wrote to memory of 2636 4948 MsiExec.exe rundll32.exe PID 2636 wrote to memory of 4872 2636 rundll32.exe SetupHelper.exe PID 2636 wrote to memory of 4872 2636 rundll32.exe SetupHelper.exe PID 4872 wrote to memory of 4100 4872 SetupHelper.exe RegAsm.exe PID 4872 wrote to memory of 4100 4872 SetupHelper.exe RegAsm.exe PID 4872 wrote to memory of 1964 4872 SetupHelper.exe RegAsm.exe PID 4872 wrote to memory of 1964 4872 SetupHelper.exe RegAsm.exe PID 4872 wrote to memory of 1964 4872 SetupHelper.exe RegAsm.exe PID 4948 wrote to memory of 384 4948 MsiExec.exe rundll32.exe PID 4948 wrote to memory of 384 4948 MsiExec.exe rundll32.exe PID 384 wrote to memory of 1288 384 rundll32.exe SetupHelper.exe PID 384 wrote to memory of 1288 384 rundll32.exe SetupHelper.exe PID 1288 wrote to memory of 4792 1288 SetupHelper.exe RegAsm.exe PID 1288 wrote to memory of 4792 1288 SetupHelper.exe RegAsm.exe PID 2576 wrote to memory of 2316 2576 OperaSetup.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 2576 wrote to memory of 2316 2576 OperaSetup.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 2576 wrote to memory of 2316 2576 OperaSetup.exe Assistant_96.0.4693.50_Setup.exe_sfx.exe PID 1288 wrote to memory of 3412 1288 SetupHelper.exe RegAsm.exe PID 1288 wrote to memory of 3412 1288 SetupHelper.exe RegAsm.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://download.pdfforge.org/download/pdfcreator/PDFCreator-stable1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1916 CREDAT:17410 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4424
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\PDFCreator-5_0_3-Setup.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\PDFCreator-5_0_3-Setup.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\7z.exe"C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\7z.exe" x "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\PDFCreator-5_0_3-Setup.exe" -o"C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1132
-
-
C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\PDFCreatorSetup.exe"C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\PDFCreatorSetup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\banners-bc25ifb1.z04\playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe"C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\banners-bc25ifb1.z04\playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe" HASYNC HHWND=66136 HLANG=en HSHOWCARRIER4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe" --silent --allusers=05⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Local\Temp\OperaSetup.exeC:\Users\Admin\AppData\Local\Temp\OperaSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.83 --initial-client-data=0x2f4,0x2f8,0x2fc,0x2d0,0x300,0x67ea33e0,0x67ea33f0,0x67ea33fc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4788
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\OperaSetup.exe" --version6⤵PID:4760
-
-
C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe"C:\Users\Admin\AppData\Local\Temp\OperaSetup.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --server-tracking-data=server_tracking_data --initial-pid=2576 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20230418152639" --session-guid=52d027f9-f724-4843-acdf-a3193403100e --server-tracking-blob="YWJlZjg0OTJhOTMyMjVkZTE5NmJkMzAxMGZmYmUxMjE4ZjZmMzc4MWU3NjQyYjFlMTVkNjg4YjRlODRlZjNjZTp7ImNvdW50cnkiOiJJTiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cz91dG1fc291cmNlPXBsYXlhbmV4dCZ1dG1fbWVkaXVtPWFwYiZ1dG1fY2FtcGFpZ249cGRmY3JlYXRvciIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTY4MTgyNDM5Ny41MTcwIiwidXNlcmFnZW50IjoiTW96aWxsYS81LjAgKFdpbmRvd3MgTlQgMTAuMDsgV2luNjQ7IHg2NCkiLCJ1dG0iOnsiY2FtcGFpZ24iOiJwZGZjcmVhdG9yIiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoicGxheWFuZXh0In0sInV1aWQiOiJmNDkxMWNmMy00ZjVkLTQ5NjItYjhiNC1lZDYxYjA1NDYxNDkifQ== " --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=60050000000000006⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Users\Admin\AppData\Local\Temp\OperaSetup.exeC:\Users\Admin\AppData\Local\Temp\OperaSetup.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=97.0.4719.83 --initial-client-data=0x300,0x304,0x308,0x2d0,0x30c,0x672033e0,0x672033f0,0x672033fc7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4824
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304181526391\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304181526391\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2316
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304181526391\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304181526391\assistant\assistant_installer.exe" --version6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2336 -
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304181526391\assistant\assistant_installer.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304181526391\assistant\assistant_installer.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=96.0.4693.50 --initial-client-data=0x288,0x28c,0x290,0x264,0x294,0xe56c28,0xe56c38,0xe56c447⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4924
-
-
-
-
-
C:\Program Files\PDFCreator\PrinterHelper.exe"C:\Program Files\PDFCreator\PrinterHelper.exe" installprinter -name=PDFCreator "-portapplication=C:\Program Files\PDFCreator\PDFCreator-cli.exe" -log=C:\Users\Admin\AppData\Local\Temp\tmpE520.tmp4⤵
- Registers new Print Monitor
- Executes dropped EXE
- Drops file in System32 directory
PID:4852
-
-
C:\Program Files\PDFCreator\PDF Architect\architect-setup.exe"C:\Program Files\PDFCreator\PDF Architect\architect-setup.exe" /quiet /run_application=0 /default_application=0 /desktop_shortcut=1 /enable_automatic_updates=yes /win_explorer_integration4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1940 -
C:\ProgramData\PDF Architect 9\Installation\PDF_Architect_9_Installer.exe"C:\ProgramData\PDF Architect 9\Installation\PDF_Architect_9_Installer.exe" /RegServer5⤵
- Executes dropped EXE
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1652
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4028 -
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding AC6FAB3CB6431A39FE956D94A337C36A2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4268 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI3BC1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240598218 2 WixSharp!WixSharp.ManagedProjectActions.WixSharp_InitRuntime_Action3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4576
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4084.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240599296 6 WixSharp!WixSharp.ManagedProjectActions.WixSharp_Load_Action3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:412
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI4A49.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240601718 28 PDFCreator_setup!pdfforge.PDFCreator.Setup.CustomActions.RegSettingsCustomActions.SetPdfCreatorRegistryParameters3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3632
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI55C5.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240604781 36 PDFCreator_setup!pdfforge.PDFCreator.Setup.CustomActions.PdfArchitectCustomAction.DetectInstalledPdfArchitect3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2924
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI5C00.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240606203 45 PDFCreator_setup!pdfforge.PDFCreator.Setup.CustomActions.InnoSetupCustomActions.UninstallPdfCreatorInnoSetup3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:2964
-
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6C7A09DC051EF311514029F8E3F517C2 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI7209.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240611906 50 PDFCreator_setup!pdfforge.PDFCreator.Setup.CustomActions.FreewareCustomActions.CheckInstall3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:3944
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSI8A36.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240618078 55 PDFCreator_setup!pdfforge.PDFCreator.Setup.CustomActions.FileExtensionsCustomActions.FileExtensionsAdd3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files\PDFCreator\SetupHelper.exe"C:\Program Files\PDFCreator\SetupHelper.exe" /FileExtensions=Add4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" "C:\Program Files\PDFCreator\PDFCreatorShell.dll" /codebase5⤵
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4100
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files\PDFCreator\PDFCreatorShell.dll" /codebase5⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1964
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIACC3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240626890 66 PDFCreator_setup!pdfforge.PDFCreator.Setup.CustomActions.ComCustomActions.RegisterCom3⤵
- Loads dropped DLL
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:384 -
C:\Program Files\PDFCreator\SetupHelper.exe"C:\Program Files\PDFCreator\SetupHelper.exe" /ComInterface=Register4⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe" "C:\Program Files\PDFCreator\PDFCreator.COM.dll" /codebase /tlb5⤵
- Registers COM server for autorun
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4792 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:4760
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" "C:\Program Files\PDFCreator\PDFCreator.COM.dll" /codebase /tlb5⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Modifies registry class
PID:3412
-
-
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Windows\Installer\MSIBD4E.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240631156 76 WixSharp!WixSharp.ManagedProjectActions.CancelRequestHandler3⤵
- Loads dropped DLL
- Drops file in Windows directory
PID:4308
-
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:1740
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 07C56F492A8D715C19302A593261D0EA2⤵PID:3812
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:1232
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
108KB
MD5ae852e9aa559ac3da1cc2340fb79f52d
SHA1d52a15a3a16b0547d0d49326914336a028c1ee36
SHA25627560e4c9d4cf5b138235c3ea72dc58ce4f83e9c89b5d151afec477d2b541e74
SHA512534557279d47acbb16c65cd1fb969395a1baa8f5ccce8a88410937548437bc5a3c4a60416abe2b2501ff86f40ab23c9df6cf3918a11a0d5fe06e3e43a0a4a3a5
-
Filesize
114KB
MD50f2559173becf1c8916ee8faf6e680ef
SHA1e91004021080f7b7422ee6cc62002968c85f31e8
SHA25652cf7ff308c2e4777ca7b9a0336275f1eabe584bdf6efb7fc6884d43ed989f4f
SHA5126584c8a624c5eeebeea3f824343551a21c9075cc81f7730c27a5b88be3d79a42420bfcad690ac9b30a2bd7935f932b968ecd86169beb9957e6470617ae9084ea
-
Filesize
15.2MB
MD525366a0fefaad3472af4174fba047c1a
SHA170ec0550eba324cef6fa0c502e48bf48d245a5f5
SHA2566543fd0e16764be534e1c32aeea7c7d47487b3be33e5900e10e5d28f9f6f8339
SHA512a45a274f7003636b7578aaf51eb8713ac5c3d65dc7ae15f09fdc958b23f4a360370a2b344194f9c65859a7f3c153771fa71e6866dac4642406a373f5f004bd18
-
Filesize
6.8MB
MD5420746cfc8baf3a33572a3159347c78d
SHA19fddfd028b554818200ab4baf46bcb4eaa6aeb04
SHA2568d04ee640a773be6b656a26b19fe210c8503c51b5b30741fd8e3b555f863c200
SHA512fd68a1e8fa7890fc835cd535e74ae01af727d2b7806bec17aef46a699095e005492c26ebc269497ba17361a7649b47420ba3e48c903cdf8fc526cab791b8bf57
-
Filesize
104.6MB
MD5556afb40e8fed74d109b6d768e25b016
SHA1a33178ace9ca18e3dfd7d66ea9a274f4e8fc32c1
SHA2560c41648bd685b3cd6a1ddab433cc6c4576f301a62a866701e5e35dc543e67ad0
SHA512c8cbf8c7456f970474f73d1b6c05f6dbf97d9b7004987e0a49da4753f631f2d0825992dc5183233e7d3c334493345e6f5de7c5c1ef42c4f3b40e99cc25ee2a94
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5cd20a697debac967d6e006796d88de7e
SHA139950e433af6db44e65a9411e0869f93daeb03fb
SHA25674a5f99d6a592ffe83f7871dd842c538d7f2ce307a892b134c1957de356ca323
SHA51251b1bd6f784587c540a7d5e17d74d38afc962e233633a12f9db8b59cb9592ceb14e2e67bb57bb7e68b5b312df0afe3fe17376c1b652a41f26dd6913baa10810a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5ABF2B93FF506722017092AC4D4208F7
Filesize727B
MD5e0a86277e4dbbcc53877ac33cde6e166
SHA1b068c079cd6e39873e8e47938df4ffe23377eaa2
SHA256ea4ee83f9569cf179dcf238a6d541430fb8693a76127a63987c7ef2b97ea0cca
SHA5128d02608c0e65ed7b5c880f660ba4597261f15b78f7d927778b10bb6bbc8b27fb03f82c1e97977a2461ad0dc67c0d54bd4a49cff1cb6496655fb5050973d74639
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize727B
MD5e49dba953e128b00775ebdad47d32ef9
SHA1ba90944e4e3ae611aeef99c6c527a597de445776
SHA2563b58edbd4dfb0716e1d7f4d95d6badbcb8ef8efd82a13a0c36b367ddbe056fcc
SHA5126aa1ea9fdeda2ad4c37994a516a831e3ce6d1ad46d4adb6e6dc06b311f4096d49c68cc56810c6b76f6447c39840e6e1a872a428bc431eece28fc824ee94f585b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5d5a7285c84e090847219f648caab2771
SHA1bbe27102acd6008c151bf0b2c0d63310fb70b00e
SHA256ca1660802f4a2a8bd10dfbe17c4d97018a95f1f230d1d8be4fd71cd1d663a2c3
SHA512bcee211ae99f6a47ac8ee0984b35a1078ac520e5e03ecbd0d923f8d4430166836b15ed27cab0089dfc3004708dcdbaceb675e5bb167e2f749b229cdac8c9a73b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5ABF2B93FF506722017092AC4D4208F7
Filesize442B
MD5f0d47b5b17b1f921813f7e1174677da2
SHA11c5db3175310855c851535808a9dad2c48f3fe51
SHA256bdb00fe45db74139e06f4cbfa9e38b3b47e398fcb815523867dfe9e923dc36cd
SHA5129816a67e4bef24ce5f29b24446bccaf37c3acd7aa3c056ba49844376d68e2d146a3890e7f3aa7b9816e0e38d1ea28037a765221c72103fab1d40f1c228215d8c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize442B
MD50e6f168fa167d1201d38c0429b91daef
SHA1ca7837fc942ac1b8459099aae278709936749282
SHA256b13a140e700a43fa10b6fbdf15eff502ab5982eae65a143d9cae6bb996024794
SHA5126d8a626f9f11a044684a5c1a031365795a6646a3a8784ae76ba87c1b990c3ab37a75e967ddd88405566c78b26180fb6d4c3950bf618728c0b4c795b02433f479
-
Filesize
651B
MD500bfeb783aeff425ce898d55718d506d
SHA1aac7a973dc1f9ca7abc529c7ea37ad7eaf491b8f
SHA256d06099ef43eb002055378b1b6d9853f9b1f891ada476932ba575d1f97065a580
SHA5122209d5f4999cb36ebf26c6b8cb3195cc9fc0f0a103f4a28dd77b04605d7c6e79d47d806454c63b8d42bbe32864be7cdb56df3cccf71a6c27fe0b331d8304e1ff
-
Filesize
203B
MD53cb9778b0732507f96d7f37dc95683fe
SHA1072bf380e7b6107baef0909fa42d384150a61a56
SHA25680847daa15eac8fb8b869375cf2353c29440ce59cfcd5f3ec80ceacd869ce0d8
SHA512555c952836e4934836194f537e37e45c0ff4e8abbe1e1a29edf5f520f1c408fe987e05e055ce8a16ca49fc9bdda53cb65656832082f0c0c7f9dbc42d9733cefd
-
Filesize
367B
MD56df505005eea26ecfe0cc011e5886131
SHA18734a6c6a25be3e423259fd61f8bbc450a66076c
SHA256f8a7754498f5c6255cc14d09f797666eb9892165f7fbd8850bafec61cec08226
SHA5127edcf32e61bd83f6872c9994a00840739b6e933af2dede0ec3a5754da9daff4b659002ccf5f7caf385c3d541a5ebd38ff6b5fa4de26432700db45d49bbd5636d
-
Filesize
825B
MD5454696bd637dd9509c1bf897e47d6375
SHA1373bcbd0c7413dc7463959e71d5189d730c7e5c0
SHA256f1b882893f29263e217808214e710040f2ffdeb7c4f40be237fe401f8f53472d
SHA512592672c6568b8f79c03412fa4bee46a1fbe44f48f1c64571492035ed6ebd5a3824fbf8188a95d01b06eb55c85ebc8090576eef93c2b8d905ddbcd9547b16870f
-
Filesize
697B
MD5693e03d6ea2451b04effc8717da220e0
SHA1225e306a738f1e80c710b25173343723f1f7ff6c
SHA2560e29c21ad565cedbe3d0ef9f971d4896bf0ada1eecf92b0185906e32431c910e
SHA512ed58fd46132c0dd7b96722155bab59674ac63b2e38f44f03d05d18e9eba25deca3e1780a443462f7f1b388c22782a3936ea79ad6f4e7ab818f86f4b3600c5769
-
Filesize
37.4MB
MD5c3441267a4f584f649c9154a2442057b
SHA1dddde15b0ab014f81a9cec227101843a3da9bead
SHA2563066d8aee375735ae180cd83974d6a72f98489736e59333798e458e383d2b718
SHA5123dbd9d39eb4011e92c225ae4b990ab7be371c5becb808f68a2aa91b5cd699bdb9b7f4b1f8e6762713ce22dcaa81e90cdcde481e57904f799dcc46843b67da9cb
-
Filesize
170B
MD5e7673c60af825466f83d46da72ca1635
SHA1fc0fcbee0835709ba2d28798a612bfd687903fb5
SHA2560b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
SHA512f1c33e72643ce366fd578e3b5d393799e8c9ea27b180987826af43b4fc00b65a4eaae5e6426a23448956fee99e3108c6a86f32fb4896c156e24af0571a11c498
-
Filesize
17KB
MD55a34cb996293fde2cb7a4ac89587393a
SHA13c96c993500690d1a77873cd62bc639b3a10653f
SHA256c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad
SHA512e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee
-
Filesize
37.4MB
MD5c3441267a4f584f649c9154a2442057b
SHA1dddde15b0ab014f81a9cec227101843a3da9bead
SHA2563066d8aee375735ae180cd83974d6a72f98489736e59333798e458e383d2b718
SHA5123dbd9d39eb4011e92c225ae4b990ab7be371c5becb808f68a2aa91b5cd699bdb9b7f4b1f8e6762713ce22dcaa81e90cdcde481e57904f799dcc46843b67da9cb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\DKFP9JBL\PDFCreator-5_0_3-Setup.exe.lb239my.partial
Filesize37.4MB
MD5c3441267a4f584f649c9154a2442057b
SHA1dddde15b0ab014f81a9cec227101843a3da9bead
SHA2563066d8aee375735ae180cd83974d6a72f98489736e59333798e458e383d2b718
SHA5123dbd9d39eb4011e92c225ae4b990ab7be371c5becb808f68a2aa91b5cd699bdb9b7f4b1f8e6762713ce22dcaa81e90cdcde481e57904f799dcc46843b67da9cb
-
Filesize
126KB
MD5d20c1f868694e1acc3fca04e64456b09
SHA1fa610722a9120d995ca6233bae1ac202f475f687
SHA256df1e037ddb9ca307ef5b5c1e08b1ea335b953e1965d022a2c5325f2b560c46f8
SHA512285f517c93de527450518a031bbc2a9b59a43800d590e1cf7910afe0d735105abc74da92fdf1ccab5a76f0e9301053034e9ae5ec0f37c9aa718e904ec5c33250
-
Filesize
126KB
MD547407b342e7c1d7f1eff639ded8887f4
SHA17e3e36500fbf1a3c477df39fefa3497e833ce1a6
SHA256fa20ea97cbcb858ca2363fcbb3ebfe377bcc4f7c8a9a0e3f0b9b807dd3d7fc13
SHA512a0a81badd7562bd13a1210cb687a0ee3eeb43452aaa2f15df6f5b1bae2819452846a5ab9a2ccd2b099282e01813ac74b190c12115c5c2edce80688f5664f7ff3
-
Filesize
118KB
MD5fe3eea98cd6927a42f006fc3e91a915b
SHA1b0306e871f079d1800ed568ef7702acd42e78b7a
SHA256ad0f5e4effc2f44a6b4b23075169cfed9ba877ad59078f427d4000b00605691d
SHA512a493287d9644a704ce856defd6792b41505ecd149ed0bca80d304b738915ea9d701f152f127622b955001e6f3b303832442becdd7892df3973c53acb07c4dde0
-
Filesize
127KB
MD564e5cf964b1ad32e649f84ee1b1a93df
SHA1a8657f692dc31d285b4612cb9bba16dd7044258a
SHA256a6a54e48e7269544229e98d7781c25daea88362693e227f52c80e348bc272782
SHA512251c9e18936af59d0cb645d573e590cd0bb084ed05893c7bfb63d8fa83d03e6c13962bef3870022b5509aa6cb783823d15c5fc6ad662d37cc6192b2d8081c60b
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304181526391\assistant\Assistant_96.0.4693.50_Setup.exe_sfx.exe
Filesize1.7MB
MD5b386cdcb413405daa8219af8e4cbd318
SHA1ce275ff8514fef0629c915a6ee7b5ac481b9043d
SHA256408ebcce07eb76963651b97f84255b67e5f0e7ff6869e9c0e5bab0082eafe66e
SHA51291f6bf600e022a2a80c6b0a7b84fd5549804111447f66c4a30e768a589efc0702d02634a9ba23ce18c42701e42b440af0aa3396cc317fa733c2f90223b6db626
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_202304181526391\opera_package
Filesize89.4MB
MD5cd1e39e0513828714fb37c56b63b5a95
SHA1c652c55d746bf7fdbf7c5ea6c0651ba60b57da8d
SHA25690aeb55c306d9e51266033f6bf1b63769baf0fa4728d3d8b82466a097563d40d
SHA5123bf8dfef862deda8a6be462e1c8a308d9f73242f3adc290f4c8be6abdd1ee8c52d420feea7f2165c3050b77e47bf27f4b0f57bf9712bbaf3f1cc95cd934e45c6
-
Filesize
676KB
MD52e3309647ce678ca313fe3825a57ccb9
SHA1792fdeccddd3cc182eac3a1ecd7affe5b48262c8
SHA256e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4
SHA5125eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc
-
Filesize
676KB
MD52e3309647ce678ca313fe3825a57ccb9
SHA1792fdeccddd3cc182eac3a1ecd7affe5b48262c8
SHA256e6855553350fa6fb23e05839c7f3ef140dad29d9a0e3495de4d1b17a9fbf5ca4
SHA5125eb2af380fed7117d45232d42dec4d05a6f4f6cd6c7d03583c181b235344ea922290b6e0bf6b9683592bccc0f4a3b2b9b9fd7d41fbfebf1045bd95b027539dbc
-
Filesize
54KB
MD51959f4be85635e2188407bda4c87747e
SHA18d54ec03f68503ed204888149ac017856a7c7568
SHA256b235334ed8e95c4fc10638a4dd68fd08cbd5f5be9bc4439af6284bf4c6d0f263
SHA51285b92c9ee1435e002ce9d42edb6159142d6171444f236e3b0d9927aba76b60d5ebbb524cec1040ee28b3527c2171c33d8a369dde420f0fcbe2ad066102736c5d
-
Filesize
9KB
MD57072bbdc5f778b5fbe6d4b628ca1a4ce
SHA148786a00e787e4c2a7ceb848d89f0f7cbfda8121
SHA25632f6701c64317249df8e95dfdff03789f2c2bf4124b8769558ff2624c56a504b
SHA51275a8a7067035636f6d6240998be0357989e6351ce7b91a645370135904baa9a0c4dbb70c31b7cf0de495cb01dbdce183008fd582d6cd638bce447c3eaf99810d
-
Filesize
25KB
MD575895b347003574f6b33aa01378be66b
SHA1c8882c26a78c320d73af4a8dd746a9a288b43b6d
SHA256b6e260abef05efe46a752c09d9b68baa54597e7077933a7cd78019003de6fb3b
SHA5125313ddcc2fff20443af6155fe6d74aed6e90d0932b31607ec8e5aefaed4494e78347bdc37ba6ea6f0cc6cecebdb7952889ce7901678ff29e00724dfab6022d37
-
Filesize
15KB
MD56b10b6243a6d3262908ff2126421ac06
SHA13fcbba8d06c492b3a590b95c2d9ad3629a70db9a
SHA2560f1ca853c6bf409a2195f3a6647a03b2f9ac299e57c41db716e177df08d8f313
SHA512f7cdb0b680c2052b898327759cd1910f5f2bd14d97bbf0cec35ecb0c521432f21b21e1e53682e208c5ec951a6c6ea588040bc2f94d5de8d6bbb800716414a55f
-
Filesize
3.3MB
MD5b919241c021b219da87a1b7a09415af6
SHA19f3542bd4fe29185249a322edeefa7b0817a3101
SHA256ab4b8371708d341fb25973acc6c86d5590c0be2ac3237a80618d4072458b6a1b
SHA512c267157dfd762b0ab576e207d99c073f32cec33bab4a376d98bd755360f4779bc2d5100f949fa2d49f69644766dcd0eeb15913be82326273e60f7c41bf44aab9
-
Filesize
198KB
MD5e79b5e46341571543960e78afd519fa9
SHA1ed47bb878eb9e1541e51dce7afeb7d5cda348244
SHA256fcee48f5d649df09f1ce12054a7ad6fd10566327d398cd8d5d9b72dda9233c8b
SHA512a02efd971b0ba3b69188d260741b8af6da8dbf835b0c82c5be00ef7a24be671b67a55968bf7f67cb24ccbc9a00a2ac574ebbab7b38db6d9c04fc5c042908e58b
-
Filesize
12KB
MD5acd5f4dc6a127db1b403cb174eb27eee
SHA1490634464aa1c055085ac903e8752cf4c7179e32
SHA256b8e2ae75ea24f1cb47dfc605bb340f403d6bf2dcd04c8e73c7ea018675646fc4
SHA5125315aee1e34f64e3670e84bd61ce4edd4e852a3d04a578ab101a7ee8e9c0367400b48de279f8a584e0496f5d6a9029c3d71d64df056a8e91e1ef64d2725d7e64
-
Filesize
39KB
MD543deff1be0fe06dc684a1b1ed5738b57
SHA1a56380952baf99d267ca83c950fa21b8e663c22d
SHA256460123294bfccbea3104a81ebecc881516d024e0ce47e41842f91f436c5662e3
SHA512735ab29cb5baf17394539604d94e8aefab0b211997ba3c443234db1288246ce1c3f8f7f2fed7ba911d3df00e1641b858720d0e11ed13db5c53577e2d5cf9f661
-
Filesize
1.1MB
MD5a1b84e1d85ef46e744e0a492c73cefa1
SHA1492240e4796d1f7b62f16b90c530bb2bb1feb3bf
SHA256f1a8d821a17d9a38c878b6239f1c142f04495607ad17457022ef58796c127d51
SHA512813a63572fd0682ba57da714402de7ff8f250c535a0238711e6ceaeee7bb482360e1cfd2a4bfe40d59756ff12598ca3750df9cb34dd756e29e4e197aea7f1b88
-
Filesize
22KB
MD5da40f3db8b34571684c0cb5bcecd2a79
SHA11c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA256619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
SHA512e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
-
Filesize
141KB
MD56b93b0f937d04d39172f9cd61fe58fd5
SHA154fb26f8b4f11d01573fd1c6a1b532af2b37d687
SHA256ff75938fedee596706171916db763ac100bc7164a7346dd739ad61660e068b5a
SHA512d3b7bbb09842984147b8dc849ef7467c3927cd8730ccfcc310d6d46bf3070e826d7a1cffc43a2ccc33d5d8521ea07d2c19d766b127fafc71edcf288db187df1d
-
Filesize
39KB
MD5f949444a5b853098d15a1430904312ac
SHA110640d584178057f3f49615c6beef8e27f0ce37e
SHA2565f95595245162345d917d33b835d06bca32b17804f5fc2e54541b81ba2d56e4a
SHA512d4d5554e0efc5fc38354e4ad3a05520d789f75f9686a8804c8edbe8aebe7a075a867e81757b127a4a8a7f0fecef387856707f60eb4fd332baa62a96907d723e2
-
Filesize
824KB
MD581f18db21793dd155835019b49b75152
SHA1629c4ae17f7ef1a849254f21d3f13ccc14228051
SHA25668936e2536bc04e0815fb9bee4c702adb989447d80b186a769fd68ee9899e13d
SHA5123a705c5a2078c9f76019f2af7a61f44efd20d4493964e88d960b4f8d0416f73025f8aeda100cb51a73a75b7139cf1b8ecab3468b01ab5a7f9a04551160900f56
-
Filesize
683KB
MD56815034209687816d8cf401877ec8133
SHA11248142eb45eed3beb0d9a2d3b8bed5fe2569b10
SHA2567f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814
SHA5123398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721
-
Filesize
37KB
MD58386fb3cca7993a1f75e57686548ffb7
SHA11ad7a5c6f86cfcc51cea2f4300f9d7316d7815be
SHA25699479d9845345e0ebf5d00cbaf7fee663df662a86278e78e458c7481bf144e98
SHA5128b1bcee91b29845b9dd3b896f4fb2dea7396cb85d9fa348a6669b66ffb9b55bebbff9584d4e2682ac58b1a785ce3a8afd87bab938b1c03ae3460ec5168b01d96
-
Filesize
26KB
MD5861a42ddb1203769193f2ba887fe1afb
SHA1bd690e1e84085015819cf91918dc61da22a8de11
SHA2564a57cb0faab044ff0219d58bb60a121e303fde61ad8e4521ab3bc79ed2f81423
SHA51269c19817b7796c740c9a41b88beafa0b8a7d63917e5be2d08fb6bd94d364b756c60f644ca5c4e488a10393b139b98dadd4329cb5ad6283b6d1e9fb8cdfdeaf39
-
Filesize
79.4MB
MD5f303fd05d4b683cf84151a12bbc5f359
SHA1303ae12766da60020e861bca15a6a6ea1a354dc3
SHA25628879b88a7052db028440ba094b7dfc391e1a74b873fb833d912c708aa6ece8e
SHA512e9d3a5abbd91749540d1157ce4a2cc3b027a1e08703838950d849695df1bf7b156f0508f5098b5e1c82508fab0e0e2bea30fead57be3a95c541f3ccbb32d7226
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
Filesize
70KB
MD5ccecfd7afb2e786031c00753560c1c2a
SHA142e462b6658129c498507628b1fd2523d8ea33be
SHA25638398960bafdabcd648d30c4d40b659d0b70df3829634974caf1e9fa6cfe2cee
SHA51205330482579551284b50ab7b7e79f9189569c3e4915ee0980f146f010174ac7c9d846bc465a68eed5d42190a06616f1cfcd1dc0a477004d6c525ddce8c6bbfef
-
Filesize
70KB
MD5ccecfd7afb2e786031c00753560c1c2a
SHA142e462b6658129c498507628b1fd2523d8ea33be
SHA25638398960bafdabcd648d30c4d40b659d0b70df3829634974caf1e9fa6cfe2cee
SHA51205330482579551284b50ab7b7e79f9189569c3e4915ee0980f146f010174ac7c9d846bc465a68eed5d42190a06616f1cfcd1dc0a477004d6c525ddce8c6bbfef
-
Filesize
2KB
MD5ab73d2be0c53da6e1bf23b5f533b7d4d
SHA1728f2dbfc7ca03af17b2b911f25a71f5c85dd698
SHA256ad3bffc2122f909da3a0e267115605910f1908e6bd06ce078f1f853f12866b28
SHA512310949970b3a0e2b982f095e777221eb244ac7c5ecd0ec462a9cee0c9961c1555c751a8b204bd12bc84e786ca5395fe52c0d912a984823f01265a73286459219
-
Filesize
12KB
MD55ba043f8fe91bb799fe7fcc882e3ee7d
SHA12d84f1ada4b60ae2e70fd0b1879de9cdb1019f0b
SHA2563b5fcfe1f18a10fbe12cbe72a94126f666b3cc765513cc1a4d0349bcd97d839b
SHA5125d5b31b8d133db8b6901b32de4c8ab0f542f62388698d213b49fddf7231614463fd98294d496ba5dc1d0f34a8adba17f71db2f1ff62fa3de86622e85ad3d77cc
-
Filesize
109KB
MD5683e6b011aba47525895c01d0cbe57f9
SHA10b438cab195e45374ce3b1ed0ddaf8a2ee6ee22c
SHA256ede813c71f4456350a3bcdd795a89277df81f40a8720f383fcd00f0c495b5644
SHA51270441581a7eac049ee0e5a1e267c82302a3479d2eed287a38d28d8c3fdfb80dc4f1461726b68db90ccb21b1306baa7f2104b48a5a561c7f8f410ef660e607b0a
-
Filesize
418KB
MD5ca7496309aff08cf95f8800e6eb9278b
SHA146751d36818c9a167a9f7bdd2fc5d89a71f47df4
SHA2560db464d355eeaea5877ac45eb34970cc1dc7967c915e148424cbd02288fa7493
SHA5121b9cb11cb26bee15ba5a47992d93f81f818a0f8ad9182fdb79a8e3c90042495344b89b0a55e9e4945af3a20c1135711354cf8714fb3854920b01ca6e1919c3fa
-
Filesize
54KB
MD5580244bc805220253a87196913eb3e5e
SHA1ce6c4c18cf638f980905b9cb6710ee1fa73bb397
SHA25693fbc59e4880afc9f136c3ac0976ada7f3faa7cacedce5c824b337cbca9d2ebf
SHA5122666b594f13ce9df2352d10a3d8836bf447eaf6a08da528b027436bb4affaad9cd5466b4337a3eaf7b41d3021016b53c5448c7a52c037708cae9501db89a73f0
-
Filesize
38KB
MD5cc809a2fda737badd3b9d0577d473e8e
SHA1262e5b82701cb1f29915ec75761e46f4278dc6bc
SHA256cb2f3c682b195cf793ca92098138adf89b381db7faa55cea1293fd855eb278b9
SHA512282cab5c851e880c3dbb018941ebf9e8319d68af597da9f8d89f92b0fedfedd15cb7f10a6edfd7eef526296f35933ab0ab299a930ae8237dfa8a439e75f55460
-
Filesize
63KB
MD51b80b4b170144136ee859887e0013ac2
SHA1214abb16a15fccbe6fa8cce32df25fd53b433920
SHA256bae697961ca2d00669123d5c725c7fa57d948b91247b143f690570936cfa9d14
SHA512c2ca33b77985d710c2e76b795a422dca394005470b190adcca075ee2fcc596d4aa0c942e3e747ac6f0b2c6ad51eeebc0dc1fa9fa084a21e800dbd689a50d5818
-
Filesize
6KB
MD52d07f8fec9bb42d6e5c7f9e7ed9045ba
SHA1d5de53e170701437ea750e374a7ba8196a217001
SHA25627c9f9ab52fdbf1ad74db5523b569f676621c6b87a3e1eb785febf17f9c70f51
SHA5126c6653ff5f7512c2ad7c1a1cb3f62c6da67f7f07a64786c05cac6fa3293f062fa2481f4ff3de853c1787ef1017779be36f933a026ee6bc38e19422c036571b75
-
Filesize
26KB
MD519286beecba33c5a58360d6193cdda71
SHA170effead44bb30a4df884fad9f91fffc23eef2a9
SHA256b3705e456ffa1426a46862de8d24699a2325eab34c6b0fa4909c3482c144be89
SHA51267323e03da57ab4361bc6b9796d97c7285bd2e44fa0297b2459031ef63956533abc1c58899fe417914a69a764700e0cf4d36bed8f29e9780fa2eff3928573e19
-
Filesize
12KB
MD5687c731b8f3b0dde161ffa870455cbdb
SHA14d07caca5ee0c0587d3176846106aabf413d7289
SHA2560dc20e3017b483219260c6cc8ddd2f3ec9e07ec7a354b638b52386b79c343699
SHA512a15855524cc51cb1764071f48aa6076ab02ad25c20d9c708e9ea7c9a9a799031f8e64c1332359e979059d99439de6d64c578f8d473fed969f1e85cdcd3bd79e5
-
Filesize
27KB
MD5818e71edd6f91f393f697560a50f751c
SHA10542b48e0a2a2e649bb0621d938cd049cdecd086
SHA256f974e66e84965edd489862cdc92d1f2167c1139cec3c703e9305c76e67ed87d8
SHA512f11d7c222dea654c0d124e4e698b2d606ac54522df9dc7ef14dbf77b2483da887f12f900379b6cac9f2d1039599f5ca93d2708e72d7ca85244dbb4096bde9f44
-
Filesize
380KB
MD5a43afd31efe0ba14a32efb4e17f0d8e7
SHA15b6baf45e8ef32518c59c6062b057fcf0a40538f
SHA25622e1e8c4e1a72e2bd67cbb906fae1eacd6fea5fea10de06c22f378e06580df0f
SHA512fd1041fef31d65b9bfa0435ce7a56a6fd6627bec058edb5d832208c78dfa5228f6f2234ff4f14bc0e4e6a547a683d4ef71b10bc58b1f556087b9d38c6f32800b
-
Filesize
20KB
MD5cec13d72acb8c6f150581db3b190a495
SHA11dbd861922ab5870be770326aa679b18eae677b0
SHA256b52714a46c8405733ac63053f86e983f0afeed3adc3bb8760f1e1e60f651f985
SHA512e02c9fff16a4cc0673e26b352bd493ca6191360b864641af8bf13735d22bad190ed9e6a97fa93e3290194199ac1ed90e8737ef1a24fb927e062f2778b32206b2
-
C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\banners-bc25ifb1.z04\playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe
Filesize971KB
MD55c0f32cfbb191162b4512149a7ce0d36
SHA146d95254dc37145b906ad53e6d1bcdedc929012e
SHA25670c0ee91fdf48741138c3d0967599e2217e01ca597f929b48ee2c3b6a5283b83
SHA512869e2b75c082089f592d2f01432e1c3ed6e23d600f3f913ea2755e8550ea54bff00015ec975729be23c384057b3f14ded9c2fd117dee8b6932b8f9e946eb3f4f
-
C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\banners-bc25ifb1.z04\playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe
Filesize971KB
MD55c0f32cfbb191162b4512149a7ce0d36
SHA146d95254dc37145b906ad53e6d1bcdedc929012e
SHA25670c0ee91fdf48741138c3d0967599e2217e01ca597f929b48ee2c3b6a5283b83
SHA512869e2b75c082089f592d2f01432e1c3ed6e23d600f3f913ea2755e8550ea54bff00015ec975729be23c384057b3f14ded9c2fd117dee8b6932b8f9e946eb3f4f
-
C:\Users\Admin\AppData\Local\Temp\4r2jcna2.yqv\banners-bc25ifb1.z04\playanext_overlay_setup_progress_en_ed92301c-0751-4df6-b986-402ce8923ffd-v1.exe
Filesize971KB
MD55c0f32cfbb191162b4512149a7ce0d36
SHA146d95254dc37145b906ad53e6d1bcdedc929012e
SHA25670c0ee91fdf48741138c3d0967599e2217e01ca597f929b48ee2c3b6a5283b83
SHA512869e2b75c082089f592d2f01432e1c3ed6e23d600f3f913ea2755e8550ea54bff00015ec975729be23c384057b3f14ded9c2fd117dee8b6932b8f9e946eb3f4f
-
Filesize
155B
MD5e1d8a70e984096e83fa7f844893e01db
SHA18acc289c552bc3a86ccaf4c38a79fea9959dc65b
SHA25665e4ae2763194b6b71688b5eb7143002513443ac9207dda1cd61b4abd873ee01
SHA512c2d5558be1f35ec27d8cd79e2c4c6ced6f8d51f34cce1a046fcb7241d4c09b5c2b3c7d0f25f14ddd9d6125b9f89b48f6d94dea4073b5107620c236bdd9e1f6d0
-
Filesize
2.7MB
MD5f128afa6c6c576046fa645a15b2dcc26
SHA1b081f47af73d6f78d5eab661198f4bb3028c7949
SHA256e18f06ccc1a29d12e559b48bd3fcde0bf50645769d46125d6272bdd64c3981d7
SHA5125b8ebd096965e7c4dcafb2587647a81b166931a7178f61987ce78b77a26fc29a7b3e5cad51efd9c79f4c1473c29d57382c1c2b0b782a8e42d3f90479c4888201
-
Filesize
4.6MB
MD5ad733fc8caa65678643c25fa6afc1ebe
SHA1c40f0acf7abb77b933a0394106dec760c9a442fc
SHA256e74bdc3bc0f80d61bc26d2360dd55a8247e95aeb0a27bb58566826da6a2d2afd
SHA5121579c0bcccfbd1805c16c4516437ae146c4af1d39ab56ed1283179e752abb2870a94c6255694ca66f8537a06e71ca70009a32f22dba548e8a9cf2d9b5ca3c137
-
Filesize
4KB
MD5b4edec0f1e685f6853e4a67b897cfb81
SHA1d04729daeb33f63a456d063499587dc0a45aaf39
SHA256ea36a2d52ae103938d37a1bdc88c8263a588f2475134b031fb7e8c209e81f061
SHA512cbbf023cc25b9122e587c998278f0ce33e0a59adc358eac64b12653ad4a3ceca6804ff8b2bf525d26f508b050529251183df80f2d5671f73bc2c12f85fdd130f
-
Filesize
40B
MD5ec9f07086304e01f174753de4ea7c558
SHA15d1ffe040f045e86ba8e0d1ccf882679a0f2efee
SHA256df6d4e9e7267514f5ee285820d86d859205bc4f99eaeb0c9f393c957dab6465f
SHA5126f667e7d6e577f1bdcc2ebb80e74a8395b6328ffb06398256a9f37151e080c2910651bbc402917eae0a7a3369f18ac5d9e8ea206f920e0af2464c5dcd633ca46
-
Filesize
906KB
MD514eeb7ede2dd57a1b02209f79336abf9
SHA1ea6262744359d869246507754fcab1efd1eca872
SHA2566661e6bb7bf3de2e98fe82951e05772cc85cf551593a0d52d7618201b5e88553
SHA512379ab6618c9a196c0f996deb3223f5e17c1466e424a8930f7af880ffd5acadc0eed41ad4a096c7fdfa8b17ae297f1a72b7a28a277ecf1118cfcb635383afcd53
-
Filesize
906KB
MD514eeb7ede2dd57a1b02209f79336abf9
SHA1ea6262744359d869246507754fcab1efd1eca872
SHA2566661e6bb7bf3de2e98fe82951e05772cc85cf551593a0d52d7618201b5e88553
SHA512379ab6618c9a196c0f996deb3223f5e17c1466e424a8930f7af880ffd5acadc0eed41ad4a096c7fdfa8b17ae297f1a72b7a28a277ecf1118cfcb635383afcd53
-
Filesize
906KB
MD514eeb7ede2dd57a1b02209f79336abf9
SHA1ea6262744359d869246507754fcab1efd1eca872
SHA2566661e6bb7bf3de2e98fe82951e05772cc85cf551593a0d52d7618201b5e88553
SHA512379ab6618c9a196c0f996deb3223f5e17c1466e424a8930f7af880ffd5acadc0eed41ad4a096c7fdfa8b17ae297f1a72b7a28a277ecf1118cfcb635383afcd53
-
Filesize
380KB
MD5a43afd31efe0ba14a32efb4e17f0d8e7
SHA15b6baf45e8ef32518c59c6062b057fcf0a40538f
SHA25622e1e8c4e1a72e2bd67cbb906fae1eacd6fea5fea10de06c22f378e06580df0f
SHA512fd1041fef31d65b9bfa0435ce7a56a6fd6627bec058edb5d832208c78dfa5228f6f2234ff4f14bc0e4e6a547a683d4ef71b10bc58b1f556087b9d38c6f32800b
-
Filesize
906KB
MD514eeb7ede2dd57a1b02209f79336abf9
SHA1ea6262744359d869246507754fcab1efd1eca872
SHA2566661e6bb7bf3de2e98fe82951e05772cc85cf551593a0d52d7618201b5e88553
SHA512379ab6618c9a196c0f996deb3223f5e17c1466e424a8930f7af880ffd5acadc0eed41ad4a096c7fdfa8b17ae297f1a72b7a28a277ecf1118cfcb635383afcd53
-
Filesize
906KB
MD514eeb7ede2dd57a1b02209f79336abf9
SHA1ea6262744359d869246507754fcab1efd1eca872
SHA2566661e6bb7bf3de2e98fe82951e05772cc85cf551593a0d52d7618201b5e88553
SHA512379ab6618c9a196c0f996deb3223f5e17c1466e424a8930f7af880ffd5acadc0eed41ad4a096c7fdfa8b17ae297f1a72b7a28a277ecf1118cfcb635383afcd53
-
Filesize
906KB
MD514eeb7ede2dd57a1b02209f79336abf9
SHA1ea6262744359d869246507754fcab1efd1eca872
SHA2566661e6bb7bf3de2e98fe82951e05772cc85cf551593a0d52d7618201b5e88553
SHA512379ab6618c9a196c0f996deb3223f5e17c1466e424a8930f7af880ffd5acadc0eed41ad4a096c7fdfa8b17ae297f1a72b7a28a277ecf1118cfcb635383afcd53
-
Filesize
980B
MD5c9c40af1656f8531eaa647caceb1e436
SHA1907837497508de13d5a7e60697fc9d050e327e19
SHA2561a67f60962ca1cbf19873b62a8518efe8c701a09cd609af4c50ecc7f0b468bb8
SHA5120f7033686befa3f4acf3ed355c1674eaa6e349fba97e906446c8a7000be6876f157bc015bf5d3011fbbdc2c771bcbaea97918b8d24c064cbbd302741cc70cbc7
-
Filesize
172KB
MD5233ca870e2530da48897db8fa6f1e3cf
SHA11e4b4964978858c787f2a898b20f36e1fa805717
SHA256ca420fef4909c10e2e95c8c899fa7d009892dddf0b2424870236f1d0676e9165
SHA51225544ee4113fe4dc2b54f8a5a068f340bbb3b30bd444ff18dcdc789c573d2c24f3019601c3c9e8eec4a61fbb5540867930b99a3696358eb587f64d3a70e1b9a6
-
Filesize
22KB
MD5da40f3db8b34571684c0cb5bcecd2a79
SHA11c27a41fd84d6bfe99dabae2e59fcf12fccf6213
SHA256619737e2af8fb713085726631dd2e522fe130cac1d388a59c38907a47d7aadea
SHA512e656d72e111eaca7c8e9b7d4106030c1104286395046c2de58a04edd590cb2714dcf3aeca2b93f843b4663f1d1e630cc19f1e4eae2fa62f0d382fa18cc8a5981
-
Filesize
824KB
MD581f18db21793dd155835019b49b75152
SHA1629c4ae17f7ef1a849254f21d3f13ccc14228051
SHA25668936e2536bc04e0815fb9bee4c702adb989447d80b186a769fd68ee9899e13d
SHA5123a705c5a2078c9f76019f2af7a61f44efd20d4493964e88d960b4f8d0416f73025f8aeda100cb51a73a75b7139cf1b8ecab3468b01ab5a7f9a04551160900f56
-
Filesize
12KB
MD55ba043f8fe91bb799fe7fcc882e3ee7d
SHA12d84f1ada4b60ae2e70fd0b1879de9cdb1019f0b
SHA2563b5fcfe1f18a10fbe12cbe72a94126f666b3cc765513cc1a4d0349bcd97d839b
SHA5125d5b31b8d133db8b6901b32de4c8ab0f542f62388698d213b49fddf7231614463fd98294d496ba5dc1d0f34a8adba17f71db2f1ff62fa3de86622e85ad3d77cc
-
Filesize
109KB
MD5683e6b011aba47525895c01d0cbe57f9
SHA10b438cab195e45374ce3b1ed0ddaf8a2ee6ee22c
SHA256ede813c71f4456350a3bcdd795a89277df81f40a8720f383fcd00f0c495b5644
SHA51270441581a7eac049ee0e5a1e267c82302a3479d2eed287a38d28d8c3fdfb80dc4f1461726b68db90ccb21b1306baa7f2104b48a5a561c7f8f410ef660e607b0a
-
Filesize
38KB
MD5cc809a2fda737badd3b9d0577d473e8e
SHA1262e5b82701cb1f29915ec75761e46f4278dc6bc
SHA256cb2f3c682b195cf793ca92098138adf89b381db7faa55cea1293fd855eb278b9
SHA512282cab5c851e880c3dbb018941ebf9e8319d68af597da9f8d89f92b0fedfedd15cb7f10a6edfd7eef526296f35933ab0ab299a930ae8237dfa8a439e75f55460
-
Filesize
63KB
MD51b80b4b170144136ee859887e0013ac2
SHA1214abb16a15fccbe6fa8cce32df25fd53b433920
SHA256bae697961ca2d00669123d5c725c7fa57d948b91247b143f690570936cfa9d14
SHA512c2ca33b77985d710c2e76b795a422dca394005470b190adcca075ee2fcc596d4aa0c942e3e747ac6f0b2c6ad51eeebc0dc1fa9fa084a21e800dbd689a50d5818
-
Filesize
20KB
MD5cec13d72acb8c6f150581db3b190a495
SHA11dbd861922ab5870be770326aa679b18eae677b0
SHA256b52714a46c8405733ac63053f86e983f0afeed3adc3bb8760f1e1e60f651f985
SHA512e02c9fff16a4cc0673e26b352bd493ca6191360b864641af8bf13735d22bad190ed9e6a97fa93e3290194199ac1ed90e8737ef1a24fb927e062f2778b32206b2
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
12KB
MD5acd5f4dc6a127db1b403cb174eb27eee
SHA1490634464aa1c055085ac903e8752cf4c7179e32
SHA256b8e2ae75ea24f1cb47dfc605bb340f403d6bf2dcd04c8e73c7ea018675646fc4
SHA5125315aee1e34f64e3670e84bd61ce4edd4e852a3d04a578ab101a7ee8e9c0367400b48de279f8a584e0496f5d6a9029c3d71d64df056a8e91e1ef64d2725d7e64
-
Filesize
38KB
MD5c9c1bf0abe2b9697ed1dbe1b60054659
SHA18439d26082d3d16cba8c636208b4b676437f4886
SHA25630208442887e68eed4459c0dc6e88eaa41ec6152733456bd5100552b63770e31
SHA512a708c5ea91e8bc5288aa173215dcea9c89afada1252a4143c33fe388786cfeb414d286e6c1635cd7b9df0bea8abf4db70b698744b779222c9df570ec78604c0c
-
Filesize
26KB
MD5861a42ddb1203769193f2ba887fe1afb
SHA1bd690e1e84085015819cf91918dc61da22a8de11
SHA2564a57cb0faab044ff0219d58bb60a121e303fde61ad8e4521ab3bc79ed2f81423
SHA51269c19817b7796c740c9a41b88beafa0b8a7d63917e5be2d08fb6bd94d364b756c60f644ca5c4e488a10393b139b98dadd4329cb5ad6283b6d1e9fb8cdfdeaf39
-
Filesize
98KB
MD52d1123c1c4876fd285ad44c1ece3de1e
SHA14eabc0f5c5774b5f2b29ae55e0e03b864c872a01
SHA256516e5a7d433f661157e7d33984fa814aacdcd8ab3817daccdcd2948bbd72a549
SHA5129019fd9c8cec3e729ad8b3e4d48bbc032be70989ebd067e4a6e2891a02b16645f4393bc9e2ba020440356879797d06272ca616564f521df34fcce977e449c8d9
-
Filesize
30KB
MD52d3e0b4ddf8628b41057b2aceef296eb
SHA18a3b1bd9df5d052c24de2304a2928fad86927f6d
SHA256aced52254a8c3cb6ad30f99f8b745296926c49373cab00824c2c4c10ad325b10
SHA512faac4233c45a773c4470071b0b2a75ee81eefa45f88b76fea305443514ff9c8429af3d394884933712d1fb7a7a03701f3d9df0f1de345078ddfeeeb5b4dc094b
-
Filesize
24KB
MD5359ad662a82a35b1cd777b02ce8d419b
SHA1683f165b3c9543be7c1db313d33a0479697c65f2
SHA25650653deedf757fd1669f54c1cbac2c2d1403d5864b73f63454ac4adc9619d831
SHA512c24ab4b7ab61eb401558c354c2e86e956d33db68817d53643af15c2fda83bc928657f9bb102dbbd3317ee9c9184195360f4c30ce371ebea4eef4771b9e19dafb
-
Filesize
17KB
MD5be2962225b441cc23575456f32a9cf6a
SHA19a5be1fcf410fe5934d720329d36a2377e83747e
SHA256b4d8e15adc235d0e858e39b5133e5d00a4baa8c94f4f39e3b5e791b0f9c0c806
SHA5123f7692e94419bffe3465d54c0e25c207330cd1368fcdfad71dbeed1ee842474b5abcb03dba5bc124bd10033263f22dc9f462f12c20f866aebc5c91eb151af2e6
-
Filesize
26KB
MD519286beecba33c5a58360d6193cdda71
SHA170effead44bb30a4df884fad9f91fffc23eef2a9
SHA256b3705e456ffa1426a46862de8d24699a2325eab34c6b0fa4909c3482c144be89
SHA51267323e03da57ab4361bc6b9796d97c7285bd2e44fa0297b2459031ef63956533abc1c58899fe417914a69a764700e0cf4d36bed8f29e9780fa2eff3928573e19
-
Filesize
235KB
MD5843806fb6e0b292b396e1879db81c2f5
SHA1517de28c4fd95a30a616aa5861b447a0b52aac2f
SHA2565a7b429c7c996ff990006dfe2550a899b20e5bdcba6c0cd9a3b603a8dfda834d
SHA5125da6bc2fa8addbd5f0dfd4cb7454a867462e74b0373fea44c1978e494edcfdd182e2056756e73b1daaeeb6012c7cbac4f9719fcd58565c88d6c67657dd6c30c0
-
Filesize
13KB
MD52ef9d22d3bece298071334c2681b0ecc
SHA10da4299bf3d01790eae08cc48634cc9db2d30f60
SHA25608d2eb9498f02f59ff488975ff8b37bddc022b2c7e213e16da2d0b3c798a81f1
SHA512a1929c7bb1526f8db8fefb1cf6d0a27fd22a27f2bf152c291a97f01c284d38e621805339ea3acbcd27c4f2b84c6ba52b94e462b5669266e2125d0f1c9651fe97
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
43KB
MD5d0220eb32a8a631ca29f55929c7046cb
SHA1553ec4ecc90676c7bb1de9f75a6b1226f39677aa
SHA256e6124423367a9ec411176e2714c16a041c1a8b3e1691845040b57b0d779bef14
SHA51263c2d7ac019d511751c57153bde64c5c57819a74ffbd1a893ea980211185296f018bc09980537394bb33e92508b4e14d87da8a6fba2ca87b820b9276d07a3445
-
Filesize
943KB
MD53ae587e8956bc06683701bc602bc83e2
SHA107df7028756de51279a191859b787003fa50a095
SHA2564bcf2cddd60aad12768347f97cfe76b3ee5b64ad154eabe1801fc6e1733f7677
SHA512e00befc09fe14fad89bb8950380251355d3472e0658370212c434aec6e9b4d0dc6b0fa96f0d5f0e15d907228eeb7135fa717972c2836f54657942f0d484e25d7
-
Filesize
227KB
MD57be5da1217ad69484eda8f74b5376170
SHA12cc3495445ded22c1f9af6764d8ebc84698248c7
SHA256cdd008d769df5f9a4eeda86a909b4d575db327302b0cdcfcc29ca66fee56a6f7
SHA5120d0ed7e106b7fc561ab4704688ef65c7db48fbefc11b44210fa9ced88cab135d57c33ee84f694f5ec6876a5325d2f76e9e070cb679a35016b9d63af359c2d6a8
-
Filesize
906KB
MD514eeb7ede2dd57a1b02209f79336abf9
SHA1ea6262744359d869246507754fcab1efd1eca872
SHA2566661e6bb7bf3de2e98fe82951e05772cc85cf551593a0d52d7618201b5e88553
SHA512379ab6618c9a196c0f996deb3223f5e17c1466e424a8930f7af880ffd5acadc0eed41ad4a096c7fdfa8b17ae297f1a72b7a28a277ecf1118cfcb635383afcd53
-
Filesize
79.4MB
MD5f303fd05d4b683cf84151a12bbc5f359
SHA1303ae12766da60020e861bca15a6a6ea1a354dc3
SHA25628879b88a7052db028440ba094b7dfc391e1a74b873fb833d912c708aa6ece8e
SHA512e9d3a5abbd91749540d1157ce4a2cc3b027a1e08703838950d849695df1bf7b156f0508f5098b5e1c82508fab0e0e2bea30fead57be3a95c541f3ccbb32d7226
-
Filesize
177KB
MD58a5acb15746aa5a0b7e3d0f68f06e835
SHA1f7fc5a2b6eb458b3a34b700bb64dcd6cd95998a1
SHA2565c2e36eb2a2bd2e7e869d68f4887a54be25c9345e47aac1b1fcb75e405872aab
SHA5121c81d57647eeb762feb1f2fc7b320f2fb31243062f75c91581699128bf496edf425f5706761e3735f41b872af92ae32473774d5f19a72d384dadd7eb62474e9d