492a3482fd1d0b9e1f9bbb02a554ac521bf3b4be07234cb3e6e393051ce07505

Analysis

max time kernel
94s
max time network
201s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
nitro_pro_x64.msi
Size 520.1MB
Sample260709-txd2jadv4q
SHA256 492a3482fd1d0b9e1f9bbb02a554ac521bf3b4be07234cb3e6e393051ce07505
MD5 e68213c94fba9d888faf7a5345f3046e
SHA1 192b40a18f421951c46964b32257269cf487869f
SHA512 bdc5f818173d30095e5a5ae77320d35db5f068d1a2c9386e5997d725f6e0303c82e714f0feae5dd824cd668fdb07edac34ffe84c5c3e7c811759cd4796a77a47
SSDEEP 12582912:pHZ/0VDveQELL65AViAXxwNjQhX6M93Xz8gRTVfSEV2z2J:pHZAyp65AViGwFw6olFVfhV2qJ
TLSH
T11F49331576A84CB5F69A9138C9178E1AE7B37EC1036086CB7160BB5B2FF3BD1463B241
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Boot or Logon Autostart Execution: Port Monitors 1 TTPs 14 IoCs

Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.

persistence

Port Monitors

T1547.010

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Nitro PDF Port Monitor	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port	spoolsv.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor	spoolsv.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4556	MSIFF0B.tmp
3060	Process not Found
4800	NitroPDF.exe
4196	BugSplatMonitor.exe
3004	nitro_module_loader.exe

Loads dropped DLL 64 IoCs

pid	Process
2724	MsiExec.exe
2724	MsiExec.exe
1984	rundll32.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4436	rundll32.exe
4768	MsiExec.exe
4284	rundll32.exe
4768	MsiExec.exe
5072	rundll32.exe
4768	MsiExec.exe
4684	rundll32.exe
4892	MsiExec.exe
4892	MsiExec.exe
4892	MsiExec.exe
4892	MsiExec.exe
4892	MsiExec.exe
4892	MsiExec.exe
1504	MsiExec.exe
2500	rundll32.exe
1504	MsiExec.exe
3060	Process not Found
3060	Process not Found
3060	Process not Found
3060	Process not Found
4704	spoolsv.exe
4704	spoolsv.exe
4704	spoolsv.exe
4704	spoolsv.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4768	MsiExec.exe
4364	MsiExec.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4196	BugSplatMonitor.exe
4196	BugSplatMonitor.exe
4196	BugSplatMonitor.exe
4196	BugSplatMonitor.exe
4196	BugSplatMonitor.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	2724	MsiExec.exe
3	2724	MsiExec.exe
4	2724	MsiExec.exe
5	4768	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004
Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	NitroPDF.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	NitroPDF.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\SET575A.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\es-ES\NxPdfUI.dll.mui	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\prnms009.cat	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\PS5UI.DLL	MsiExec.exe
File created	C:\Windows\SysWOW64\vcruntime140_threads.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\nl-NL\NxPdfUI.dll.mui	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\PSCRIPT5.DLL	MsiExec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\NxPdfCreator.ppd	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\MPDW-PDC.xml	DrvInst.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\SET5735.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\SET5745.tmp	DrvInst.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\SET575A.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File created	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\SET5735.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\SET5746.tmp	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\SET5746.tmp	DrvInst.exe
File created	C:\Windows\SysWOW64\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_1.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\it-IT\NxPdfUI.dll.mui	MsiExec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\NxPdfUI.dll	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\SET5758.tmp	DrvInst.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\SysWOW64\mfc140u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp140_atomic_wait.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\concrt140.dll	msiexec.exe
File created	C:\Windows\system32\spool\DRIVERS\x64\3\de-DE\NxPdfUI.dll.mui	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\NxPrinterMonitor.dll	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{58e6df98-0722-354a-b46b-4de9bbdb663b}\MPDW-constraints.js	DrvInst.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib140.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\nitro-xfa-server.exe	tar.exe
File created	C:\Program Files (x86)\Nitro\PDF Pro\CV\crash_handler.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.Extensions.Identity.Core.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\System.Security.Cryptography.X509Certificates.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\cef\resources\locales\bn.pak	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\cef\resources\locales\es.pak	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\x64\it-IT\NxPdfUI.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\ru\System.ServiceModel.Primitives.resources.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.AspNetCore.RequestDecompression.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.Extensions.DependencyInjection.Abstractions.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\System.Reflection.Emit.Lightweight.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa\assets\fontawesome\css\all.css	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\idrspdf16.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\winui\ribbon\controls\ribbon_button\ribbon_button_styles.xbf	msiexec.exe
File opened for modification	C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa\assets\fontawesome\webfonts\	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\it-IT\NitroPDF.exe.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.AspNetCore.Metadata.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.AspNetCore.Server.HttpSys.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\IRIS_OCR\resources\grk.ilex	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.Extensions.Configuration.UserSecrets.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\System.Private.CoreLib.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\System.Runtime.Extensions.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\System.Xml.XDocument.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\Newtonsoft.Json.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\en-US\NitroPDF.exe.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\es-ES\np_forms.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.AspNetCore.Authentication.BearerToken.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.AspNetCore.Routing.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.Extensions.Hosting.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\np_scan2pdf.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\Assets\sharepoint.svg	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.AspNetCore.Hosting.Server.Abstractions.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\WindowsBase.dll	tar.exe
File opened for modification	C:\Program Files\Nitro\PDF Pro\CV\xfa\pl	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa\polyfills-core-js.1dd0ee6a78ca6fee.js	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\cef\resources\locales\id.pak	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\it-IT\NxPdfCreator.exe.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\cef\resources\locales\uk.pak	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\nitro-xfa-server.staticwebassets.endpoints.json	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\idrsbarcodeevoi16.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\nl-NL\np_watermarks.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\System.Private.DataContractSerialization.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa\assets\fontawesome\css\v5-font-face.css	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\es-ES\np_convert_pdf.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\de-DE\np_layers.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\de\System.ServiceModel.Primitives.resources.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\fonts\SourceSansPro-Light.ttf	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\ru\System.ServiceModel.Http.resources.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\Microsoft.DiaSymReader.Native.amd64.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\Microsoft.WindowsAppRuntime.Bootstrap.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\fr-FR\np_cloud_storage.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\cef\resources\locales\pt-BR.pak	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\NitroPDFPreviewHandler.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\it-IT\np_pdfa.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\es-ES\np_watermarks.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\solid_framework\ImageTool.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\System.Net.Http.Json.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\imanage\iwCommands.dll	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\winui\backstage\save_as\backstage_save_as_tab.xbf	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\cef\resources\locales\it.pak	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\en-US\np_convert_pdf.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\fr-FR\np_links.dll.mui	msiexec.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\xfa\System.Reflection.Extensions.dll	tar.exe
File created	C:\Program Files\Nitro\PDF Pro\CV\it-IT\np_cloud_storage.dll.mui	msiexec.exe

Drops file in Windows directory 46 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID384.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB412.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB412.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB51D.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File created	C:\Windows\Installer\SourceHash{FC0AF2EE-4ED9-43B6-9534-7730B0B9321D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34B6.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI3A74.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1A1.tmp	msiexec.exe
File created	C:\Windows\Installer\e5a8379.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA46F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB19F.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB307.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB51D.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB307.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSID52C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI32DF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI34B6.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI34B6.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5CA3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF85302FBAF056C6B0.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB412.tmp-\NitroCA.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB51D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB51D.tmp-\CustomAction.config	rundll32.exe
File created	C:\Windows\SystemTemp\~DFDF91F8E2550FC24D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID4BD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{FC0AF2EE-4ED9-43B6-9534-7730B0B9321D}\Professional.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e5a8379.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB19F.tmp-\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSIB307.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB307.tmp-\NitroCA.dll	rundll32.exe
File created	C:\Windows\Installer\{FC0AF2EE-4ED9-43B6-9534-7730B0B9321D}\Professional.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB19F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB412.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF0B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	spoolsv.exe
File created	C:\Windows\Installer\e5a8396.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF4D2886466474CEE3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB19F.tmp-\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3438.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE3673C805AF773FB.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D02.tmp	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4976	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	spoolsv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	spoolsv.exe

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Control Panel\Colors	NitroPDF.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Nitro PDF Creator = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\DevModePerUser	spoolsv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Nitro PDF Creator = "winspool,Ne00:"	spoolsv.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Nitro PDF Creator = "winspool,Ne00:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers\ConvertUserDevModesCount	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\IsMRUEstablished = "0"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Nitro PDF Creator = "winspool,Ne00:,15,45"	spoolsv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Printers\ConvertUserDevModesCount\Nitro PDF Creator = "1"	spoolsv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\LegacyDefaultPrinterMode = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:"	spoolsv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Nitro PDF Creator = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices\Nitro PDF Creator = "winspool,Ne00:"	spoolsv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Windows\Device = "Nitro PDF Creator,winspool,Ne00:"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices	spoolsv.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf\Extension = ".pdf"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/ppdf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document\shell\print\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\22 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CEF53101-E1DB-4950-9C03-53FAB48081E2}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EEC52A4D-E930-4782-B5E9-D03F5A3EA15E}\1.0\0\win64\ = "C:\\Program Files\\Nitro\\PDF Pro\\CV\\Nitro.OfficeAddin.Net.Proxy.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/pdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\NitroPDF.exe\SupportedTypes\.ppdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\23 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\46 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7347baa5-ddad-428a-bbed-3a95b53237f7}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppdf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document\shell\printto\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.PPDFDoc\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.ppdf	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.fdf\old\Content Type = "application/vnd.fdf"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.fdf\old\ = "AcroExch.FDFDoc"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.pdf\shell\edit.NitroPDF.exe\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1846C90791F3DDE45AFFDD7F7F555C36	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\38 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\ = "Nitro PDF Preview Handler"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CEF53101-E1DB-4950-9C03-53FAB48081E2}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.xfdf\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\13 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fdf\shell\open.NitroPDF.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.PPDFDoc\DefaultIcon\ = "C:\\PROGRA~1\\Nitro\\PDFPRO~1\\CV\\filetype.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.PPDFDoc\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\12 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\InstallPath = "C:\\Program Files (x86)\\Nitro\\PDF Pro\\CV\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\nitro	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7347BAA5-DDAD-428A-BBED-3A95B53237F7}\AppID = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\Content Type = "application/fdf"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "NitroPDF.Document"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xfdf\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document\DefaultIcon\ = "C:\\PROGRA~1\\Nitro\\PDFPRO~1\\CV\\filetype.ico"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1846C90791F3DDE45AFFDD7F7F555C36\EE2FA0CF9DE46B34594377030B9B23D1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.gonitro.desktop\shell\open\command\ = "C:\\PROGRA~1\\Nitro\\PDFPRO~1\\CV\\NitroPDF.exe \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\18 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\.fdf\shell\open.NitroPDF.exe\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}\ = "{cef53101-e1db-4950-9c03-53fab48081e2}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\47 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\TypeLib\ = "{EEC52A4D-E930-4782-B5E9-D03F5A3EA15E}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ppdf\OpenWithProgids	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document\ShellEx\{e357fccd-a995-4576-b01f-234630154e96}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\8 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList\Media\17 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.fdf	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDFProfessional.MSOfficeAddin\CLSID\ = "{D7570413-6651-467E-AF76-69BDD1265663}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7570413-6651-467E-AF76-69BDD1265663}\ProgID\ = "NitroPDFProfessional.MSOfficeAddin.1_x64"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.Document\shell\printto\command\ = "C:\\PROGRA~1\\Nitro\\PDFPRO~1\\CV\\NitroPDF.exe /pt \"%1\" \"%2\" \"%3\" \"%4\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NitroPDF.PPDFDoc\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EE2FA0CF9DE46B34594377030B9B23D1\SourceList	msiexec.exe

Modifies system certificate store 2 TTPs 4 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\Nitro5Trusted\CRLs	NitroPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\Nitro5Trusted\CTLs	NitroPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\Nitro5Trusted	NitroPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\SystemCertificates\Nitro5Trusted\Certificates	NitroPDF.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4284	rundll32.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe
4800	NitroPDF.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4976	msiexec.exe
Token: SeSecurityPrivilege	1364	msiexec.exe
Token: SeCreateTokenPrivilege	4976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4976	msiexec.exe
Token: SeLockMemoryPrivilege	4976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4976	msiexec.exe
Token: SeMachineAccountPrivilege	4976	msiexec.exe
Token: SeTcbPrivilege	4976	msiexec.exe
Token: SeSecurityPrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeLoadDriverPrivilege	4976	msiexec.exe
Token: SeSystemProfilePrivilege	4976	msiexec.exe
Token: SeSystemtimePrivilege	4976	msiexec.exe
Token: SeProfSingleProcessPrivilege	4976	msiexec.exe
Token: SeIncBasePriorityPrivilege	4976	msiexec.exe
Token: SeCreatePagefilePrivilege	4976	msiexec.exe
Token: SeCreatePermanentPrivilege	4976	msiexec.exe
Token: SeBackupPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeShutdownPrivilege	4976	msiexec.exe
Token: SeDebugPrivilege	4976	msiexec.exe
Token: SeAuditPrivilege	4976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4976	msiexec.exe
Token: SeChangeNotifyPrivilege	4976	msiexec.exe
Token: SeRemoteShutdownPrivilege	4976	msiexec.exe
Token: SeUndockPrivilege	4976	msiexec.exe
Token: SeSyncAgentPrivilege	4976	msiexec.exe
Token: SeEnableDelegationPrivilege	4976	msiexec.exe
Token: SeManageVolumePrivilege	4976	msiexec.exe
Token: SeImpersonatePrivilege	4976	msiexec.exe
Token: SeCreateGlobalPrivilege	4976	msiexec.exe
Token: SeCreateTokenPrivilege	4976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4976	msiexec.exe
Token: SeLockMemoryPrivilege	4976	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4976	msiexec.exe
Token: SeMachineAccountPrivilege	4976	msiexec.exe
Token: SeTcbPrivilege	4976	msiexec.exe
Token: SeSecurityPrivilege	4976	msiexec.exe
Token: SeTakeOwnershipPrivilege	4976	msiexec.exe
Token: SeLoadDriverPrivilege	4976	msiexec.exe
Token: SeSystemProfilePrivilege	4976	msiexec.exe
Token: SeSystemtimePrivilege	4976	msiexec.exe
Token: SeProfSingleProcessPrivilege	4976	msiexec.exe
Token: SeIncBasePriorityPrivilege	4976	msiexec.exe
Token: SeCreatePagefilePrivilege	4976	msiexec.exe
Token: SeCreatePermanentPrivilege	4976	msiexec.exe
Token: SeBackupPrivilege	4976	msiexec.exe
Token: SeRestorePrivilege	4976	msiexec.exe
Token: SeShutdownPrivilege	4976	msiexec.exe
Token: SeDebugPrivilege	4976	msiexec.exe
Token: SeAuditPrivilege	4976	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4976	msiexec.exe
Token: SeChangeNotifyPrivilege	4976	msiexec.exe
Token: SeRemoteShutdownPrivilege	4976	msiexec.exe
Token: SeUndockPrivilege	4976	msiexec.exe
Token: SeSyncAgentPrivilege	4976	msiexec.exe
Token: SeEnableDelegationPrivilege	4976	msiexec.exe
Token: SeManageVolumePrivilege	4976	msiexec.exe
Token: SeImpersonatePrivilege	4976	msiexec.exe
Token: SeCreateGlobalPrivilege	4976	msiexec.exe
Token: SeCreateTokenPrivilege	4976	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4976	msiexec.exe
Token: SeLockMemoryPrivilege	4976	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4976	msiexec.exe
4976	msiexec.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4976	msiexec.exe
1364	msiexec.exe
2724	MsiExec.exe
4768	MsiExec.exe
4892	MsiExec.exe
1504	MsiExec.exe
4364	MsiExec.exe
4800	NitroPDF.exe
4800	NitroPDF.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 1364 wrote to memory of 2724	1364	msiexec.exe	86
PID 2724 wrote to memory of 1984	2724	MsiExec.exe	87
PID 1364 wrote to memory of 4768	1364	msiexec.exe	90
PID 4768 wrote to memory of 4436	4768	MsiExec.exe	91
PID 4768 wrote to memory of 4284	4768	MsiExec.exe	92
PID 4768 wrote to memory of 5072	4768	MsiExec.exe	93
PID 4768 wrote to memory of 4684	4768	MsiExec.exe	94
PID 1364 wrote to memory of 4892	1364	msiexec.exe	95
PID 4892 wrote to memory of 3752	4892	MsiExec.exe	96
PID 4892 wrote to memory of 1060	4892	MsiExec.exe	98
PID 4892 wrote to memory of 4168	4892	MsiExec.exe	100
PID 1364 wrote to memory of 4556	1364	msiexec.exe	102
PID 4892 wrote to memory of 2628	4892	MsiExec.exe	113
PID 4892 wrote to memory of 4284	4892	MsiExec.exe	115
PID 4892 wrote to memory of 4120	4892	MsiExec.exe	117
PID 1364 wrote to memory of 1504	1364	msiexec.exe	119
PID 1504 wrote to memory of 2500	1504	MsiExec.exe	120
PID 1504 wrote to memory of 1788	1504	MsiExec.exe	124
PID 1788 wrote to memory of 4832	1788	net.exe	126
PID 1504 wrote to memory of 1780	1504	MsiExec.exe	127
PID 1780 wrote to memory of 2396	1780	net.exe	129
PID 1504 wrote to memory of 4848	1504	MsiExec.exe	130
PID 4848 wrote to memory of 2308	4848	net.exe	132
PID 1504 wrote to memory of 428	1504	MsiExec.exe	134
PID 428 wrote to memory of 2184	428	net.exe	136
PID 1364 wrote to memory of 4364	1364	msiexec.exe	138
PID 4364 wrote to memory of 4800	4364	MsiExec.exe	139
PID 4800 wrote to memory of 4196	4800	NitroPDF.exe	140
PID 4800 wrote to memory of 3004	4800	NitroPDF.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\nitro_pro_x64.msi
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4976

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1364
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 31DE119D2A63120108079D8ACE31EA04 C
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI57D7.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240801781 2 NitroCA!NitroCA.CustomActions.DefineAgreement
    3⤵
    - Loads dropped DLL
    PID:1984
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A468F76A1F0F402F58C3F5A4512C32C7
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB19F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240824781 3 NitroCA!NitroCA.CustomActions.GetOfficeBinaryType
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4436
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB307.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240825109 10 NitroCA!NitroCA.CustomActions.ClosePrompt
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    PID:4284
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB412.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240825390 17 NitroCA!NitroCA.CustomActions.SetLanguageSpecificPreferences
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:5072
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSIB51D.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240825656 22 NitroCA!NitroCA.CustomActions.SetSpellCheckLanguage
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:4684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3DF51962097E90FBF3E8E0DB76F0F263 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\reg.exe
    "reg.exe" copy HKLM\SOFTWARE\Classes\.fdf HKLM\SOFTWARE\Classes\NitroPDF.fdf\old /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3752
- - C:\Windows\SysWOW64\reg.exe
    "reg.exe" copy HKLM\SOFTWARE\Classes\.pdf HKLM\SOFTWARE\Classes\NitroPDF.pdf\old /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1060
- - C:\Windows\SysWOW64\reg.exe
    "reg.exe" copy HKLM\SOFTWARE\Classes\.xfdf HKLM\SOFTWARE\Classes\NitroPDF.xfdf\old /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4168
- - C:\Windows\SysWOW64\tar.exe
    "C:\Windows\SysWOW64\tar" -xf "C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa.zip" -C "C:\Program Files\Nitro\PDF Pro\CV\xfa"
    3⤵
    - Drops file in Program Files directory
    PID:2628
- - C:\Windows\SysWOW64\tar.exe
    "C:\Windows\SysWOW64\tar" -xf "C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa_fe.zip" -C "C:\Program Files\Nitro\PDF Pro\CV\xfa"
    3⤵
    - Drops file in Program Files directory
    PID:4284
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\SysWOW64\cmd" /C del "C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa.zip" "C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa_fe.zip"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4120
- C:\Windows\Installer\MSIFF0B.tmp
  "C:\Windows\Installer\MSIFF0B.tmp" --quiet
  2⤵
  - Executes dropped EXE
  PID:4556
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 47724BD12C6FF9B1E38B6A60FB0456AC E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI34B6.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240858421 39 NitroCA!NitroCA.CustomActions.MoveShellExtensionToCommonFiles
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2500
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop LPDSVC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop LPDSVC
      4⤵
      PID:4832
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop spooler
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1780
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop spooler
      4⤵
      PID:2396
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" start spooler
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start spooler
      4⤵
      PID:2308
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" start LPDSVC
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 start LPDSVC
      4⤵
      PID:2184
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 62FBDCF409D8718AB49FB6EC3608121A C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Program Files\Nitro\PDF Pro\CV\NitroPDF.exe
    "C:\Program Files\Nitro\PDF Pro\CV\NitroPDF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks system information in the registry
    - Modifies Control Panel
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Program Files\Nitro\PDF Pro\CV\BugSplatMonitor.exe
      "C:\Program Files\Nitro\PDF Pro\CV\BugSplatMonitor.exe" -m 4800
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4196
  - - C:\Program Files\Nitro\PDF Pro\CV\nitro_module_loader.exe
      "C:\Program Files\Nitro\PDF Pro\CV\nitro_module_loader.exe"
      4⤵
      Executes dropped EXE
      PID:3004
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=NitroPDF.exe --webview-exe-version=26.1.0.54 --user-data-dir="C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=4800.3052.17160500030115525856 /pfhostedapp:a9bec9992c621cb9cd203b9745b5c6423a103c25
      4⤵
      PID:1264
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView" /prefetch:4 /pfhostedapp:a9bec9992c621cb9cd203b9745b5c6423a103c25 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x50,0x168,0x18c,0x144,0x194,0x7ffafdb05fd8,0x7ffafdb05fe4,0x7ffafdb05ff0
        5⤵
        
        PID:2584
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView" --webview-exe-name=NitroPDF.exe --webview-exe-version=26.1.0.54 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1756 --field-trial-handle=1752,i,3955960269890000925,16892812114840996230,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:a9bec9992c621cb9cd203b9745b5c6423a103c25
        5⤵
        
        PID:6056
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView" --webview-exe-name=NitroPDF.exe --webview-exe-version=26.1.0.54 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2032 --field-trial-handle=1752,i,3955960269890000925,16892812114840996230,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:a9bec9992c621cb9cd203b9745b5c6423a103c25
        5⤵
        
        PID:1812
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView" --webview-exe-name=NitroPDF.exe --webview-exe-version=26.1.0.54 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=1752,i,3955960269890000925,16892812114840996230,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:a9bec9992c621cb9cd203b9745b5c6423a103c25
        5⤵
        
        PID:3324
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView" --webview-exe-name=NitroPDF.exe --webview-exe-version=26.1.0.54 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3420 --field-trial-handle=1752,i,3955960269890000925,16892812114840996230,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:a9bec9992c621cb9cd203b9745b5c6423a103c25 /prefetch:1
        5⤵
        
        PID:3752
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView" --webview-exe-name=NitroPDF.exe --webview-exe-version=26.1.0.54 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3720 --field-trial-handle=1752,i,3955960269890000925,16892812114840996230,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:a9bec9992c621cb9cd203b9745b5c6423a103c25 /prefetch:1
        5⤵
        
        PID:944

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4300

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.675.1142.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.675.1142.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.675.1142.0_x64__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:true
1⤵
PID:4232

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" uninstall-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.675.1142.0_x64__8wekyb3d8bbwe\EventLog-Instrumentation.man" /unicode:true
1⤵
PID:1060

C:\Windows\system32\wevtutil.exe
"C:\Windows\system32\wevtutil.exe" install-manifest "C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.675.1142.0_x86__8wekyb3d8bbwe\EventLog-Instrumentation.man" /resourceFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.675.1142.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /messageFilePath:"C:\Program Files\WindowsApps\Microsoft.WindowsAppRuntime.1.8_8000.675.1142.0_x86__8wekyb3d8bbwe\WindowsAppSdk.AppxDeploymentExtensions.Desktop-EventLog-Instrumentation.dll" /unicode:true
1⤵
PID:5832

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:5616

C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_8000.675.1142.0_x64__8wekyb3d8bbwe\PushNotificationsLongRunningTask.exe
"C:\Program Files\WindowsApps\MicrosoftCorporationII.WinAppRuntime.Singleton_8000.675.1142.0_x64__8wekyb3d8bbwe\PushNotificationsLongRunningTask.exe" -Embedding
1⤵
PID:4344

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Loads dropped DLL
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4704

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "0000000000000178" "WinSta0\Default" "000000000000017C" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Port Monitors

T1547.010

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a837a.rbs

Path C:\Config.Msi\e5a837a.rbs
Size 594KB
SHA256 36b35fbba6b6e141af2814026ff67efd78b05f28d3b6f4b7c38cdbbd25aba151
MD5 d8a17884c9dc1a3e989957df5baa6460
SHA1 291bfdec07fe86d2937210c9eabe785fd137f4c6
SHA512 bd3f0e362295506c8372b58fb612f62d3b5411ec86c407a0d7dcdfd60c76c28870e489a1fbe653cf60df5492bd10c5b3673b7be77414b8f7ef4e967eb7e387ab
SSDEEP 6144:ft0BiFY/ZFZu8cxOggMMMHzWqXM3JDcpjoRuXlSDQrz/KOoPedANIne/j5/v:mQ8FZu8cdWIM3JDcpjow1D/KcANInC3
TLSH
T135D40842071A87D8F05A2EF09B45F709D772EF242A156A0F6258470ECDDBB812E7CE76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Nitro.Pro.ShellExtension.Shim.dll

Path C:\Program Files\Nitro\PDF Pro\CV\Nitro.Pro.ShellExtension.Shim.dll
Size 473KB
SHA256 a1373d127dae69b83dd2d18a0d2c0a6cf5e56d347bc6adabd07952118f86e4df
MD5 6c367dee0851c4bb3f0d938bc91593de
SHA1 f0e36ff5dc982f13da12807eb69479f1e89518c4
SHA512 ccd1f023ce70963fcba3c868d438d96a41e2e692a884c632621ee819d72def806bf1ea6f82af61f61a85e2d4da77e868ca4bf0cdecf6fc1d00878294469a5816
SSDEEP 6144:4RPMfvb1NTpUjzRNYu7j6bdTzL/xeuc06OnWVU2Jph0lhSMXlBXBWf7156Ezi73i:48NT2Iu72bJzlXuJph0lhSMXl+71f
TLSH
T1BBA49E12B75880ADE11AC1BCC95B8A42FBB378458791A3DB1360E7B96F677D11F39302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NitroPDF.exe

Path C:\Program Files\Nitro\PDF Pro\CV\NitroPDF.exe
Size 21.8MB
SHA256 738de747591baefe7c69dd3e0e989cf778e3e97e160c9493cb6b6cc2d4285fb0
MD5 34be2f3c870ee5036b16610014c5ed0f
SHA1 ebf870da32d6286d35fe0cf49abd07f45ab665eb
SHA512 3958508f3d206078c3b18eb0d460c2b66bccce9ebb9529b7f26e41f0bb4705eeed396be508f3d76082abf26e467145bdb7bea6c726a06073cc511d1221c63f77
SSDEEP 393216:UuXonnXtMLwhUxoVccmSQoz5KheozxJKiSZIckJzsVld3ygsMtpj3y3cJZJZ+O+V:UQwhUxoVccmSQoFxMJKzZIckJo3ygsMC
TLSH
T165372A4DE29444E2D87591368B069455EAA3BC92871192CF372D3B0E6FF2FD84D7BE80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hu.mo

Path C:\Program Files\Nitro\PDF Pro\CV\solid_framework\lang\hu\hu.mo
Size 233KB
SHA256 344df8aa236c83a067beaed4f616eb8c008b23ff57e12bfbb294cae4a242e978
MD5 f4e79a5d0da15e4e8f8c459771d22d8b
SHA1 42f86de6103d19a32f88414d5e14c933866ba5f3
SHA512 1ab84ab13f875e6c3ba3398264b237e414d217f4aa3f7661e9898f73bc0b49d38ec1044bc4b3c0ec133680da678b9aff66d51a19517313d57e7bc77ab329993d
SSDEEP 3072:Ms2sUqiVgzG7u7lwtprgnQDODdIrBY2ibD6EST/203qSdfMVLAFjhHUJqnCOvSyF:Ms28d67WlkpwQDODqibuaMd0EL6ER
TLSH
T1A6345D3E52598D12D7DB03BB30318F09677E4141036E8BBF85ADE87A1C837898E5769E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxPdfCreator.ini

Path C:\Program Files\Nitro\PDF Pro\CV\x64\NxPdfCreator.ini
Size 40B
SHA256 4117bb32c6e69d4c6fbd050b8fefc65bcb0352fc11b8825d55732b662461b0a0
MD5 a562cd0f11eeb9b38d310b8545033cf2
SHA1 a4b236baf81bc434a05b829d3d0af7ad87bafea5
SHA512 bff48e74a7efe0dc35ee387ec650567e0ada853914b02d1b8d2903eb8dd6819d7b9889ea23d6b352b4081b0e64a68e378ece281ced115ecc72b163d7bade9757
MD5 SHA1 SHA512

Submit Download

NxPdfCreator.ppd

Path C:\Program Files\Nitro\PDF Pro\CV\x64\NxPdfCreator.ppd
Size 28KB
SHA256 43654163a5c11740c7ae37fd3d7e76a9202e7829b3e23a20bd113c9be99e5473
MD5 ba7b712c01428a5165f2578b214713e6
SHA1 dc8966bc3e05d4f417f55b697cdf51b9ecdc2e98
SHA512 eec252f0d1b240dbff81395b8cc7938416bcfc30537c60f1320723775c671bff6786188aeb6b02251f59a47b41b8827154c7c1cdf077dea472e1cb48349edc6d
SSDEEP 768:urXfT4bSgzj/4HT3yZOhTZVvlH0N1fkVZjgpnNBFBrobBlT933CHsv72whgJTFag:uryh
TLSH
T10CD212F460F8C55CCFE6B804FDACBA87A1A762927191A4FE556FCB260C07155AFA0307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxPdfUI.dll

Path C:\Program Files\Nitro\PDF Pro\CV\x64\NxPdfUI.dll
Size 3.6MB
SHA256 43de1b06ba1fcc610a7a92958939ac192d0c30c7dc7a735076d1d0dee65e8527
MD5 118255d68a94f588c3219904b8861e3f
SHA1 147c35f63136440b17f8291007328a15eeb3fb0f
SHA512 1a010bad15e8b230798568deddf0889b624dbc762206c959d13bb0900f01716c52c43f86284abdd685af07b0858cf0f8004245bbd9b5f36d2bb0ffd36d6b7e3c
SSDEEP 49152:DHKK357kFys4bAniIIx82qIzcYMTX5NbHx49uYzAQC0chJ/DGDEX+bcZ7hsPt1f+:y4OiISYCdAQMZ+bcAKj
TLSH
T1A8067D0A6BAD41D8D569D17AC94B4E0FD7F2B801037193CF02A08B9EAF777E1563A325
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PS5UI.DLL

Path C:\Program Files\Nitro\PDF Pro\CV\x64\PS5UI.DLL
Size 875KB
SHA256 2d98d00bb187d61457bc5b775fc8ab3c1d2e26057ce1b20182bc5334ff480813
MD5 eb89454cbd533963c326c7de1f5aeec7
SHA1 88113c810a40f5a956f04a7670e801ecd8030b06
SHA512 b9412d86cb0949acfc0abf5415bb34919b8fe30e70a1b030f3b90e555b2d6913fa94110b28ec22cb14ba852c89332ad8e733de6e6d3f15d7048f6f48a455326c
SSDEEP 24576:y+W9mVt3BPlF5q/C+lJ6bJBTErMiPRtn91Vw:KUVpRlF5SC+lgbJBTErM6RTw
TLSH
T1FD15D50163FA0229F1F79B7499B64252DA76BC456B35C6CF1290954E1E33BE0EA38733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PSCRIPT5.DLL

Path C:\Program Files\Nitro\PDF Pro\CV\x64\PSCRIPT5.DLL
Size 645KB
SHA256 d29ff293ceb6921faae224d2e333e60fef25bc9784b6e0f7b77f9025bf17f6c6
MD5 8acd939087ade69a24df4959e2d32214
SHA1 07f7a0c2756597461e0dc118dfb9f2028166e6f3
SHA512 a68be7cf2c1fe5dc916e61e02227984191527bccfc3a5757078ba06dd254195fe7ffdbf4ac2fa27f4e32e5708aa3ee11722f3a9f6c0b7553347f7a0000baa92e
SSDEEP 12288:RQ9DAonrTk8fwiTfEI6Gt9Qew9QrsRMofUAC3LZui0I:RTorTtYizEI6Gt96QrseocAC3LYpI
TLSH
T1C6E49E96A3A40076D4B78539D5974F1BE77AF40923208BDF86E487AD2F13BE0A63C315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxPdfUI.dll.mui

Path C:\Program Files\Nitro\PDF Pro\CV\x64\de-DE\NxPdfUI.dll.mui
Size 15KB
SHA256 936d34b60497cc4a831ba671664f8d1c071fe4776e3088e5d20abc589aced4bd
MD5 8758d2b2810c4af289a3d8c5d5bb9e91
SHA1 2f6fdcea0021cc5c0689464c4215a760f662cdd7
SHA512 31e063c2ad44da5bf33b1a9adc62cdb7d38993f8b38b209434e127ab3a057c2fa9f33b7de21ca1e8cd13bbc5c4c6591cae4b27963a8c50713bad37703614e130
SSDEEP 192:VWs2r97dcMIwoA6mSaVio06HJuBaW2K0kZhfOY3Yc9+kBB:QN3fIwoAkaV5HJUaW2K0kZprokvBB
TLSH
T14862790057EA8619F2F39F346EB692D16E36BC927E76D51F9F04328D1831B44CA25B32
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxPdfUI.dll.mui

Path C:\Program Files\Nitro\PDF Pro\CV\x64\en-US\NxPdfUI.dll.mui
Size 13KB
SHA256 afdf7738691642cba7da40cd7efd98fe1a132efc928182229ecff394f46a5fcc
MD5 b62fd03d763685b8f862e33da958f314
SHA1 8de2def9c93d62b70c74984cbdaca916ac6a5623
SHA512 f5614d454bb81a03e68c366fa299c9569cc708d0aae2fae6548f63b21d5b75cadebb5758ba62af5a5fde5bc231dc5cdcfdc3ca99ad93f54b1b099fb02d02fafc
SSDEEP 96:ODRWscqVI2laGntl7xwuE2ijJr20izCxUu7rgAWfkiDy7g+Tp0eeAcVL8Y4stuDJ:kRWsfZAMNe2H//QWeeqfMutAi2W/yG
TLSH
T1BD52330067FA8519F1F3AF755EB686911E36BC61AE39CA1F9A04320E5831E40DD79B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxPdfUI.dll.mui

Path C:\Program Files\Nitro\PDF Pro\CV\x64\es-ES\NxPdfUI.dll.mui
Size 15KB
SHA256 996f2cfdbfce7e66e34a6c6d5c208c5b1c6488dace6ce86519c517bd5df08927
MD5 5bc3c297d82b06309035498b3364794a
SHA1 88a9f03abc45531f0a3c9d0d35454ef5c0a12129
SHA512 777155f620043799a1dd7a3ca65d301e2c50db95e127a5171fc9f3e2b8a7fe475aeeea9864285367a8bfff755ad92b091971eb2c3ba072ab7df07c4a6afdcdd0
SSDEEP 96:OuWscFEiISGnVDoTLucbUAMbAs06cY7M9PBC23ES7dJjPfSBejStO+ZC6tQ+P6Fa:XWsq3RM49s177F23QRZC6t8eJuwBFvI4
TLSH
T11162524057FD9606F1F3AB79A9B64A914E3BBC52AD39C50F9A04324E1C71F44CE29B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxPdfUI.dll.mui

Path C:\Program Files\Nitro\PDF Pro\CV\x64\fr-FR\NxPdfUI.dll.mui
Size 15KB
SHA256 a05132f0a27e7a3862da0a732f72ac699a5c20f46a7ccb2da0365e03d66f0dae
MD5 26381ce754035e6c8b062cb443b65c73
SHA1 65dda1980a99ac120035338a0a1117c6a2f28dee
SHA512 77350c65cb1d17ab42e0e89f8dc00ae93734fdaddbdfad15656f7f10faf46dbf7ffd6101cf21dc68d5a959ac65c57e064b906d3c892f6eb8620001ca33fd016d
SSDEEP 192:BWs4tMDQ6exZupuQg3bYNGP1BL6o3LVGFhd+:Mgk6exZ6uQ5GX6o
TLSH
T12962340067FA8512F2F27F35A9B945911E3ABC97AD36C61F5A00328D6C72F44CD69B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NxPdfUI.dll.mui

Path C:\Program Files\Nitro\PDF Pro\CV\x64\it-IT\NxPdfUI.dll.mui
Size 15KB
SHA256 7f897f8ae960af1efcfb4e7cfeceeca7a065ff81a2eedfa9e7b54666c143ff22
MD5 503cf14b8f2ecde16f19789c204938b7
SHA1 d3c3535240a98047b399aa462143af16211847cb
SHA512 18023e8e9f9a529058db03d49c0439f44cd3003e94121c2fedf5a0034c54b404e84fec43e1ec9a6f79b4f46f9939290042af3faddcc12425cd2c121e267b1e92
SSDEEP 192:lWsAtlFlM1okOFIzBrtHgcYrtzAts/sbhcbXagZGBYs:A5vm1okQIzBmcGtzAts/s6agZG+s
TLSH
T15662441163FD8505F1F3AF34AE7A86910D3ABD22AD35C21F9A05328E6871E44CE65B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xfa_fe.zip

Path C:\Program Files\Nitro\PDF Pro\CV\xfa\xfa_fe.zip
Size 2.8MB
SHA256 ee122f2b76132e6b8cfaac1cf9ed38934a05f9cd79a0dbaf1fd5fe3520137ec6
MD5 2b155f7710901bacd873c8e6d13ca7b4
SHA1 8cf13585bde6db210a41cdc35aa4c890449f6062
SHA512 e2acc7dbd53c4eb370a6164ebdd66a2ceb0824a0bf4e48ed8a8eb0d8cb8084811df59c98c84cc48ebf94ca9462456d9ee76e8b5e7afd85ca282e6d0851206c87
SSDEEP 49152:JM9StJ9Z9r878+Ebp5atEaib1X5J9rM9S9mRuarhndiUDRmaYZz0BgKtFjRcOx2R:J2ShRyG7r2S9m88RDRUZ0pjRcOx2L60r
TLSH
T13AD53366C504019BC01A777300EA4B92DED9E205AF16FEBEE46C7249781598F1BF782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D147C6F2E18651EA793D0303A54625E5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_D147C6F2E18651EA793D0303A54625E5
Size 1KB
SHA256 c67e3e74c7b3f99156d8e29f1cbe63932843aa9e292b9e0c03e7eb4f6c794880
MD5 995cc6d65882f1dfec0c6703a5bd41b4
SHA1 b6c2c0317a928cf530cc8a2ed1f721917be49a0f
SHA512 04c526f00d03cabb48944f235681118f6d74f86409ac64063c2266426bffa5dbbb1d8803c28d18a0142e159b908d9b50617ac6413aaa1ea5e50e54767eb2e7ec
TLSH
T1F431D88A211D2D979EC7CF686CCE99087E2860F43AA86855153F9275B8503F31BB602A
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 1KB
SHA256 f616c9cb17b7963f763381b54c42dc1f75f95ec8ceddabd38ee5e402355a4c01
MD5 ce56f853dceab5e524224552a5bcdb1b
SHA1 fdc292e652e42f448fe1c858ee7cd343a9aa8b35
SHA512 70e4e684981d2014912630bb7214b331a72d6c985e95dcc4848e31bb7524d28e5609833eb87a2099bd28642d9335798733bebfe64514f484b2173e554067eeee
TLSH
T14E31FA3B6F2C59218E234D942DD9F9720C70D6A16CF914AA7014EB2F18C9BB34F0591B
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

357F04AD41BCF5FE18FCB69F60C6680F_D147C6F2E18651EA793D0303A54625E5

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_D147C6F2E18651EA793D0303A54625E5
Size 540B
SHA256 df5d74af2982b418822e40f3b482beaba345ae3ee1f5ce457cc6702ef4265548
MD5 79c017aa9c85332f7434844a74fc6800
SHA1 3fdf5ddff2e6ea1ee8051e6ab58c351f377cb172
SHA512 9962078da6c047271e7acf207ed8136409b4f27eeb60390c34da3b472eafdc48d7c79225fd8c4c447cbbe4a25f2eaa62147e8e65122fbcebcd47c4c9728876ff
TLSH
T1E1F09E3C14FA142FF072C9741BE1A5670D19FA2F151585580AA84309E87AF045C92B3E
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 f1c718b5a3971eb11d8700f7fde692259a882280b0508e78b5ff201f2ca6be70
MD5 831e21127167780c6e6da4225823f275
SHA1 2cfde3f931a47801d6ae31b2a04ba146bf967693
SHA512 8d6cbe89b50f205578609b2df19d604cf6af97d393c3134a108b5dcf9cf98826e36be6c837cd1bc7013cea6e38964c6a833bca3d983bbaea3f2d3b1dc81bb7e9
TLSH
T1E0C04C0837B64255F1314D7F1652531147BAA5058D5183540F60626D862DA529CA5D06
MD5 SHA1 SHA512 TLSH

Submit Download

9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554E
Size 536B
SHA256 64b288f7158bc689778fab1f804c3c9938a208159b30761885c078643bbff4ef
MD5 8cd45d690579c348403922c7b5be113e
SHA1 734d849f572d9ec296fd37ad4a257ab8920b0def
SHA512 c744235f3116591cda41b9f400b2812f87cd4f2bc2419ad8b7e0a4e5381b1f38a61ac16fa3632b00ef15b7c8704368b76e095921e1fe3a0b905897a98915e587
TLSH
T1DBF09E0807F1421FF473D93909E85456A526FC03680056A9079A1B0D5832B416D32429
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 6207ae2a3dd961ffc4a49aa5741430be95677f35054e7916e900eed9baa6c3e3
MD5 996f48c770bae999148b9a86667162ec
SHA1 917898afb3277f7bbc72b70694183549e97f847b
SHA512 71c5dc21012f697ab3a1b44d609268d4fd4b3217e005816bae0c83f9bf74c1a046dc2934b7f29d4f60b0dc29bf19bdac652e58ce0fcc51199c79800bcdecee11
TLSH
T170C09B1473E54755F10D513D7DD6560417F95145F5C6CB444B74113485186510C71D09
MD5 SHA1 SHA512 TLSH

Submit Download

BugSplat.log

Path C:\Users\Admin\AppData\Local\Temp\BugSplat\Nitro_Pro-26.1.0.54_w64\A22160E8-4FC6-456A-8041-2DE9C5B50AC8\BugSplat.log
Size 1KB
SHA256 e19bbb987455d6ff55c44b33168418908f8b5d5843dd7862c284a4f302f87cba
MD5 fc2897309ee6e2ea1185cf5399e51040
SHA1 863962386670ff5cc40969362631eb663e642744
SHA512 27bab1ca5d15dd3006badf08d24701bebfce9a0d5b3ed9b05fa7cdbd5f148f8cf577a58319858831892adf7451324030282c5e7bf2102c1305d2747d09c75181
TLSH
T1E031C32E27F44125B3B7C142DAE6D5277536B8996930CE5E02C9038C1E71603FAA1F7B
MD5 SHA1 SHA512 TLSH

Submit Download

MSI4B52.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI4B52.tmp
Size 2.7MB
SHA256 ddc2dbee07f1e5e4bbca7c0d35e5bb166684472c1c9ca63d2bdf1408915544c0
MD5 19d7e08cc549a2b024968c03370aa92f
SHA1 32d139ebf53fe8139b5329dc6dcc6c3a69a0fc91
SHA512 679013152c131f19197ec4db84b950421337fb01dedcb0af29ff0ec165b785a765f74b183163ee55ed1a010fde0e293c207e5981837eb51f7f7da786ed4b6cd6
SSDEEP 49152:OGtlqQsIU6iQVwASOP0aITLc2Roo5EXKDE40MbbQZ1RaWOvEeAyseJdPwKIVAPI:f+Ai9BFHq7B++KIl
TLSH
T16ED5BF1AA6A804F8DC7AC17CC9575637D7F2B45503B097DB07A8CAAA0F23BD1173AB41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI57D7.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI57D7.tmp
Size 324KB
SHA256 14b35b6348bd778e72a48dd4719bf2f34988fd3437167be0277a9ab994b7edad
MD5 a8dbfd78c00bea182347e412b598b43f
SHA1 9e95c3c3df5bdb73e0c397ce5739f5b4b363d1e2
SHA512 7d01ff1ef47572f38a3438afbc5a4335c5b780d3af729967bf2dd59a715d5e49d8039f9d991e4a764fb257885e8b5d0aea1ae837ab497728e9d1b6643444dfe6
SSDEEP 6144:QHzWqXM3JDcpjoRuXlSDQrz/KOoPedANIne/3:CWIM3JDcpjow1D/KcANInU
TLSH
T19964BE6A77F80D79FCB7923589638A16D6737C520A30D71F03604259EF6B390A53EB22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42386fa3-1ac2-4e16-b8da-fc8222f6f6fa.tmp

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\42386fa3-1ac2-4e16-b8da-fc8222f6f6fa.tmp
Size 15KB
SHA256 f7d7d6af19fd17b51a0121aa8c20a049cd474c1c23cffa20266f0cd8558a1461
MD5 6e7eb93fb3872acc05bdf43a3954b8e6
SHA1 d0718923573aa8856a310c8ecebb0498e9045172
SHA512 68ba8359bd4042c4588ff44ab2136ca2d844269baba10d412f2d7873d710d479fcc6efb44656e2eb39f9a4350df8fd501a0a65ddf39ecdeee6fca4983b7c59f7
SSDEEP 384:xsrv+89zHqlDNP9oid6NBS7eDvQ2isd+6Nq:erv+4UNbd+I2is06Nq
TLSH
T12172AF33E93CAB379DB78904B48A7A1B3B7C60576BC21AA4E5994F8D41CB0D93316D43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d0f78f8da96ec0757d722b59ca51be3a4e62f2439ced7627dc81b848fb472fc4
MD5 b577682d8193d54e02f6f753e189d955
SHA1 a0255808ced9d5a1729b747e0789488288455f81
SHA512 929de599725c04223fd910d2838e63638ef63c3a500bd44a9674cf08c57e970bb0a2f5805dad047869b03567371c1fa742fd46c3a7b578626d750d04064488a2
TLSH
T16FD00470D3001451C00471315031511145055510341111504C11C04D17540445031050
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c4a52c8649b4ab474148240f30b76db65193b348903e06c6af6759f8dbc51fe5
MD5 60a3477f0e3730df612a461efd199bfe
SHA1 bc0d7940f731991b2031d5701b27f8100eeceefd
SHA512 897070a09b15d8cbfd96364711b63ef5e4c7dbfde58a08e71a5f9b015cf675bc68b8fb69acf0288ad7acad4c6486a0210b3722a386ce222860c43f36effbd7be
TLSH
T15ED0122273010574C0103133101371090801D21B500540409C29C55E2B180941922491
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ab946cd6-1863-466c-a8cc-faa335b1bd79.tmp

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Default\ab946cd6-1863-466c-a8cc-faa335b1bd79.tmp
Size 5KB
SHA256 bc3f7c6fc2f45edc9215a54e80201ea24d0645b99d511edbf81d14c5907a5f7c
MD5 ed24384395fab0a7c665689d1079268b
SHA1 8310d301bdc744292bc2311b1048a49c3d27b5bb
SHA512 b5ae8fa2e6a4265e4c0381f53ecf266df540e340dcd48e342d21875615c20ae3495824889d03e50497385b9ef65b4f3a89a3b98905a65a37661bd00d59cb4234
SSDEEP 96:st7/do0x5vb9Bkno5h16ZZs7/x+6MhmuecmjepK+gpb028XM1C7K:stDd/2o+sV+FijnD0G6K
TLSH
T11BC1A6025E28697B4CC6F109BA39BB43E2F9607276D52E58EBF8461C08DB5CD2317D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Local State
Size 2KB
SHA256 8ec3be3ae6d073d4325498e8b174c1b94271d83f467a24900454d5df13dd0565
MD5 df440ef16cf0b8d3ff66a1de79628bb1
SHA1 d85d1cc746bef4631d35a4c418d9ec759e37fdd9
SHA512 42da66833ecf527700e424a5c74b0862f8f8256d00d6c9a2797828041929d39c14bcfcb3a8a5268641065d659184c6b87d09d12986e05510114add04183dfd0a
TLSH
T1775192336D149B77A8E38608799A7F67CB7560A6AB913F50E6DC0B0801C748C3717C3A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Local State
Size 3KB
SHA256 46ca3908f7bab67b0c3e1c43c841a8c50655f278ce8851735d6a37a43b3bf58d
MD5 5da699cb6cab8587ed5aaecde8e3ab92
SHA1 56591ad8dcd52717e7234356a0578448cc6547df
SHA512 bd5c4d7cf6350262ce6344fb937c1ba37e674b229a7209d4aef79e13cacf4b0f8a197937c6dcb4686572909f9ab79dddc2c164211bf61a98eff6de8b6346fc90
TLSH
T13D71A537AD649A7B5DE38A0879853B5AA7A12037EAC53F95E6EC0F0C01C72882353C16
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5bab31.TMP

Path C:\Users\Admin\AppData\Roaming\Nitro\PDF Pro\CV\webview_wrapper\34f21292-ed02-46d9-b194-06806f181a5b\EBWebView\Local State~RFe5bab31.TMP
Size 1KB
SHA256 9b6325396338ef30f6c59089a2e9d4a3f0c1b39dc1cf4a1acd4310a862b2ac64
MD5 5a2c4c9750a726072e7117f827411d3c
SHA1 862b1dd6df0bd7e5f3f85a82f020fbaa540e8e8c
SHA512 a1d49e1f4493adf37ba15a4614fa2060c9869cb128005f9498e96dd5e21f2d9c5aa11216edd5b37950823cf710587d43ec30e9165a201ef60ff1fb587f1665ab
TLSH
T1623130B3DDA94B73BC8656053291BA9B9F71207B47805E44B2CD8A0912C788D7B3FC36
MD5 SHA1 SHA512 TLSH

Submit Download

MSI3A74.tmp

Path C:\Windows\Installer\MSI3A74.tmp
Size 2.9MB
SHA256 bee98d4f033480b06db40054cc7966437396d23761a576c398374462e719649a
MD5 e1434b2925095632046f28748adde0ce
SHA1 d68cb4b78a773adbedb988d145c2d5b34a39bb08
SHA512 2272eca2a1f146de4071c568797983ec6930e102b2a0e78926b6e957c876af3f72a31478c27c14019e1d63ded9eb8af5b648c4e266f88e8474758787820e489e
SSDEEP 49152:aL3dcTZ+HpKS338T4yAgmSRY/FBT/SSaCNeqMu/h2w6uQ2ZnjhfSt6aA:g9vZeqP4UnjB
TLSH
T127E56C4AA6ED4094D9A6D079C63B490FE7B2BC1103B293CF21704B9EAF37BD1453A365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSIB19F.tmp-\CustomAction.config
Size 1KB
SHA256 dc44fb3a0ce9cb88926b2d91ec3cc5a5c5d694b02415c4b2459090f08f08ed58
MD5 4933c1e1be5973187e991ea2ed9e6451
SHA1 b16b52ba34a835b5bb8665f502e7e37985b6776e
SHA512 766ed216354a9d0f681607577e586e89dc82729ced58c328676771178ba547cd87878a1f5955cd46b197672753bc693d08246a7a11ceb8a7f255e1321403e805
TLSH
T18C31568E0B05B77711312753AEED90C5DB7561A73C958118349EA9293F36578137338E
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSIB19F.tmp-\Microsoft.Deployment.WindowsInstaller.dll
Size 183KB
SHA256 abe1742945a10588376cd127771c3d5f3f0579d4ff1bde15c41a494451d89444
MD5 a4d3eaf44156ab27772e2cf99033ed64
SHA1 bd28431730bea4908d2ea728ea70ccf48debc5d8
SHA512 aeb342f38a05cd061b76bdc7cbfa469e6c95e40dc81707d0df2223a7bb1ac2b25169653aae4d49945ffd579954897a166d897b65410dec5ecda5f32e15f1adaa
SSDEEP 3072:xGfZS7hUuK3PcbFeRRLxyR69UgoCaf8Y/CnfKlRUjW01Ky/hP:tzMRLkR6joxfjG
TLSH
T1AA047D2953FC473ACEEF4778E261425197B1F2E67113DB0EAC8181BA2522780F792797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NitroCA.dll

Path C:\Windows\Installer\MSIB19F.tmp-\NitroCA.dll
Size 27KB
SHA256 fa000d4720135a8f3830f3b36504d50449212a13111fc90a7a743a6d99917f4e
MD5 c67805909661ccd40baeb31dd3c8b26f
SHA1 8b868ef93a154f2f25bc19075fadb57de10dcfc5
SHA512 5e7a7e281a076291152854aa6e2dfa1c44b3f7b2e11c4deeaa24ecea58ac5958ac2d35867e5828e4951d9438f0bd4ac0aded6aa3d352e5ff891ddebcfe67e675
SSDEEP 768:jxIpgn8WiL9xkcgBIjQOyFokTsy2dq/gEEAW0+:14dqoEEAi
TLSH
T113C28101BBF84728F6FA9F756DBB09544B79FD5D4932E21E2988508E0872B40CDA0B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID384.tmp

Path C:\Windows\Installer\MSID384.tmp
Size 234KB
SHA256 86ada378311714ac96700fa0000bae824342ceae6382ff8bee203b8af8f89b26
MD5 ee248d3dd120e7f40d32019514c5fe73
SHA1 b6085a4fdd9ce834a7d73b42ce8846a80d0fc21b
SHA512 a888b3f9dc63e57a0bc85be60193200d04e89006abf07eac71258a3107f72b13748b6a40c0eb1048dbf7f9179845c0dd4f53fc9786b847428cfd3fb4fe9a93e6
SSDEEP 3072:AYP9qm6XOzw+aMELW/AHC9DvBWiTallSLIflQnp3Gbc7gEsNrLPsVzhPP:AS6+zjy+DvBtsliZnsRsh
TLSH
T173348D217494547EEBFF0832953EDA71AE3DF2280B90C56EC394481E5D609C1ABB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

concrt140.dll

Path C:\Windows\System32\concrt140.dll
Size 308KB
SHA256 5b757f98a5f3e4ab8b944067c12bec9d67a80aa31c7de702b15dbd199dd602ed
MD5 0b42ac3aff1633b0d7edb9fdf5e4ecd6
SHA1 2ca2129c8bbcbabc4e21368a6f9acf59a64d33fe
SHA512 afc8942f002ec2958eafebbbeb4b30c47c3e286c387322c4be8839b56f9a1621d556d8cb93caee6ece8bcbd1b99c96972a562b758080c183c27762b5a2acbee7
SSDEEP 6144:Z9DkdwiHjMa13DgU/0qg7Rylk1aMZR0EsT+EX8EO/VnWzgBsHCJuWo1:LViDMMf0p7RyvvZpzS
TLSH
T18764299A72140CE6F967A039C553890BE6F2BC416366D3CB0275839F6F537E0D93A722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mfc140u.dll

Path C:\Windows\System32\mfc140u.dll
Size 5.4MB
SHA256 183c851a0dc535066811f33c16555f6319ffaacacd04d346758769931f61b19a
MD5 09d45d46f97b1b08450b58c943803746
SHA1 a9a8a6cd7df5035ec70fd931e18e8bc12dc990ff
SHA512 02400b48b85837f6b9040bd896d632fcd98833177c9646989aff9ee95952a48378def03c3ad1f5611d77ca01c92f6bf13f5d54a73f3961c551a393d0f0933b32
SSDEEP 98304:R1lubyfp6KmkUQFLOAkGkzdnEVomFHKnP6:NuSp6KpLFLOyomFHKnP6
TLSH
T191467C46BAAD0084D9A9D03AC6278D4BD7B2FC50136593CF0132A75FAF777D2493A326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Windows\System32\msvcp140.dll
Size 554KB
SHA256 a8102891d06b5f21c35c67e4ab26eb84f54405b67e67eaf75dadc62cef08b55a
MD5 c7a693fcffcb6c245282d1132e38ac5b
SHA1 8965f69c938eecb2226ad7329a9df5109d93cb8c
SHA512 321456ae04eb392734a0aba27e965500467d58dc1277fc550b6573916607ba53c686db05219ce326fb3f9289cc4430b85990362f630e4a7829345067986ca6d2
SSDEEP 12288:Lk81h3wi9M2OgltEM70X5KvRg6lCEP9pSa29pttcYzQEKZm+jWodEEV8LmK:Lk849pFQEKZm+jWodEEuC
TLSH
T139C40927774902A0E195A3B8A1C74305D7F17C4A8322A3C792FBD6AD2F5B7D1673B290
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Windows\System32\vcruntime140.dll
Size 94KB
SHA256 d8faf8ebf360ed0b3b1a43877a04863f7e044b3d19b641d88737e0829d683b36
MD5 6e34fc4a713c3fbd88e47ac188d2540d
SHA1 1877a17da406d147566168c56aac1eb576782b37
SHA512 848a1d9602210d7da0f6e4d7817af08dc02baac7eccf1cfaadaf3a24b55e1316e77c40672a6a1195797e525f448817e534ae200e99cdf548ee64a7996fbcec4f
SSDEEP 1536:NT11/9nhu8HQRC/lYLFy1E0CWtVn3GwDa/becbfQqFt3:N5NF/eLUCnWtVn2wDObecbftFt
TLSH
T1FA936C4A76A442B7D06AD178C2E35E16F770B844877053CF03B686AA8F67BE05E3D346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Windows\System32\vcruntime140_1.dll
Size 36KB
SHA256 0d8217dbb0d52a3f8cd233b089131ca19aa6e0fc0c0fb10081f3c50761f5d15e
MD5 d76532f224b6648179b77525326e8754
SHA1 cb0a90adf84b9c19e750b166789452693f031053
SHA512 721b4f0f55fbeefa394d3471c66d32e2f0f452f9977987450b1662b8e2e9a88d1b9c014b5f2a4b378d99f6fe4de6b5810f8b00157ae25b0de2a3bf3e211ea2fc
SSDEEP 384:isFi8rE+2UUtAAd928q4qXnU5fBLn8umItRWqoVJtYftmz/U3ZlvJWriKW/014gx:s8g+2UUt/yXgBLn85aRZoZStvZRcbB0Y
TLSH
T1BDF23A9563784092E46B95B0C4D3AF27FB38F8A15750978F0BA0825D2E237D0F63E71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/944-1807-0x00007FFB2DD60000-0x00007FFB2DD61000-memory.dmp

Download

memory/1984-28-0x0000016077350000-0x000001607737E000-memory.dmp

Download

memory/1984-30-0x00000160764C0000-0x00000160764CE000-memory.dmp

Download

memory/3324-1782-0x00007FFB2E0B0000-0x00007FFB2E0B1000-memory.dmp

Download

memory/3324-1783-0x00007FFB2D8B0000-0x00007FFB2D8B1000-memory.dmp

Download

memory/3324-1855-0x000002A730D90000-0x000002A730DBF000-memory.dmp

Download

memory/4800-1655-0x00007FF672DE0000-0x00007FF6744D5000-memory.dmp

Download

memory/6056-1702-0x00007FFB2DD60000-0x00007FFB2DD61000-memory.dmp

Download