Analysis
- user interaction
yes - max time kernel
208s - max time network
210s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 14:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://download7.pdfsam.org/get-app.aspx?configld=DECC253B-6466-450B-B829-296A7FBAB00A&uid=1007261&cmp=PDFsam_Basic&ref=pdfsam.org/in-app&wid=6848
Resource
win10v2004-20260513-en
windows10-2004-x64
31 signatures
150 seconds
General
- Target https://download7.pdfsam.org/get-app.aspx?configld=DECC253B-6466-450B-B829-296A7FBAB00A&uid=1007261&cmp=PDFsam_Basic&ref=pdfsam.org/in-app&wid=6848
- Sample260813-repn7sbd89
Malware Config
Signatures
- Boot or Logon Autostart Execution: Port Monitors 1 TTPs 26 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\FileName printer-installer-app.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor printer-installer-app.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\UniqueNames = "1" printer-installer-app.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\Command = "\"C:\\Program Files\\PDFsam Enhanced 7\\creator-app.exe\" \"%FILE%\"" printer-installer-app.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Microsoft Shared Fax Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports printer-installer-app.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\RemoveExtension = "1" printer-installer-app.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\AddUser = "0" printer-installer-app.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\FolderName = "C:\\Program Files\\PDFsam Enhanced 7\\Print" printer-installer-app.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port: printer-installer-app.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\PromptFilename = "0" printer-installer-app.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon spoolsv.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\RemovePrefixes = "0" printer-installer-app.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\ExecuteCommand = "1" printer-installer-app.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\PDFsam Enhanced 7 Monitor\Ports\PDFsamEnhanced7_Port:\AddTimeStamp = "0" printer-installer-app.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation sam.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 24 IoCs
pid Process 1556 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 5652 PDFsam_Enhanced_7_Installer.exe 5492 printer-installer-app.exe 2240 Process not Found 5504 creator-app.exe 3020 creator-ws.exe 5236 activation-service.exe 5572 sam.exe 5648 activation-service.exe 1156 update-service.exe 6004 stats-com.exe 4568 creator-ws.exe 3408 sam-launcher.exe 5756 sam.exe 4140 sam-launcher.exe 3720 sam.exe 1264 update-service.exe 4336 sam-launcher.exe 1144 sam.exe 4336 sam.exe 2312 sam.exe 564 stats-com.exe 1864 sam.exe - Loads dropped DLL 64 IoCs
pid Process 5308 regsvr32.exe 5148 PDFsamBasic7Installer.exe 5452 DllHost.exe 6140 MsiExec.exe 6140 MsiExec.exe 5648 MsiExec.exe 2064 MsiExec.exe 2064 MsiExec.exe 2064 MsiExec.exe 2064 MsiExec.exe 2064 MsiExec.exe 5104 MsiExec.exe 5492 printer-installer-app.exe 5492 printer-installer-app.exe 5492 printer-installer-app.exe 5492 printer-installer-app.exe 5492 printer-installer-app.exe 5492 printer-installer-app.exe 5492 printer-installer-app.exe 5492 printer-installer-app.exe 1056 spoolsv.exe 1056 spoolsv.exe 1056 spoolsv.exe 5504 creator-app.exe 5504 creator-app.exe 5504 creator-app.exe 5504 creator-app.exe 5504 creator-app.exe 5504 creator-app.exe 5504 creator-app.exe 5504 creator-app.exe 5504 creator-app.exe 3020 creator-ws.exe 3020 creator-ws.exe 3020 creator-ws.exe 3020 creator-ws.exe 3020 creator-ws.exe 3020 creator-ws.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5236 activation-service.exe 5564 MsiExec.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe 5572 sam.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe - Drops file in System32 directory 14 IoCs
description ioc Process File opened for modification C:\Windows\system32\spool\DRIVERS\x64\brand_solution_name_pdfprnui_v.6.11.0.7.dll spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\brand_solution_name_pdfprnui_v.6.11.0.7.dll printer-installer-app.exe File created C:\Windows\system32\spool\DRIVERS\x64\brand_solution_name_pdfprnui_v.6.11.0.7.hlp printer-installer-app.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\brand_solution_name_pdfprn_v.6.11.0.7.dll spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\brand_solution_name_pdfprn_v.6.11.0.7.dll spoolsv.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\439F613B3D55693954E1B080DE3085B4_34E5860FFE20BE5B0BFD962D5C01ADB7 activation-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\439F613B3D55693954E1B080DE3085B4_34E5860FFE20BE5B0BFD962D5C01ADB7 activation-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EBD5593D469F3B707C150CCE524C85AE_82A14D8D24A457F0C09486A39293303B activation-service.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EBD5593D469F3B707C150CCE524C85AE_82A14D8D24A457F0C09486A39293303B activation-service.exe File created C:\Windows\system32\spool\DRIVERS\x64\brand_solution_name_pdfprn_v.6.11.0.7.dll printer-installer-app.exe File created C:\Windows\system32\spool\DRIVERS\x64\brand_solution_name_pdfpmon_v.6.11.0.7.dll printer-installer-app.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\brand_solution_name_pdfprnui_v.6.11.0.7.dll spoolsv.exe File created C:\Windows\system32\spool\DRIVERS\x64\3\New\brand_solution_name_pdfprnui_v.6.11.0.7.hlp spoolsv.exe File opened for modification C:\Windows\system32\spool\DRIVERS\x64\brand_solution_name_pdfprnui_v.6.11.0.7.hlp spoolsv.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\de\confidential.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\it\departmental.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\plugin-review.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniCNS-UTF16-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\localization\de\messages.dat msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\notification-service.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\plugin-pdf-creator.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\ui-dialogs.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\fr\top-secret.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniGB-UTF32-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniJIS2004-UTF8-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\resources\solid\bin\Resources\metadata.xml msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\Adobe-GB1-H-Host msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\Adobe-Japan1-PS-V msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\EUC-V msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniJIS2004-UTF16-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniKS-UTF32-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\ui-remover.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\90msp-RKSJ-V msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\en\preliminary-results.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniCNS-UTF8-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniJIS-UCS2-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniJIS-UTF16-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\icuuc68.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\resources\solid\bin\ImageTool.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\localization\ru\info.json msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\resources\solid\bin\msvcp140.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\it\expired.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\sp\bl\bl.csp msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Scripts\Common.js msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\ui.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\CNS01-RKSJ-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\localization\ja\messages.dat msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\GB-RKSJ-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\GBpc-EUC-UCS2 msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniJIS2004-UTF32-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\es\preliminary-results.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\ui-secure-module.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniCNS-UCS2-V msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\Encodings\SJISEncoding msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\webservices-so.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\90pv-RKSJ-V msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\de\preliminary-results.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\pt\experimental.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\KSC-EUC-V msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\plugin-spelling-checker.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\UniJIS-UTF32-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\Identity-V msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\logger.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\msvcp140_2.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\en\approved.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\it\not-for-public-release.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\BusinessStamp\pt\completed.pdf msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\RKSJ-H msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\Roman msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\plugin-evernote.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\preview-handler.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\resources\solid\bin\Resources\SolidLists.pdf msiexec.exe File opened for modification C:\Program Files\PDFsam Enhanced 7\ui-document-panel-properties.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\B5-V msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\Hiragana msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\plugins\plugin-edit.dll msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\Adobe-CNS1-3 msiexec.exe File created C:\Program Files\PDFsam Enhanced 7\resources\Core\CMap\B5pc-UCS2 msiexec.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\main_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\edit_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\insert_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\e59c8dd.msi msiexec.exe File created C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\ocr_icon msiexec.exe File opened for modification C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\review_icon msiexec.exe File opened for modification C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\secure_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\convert_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\forms_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\uninstall_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\e59c8d9.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI3780.tmp msiexec.exe File created C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\asian_icon msiexec.exe File created C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\insert_icon msiexec.exe File created C:\Windows\Installer\SourceHash{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553} msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\asian_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\secure_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File opened for modification C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\main_icon msiexec.exe File opened for modification C:\Windows\Installer\MSID73E.tmp msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\convert_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\install_icon msiexec.exe File created C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\convert_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\install_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\convert_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\create_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\review_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\secure_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\asian_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\install_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\review_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\insert_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\forms_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\ocr_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File opened for modification C:\Windows\Installer\e59c8d9.msi msiexec.exe File created C:\Windows\Installer\SourceHash{63380AAA-0783-42BC-B807-471E0BC00907} msiexec.exe File created C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\uninstall_icon msiexec.exe File opened for modification C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\asian_icon msiexec.exe File opened for modification C:\Windows\Installer\MSICF8B.tmp msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\uninstall_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\main_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\main_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\main_icon msiexec.exe File opened for modification C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\insert_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\create_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\forms_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\uninstall_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File opened for modification C:\Windows\Installer\e59c8d4.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\ocr_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\ocr_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\main_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\forms_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\asian_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File opened for modification C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\install_icon msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\install_icon msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\review_icon msiexec.exe File created C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\edit_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File opened for modification C:\Windows\Installer\{A1DD96C4-2ADF-4A7E-AA8B-D9362106B553}\edit_icon.5C9BBFCE_F40D_4866_BD03_B64A7523DB29 msiexec.exe File created C:\Windows\Installer\e59c8d8.msi msiexec.exe File opened for modification C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\uninstall_icon msiexec.exe File opened for modification C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\convert_icon msiexec.exe File opened for modification C:\Windows\Installer\MSID633.tmp msiexec.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDFsamBasic7Installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDFsamBasic7Installer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DllHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PDFsam_Enhanced_7_Installer.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4168 msedge.exe - Checks SCSI registry key(s) 3 TTPs 21 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002 spoolsv.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002 spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{f01fac5d-e5f6-485f-a8c6-27446425998c}\0002 spoolsv.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 61 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ activation-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\NgcRecovery.dll,-100 = "Windows Hello Recovery Key Encryption" activation-service.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\PDFsam Enhanced 7 = "winspool,Ne03:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\PDFsam Enhanced 7\Previewers Settings activation-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-100 = "Isolated User Mode (IUM)" activation-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-844 = "BitLocker Data Recovery Agent" activation-service.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Key created \REGISTRY\USER\.DEFAULT\Software\PDFsam Enhanced 7 printer-installer-app.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" activation-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing activation-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\wuaueng.dll,-400 = "Windows Update" activation-service.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" spoolsv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\PDFsam Enhanced 7\PDF Printer\OpenAfterConversion = "1" printer-installer-app.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E activation-service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" activation-service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" activation-service.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft Print to PDF = "winspool,Ne01:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" activation-service.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software printer-installer-app.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\ci.dll,-101 = "Enclave" activation-service.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\PDF Tools AG spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Printers\DevModePerUser spoolsv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\PDFsam Enhanced 7\Previewers Settings\IE = "1" activation-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" activation-service.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" activation-service.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\PDFsam Enhanced 7 = "winspool,Ne03:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft XPS Document Writer = "winspool,Ne00:" spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\System32\fveui.dll,-843 = "BitLocker Drive Encryption" activation-service.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\29 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\28\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\PDFsam Enhanced 7\PDF Printer printer-installer-app.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311036525181816" msedge.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Fax = "winspool,Ne02:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\PDFsam Enhanced 7 = "winspool,Ne03:,15,45" spoolsv.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix activation-service.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Microsoft XPS Document Writer = "winspool,Ne00:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Fax = "winspool,Ne02:,15,45" spoolsv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" activation-service.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" activation-service.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\Microsoft Print to PDF = "winspool,Ne01:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Devices\PDFsam Enhanced 7 = "winspool,Ne03:" spoolsv.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\PDFsam Enhanced 7\PDF Printer\ChooseFile = "1" printer-installer-app.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{577F1DE3-9A44-47F2-BB71-13E927563A1A}\ProxyStubClsid32 stats-com.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD2DDB7C-DD73-446F-BAE8-FA8D3AA7AEEE}\Version\ = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7790D212-75A7-469B-A3B5-9F32E598D433}\TypeLib\ = "{336A1FBB-E907-46CB-9FC8-42DAB7C05E70}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C4CDEB4C-ED1F-47E4-BEF7-58BD9338DE13}\InprocServer32 MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{493D0B45-9691-48DC-B6B1-3CB5D392CFE9}\TypeLib\Version = "1.0" update-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DEDABABE-EBBA-A555-0000-00DEDABABAEB}\TypeLib\ = "{3F77A86C-2FB5-4743-984A-138B13294292}" stats-com.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{575D7782-AD15-4B78-ACFC-749BA5ABE1BC}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9A7DB4F-2333-47B6-B9F5-C691B37D13DF}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{587B84DE-8C24-4AA4-B35E-9EFDD0189968}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4BFB0279-33AB-4CDC-A8CD-8DBC18A6A398}\ = "IInstallItemModule" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{86FF4A31-02B9-46B5-BE4D-F741207A89CD}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3F77A86C-2FB5-4743-984A-138B13294292}\1.0\FLAGS stats-com.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5887D2B7-4C1D-41FA-889A-0179A2B37687}\ = "DownloadItemModule3_1 Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C310D253-8068-41C9-9A73-76F5DE090612}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{005557BB-8996-4B60-9747-03740FE0A9E0}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4BFB0279-33AB-4CDC-A8CD-8DBC18A6A398}\TypeLib\Version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1D16B343-C0E3-4492-9122-BFEC46391E58} regsvr32.exe Key created \REGISTRY\MACHINE\Software\Classes\PDFsam Enhanced 7 WWF\shell\open\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{77EC23C5-BB68-4A7B-AE5C-F4AD0B6C678D}\DllSurrogate regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A9B840F0-5D75-4B35-9B76-923CA5E60695}\ = "InstallItemModule3_1 Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{981CC4BD-3A05-4EAB-9080-0C3B6BD6A713}\ = "IInstallItemToolbar" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{01CCDEBD-18EA-40F7-948D-2472ABBDEC67}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ContextMenuExt.DLL\AppID = "{ACD2C44D-8C63-49D7-B67B-6EABA7DE271D}" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C5441DB3-2A75-4190-948E-152AC6372EAB} activation-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C6AFCF95-1139-4EEC-98B0-A563425EA342}\ = "_ISubscriptionBridgeEvents" activation-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D06CC382-A652-40EA-947A-A11E7A690F82}\TypeLib\Version = "1.0" activation-service.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4EC97C60-CFF5-41F0-B49B-9E786C891518}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0084E94B-99A0-48F0-ACC8-3EBE184C5A7A}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFsam Enhanced 7\shell\print\command\ = "\"C:\\Program Files\\PDFsam Enhanced 7\\sam.exe\" --pdf-tools --print --source-file \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{4943A1EA-C4C9-42E3-9E07-E70D209CD155}\ = "PDFsam Enhanced 7 Preview Handler" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF4A4C12-A2B5-442F-8F13-7E6109AFE3CE}\LocalServer32 stats-com.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0CB19B1-7ADB-4999-B633-C8C1E74E20B8}\TypeLib\ = "{3F77A86C-2FB5-4743-984A-138B13294292}" stats-com.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03DBEE9A-62F2-4251-A167-73EC96DA12E6}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD2DDB7C-DD73-446F-BAE8-FA8D3AA7AEEE}\ = "DownloadItemModule Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C5441DB3-2A75-4190-948E-152AC6372EAB}\Programmable activation-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{03DBEE9A-62F2-4251-A167-73EC96DA12E6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F61DA78-EB43-4906-A703-3C4C3F581029} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD2DDB7C-DD73-446F-BAE8-FA8D3AA7AEEE}\TypeLib\ = "{336A1FBB-E907-46CB-9FC8-42DAB7C05E70}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A30780E-810C-4D09-814D-6A5901ADA2EB}\ = "ISaveUserDataStructLong" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0EF82CA-662B-4DC6-A4A4-33D2EE9AF558}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\pdfsamenhanced\URL Protocol msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{ACD2C44D-8C63-49D7-B67B-6EABA7DE271D}\ = "ContextMenuExt" MsiExec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{010EF49B-BF18-42C1-9A3C-2A25003D2BD6}\TypeLib activation-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1F61DA78-EB43-4906-A703-3C4C3F581029}\Version\ = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{083EC4E3-C4EC-4924-AF43-F1AFF83CE9F1}\Version regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A7E47C65-6558-4934-9EC3-4409F631DAF3}\AppID = "{77EC23C5-BB68-4A7B-AE5C-F4AD0B6C678D}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{314361EC-B6FB-4864-B8B4-5BE49FC3034F}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{401C4C68-DB13-4279-9B55-24D23326AF67}\TypeLib\ = "{CA4972A6-E83E-4C39-BFDB-01530BBCF20C}" MsiExec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DEC287C2-D3A0-4BCB-A8DB-B7BE3415C49A}\ = "ActivationBridge Class" activation-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D06CC382-A652-40EA-947A-A11E7A690F82}\ = "IMemberIdGetterBridge" activation-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF4A4C12-A2B5-442F-8F13-7E6109AFE3CE}\LocalServer32\ = "\"C:\\Program Files\\PDFsam Enhanced 7\\stats-com.exe\"" stats-com.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B9A7DB4F-2333-47B6-B9F5-C691B37D13DF}\TypeLib\ = "{336A1FBB-E907-46CB-9FC8-42DAB7C05E70}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E177E81C-DEE7-46F9-AD34-12D7F573C2A5}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E177E81C-DEE7-46F9-AD34-12D7F573C2A5}\TypeLib\ = "{336A1FBB-E907-46CB-9FC8-42DAB7C05E70}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66794D53-3665-411E-B8FA-7F9813A62E2B}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0084E94B-99A0-48F0-ACC8-3EBE184C5A7A}\TypeLib\ = "{336A1FBB-E907-46CB-9FC8-42DAB7C05E70}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC14DF98-EA87-4CDB-A4A2-E5C845917B88}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" activation-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{484B7414-E690-44FD-A410-CAB40C32237A}\ = "ISaveUserDataStruct" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E90C899-DD9A-4E66-817D-6C1974001B29}\LocalizedString = "@%programdata%\\PDFsam Enhanced 7\\Installation\\logs\\analytics.dll,-127" PDFsam_Enhanced_7_Installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFsamEnhanced7CreatorService.COMCreator.1\CLSID\ = "{313A6845-2D67-4602-B363-36565CD1947D}" creator-ws.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\4C69DD1AFDA2E7A4AAB89D6312605B35\SourceList\Net msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC14DF98-EA87-4CDB-A4A2-E5C845917B88}\TypeLib\ = "{64979026-A982-48BD-8862-E9A3D474618C}" activation-service.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF4A4C12-A2B5-442F-8F13-7E6109AFE3CE}\TypeLib\ = "{3F77A86C-2FB5-4743-984A-138B13294292}" stats-com.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\AAA083363870CB248B7074E1B00C9070\SourceList\Media msiexec.exe - Modifies system certificate store 2 TTPs 13 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b90f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e404000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c00000001000000040000000010000004000000010000001000000078f2fcaa601f2fb4ebc937ba532e7549030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 1900000001000000100000009f687581f7ef744ecfc12b9cee6238f10f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa2040000000100000010000000be954f16012122448ca8bc279602acf52000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410 PDFsamBasic7Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e PDFsamBasic7Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2 PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 0f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e0b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000006200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e1270090000000100000016000000301406082b0601050507030306082b06010505070308140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa22000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e2000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 PDFsamBasic7Installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\F40042E2E5F7E8EF8189FED15519AECE42C3BFA2\Blob = 5c000000010000000400000000100000040000000100000010000000be954f16012122448ca8bc279602acf5030000000100000014000000f40042e2e5f7e8ef8189fed15519aece42c3bfa21d0000000100000010000000e78921f81cea4d4105d2b5f4afae0c78140000000100000014000000c87ed26a852a1bca1998040727cf50104f68a8a2090000000100000016000000301406082b0601050507030306082b060105050703086200000001000000200000005367f20c7ade0e2bca790915056d086b720c33c1fa2a2661acf787e3292e12700b00000001000000800000004d006900630072006f0073006f006600740020004900640065006e007400690074007900200056006500720069006600690063006100740069006f006e00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003200300000000f000000010000003000000041ce925678dfe0ccaa8089263c242b897ca582089d14e5eb685fca967f36dbd334e97e81fd0e64815f851f914ade1a1e1900000001000000100000009f687581f7ef744ecfc12b9cee6238f12000000001000000d0050000308205cc308203b4a00302010202105498d2d1d45b1995481379c811c08799300d06092a864886f70d01010c05003077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f726974792032303230301e170d3230303431363138333631365a170d3435303431363138343434305a3077310b3009060355040613025553311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e314830460603550403133f4d6963726f736f6674204964656e7469747920566572696669636174696f6e20526f6f7420436572746966696361746520417574686f72697479203230323030820222300d06092a864886f70d01010105000382020f003082020a0282020100b3912a07830667fd9e9de0c7c0b7a4e642047f0fa6db5ffbd55ad745a0fb770bf080f3a66d5a4d7953d8a08684574520c7a254fbc7a2bf8ac76e35f3a215c42f4ee34a8596490dffbe99d814f6bc2707ee429b2bf50b9206e4fd691365a89172f29884eb833d0ee4d771124821cb0dedf64749b79bf9c9c717b6844fffb8ac9ad773674985e386bd3740d02586d4deb5c26d626ad5a978bc2d6f49f9e56c1414fd14c7d3651637decb6ebc5e298dfd629b152cd605e6b9893233a362c7d7d6526708c42ef4562b9e0b87cceca7b4a6aaeb05cd1957a53a0b04271c91679e2d622d2f1ebedac020cb0419ca33fb89be98e272a07235be79e19c836fe46d176f90f33d008675388ed0e0499abbdbd3f830cad55788684d72d3bf6d7f71d8fdbd0dae926448b75b6f7926b5cd9b952184d1ef0f323d7b578cf345074c7ce05e180e35768b6d9ecb3674ab05f8e0735d3256946797250ac6353d9497e7c1448b80fdc1f8f47419e530f606fb21573e061c8b6b158627497b8293ca59e87547e83f38f4c75379a0b6b4e25c51efbd5f38c113e6780c955a2ec5405928cc0f24c0ecba0977239938a6b61cdac7ba20b6d737d87f37af08e33b71db6e731b7d9972b0e486335974b516007b506dc68613dafdc439823d24009a60daba94c005512c34ac50991387bbb30580b24d30025cb826835db46373efae23954f6028be37d55ba50203010001a3543052300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414c87ed26a852a1bca1998040727cf50104f68a8a2301006092b06010401823715010403020100300d06092a864886f70d01010c05000382020100af6adde619e72d9443194ecbe9509564a50391028be236803b15a252c21619b66a5a5d744330f49bff607409b1211e90166dc5248f5c668863f44fcc7df2124c40108b019fdaa9c8aef2951bcf9d05eb493e74a0685be5562c651c827e53da56d94617799245c4103608522917cb2fa6f27ed469248a1e8fb0730dcc1c4aabb2aaeda79163016422a832b87e3228b367732d91b4dc31010bf7470aa6f1d74aed5660c42c08a37b40b0bc74275287d6be88dd378a896e67881df5c95da0feb6ab3a80d71a973c173622411eac4dd583e63c38bd4f30e954a9d3b604c3327661bbb018c52b18b3c080d5b795b05e514d22fcec58aae8d894b4a52eed92dee7187c2157dd5563f7bf6dcd1fd2a6772870c7e25b3a5b08d25b4ec80096b3e18336af860a655c74f6eaec7a6a74a0f04beeef94a3ac50f287edd73a3083c9fb7d57bee5e3f841cae564aeb3a3ec58ec859accefb9eaf35618b95c739aafc577178359db371a187254a541d2b62375a3439ae5777c9679b7418dbfecdc80a09fd17775585f3513e0251a670b7dce25fa070ae46121d8d41ce507c63699f496d0c615fe4ecdd7ae8b9ddb16fd04c692bdd488e6a9a3aabbf764383b5fcc0cd035be741903a6c5aa4ca26136823e1df32bbc975ddb4b783b2df53bef6023e8f5ec0b233695af9866bf53d37bb8694a2a966669c494c6f45f6eac98788880065ca2b2eda2 PDFsamBasic7Installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1 PDFsamBasic7Installer.exe - Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 3720 sam.exe 2312 sam.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 5612 msiexec.exe 5612 msiexec.exe 3720 sam.exe 3720 sam.exe 5612 msiexec.exe 5612 msiexec.exe 4976 msedge.exe 4976 msedge.exe 1144 sam.exe 1144 sam.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 5648 activation-service.exe 5648 activation-service.exe 5648 activation-service.exe 5648 activation-service.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 2312 sam.exe 2312 sam.exe 1864 sam.exe 1864 sam.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5148 PDFsamBasic7Installer.exe Token: SeIncreaseQuotaPrivilege 5148 PDFsamBasic7Installer.exe Token: SeSecurityPrivilege 5612 msiexec.exe Token: SeCreateTokenPrivilege 5148 PDFsamBasic7Installer.exe Token: SeAssignPrimaryTokenPrivilege 5148 PDFsamBasic7Installer.exe Token: SeLockMemoryPrivilege 5148 PDFsamBasic7Installer.exe Token: SeIncreaseQuotaPrivilege 5148 PDFsamBasic7Installer.exe Token: SeMachineAccountPrivilege 5148 PDFsamBasic7Installer.exe Token: SeTcbPrivilege 5148 PDFsamBasic7Installer.exe Token: SeSecurityPrivilege 5148 PDFsamBasic7Installer.exe Token: SeTakeOwnershipPrivilege 5148 PDFsamBasic7Installer.exe Token: SeLoadDriverPrivilege 5148 PDFsamBasic7Installer.exe Token: SeSystemProfilePrivilege 5148 PDFsamBasic7Installer.exe Token: SeSystemtimePrivilege 5148 PDFsamBasic7Installer.exe Token: SeProfSingleProcessPrivilege 5148 PDFsamBasic7Installer.exe Token: SeIncBasePriorityPrivilege 5148 PDFsamBasic7Installer.exe Token: SeCreatePagefilePrivilege 5148 PDFsamBasic7Installer.exe Token: SeCreatePermanentPrivilege 5148 PDFsamBasic7Installer.exe Token: SeBackupPrivilege 5148 PDFsamBasic7Installer.exe Token: SeRestorePrivilege 5148 PDFsamBasic7Installer.exe Token: SeShutdownPrivilege 5148 PDFsamBasic7Installer.exe Token: SeDebugPrivilege 5148 PDFsamBasic7Installer.exe Token: SeAuditPrivilege 5148 PDFsamBasic7Installer.exe Token: SeSystemEnvironmentPrivilege 5148 PDFsamBasic7Installer.exe Token: SeChangeNotifyPrivilege 5148 PDFsamBasic7Installer.exe Token: SeRemoteShutdownPrivilege 5148 PDFsamBasic7Installer.exe Token: SeUndockPrivilege 5148 PDFsamBasic7Installer.exe Token: SeSyncAgentPrivilege 5148 PDFsamBasic7Installer.exe Token: SeEnableDelegationPrivilege 5148 PDFsamBasic7Installer.exe Token: SeManageVolumePrivilege 5148 PDFsamBasic7Installer.exe Token: SeImpersonatePrivilege 5148 PDFsamBasic7Installer.exe Token: SeCreateGlobalPrivilege 5148 PDFsamBasic7Installer.exe Token: SeBackupPrivilege 5684 vssvc.exe Token: SeRestorePrivilege 5684 vssvc.exe Token: SeAuditPrivilege 5684 vssvc.exe Token: SeBackupPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeBackupPrivilege 5972 srtasks.exe Token: SeRestorePrivilege 5972 srtasks.exe Token: SeSecurityPrivilege 5972 srtasks.exe Token: SeTakeOwnershipPrivilege 5972 srtasks.exe Token: SeBackupPrivilege 5972 srtasks.exe Token: SeRestorePrivilege 5972 srtasks.exe Token: SeSecurityPrivilege 5972 srtasks.exe Token: SeTakeOwnershipPrivilege 5972 srtasks.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeLoadDriverPrivilege 5492 printer-installer-app.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe Token: SeRestorePrivilege 5612 msiexec.exe Token: SeTakeOwnershipPrivilege 5612 msiexec.exe - Suspicious use of FindShellTrayWindow 47 IoCs
pid Process 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe - Suspicious use of SendNotifyMessage 35 IoCs
pid Process 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 1080 msedge.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe - Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 1556 PDFsamBasic7Installer.exe 5148 PDFsamBasic7Installer.exe 5652 PDFsam_Enhanced_7_Installer.exe 3720 sam.exe 2312 sam.exe 2312 sam.exe 2312 sam.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 3340 1080 msedge.exe 85 PID 1080 wrote to memory of 4168 1080 msedge.exe 86 PID 1080 wrote to memory of 664 1080 msedge.exe 87 PID 1080 wrote to memory of 664 1080 msedge.exe 87 PID 1080 wrote to memory of 664 1080 msedge.exe 87 PID 1080 wrote to memory of 3668 1080 msedge.exe 88 PID 1080 wrote to memory of 3668 1080 msedge.exe 88 PID 1080 wrote to memory of 3272 1080 msedge.exe 90 PID 1080 wrote to memory of 3272 1080 msedge.exe 90 PID 1080 wrote to memory of 3272 1080 msedge.exe 90 PID 1080 wrote to memory of 964 1080 msedge.exe 91 PID 1080 wrote to memory of 964 1080 msedge.exe 91 PID 1080 wrote to memory of 964 1080 msedge.exe 91 PID 1080 wrote to memory of 1636 1080 msedge.exe 92 PID 1080 wrote to memory of 1636 1080 msedge.exe 92 PID 1080 wrote to memory of 1636 1080 msedge.exe 92 PID 1080 wrote to memory of 3796 1080 msedge.exe 93 PID 1080 wrote to memory of 3796 1080 msedge.exe 93 PID 1080 wrote to memory of 3796 1080 msedge.exe 93 PID 1080 wrote to memory of 3624 1080 msedge.exe 97 PID 1080 wrote to memory of 3640 1080 msedge.exe 98 PID 1080 wrote to memory of 3624 1080 msedge.exe 97 PID 1080 wrote to memory of 3640 1080 msedge.exe 98 PID 1080 wrote to memory of 2604 1080 msedge.exe 99 PID 1080 wrote to memory of 2604 1080 msedge.exe 99 PID 1080 wrote to memory of 3060 1080 msedge.exe 100 PID 1080 wrote to memory of 2604 1080 msedge.exe 99 PID 1080 wrote to memory of 3060 1080 msedge.exe 100 PID 1080 wrote to memory of 1860 1080 msedge.exe 102 PID 1080 wrote to memory of 4524 1080 msedge.exe 103 PID 1080 wrote to memory of 1556 1080 msedge.exe 110 PID 1080 wrote to memory of 892 1080 msedge.exe 120 PID 1080 wrote to memory of 4128 1080 msedge.exe 121 PID 1080 wrote to memory of 3564 1080 msedge.exe 122 PID 1080 wrote to memory of 5148 1080 msedge.exe 123 PID 5148 wrote to memory of 5308 5148 PDFsamBasic7Installer.exe 125 PID 5148 wrote to memory of 5652 5148 PDFsamBasic7Installer.exe 128 PID 1080 wrote to memory of 6060 1080 msedge.exe 130 PID 1080 wrote to memory of 6060 1080 msedge.exe 130 PID 5612 wrote to memory of 5972 5612 msiexec.exe 137 PID 5612 wrote to memory of 6140 5612 msiexec.exe 139 PID 5612 wrote to memory of 5648 5612 msiexec.exe 140 PID 5612 wrote to memory of 2064 5612 msiexec.exe 141 PID 5612 wrote to memory of 5104 5612 msiexec.exe 142 PID 5612 wrote to memory of 5492 5612 msiexec.exe 143 PID 5612 wrote to memory of 5504 5612 msiexec.exe 150 PID 5612 wrote to memory of 3020 5612 msiexec.exe 151 PID 5612 wrote to memory of 5236 5612 msiexec.exe 152 PID 5612 wrote to memory of 5564 5612 msiexec.exe 153 PID 5612 wrote to memory of 5572 5612 msiexec.exe 154 PID 5612 wrote to memory of 1156 5612 msiexec.exe 157 PID 5612 wrote to memory of 6004 5612 msiexec.exe 158 PID 5612 wrote to memory of 3408 5612 msiexec.exe 160 PID 5612 wrote to memory of 5756 5612 msiexec.exe 161 PID 4140 wrote to memory of 3720 4140 sam-launcher.exe 165 PID 5648 wrote to memory of 4336 5648 activation-service.exe 167 PID 1080 wrote to memory of 4976 1080 msedge.exe 170 PID 5148 wrote to memory of 3876 5148 PDFsamBasic7Installer.exe 172 PID 3876 wrote to memory of 5516 3876 msedge.exe 173 PID 1080 wrote to memory of 5580 1080 msedge.exe 174 PID 1080 wrote to memory of 5580 1080 msedge.exe 174 PID 1080 wrote to memory of 5580 1080 msedge.exe 174 PID 5648 wrote to memory of 4336 5648 activation-service.exe 177 PID 1080 wrote to memory of 5272 1080 msedge.exe 185 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://download7.pdfsam.org/get-app.aspx?configld=DECC253B-6466-450B-B829-296A7FBAB00A&uid=1007261&cmp=PDFsam_Basic&ref=pdfsam.org/in-app&wid=68481⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff8ea0ac188,0x7ff8ea0ac194,0x7ff8ea0ac1a02⤵PID:3340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,16265203977000682691,4900064703968370967,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:32⤵
- System Time Discovery
PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,11849953745806694279,12180166901302256107,262144 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:22⤵PID:664
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,10145785031357728523,17026755908608342218,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:82⤵PID:3668
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,8181915675802479735,2818762866251484495,2097152 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:3272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,8783212902437436578,10812853432651746929,2097152 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,681831548876418853,8182817422280141731,2097152 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:12⤵PID:1636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,14350204820214543638,8227903475206475555,2097152 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:22⤵PID:3796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,4060552583671545239,9973737649781808127,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:82⤵PID:3624
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,7667941080003428493,1953985735966371220,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:3640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5720,i,13895455284018394521,9698638711996055057,2097152 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:12⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,12612550999853194287,11043608896485095461,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:82⤵PID:3060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,15514478608064890676,4847638371268742320,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:82⤵PID:3952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,15514478608064890676,4847638371268742320,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:82⤵PID:1860
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,7043070797787371197,16112267356302954394,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:82⤵PID:4524
-
-
C:\Users\Admin\Downloads\PDFsamBasic7Installer.exe"C:\Users\Admin\Downloads\PDFsamBasic7Installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1556
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,18087387967397890667,16209181253753728191,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:82⤵PID:892
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,34845128568931533,4839529388544168723,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:82⤵PID:4128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,2942925022114683131,5236261725266725276,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:82⤵PID:3564
-
-
C:\Users\Admin\Downloads\PDFsamBasic7Installer.exe"C:\Users\Admin\Downloads\PDFsamBasic7Installer.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5148 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\ProgramData\PDFsam Enhanced 7\Installation\analytics.dll"3⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5308
-
-
C:\ProgramData\PDFsam Enhanced 7\Installation\PDFsam_Enhanced_7_Installer.exe"C:\ProgramData\PDFsam Enhanced 7\Installation\PDFsam_Enhanced_7_Installer.exe" /regserver3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://paygw.pdfsam.org/redirect/install/PDFsam%20Enhanced%207/?lang=en&configld=decc253b-6466-450b-b829-296a7fbab00a&uid=1007261&cmp=pdfsam_basic&ref=pdfsam.org/in-app&wid=6848&version=7.0.70.15196&configId=11590878-6C42-43CF-BED5-F3BA3A011783&guid=6E4B9E71-F0FD-4923-BE03-5DEB6AF0ED1E3⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://paygw.pdfsam.org/redirect/install/PDFsam%20Enhanced%207/?lang=en&configld=decc253b-6466-450b-b829-296a7fbab00a&uid=1007261&cmp=pdfsam_basic&ref=pdfsam.org/in-app&wid=6848&version=7.0.70.15196&configId=11590878-6C42-43CF-BED5-F3BA3A011783&guid=6E4B9E71-F0FD-4923-BE03-5DEB6AF0ED1E4⤵PID:5516
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,15888606740480816151,14075863363181284285,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:82⤵PID:6060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3620,i,5887918712131172146,3250028418890115199,262144 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4976
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6236,i,543508991352561161,12697220012974838389,2097152 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:12⤵PID:5580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,18222161095341587701,17708326851299473586,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:82⤵PID:5272
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,15530461006089674790,396562482813765422,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:82⤵PID:4320
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,10064279224669843256,1230600505579164743,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:82⤵PID:4192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4376,i,15524584610630527498,14510534183904266010,2097152 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:12⤵PID:512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7016,i,4091249538214050658,16107801133495455809,2097152 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:12⤵PID:1060
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,17843786890601764461,17877403402261123223,524288 --field-trial-handle=2288,i,18312419181612901143,17961797106094186323,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:82⤵PID:1992
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:4140
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{77EC23C5-BB68-4A7B-AE5C-F4AD0B6C678D}1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5452
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5612 -
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
PID:5972
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2CFEA56B6F7065C3F4AAF602386F24762⤵
- Loads dropped DLL
PID:6140
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\PDFsam Enhanced 7\preview-handler.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5648
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\PDFsam Enhanced 7\thumbnail-handler.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:2064
-
-
C:\Windows\System32\MsiExec.exe"C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\PDFsam Enhanced 7\context-menu.dll"2⤵
- Loads dropped DLL
- Modifies registry class
PID:5104
-
-
C:\Program Files\PDFsam Enhanced 7\printer-installer-app.exe"C:\Program Files\PDFsam Enhanced 7\printer-installer-app.exe" -i "C:\Program Files\PDFsam Enhanced 7\"2⤵
- Boot or Logon Autostart Execution: Port Monitors
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5492
-
-
C:\Program Files\PDFsam Enhanced 7\creator-app.exe"C:\Program Files\PDFsam Enhanced 7\creator-app.exe" -regserver2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5504
-
-
C:\Program Files\PDFsam Enhanced 7\creator-ws.exe"C:\Program Files\PDFsam Enhanced 7\creator-ws.exe" -service2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:3020
-
-
C:\Program Files\PDFsam Enhanced 7\activation-service.exe"C:\Program Files\PDFsam Enhanced 7\activation-service.exe" -service2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:5236
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 340AB2425B52C5D0E0006FE6974083A0 E Global\MSI00002⤵
- Loads dropped DLL
PID:5564
-
-
C:\Program Files\PDFsam Enhanced 7\sam.exe"C:\Program Files\PDFsam Enhanced 7\sam.exe" --command --add-scheduler2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5572
-
-
C:\Program Files\PDFsam Enhanced 7\update-service.exe"C:\Program Files\PDFsam Enhanced 7\update-service.exe" -service2⤵
- Executes dropped EXE
- Modifies registry class
PID:1156
-
-
C:\Program Files\PDFsam Enhanced 7\stats-com.exe"C:\Program Files\PDFsam Enhanced 7\stats-com.exe" -RegServer2⤵
- Executes dropped EXE
- Modifies registry class
PID:6004
-
-
C:\Program Files\PDFsam Enhanced 7\sam-launcher.exe"C:\Program Files\PDFsam Enhanced 7\sam-launcher.exe" --add-scheduler2⤵
- Executes dropped EXE
PID:3408
-
-
C:\Program Files\PDFsam Enhanced 7\sam.exe"C:\Program Files\PDFsam Enhanced 7\sam.exe" --command --associate2⤵
- Executes dropped EXE
PID:5756
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5684
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Loads dropped DLL
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:1056
-
C:\Program Files\PDFsam Enhanced 7\activation-service.exe"C:\Program Files\PDFsam Enhanced 7\activation-service.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Program Files\PDFsam Enhanced 7\sam-launcher.exe"C:\Program Files\PDFsam Enhanced 7\sam-launcher.exe" --check-notifications2⤵
- Executes dropped EXE
PID:4336
-
-
C:\Program Files\PDFsam Enhanced 7\sam.exe"C:\Program Files\PDFsam Enhanced 7\sam.exe" --command --shutdown-apps --shutdown-handles "000000000005026A" --shutdown-care --shutdown-timeout 100002⤵
- Executes dropped EXE
PID:4336
-
-
C:\Program Files\PDFsam Enhanced 7\creator-ws.exe"C:\Program Files\PDFsam Enhanced 7\creator-ws.exe"1⤵
- Executes dropped EXE
PID:4568
-
C:\Program Files\PDFsam Enhanced 7\sam-launcher.exe"C:\Program Files\PDFsam Enhanced 7\sam-launcher.exe"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Program Files\PDFsam Enhanced 7\sam.exe"C:\Program Files\PDFsam Enhanced 7\sam.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3720
-
-
C:\Program Files\PDFsam Enhanced 7\update-service.exe"C:\Program Files\PDFsam Enhanced 7\update-service.exe"1⤵
- Executes dropped EXE
PID:1264
-
C:\Program Files\PDFsam Enhanced 7\sam.exe"C:\Program Files\PDFsam Enhanced 7\sam.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1144
-
C:\Program Files\PDFsam Enhanced 7\sam.exe"C:\Program Files\PDFsam Enhanced 7\sam.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2312 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe" "https://oauth.pdfsam.org/api/external/login/facebook?state=f687ebe1a5524a59880a48df2913bf1a&lang=en&source=PDFsam Enhanced 7&formId=PDFsamEnhanced7-APP&cmp=pdfsam_basic&configld=decc253b-6466-450b-b829-296a7fbab00a&ref=pdfsam.org/in-app&trial=false&trial-days=0&uid=1007261&wid=6848"2⤵PID:2972
-
-
C:\Program Files\PDFsam Enhanced 7\stats-com.exe"C:\Program Files\PDFsam Enhanced 7\stats-com.exe" -Embedding1⤵
- Executes dropped EXE
PID:564
-
C:\Program Files\PDFsam Enhanced 7\sam.exe"C:\Program Files\PDFsam Enhanced 7\sam.exe"1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1864
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5300
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://oauth.pdfsam.org/api/external/login/facebook?state=f687ebe1a5524a59880a48df2913bf1a&lang=en&source=PDFsam Enhanced 7&formId=PDFsamEnhanced7-APP&cmp=pdfsam_basic&configld=decc253b-6466-450b-b829-296a7fbab00a&ref=pdfsam.org/in-app&trial=false&trial-days2⤵PID:4628
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://oauth.pdfsam.org/api/external/login/facebook?state=f687ebe1a5524a59880a48df2913bf1a&lang=en&source=PDFsam Enhanced 7&formId=PDFsamEnhanced7-APP&cmp=pdfsam_basic&configld=decc253b-6466-450b-b829-296a7fbab00a&ref=pdfsam.org/in-app&trial=false&trial-days3⤵PID:4236
-
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Port Monitors
1Event Triggered Execution
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Port Monitors
1Event Triggered Execution
1Component Object Model Hijacking
1Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e59c8d7.rbs
- Size 58KB
- SHA256 990b5dfa181af85bd623888c3d84c19370f4d65efa99081a5d54d261ec077825
- MD5 44d1e580230e74937592ac51e6fa44c1
- SHA1 94f2bd84bc759791b974c121cf828d3cbbae8b71
- SHA512 e0e5f2fdbe9ba0530ad54ce326e230ebc124ca9f99fa789aac51489d31e256d4f04c2f476402dde4ae763199e84e4c2f88b977f8e1cb8f6d0a64da0dc3f5c8d6
- SSDEEP 1536:SvmMJmf3ksnG0EhBiVCJo93jG6wpdlcDRv7v0vsUtHG+JGfgiNH2LaA8GXlCWF+n:nvQY
- TLSH T18D43BE528A05C3D1F4A756B1AB82692E1795C886830893C713CCC76F9DCA7E06FFD1B9
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Config.Msi\e59c8dc.rbs
- Size 46KB
- SHA256 af8d52356d83e2528f76e2801a3dee002e49d1ad01a232119293879ea9a4f793
- MD5 397008bf1b577fcbe7b6f130d15b4625
- SHA1 9532fe6284d109345910991ed59a812423aabd60
- SHA512 a2ff04b390223760fb0a8891e9f5872cfc0a1dedb8ac2b6739d5e694a03b61e5b1c50d54b1ebbea8f3daf10f08068338e776758de961fa16c7b64d047afa23ec
- SSDEEP 768:4Pb0zyqmGel/e59edTfCG9PvESxRFBHigYNUbPbU/kjzqJ/:eb0zyqmGel/e59edTfCG9PvESxRFBHDc
- TLSH T1CF23F7119B15C3E0F09751F06BC1A82E0300CA4FD71C62D6578C975FACAD7A8BAF96B5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\MSVCP140.dll
- Size 603KB
- SHA256 f87819ae8c6f7c90d3237a1abb9809e8cba9dcd0c80ac3f0969a5e68ef652ca4
- MD5 a1d30ef2114e18e26e2bb96555be81bf
- SHA1 a5e3e5a5910dd0781caf0a9f58dd7b519de8c927
- SHA512 5c5bdae87327b3fb724844087257a0ba0e7ad31c194ab5f632845e8f09633f63982817ca551d1735523b1a65763efa3c2ddc8789b3bf23324d7882456e3aa6f2
- SSDEEP 12288:ttc7Tg4ObbZu3JZfzeUQEKZm+jWodEEVTMj:U7Tg4+Zu3jJQEKZm+jWodEEVMj
- TLSH T13AD40927BB5905B0E162E3B891C38715D7F1BC054322A3C782A7E66D2F673D4A73B660
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\VCRUNTIME140.dll
- Size 87KB
- SHA256 61832990e364dca5bfa2c61d930f00acaae6d1aaa3130392403455ae9a1125a5
- MD5 23105a395b807d9335219958b4d0cec1
- SHA1 fb60050d82e3bc1be3b10877b9355f5d48e04854
- SHA512 ef91d19e632d0d146fa68d52beb04ffcb9b972079cd9c255f44ea5201637a8b00907ec8e3358c7b5cc37338470e29e43dbaec7ddc0562810b49ab2e8115cc805
- SSDEEP 1536:fTSVLL1/VfZPtsO6nBy0r8Z3j5X7K0d4HIH8d2//zoXnf7toecbNCOAS7Z:fW/tB8n8F4i/LoXfeecbNCA
- TLSH T184937C5976A442B6E16AC134C0F29E5BFA32B580873043CF03B956AD0F67BE05F3D666
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\atom.dll
- Size 78KB
- SHA256 39f7df4d94318f36ab63018a47915ba7d13d8310aaf4027ac700e76194805336
- MD5 06ca905e008fe886cba234cb04c567ae
- SHA1 93815423846a78486ac65e9107728af9ec42605d
- SHA512 ff71f447e0d8472fc3cd9b31f895f3bf1aa7f722b353a627200de21e6b2f855c2bd6d7f665fc5899209974227e1ad1fece6a01be29d1de319486e177120eb98b
- SSDEEP 1536:a/jMVTl1KYpqJ5dOuaTWBd6b9+GohhovtS4x0ntzswNw4N:a/jgTtpmTOvTSwb9uhhovtS4+t3N
- TLSH T10B736B5B77580099D0A6A038D5E38B07EAB2B9824B11DBDF0390833E4F5B7E15DBD293
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\context-menu.dll
- Size 1.4MB
- SHA256 86c78e09079b9f3af25070db52134e319c551c3c3d247eb8992bc7e33ede6f96
- MD5 c8fab205d36400cf6b49c1897ef453ca
- SHA1 922209a66f6a0a2176b6f298a4fab14ea552b91f
- SHA512 873b5556fb363e56029208fc60cd955d6d877e734b16f1ad515bf629abe833a238534bcca198da46e7bcdfb790806fd17bf23a6eff177f5e058fbf127117ed2a
- SSDEEP 24576:rPp8Vk0I504Neepbh4YKJnjKI58cUNdzW7UdGo+gozeV8iVF:Lp8VP2eepmJnjwNZsUco+gozXiX
- TLSH T127657B1A7268417CE0AAD078C9578E0AE7B13C4743719BDF02A85A6B2F777F15A7E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\encoding-conversion.dll
- Size 28KB
- SHA256 249e70a3bf203692e2212ede45fdefecafaede7ab9fa6cefcf02a65f0e14cbe7
- MD5 b0f21ea663476cbf02a93b8de7152586
- SHA1 b6253d151a6d88ecf7029e79bbe4737792dfa79d
- SHA512 59fcddc5b4a87efca72a9a7c1252701c57ba65c656958d9c0a5557c3ffd049fcfeb10d6ddfeca8e33171cd269c03bb19ecbb5e7e9a25e664e1b26c81211db1c1
- SSDEEP 384:FibcYRa//wXJg3s4h+hh0cTGfZihL0cTGfZVhm:jCLOph+hhTwiNTwVhm
- TLSH T112D23A899E512C82FD438D3061C58A16EE74B642BFE292EF1768C0641FC37D226B957F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\pdfcore.dll
- Size 9.3MB
- SHA256 5c91843af1cc98459d0adbe99af6a29dc17ad7cc7d3fcbe93360fcd965eafcbc
- MD5 a02f6f2c3825ce57153d16f6e7412093
- SHA1 a205d95defce3bcd7f367a5758a0dc88e6ff4770
- SHA512 84ee4cd11f3de740128f1f3c7e87b7ee0b6cb71fa4d56831d1d9e092ff5da3ba4165b8241bc649ac0a468cc7014143710f41cbea122145736cc2239e73e07759
- SSDEEP 98304:jv+rZWUvudK1tBa4bqtJQcEY7gD9RIRP9ei1FE3c2xrTHpK0HNX:jEZWeuCa4WtJ/EY0D9R0P9M3c2ZtX
- TLSH T127A69E86B19500E5D4EAC1B9CA679917E7B1344907F0CBEB1690CAF65F23BF07A7A700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\pdfgraphics.dll
- Size 1.8MB
- SHA256 48ffa744f336dc04e0966c2484e9d1d5551e1779f5d06a506b6a5f513ecae788
- MD5 fe483075c91dd099e97cb5b9a1a6730f
- SHA1 443a4a49a1ebb3a049f84811632edf3b00b0b742
- SHA512 5160041ba14d4628d66080e0663d0130177c5f9382fca74811dc8120c120ec34d3aeb170246426e6e711815c435184a070bc6f5c548817c4b5b23fdcc94cf820
- SSDEEP 24576:f5kmkWhgQZAozi7i3pItUsMywvKWEWGy3ZVbLeiEcChDLLykNLBhZxGhEytEyWIW:f5kmkWhgQZpafmhEWEAK8dO
- TLSH T1BA956EC7729850E0C05B827CEE9BDE4BEAB138599F71D2CF19D0C2991E633E159BA710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\pdfview.dll
- Size 474KB
- SHA256 9018a236f0dbdb85c9e5d5f1a051b2760fffc31290bb1b8e8f302e7768d3fdaa
- MD5 8e9a0f0541756c39764a8ed02e83e273
- SHA1 596ee4d376631ec964358fd6d0f08291d4905cc4
- SHA512 a465c227bffb919882d52dd11285ff3bc0fa84a97e48cee1e63c5dafa7e7d776cb49509061d55f5bff0dec0e8959892d4a32a879fc0ecef439855884967a8945
- SSDEEP 6144:JJHjJavTf2bJMtxR/p36bUSxzPxCOCsnTTESHQaNHjvOtxBo7z:JJD8rObUWzxCCTINtUH
- TLSH T19EA47C6AB26448F6E067D13985A78607F7B234050771C7CF02A4D2BE6F277E19A3E325
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\preview-handler.dll
- Size 873KB
- SHA256 8166acc69137f37abe03ebc55969111ac02862a952a01c44edd8ef7466006669
- MD5 3823743b3c533c80d0de366425323de1
- SHA1 7be88837693277d625dfc95e18347eb83ee6ce6a
- SHA512 38f28beb5b046bd59fff2d0af75aaa9ef34cd1f3f230f342791006be2d72c588577e1554f2c071219fb54ea7098185aed707dc5fbdd9ef8f41c0d09faa6e8003
- SSDEEP 24576:y75Al6xecZY0Nw1C9jxC6OEBHELuRz2hYIKlx:y75j8wnwMvOokLuRz/
- TLSH T10C156C1AB6AC40B5E0A7E179C8978506E7F27883533157DF12A4076E6F6BBF11A3E310
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\printer-installer-app.exe
- Size 244KB
- SHA256 16c515079bc11db077815b0e75f66604497412f5b8602739fe64a7a8d90cf46b
- MD5 fc2f64bd97760e3682cbbb7a6d3f5863
- SHA1 bcb52a805976389b3d3a80d6b299bc5c5b53d010
- SHA512 d480ebba5fcbc8c430f2aac632b1c80f63c8775a80d6a14b92a9a5fa8568a4af24cea97e977eea7dd99a4d2613f79c7f890bd9ae58e702287b626d25e1801aae
- SSDEEP 3072:rVsKzkQ31IKYmpWt9zS3jkLBlzEpBE8kAuc7kb4Sx4z0uAK6mM8veW:J9zkaIKxWzS3jkLBpEpBl7iULAK63W
- TLSH T1CD34281B7A6848E9D1A7D1BCDA828906F77278128750EBCF53A0437A4F577D4ED3E220
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\printer-installer.dll
- Size 11.9MB
- SHA256 3be78f411dffdbd0e6a8a1226e136150e0601ecaf7b72eb7f1325a32bfeee23e
- MD5 0307a98db360eaf3ade3c1c72a469017
- SHA1 de63bcf5a7140eff434a87dd6417fda17fc4dd29
- SHA512 8a9146cbc51c3406dacee6f4191b68e271697233e8387d2d5430a9c15d0c5830a6cca75e0e1b6812af97ec8f6d79af5ab2b2e762a132337fc92137e378c787f7
- SSDEEP 196608:RxYlMG3+Vm8LP6LQCTCWbXBftzNVtglpq:y38bEhbXBVtj
- TLSH T1AAC66C2537BC0294F8B796788ABB8B09E5727C754724F7CF1250535A2F2BBE0493A724
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\thumbnail-handler.dll
- Size 400KB
- SHA256 a2eadea0671cfd07cb10b351ed4960188f387de7c8d7adbb4de3710d97625696
- MD5 df5c03f8846d817952ab271080194229
- SHA1 cfebceaf656d9184eec173650d7e5586b1fdc7b9
- SHA512 fefea3d3788561c84630c4175a5d364ce4ae782598218ac67cf68964a16914a123e393207fae57efe351b6e76cfedcc59a5fa3c1ae3c1d8e9674d574619a0df5
- SSDEEP 6144:0q5+uq4tEZinimCJR9/PAazU/qRsoh23Z8rFMql:3qAEZinilr9/LG9onD
- TLSH T19C947C19FF9808B5E077D13888734A05E6723C8A47B096EF23A8465A5F33FE0597E761
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\ui-document-panel-properties.dll
- Size 2.5MB
- SHA256 be36bcd10555ca5d28696708903aa39b227e892c2926b17769a62943a12fd15d
- MD5 81d7f5a73f3f061781b55690489fe2fc
- SHA1 7da0522afb2622d8af97f4e920839e7332698e64
- SHA512 deaa63d4bc13d737f7360b1b942c65a337e95c2ad5d0a12a34b97c7a2b30c0e64415d88876996c10383ac397c8aff1a71c94dd806f019a760e0ede80c8ae2c12
- SSDEEP 24576:5uN0vY40XGPZwdSO7sh1arGrO1U3UQfgMsyKR2HI14sL3T95rI/Ietz4py2O2WCm:wi0OwdSO7sh1xrsyTHI14sL3ZYCm
- TLSH T168C53B1677E94091C39AC23C8AA7C80AE77178654375A3EF26D0871E2F97FE069BD710
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\PDFsam Enhanced 7\vcruntime140_1.dll
- Size 43KB
- SHA256 6cc4315daceb0522816c60678344466cb452426267f70c7faae925361674e774
- MD5 9040ed0fdf4ce7558cbffb73d4c17761
- SHA1 669c8380959984cc62b05535c18836f815308362
- SHA512 303143006c781260540e9d0d3739acc33f2d54f884358c7485599dd22b87cce9b81f68d6ad80f0f5bb1798ce54a79677152c1d3600e443e192aecd442ea0a2e4
- SSDEEP 768:vG3xRsJTKdiibUoT2zvivbXXyJWqWZ8DZX:vG7DyM22DiJMCtX
- TLSH T10B136B89977C8086E4A799B0C0A2DE17FE3CF6D15650928F0EA4915D2FA37D0A73C31E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFsam Enhanced 7.lnk
- Size 1KB
- SHA256 85be94bf35ba4bb040f55e1382137589ad68561fb71fbd8493a0eb1a71f9f841
- MD5 06ecb59aee628dd06f1f50393e8f0d53
- SHA1 07607460a093cb8a78a1669e24853911a58b65c5
- SHA512 2d1249993456e105f328fe25cc81793245bf192033bdd71d8d2b208bf09292f266cc9aed43aeff77e7fb0c9bdf6182d1e9a9f8d59c932a16a783082a8f8edd37
- TLSH T18A21ED300ADE1B19F77786773D312322CB2A7D17DAB44B6D408C61891C64B008DADF76
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFsam Enhanced 7.lnk~RFe59ec5a.TMP
- Size 1KB
- SHA256 5403a04845eb62f62ffcd436037f54c49851c163b1329aef78c889f1d82e4406
- MD5 543717cbb021cfa071a23753d5793fd5
- SHA1 5599deb59b7109ba1b76575886cc8c51e9e12c4a
- SHA512 5521589d6ee72585a3ff81c08eea77b8f5bf1039a2d0f89c210874a51707bbc5cccb7c343ff459e60ff4e8ca11375e0b46a226b60e62461f59dbe24a56c39689
- TLSH T15511CC301ADA1B19E77346763D312321CB3ABE13DAA44B694088A18A08647008DADF76
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~DFsam Enhanced 7.tmp
- Size 1KB
- SHA256 9aab001eb45427eb691092720ab5041c19084de075198df948e2bdb63de33e7b
- MD5 9f46e6b10a55dc470b5536670e217ea6
- SHA1 6861d0e33dc18a399dce23425daee8b1de0c7bf7
- SHA512 35244eb328df3a50e143a516d9d5f16a98258213c97106e1f44fc4cdd3ce5165e089ef729fadf64cf28be8315a89935b0413ab1e18d54d06ac80cee3b5f09937
- TLSH T11D21DC300ADE5B19F77746763D316322CB3A7D13DAB84B6D408C918A1D647008DADF7A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\PDFsam Enhanced 7\Installation\PDFsam_Enhanced_7_Installer.exe
- Size 15.0MB
- SHA256 90fd8ba7a11fb5ca838408c8b4c097695605d68e2907cbc63ed1f7098542c558
- MD5 89aff8cc6ed2cef3c4806329f8ed6fea
- SHA1 ef2748659f847d5600bca1f3fc7a43c97fed15cf
- SHA512 4d5f36b047295095322a487aafe6148fa2398c47765fa704a942f6a9dc4691f8323f3851671332b958b5ad86dacf087f5c5ff980375cb9e5763ff73c7f0d5e9b
- SSDEEP 196608:rFhdyugSGUN8CE8aRKXsOBHvbqmH4aQBBPezpsjeMGHxrqNBkjLR2M2RbJ//:rFh6YDsOd3wPez6eMYrqNgR2T/
- TLSH T14BF68D21BA42C135D98101F0997DEFBE803DDE294B3455D7B2DC6E791B305E22B32B6A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\PDFsam Enhanced 7\Installation\analytics.dll
- Size 1.8MB
- SHA256 7020170fb6b194339d8e1813f23f165c9282b4ce0bd7899d6a1c1fd83d9d958a
- MD5 a5f0a8cb86af9a8719112dfa97a68cfa
- SHA1 639581128f4afb65bf6d41c31462065a8002a70f
- SHA512 ffe8fda929cc6eef3104e25f470d01c2d350fe1664503a11f5d5e44d880497642001a3d9a38480adc518f684aab53fa2877623f08a8bdd2133d0ed087d79579f
- SSDEEP 49152:5iEe18ofe8H1XwN3hs8yeaXqm+XqOZiL38N9ge:VeRa5hs8yPXqmaC3
- TLSH T196857C11B641C535E99D02B18D39EFAA855DEE380B7449CBB3D43B6EA9305C32B32E17
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\PDFsam Enhanced 7\Installation\pdfsam-enhanced-edit-module-7.0.70.15196-x64.msi
- Size 32.5MB
- SHA256 f582639dd6a40055fde6c520c13a943d256dba62a17ef2932264a1b59152b1ff
- MD5 19876abf5a4c447201fb22164213cde1
- SHA1 d26bfd7e3025d1a615ea4368725bea9fd3c98d04
- SHA512 d69af6a4b5fb40387a0982a581bdcbd78c81e2bfe947b953fcfdc6e86c28da07646f8eba826ce7c00294c77d63ab6646223e1441392cef978afce603fe0454f9
- SSDEEP 786432:cJ9SnVGtd2m2EmAZyYwwOOTxwHYRQuiyQ7bDTr:i9w4dvDmyb0p3DT
- TLSH T1CA77331EB3E19621CC3859B4FA1EE6B4C066AE311A66DD4730F4FBAF3A3186452D7D40
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17
- Size 2KB
- SHA256 47c8648b744b3912a8d3594d50929994f3e4623e509687f3a905b01f39adeea6
- MD5 fad4d4c2bb0a8ba43e574c53320fb26c
- SHA1 3163dd6a3420d62814c425e6dfb368f5cdce36ca
- SHA512 59c5e39a053343c112dc29ff4f83e35ec294f4f6aec80b9e395d19880cb2f25c032f5d1f20b8957be63cc9a61b7970674b9e719b61cd723f37d3a9436f28858e
- TLSH T150411BD3CCAC2530C90599A77FE9D5731D76B9C0048270B2B899E5B74C0EDDDB635409
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
- Size 1KB
- SHA256 a3f2f3519559445cac3464d15dbe02954fb49dae817043aa71fb243c8fc71dcd
- MD5 eb6fcaf0b8465837d7089bd83c3b6871
- SHA1 8749159d302e8f4ee5badd4fdf3312723a7106ff
- SHA512 c805d0d63f0c663f7baf32f3263dac55fab1c5ea1e70d53df43497995034cc5b2cae7ca9f536ce4b8f4ab0f1189903812368959b6328e49408c2d6d7f0eae0f4
- TLSH T15231C9D76FA47A217E058EE09CBD4772AC7174B1B82008B93850422BD456BF0D90AC0D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D7833C286363AD25C70511661A83D581_B141942605468A5450E14FD39AAE5BA8
- Size 510B
- SHA256 eae529b5c16948469b71ad1fdd672c0c2ad0ccf54365b9d0ab2ea753b9bfc1e3
- MD5 fd155305d81783a522f211f773929c4c
- SHA1 a6d49252fc724f5b4e9f29978f1b6ca63ede6541
- SHA512 f4c4a614f36f1dd8b1691da0f5e5e3b874b88c59adf3be22f660728d1cfd8e5c9589ece10f200beaff9db62961e637a944b3fbf89823e0f287727362e4f575ae
- TLSH T161F005861812F308B252C8C3555179177C10B63E74D1655F63E6D3FE4CE57659B4273C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_E6095CD2AECC9011BCD0D7B421356B17
- Size 488B
- SHA256 339b0fe945dd4c25d233133dd3a19b6feda3b014d4798982aade2b16504ac5c6
- MD5 4ac54381db8d5d7c87ea9db1b724e4d3
- SHA1 13949e0da4ee2f80bc213f63a39ca59d5766cc6a
- SHA512 3ea12996c942c74a32b71e7a41e0a5259abeca0653306627769bf6fb87dda18a13c468064e20da123107744d4c77da79053ed551e30b78f5831e03b2f09aa6f9
- TLSH T101F05C1832FD020DF472DC70AAD59A322A69F2233D800A6A1B8412053D02F009E33519
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
- Size 482B
- SHA256 08bcba68b065d9a4e2e4731ff5534009ccd2c180afd523e24b1e0cf085cdb618
- MD5 dccddcae1888cef00c7f6b8165800212
- SHA1 87adab2cfeec9faa5234d06a6c38eeb014b06d65
- SHA512 64f1adabc350ca11e617c15548defc09166c78c4a98c1b3ffe910c43300b4d056128d1e56ce00741126b41f884938713e2ac1d478c78103f5f28642647170300
- TLSH T171F0A32C16F9102FF1375E794FD565599839F303242027961671C3075E57A01999193A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D7833C286363AD25C70511661A83D581_B141942605468A5450E14FD39AAE5BA8
- Size 480B
- SHA256 46f83696eebe6911f4317a402dfb8292bfcf36b051f9e43f65963bdaf128f0a5
- MD5 85112791c7ba9cd72c578641985fb11a
- SHA1 029321b19e3aae30a404fe023e2f15efba389ce4
- SHA512 f2a4c3a01b653147b2766e13ea679f28e8a374db4a5eabb15aab1fb75e5dfdcd02a725336ad0d6fbcd15ed72f25cbd67fbc84e226096d420ea8146c66020b27f
- TLSH T11FF0A32C2DFE401EF175D97903A8A1D09D33F217740552EF06E6020F9F11E005C63954
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
- MD5 4751cf705a737c4226029624bf43b9a8
- SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
- SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
- TLSH T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
- MD5 2b3686986ce1fd99f079eb226e8b0a8b
- SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
- SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
- TLSH T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 ca959fe391bee1a6033d8d8968d9357bb5b1e8c617a3d49ef7f7c0f4e8d24e99
- MD5 3666808c0c6114494e506d8754f65fe6
- SHA1 5a14cb259bb89891874e5f700ccfcfdd3db5fed6
- SHA512 85d1b685757c7b2df8fc5667601d9a600b516255ad853c3c42fec5d8b381357dd202303070d5d5a47541e05eb0928e92b1fe55567f10ecdccf0e304d8f895f12
- TLSH T15B613B380B5E0482E3A256B1F0E20104707082F9FB9FDE4DEF549DF55A3232AC99249B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 5eb9cad1a93919f2525bc30153b3d8198624645d0868244b4ba36257704c8115
- MD5 28b403690b5b985625194390b0eb36c8
- SHA1 5eb3c0d0b9b4485db5ceaa8aaee2a1a9ab49adbb
- SHA512 8ddc79d2d381a189dbcf60a2fad6ea46d4c94c40df376f4790f4e9419d9d5a971fa247e2eb7b87a631f5fb5d47bcda83f2f66d05562994635bab8302bbb8de57
- TLSH T16E612C380B5E0482E3A156B1B4E30119707092F9FBCFDE4DDF149DF19A3672ACA9249B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bab0.TMP
- Size 3KB
- SHA256 299c24486fc65974784b9ba4ac8463e23f89e2e8444dfe0a9251e60af16590bc
- MD5 09ff66ad8ae1758014ea5d5ce7f43bb3
- SHA1 e9405a371d9c23da05634994ea37a17f03d3760a
- SHA512 8a52fe1ebeb36e060ad423c9b0bdfbe44fae43f42f13a0bbd274ffaa7952f2c8d7b50bb602e8e7bfb78047ab4273f0b2f90f436160f36320204ae3dead2cb29c
- TLSH T1AE613B380B5E0482E36116B1B4E20104707182F9FB8FDE4DEF148DF55A3232AC99249B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 3d72c5ae9cdc6b5d2739f29385bc896ac1d865889a33d9833105aa77de7b961b
- MD5 b3504940ad25a6a10880880d44a2b7a0
- SHA1 c04d4d521f12d8a1f0a2e1ddf0772fb540dcb091
- SHA512 93ee7291baa8cd4ebe3edd902a9b938267214b47d0cdd2bd13b62e8e7efc43366f79750a9bb175ae78b9c215a231a92268bc0ca5c1dd27a46e197d5b60398c05
- TLSH T19D515AB3C3E4862DC91262F1AB187D26CE5D0619432C3D2ACDE5AF1B63F2471E241A5F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 949B
- SHA256 e6fdef408fe469bbf939cafa6db893cb82deed260a8a7cfc4805046fe4b3a6ad
- MD5 55aed2fb769f9c7a15648dc49b2b1436
- SHA1 b0a2ba2f7cf3ec6167304c9a0e4d7bb60e39e2e0
- SHA512 535a8a8cd96071b4156ae9e2246860179b672d38217e8ac4e52a56105cf50cebd9df2e0a5b67db780f17e328c91df12a48fab6dc5399656ae8c1c6b2b3ac06da
- TLSH T1071157B3C3E5856E8D0116F05A24AE2BCE2D0A0682187C1989D4EF2B97F3575E10299B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 2c7a7cba55251ece3e8e191d0162cc9fc1150676f67a5f1b3584d48c61ab17fd
- MD5 4f1ead0add113a17f47656fe811bac0d
- SHA1 3823ede8aa096c532cec29b12076aa6a047958ec
- SHA512 fc5c84c05c6981a615d26015f1e67e1e1255191ec410b46e00e7577c0bac6a145abc497c9e61d8e8b7b51de8a4411bd1496c6d01f5b6bddd20c47ed1e8ee2948
- SSDEEP 192:sxZlRJyM/jK1Ml8M95/fUs2pXwtXIdpJHW6+WNGY9IocADIgrJ:sxZl515/fUs2pXwOJHbGK9
- TLSH T15442E812AB34697BCCCBD209FA55BF53D6F51572A2900E44A9FCCA1C04E6AED221781F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 e1300802c4ca4dbb41e8d218ede7dedc26b04155ebba3e81360ca011122a1e03
- MD5 f305b787f694a69c54e0cd04f80eef15
- SHA1 5eb88c1d202c5ab48f0283b855b1943b3e980e9a
- SHA512 d643bf73463ab4999731caaacd27e1219d0c3eaa6a0d6927a51a8d165796de6174f0eee9fb4093c040b1c0f0d28586ce57e0fa066d2debb935505a3b77795ef2
- SSDEEP 192:sxZlRJyM/jK1Ml8UQjj95/fUsUp3wQXIdpUOHW6+WN5E7/Y9I0IADIg5nJ:sxZl7qjR5/fUsUp3wpDHby/wD
- TLSH T17C52D916AA34697BCCDBD209FA55BF53D6F5547292900E449EFCCA1C00E7AED221381F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 d2eeadda4cb0154473ca1da723f6174d1bac5869fa919ab455fc71bd3e570733
- MD5 4d167bbc4b9989b8706d33637bc573b7
- SHA1 b90345415a9f419a5db145b8246d3833838f7e3e
- SHA512 c34f46bee10b3a3314db42b7e3f14920d94906221509391d0674104f35b266d91d2674f3fcc4435c4dd167207356a40f9811ef44daab77f49e46e37227c0205e
- SSDEEP 768:lScv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNSaroOg6Q:lScv21wWvu+Z+u1jaeFLeRNSROg
- TLSH T151D21B2B280CCB7E4F841E9CED2A6F8A6ED801CB57988D5447FA494C03C77EB511B59B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 4KB
- SHA256 89d47b11549302dfdbba0f51d577da5a3b127a97de472c3e145b22908d1d0fdd
- MD5 fa4fe4abce2400c540cd46bfa1742e36
- SHA1 69eac53ee94360202f0cdb79434da947610d0185
- SHA512 f4170c7339e8cf128e0e601e2c45888871896f608ff4bf88a55f5e949080645f8ab041520738da3dfee5effd2a6e0a0f3e7bfa25e4bc0debd7e3d848c6727859
- SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWuNGKmUiquQKjid:mTWV/G
- TLSH T112918312357B02813C7F681CA36B86670B427563341AE93F7BA802B64E67E560DFDDC8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59553a.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 ea843e15e51f1515e907397bcfc710714e71ab49c86599df535a8ecc1e0c580e
- MD5 c36bc565efd51f3554f33628348a5fb9
- SHA1 f180f693b49b42c96cd03319571240d036bbbb1f
- SHA512 4921270b8ecb2c5c7d6ed74ab059331c78896426849ad587b2c357ad0f0c2b4bb7ebe2293b05a674b66c4f3edabdc8593304d6200553a7562504a187247d4b0a
- SSDEEP 384:JZcIhsNQ9BziBhOe+CBd0esPqyOOPrXLpe8C/jyS:BhnCJJxsPqyOi9PgyS
- TLSH T108928E31A8742C6B5DF6B941F98736039FF88173F6C52F84A5ECEB0D01DB5981306826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 23KB
- SHA256 d6d86a3de9618f496b692bebb33bb57a654b5a32eb0f1f36d4b2747b8f4d40c5
- MD5 66a12f7e6023aae77f849fb24599ae4c
- SHA1 927e5b7f51bc3deccb5aee48eb5a2c4bde005b43
- SHA512 965eb6a95fdacad611ccb46e07ad0a11177f02f98dd76c47a96a82017d9747fcf66f68aeffbae98ddd645bc7d55c58b506111b30fdf722c5b61b1835aca333eb
- SSDEEP 384:3iFPZcI7sNn8TUNTUlIlCBzit2v2e+CBd0esOqyOOPrXLpe8C/jyS:yFH7Ywge1vBJxsOqyOi9PgyS
- TLSH T127B27D329868987FADF6AE85F94A36038FF841B3E5C16A94B6DC9A0D01DB19C1307C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 22KB
- SHA256 8b4ab23770a3e0cd4963a2ede66d9ac880288cedcccbac7ce536daa97bc84dc6
- MD5 e85a7cc551863a371a0372b2067e4ac0
- SHA1 4fe76a6833ee82549d83e478060fa531ef5e9b73
- SHA512 6a4f9f52eae25eff9957481f125c2ebbf32a6dec28708dab2a3d5324bfceb57c4981bc7e8e2ebc65d7c50a866dc4a2f55312d746948f6bdafb30bda8af88d0cf
- SSDEEP 384:3iFvZcI7sNQ8TUNTUlIlCBziJhOe+CBd0esAqyOOPrXLpe8C/jyS:yFn7xwgeWJJxsAqyOi9PgyS
- TLSH T187B27D3298689C7FADB6AE41F94A36038FF841B3E5D16E94A7DC9A0D01DB19C1307C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 982a9556ab5f46749a4a426774584665b975862507c1eca601b53ec5aa8fd946
- MD5 594e67cc8e25e373db51e90b18376934
- SHA1 9273fe5e0a4f8d243f973d6a0271130f589bb2e0
- SHA512 8130c68539d87bc55fe5cb4923dcf2def9ed098d0fe3ec48af0ecfa956599049a0331672a3727fe783a7e2769362b1384b71634946717679d428c19aafb9df4c
- SSDEEP 192:JONa6v+YLNQmiUy2vZh+CGD+FdeP9ospusq32AU6:JONa6vz/PZh+CBd0esJqmAU6
- TLSH T18D02E935AD382C7B9FF2AE45F4873A175FA82177E9912F84D9E81F1C01D765C2306826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 e475c6b3715131c79635828ff5167ced4565bee0a63fbd1afeca1dd845c095d3
- MD5 19f7957dafab6af502f835b1070612ed
- SHA1 06df1084520ac14d71334e9b857a8c9e280805cf
- SHA512 c2914411339497850b023026eb1b9a102146a6f5afc194e380bbee9190d84db770be4ca4c848d520e6e9cc9de407f1ec3123eaf35ad0783b510fc89946eabbbf
- SSDEEP 384:JZcIZsNQDBziJhOe+CBd0esPqyOOPrXLpe8C/jyS:BZ1WJJxsPqyOi9PgyS
- TLSH T1F4928E31A9782C6B5DF6B941F9873A039FF89173F6C52F84A5ECEB0D01DB5981306826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 23KB
- SHA256 94199691411b354a7a7ccbaf898126a42f0a57446dec7ac9eb9ff8c927b99d0f
- MD5 ee35bc25fd3933303b4f5a78a4f788b8
- SHA1 6a72a4c8d527fcbbc36c5c3791294a7a664a46e7
- SHA512 87f2745e70bdf01c37a5d335106ae2fc37489833a517b24fe8163058a3ff4d92fe4957dee147dbb275f19f6ca257dae3dca69180c9a6ed7704ea0e2dd3e6c081
- SSDEEP 384:3iF1ZcIFsNn8TUNTUlIlCBziP2v2e+CBd0esOqyOOPrXLpe8C/jyS:yFNFYwgeDvBJxsOqyOi9PgyS
- TLSH T17EB27D329868987FADF6AE85F94A36038FF841B7E5C16A94F7DC9A0D01DB19C1307C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 a8fd08b821032529220a718f68f89309b0986c53f5888609ea2be483a513c8d1
- MD5 810bc7ea1cec23d816a863eeabe70cb6
- SHA1 7f32186fbb74e03c6913393694519b33c3314f58
- SHA512 cc876609c9e7b6b2378ac707e4e89aa3a64bbc64c6a7be99ddbbf4f6ed4b4d947e8d391743e4a806533ab0e993afcbbc6408feee4e6d4e8409b7e8b5a925518d
- SSDEEP 192:YONp6v+YLNQmiUyAvqh+CGD+FdeP9osNOeBBCHqWqVwU6:YONp6vz3fqh+CBd0essqyU6
- TLSH T17B123A35EC782C6B5EE2A945F88735135FA54173EA863F80E9EC2F1C01EF69C2306816
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 f6300490bea222d9a8c406e9c770089e9ba50c98217b28f4491c1c0617a61f82
- MD5 61fd869bc9ee7c7338abba7d82d7bb09
- SHA1 0b3c680633c0ec74ae7519942ea65cfbba60f40a
- SHA512 5fd123c645e61ce0455284b07f019335f14075b0ed95adc3b34f9b11ebfbe89b79199c8bc7090539bf8162da4aa8db2ca56e5a4824b7bb628d58a23744908f8b
- SSDEEP 384:rZcI5sNQCBziJhOe+CBd0esPqyOOPrXLpe8C/jyS:z5cWJJxsPqyOi9PgyS
- TLSH T1D2928E31A8786C6B5DF6F941F98736039FF89173F6C52F84A5ECAB0D01DB5981306826
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\30fbc393-6c19-4948-82e1-0b5f182b1164.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 e41fab8b643ea3dabb4f394992636e39c5572fd2805541909fa8e04f06484f67
- MD5 8ee64c46e8eb16e9df491a69ae3beb14
- SHA1 1928ad7902b80e9924ae861d8f9fab1ab0abe9c2
- SHA512 4a354d9e4c9cbcbdf8d1804f6a8687cff6f7f0e7a824fa254438adf083660f7bfa4e8db740a2d9222328dd307b3704554329d9ed91e8d1ca48029e64a17348c3
- TLSH T1F241095CA6FD1148B3B7AE566BF7A86D047BBC672F47D05D00010E8E0A62A40C8B2B37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\PDFsam Enhanced 7\FileStorages\SharePoint\service
- Size 4B
- SHA256 74234e98afe7498fb5daf1f36ac2d78acc339464f950703b8c019892f982b90b
- MD5 37a6259cc0c1dae299a7866489dff0bd
- SHA1 2be88ca4242c76e8253ac62474851065032d6833
- SHA512 04f8ff2682604862e405bf88de102ed7710ac45c1205957625e4ee3e5f5a2241e453614acc451345b91bafc88f38804019c7492444595674e94e8cf4be53817f
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\PDFsam Enhanced 7\settings\user_preferences.json
- Size 3B
- SHA256 f1945cd6c19e56b3c1c78943ef5ec18116907a4ca1efc40a57d48ab1db7adfc5
- MD5 ecaa88f7fa0bf610a5a26cf545dcd3aa
- SHA1 57218c316b6921e2cd61027a2387edc31a2d9471
- SHA512 37c783b80b1d458b89e712c2dfe2777050eff0aefc9f6d8beedee77807d9aeb2e27d14815cf4f0229b1d36c186bb5f2b5ef55e632b108cc41e9fb964c39b42a5
- MD5 SHA1 SHA512
- Path C:\Users\Admin\Downloads\PDFsamBasic7Installer.exe
- Size 27.2MB
- SHA256 f2c94bc99f9ce7915ded3a1fc40e543d22056e530763a336a13d401b1e00c185
- MD5 e4574022076215f98dcb17738fb26ccd
- SHA1 a420d8d7e1eed2a8017d3fb5f121d5343df00d29
- SHA512 42172382ae7792f0d7793ae98bca6fea3a2403e312bcce8a008038e106ebecccbc478e332bd660f34a62e40a0e274c96823457a7520ca8a51541fde9beea7d7b
- SSDEEP 393216:1hWo9ws7/drqNu5yQCFFh6YDsOd3wPez6eMYrqNgR2TBTpNG:Oo9L5cJDs7P6NRABTp4
- TLSH T1EF57AE22BB02C135D99501F09A7DEBBE843DAE244B3445D7B2DC2E7D5B305D22B32B5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\MSICF8B.tmp
- Size 1.3MB
- SHA256 78a29a12f6bed940168527868f111f85ccf136065cab7343bdf2c8a1aa686cc2
- MD5 7e48a28e1c95b35dc164f39c787580b2
- SHA1 6702654ba6c72fa575ee6878c6b4830c76bf9d6f
- SHA512 4936a98551f6520b8fcbe4b40276ba00338a289591a43f2ad5cae9c0991766fb3e4d33ab715dcbe4f89db0be1fb9cc14521eee2b2ee7a695d981c1dc437874ac
- SSDEEP 24576:HWzq2PBKjE66ehuj17MIGrlFWKbdhqo8h2gy7kgyIzQNgVp8:2z/ZKjE6eWIYlFW4dhqxy7iIzQyp8
- TLSH T11E556D1A766840B8D1ABD078C9974A0AE7F13C4503719BDF27A90B5E1F77BE09A3E350
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\asian_icon
- Size 5KB
- SHA256 e38d541580d932725be656f66cb664c1008b4099ed7fbf735c8a62b29e2ce794
- MD5 ce3f9988e627a0026afb58fa6628e722
- SHA1 a88f909d14f097a17a389526090a2296a34aef3c
- SHA512 81dec615a7f6d3cb5f098b1a8bc8f3b158ab8b7a19a23e461bfe0a1120b92aa21bcb1c03c6d800f479b4696edc951e41e1b8e41e46c30501ad1fee608475e719
- SSDEEP 48:miYStlvZjk+WsGg780PNLJFywc3Y+Fi7c8hyN5ZOAEEPeDpb:mRStlvZjBcQ80zYAQJ5ZveN
- TLSH T1E5B1A98CB7D1A45ADD96AA34F38FCBB4122B7D321D64CC5A71F0374F4A3158680D2D5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\convert_icon
- Size 5KB
- SHA256 8096d69c7c49aece5dd76a47a12e64edf2a54dfdef7cd2b0d707a604a122456d
- MD5 bca3ac5ba9157aa529ee9e5b9a7d0ed6
- SHA1 370f8bb733c6cfe7ceeed85d2ba9dcf2e450e735
- SHA512 b6deb97832c50df6f6d7a4085190b40092cdd408fe193e6cdb08b83b4f8453daacdfd4df563cb4742bfe786fe614e07151874bbf41087ef09ae380d918e39ea5
- SSDEEP 48:JiAwKZQr9IRMNLJFywc3Y+Fi7c8bHlye5nvdlhBkDpC:J1wK+r9IRoYAQCHlye5nvdlhBkU
- TLSH T1E6B1A98C73D29865DD81A939FE4EC6B42127EDF24D609CEA70F03B6F493218281D2F55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\create_icon
- Size 5KB
- SHA256 dd7b000df4e1226a002f35271373f5f34ff42bfacc8cb119a82676a75afa3e12
- MD5 91a80a7e3958c3a939c67c9a2046dc17
- SHA1 0f1ac22986142392233967913b9d2fb7515db9c3
- SHA512 adaf98d3ea7322d0f3eab5fa99d7260550773d07c4b2db869ff1e02002f2e160c353f5924fb80c3511a59272a2a407053259d4727a0459a356f99b1852c3bb80
- SSDEEP 96:j+fOf6NrzkKB1E7TuPD2PHPXLYAQlX3KTTFrem:i+65zkKB1E7e2XYX3KTTFKm
- TLSH T11BB1AF40F7D9E4C6D445A930EA1FEBB882273DB1BE819C0730A43B1F9932D86A1F7456
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\edit_icon
- Size 5KB
- SHA256 c8bbdcd2c43426fff5d5ffd36053d4e92c42612e71f3b1b414e95e2bc0bb6470
- MD5 a81c868327c7f8818fd0e2d12ae87393
- SHA1 abed68106e2a97c324d318fb5c1604fa9155bb10
- SHA512 dcb529500d2c8696381a7cc803182b5a99582b34deab6ea83dcd04173e0ec0aea1d8d3982614b6dc36b629c15a1b6353842c47c8f8d18dc03d0f8afb2485dc6f
- SSDEEP 48:61ri387H3xA6mZePN6ekQmj8lck9CFYwc3Y+Fi7I87P4EZ8igEseDp6:61uMH3x0eV6ekQmjXk9CeAs0BZbEeM
- TLSH T1EBB1ECD076D0A090D864AA31DE7FCEB8921B7E718E40DD96316C77AE0F70D8681D365A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\forms_icon
- Size 5KB
- SHA256 9e636d0e5a4c6e053fddc6e617f7fcfca6fa4c8437e3ff1106dd2e16b1ba9dc9
- MD5 7edef810d56ff8cd928392470540e078
- SHA1 821fb4bd06f732ba4d79bb637d11ddf68394a7e5
- SHA512 14dcc7f2f572a23f95dca108a85fa48e98c1ca04c4540b583d0ef1ef7724beea8c9a887f50c0e1a1359b4f32453f54e0c8c4948ae41bc1739e181c7b87eae9cf
- SSDEEP 48:mijctyDyyM+yyW7RmxLJFywc3Y+Fi7c8kLeDpC:mqctyE7Rm/YAQPeU
- TLSH T13DB1AA4436D5E550DC51A939EE0FCAB8B12BBDF14D508CF2B1A23F7F493069680E2B56
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\insert_icon
- Size 5KB
- SHA256 92bf961caae94476620e0a476a04f08591e6a0abd4031a9eced611c9bad55aa8
- MD5 1d18d77ce237bc5a6aaa33b252a37e49
- SHA1 773b3b8a791b114c514622dfbc713e05b6e64d5a
- SHA512 d00bf6ddf7cb491538ecd926219d96d97241e49dd17023c40f3b7e089070c02a6906c6ef321d1f9d1814bcbf7887287a45d0ad64612ca012826675f34ea5c7a8
- SSDEEP 96:2D4UILzmhnz2MCSFYiqeYAQceroer2rek:fWHuk
- TLSH T167B1865C37D1D858CD49A578FE2ECBB8212BADB08D408CAB70F03B5F297059681DAF55
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\install_icon
- Size 5KB
- SHA256 c5d7cdb45287dd6e6c1f61cc0cf6f945957bd250e277573897d88c6d8f3f0a47
- MD5 ecfe237dcbf87825ce67fcf9e98484c2
- SHA1 35b9c8919d3e01586d5d2ed18fd0007500f2a40a
- SHA512 760b2ec1c6da538141b677a479cc2494c0d0ede806681d36620e4dcaad0853002f80847426f354de1c1cf2524d6991db4b497d52dc8d0241a3477ef42f578c8a
- SSDEEP 96:xHTjoyBGpNDbhd9o4viOfMxy3TV9KnacC:d2x/Iap
- TLSH T193B10E8CBBE19554CC51AA74F66FCBF8120B7E316E809D2A31F4774F4B3209640DAD59
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\main_icon
- Size 448KB
- SHA256 02090601ae42bbaaf6777a5cd948401fc0069ab39da2963505967645d136d80d
- MD5 5f5ffb0bd0478283811f3ef3ccefebcf
- SHA1 6c4ffb0e70cb2f01ee3d19b7b99a3a325339591e
- SHA512 26dc2ed1ee5f04519070c72557ed0ab236f1488f96dcffac11ebab6c9993f557c7a18cb116166eb9e0c3fb733cba5433e6e6f0411613c774d83639367f81f0ff
- SSDEEP 384:e8yOfYTD7R527O9hBQ3dimlfiYBryIlq8/UuNDWp6PULch4ShIlJVnrTLUDxZIK:bqD7RLeiGlFqLhShU/rGxj
- TLSH T1E2A46F8D37E2E055ED91A934FEAFCAB4061B7E312E80EC2A71F0774F4A311A651C6E15
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\ocr_icon
- Size 5KB
- SHA256 9db3083b43b526ae410cdccc6b349e73e030d0c43ad24e84e6679b78990c407f
- MD5 de094ce8dba1cb64d831615dbd6d9f30
- SHA1 6bf9bf524c2ea97a373c8b6a12a20d3ac0f45096
- SHA512 eb56ffd16f393877b50cdcabed99e0d9dab09d4b2a58038c736bb4681b8a8d62ca4bea92fade782788964e6df7b5cb2d0eafd3f1a298215f5e6d85b0a43c8a80
- SSDEEP 48:8gsvoJKuJt7wUX6fabsYJNLJFywc3Y+Fi7M8XzXC2VG8eDpS:8gsvY3kUX6f4siYAA0C2M8ek
- TLSH T103B10F8933D28855DD50A630FE2FCAB4322B6EF25D40ACF570B47F7F0A3059681D2A06
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\review_icon
- Size 5KB
- SHA256 353fd28c4fc97bf6fb4a8003a241da536ba93b976fdc4b8ab20651b960e825ea
- MD5 53b20652c3a60c2bff5cfca97371feb3
- SHA1 2df72a770364ed566be3f3094bbe070412722cef
- SHA512 fae097c89360f484dc42085a35ea1398de16b80f821f8245a749fae2546a1164587ab5d788ddd229cd97aa169df32a4b8ad87dbd7546818d128e9dac019c73c7
- SSDEEP 48:yiysQxn56lG6XgfHmBONLJFywc3Y+Fi7u08vzGBGAwulADMHeDpq:y+QX4XgfHhYAi0KAwqOMHe8
- TLSH T1A8B1678476D1D450E040BA72EE5FCAF8C22BBF325F889C5731603F4F393069691E6966
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\secure_icon
- Size 5KB
- SHA256 ca529be39f5aff6a373c58ca3c3a1e6030b027747e72be7eb845e1638007f99a
- MD5 6ee0976f40b2633adef07d0d5617b253
- SHA1 34d652e280465d3e317b88a2503d3132cbf35997
- SHA512 6ad8c25c8e624b2e06f048fe8b5d1e9e07268a2f1dff6856b0d72b5e5648e3af23a5037f1080d737abdc3b3315a728a6c8600eb5eda623ec4fb0eb7be321ca9f
- SSDEEP 48:5iMIuU6zk2kmWtqUaF+Fywc3Y+Fi7F8hafYriDj5y6DeDpS:55IuTzkNnmF+YAp6EnDek
- TLSH T152B18685B6E19050E591B531EA4FD6B8C26BBF32AF408C1770B07F4F3E305E681D296A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\Installer\{63380AAA-0783-42BC-B807-471E0BC00907}\uninstall_icon
- Size 14KB
- SHA256 d7505d889120a128181e704ec789a20e174281334fd516f2fd3fa5128474b07e
- MD5 012de35952cf9b579966593de8124087
- SHA1 33f799f8d1538c3a75defa5dcbb86ba2cfe7a779
- SHA512 66e40bfefbf358f0b58d59445d587966250a264d33b4c0284b704c806ff170a6196c491e4c3a084279071e5eec5153fb1621723021fe14549a20d6fce964df6c
- SSDEEP 96:j8jA/QcY0WK6ShkEwGF03DF1lUEjcS4oPJpEEr9sZCiOfMaMzAQ3R6nacC:jvQIrgprcEv3oCxKcURQap
- TLSH T1A362FBC8FAE29558C9B39934EA5ECAB807DBAE313D809C0931A77F4E363D1C211D6805
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\spool\drivers\x64\3\brand_solution_name_pdfprn_v.6.11.0.7.dll
- Size 9.6MB
- SHA256 5a02ab914e7b2f4907f82bb22dd226d007712945defd8071d28c2634f4fad1eb
- MD5 9a53d9053ca3c5914f95d9ed774abb29
- SHA1 1d9d6d57dedc914f0748b28576af28e8119ea9ca
- SHA512 38cc2a7f227dc8fb1c81f79ab94ab59c268a0cd4d5ac9007e51a73d93eec5af7a73f716ce3e6be7eb22f1c5b46ca54752ab266282283bae5717125a74c00b6b4
- SSDEEP 98304:BY2M+j/G3+Vm8G/ioaBRT3x6LcuqCTCWgGryGrlv3nBftvzNVtb:BYlMG3+Vm8LP6LQCTCWbXBftzNVtb
- TLSH T10BA66B2537BC0294F8BA86388FAB8F09E5B27C754324F6DF1144575A2F2BBE4453E624
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\spool\drivers\x64\3\brand_solution_name_pdfprnui_v.6.11.0.7.dll
- Size 1.1MB
- SHA256 0566f260d0d0df4ba28531651e65c7b8854e0e375cc59d24c27e888985e9e468
- MD5 a860f6732470aa5bd3ed156044462bcc
- SHA1 7c7a18496538d78a330ad8e05af20331d9d1d535
- SHA512 297a4d2585482000bddd94cd328719f852f1a105024dcad62a30dc8fbccaf5b93687a92f5cacf24c3108754f2f544683f516d13d9aadaef71150f6c16b91c9fb
- SSDEEP 12288:LdB3CNiu1QkmqRs0J+lC93LVkfsmPjyZ+8A2q36olNkB5D:v6iuBmCLJ+C+smA+8tq36lTD
- TLSH T14335491533EC0269F5B7A278CABB4A15EA727C565730D7CF03A0826E1E27BD04979732
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 24.1MB
- SHA256 622c9aedc25d0af869ea7cfe22b8f2f62565bcd32070efba03c0145bafd45c40
- MD5 2c195a37735e4e4303fd9952000741cc
- SHA1 544fbd25e287f40b4e0483e133b08b16cc0412f7
- SHA512 6325a4e869ffd33e94c0858e7f77587dfca6dbec70e19172b9b432ee1708f1ceecab9f98698b70065d6d09c8b1867735183ab56a62f058cd98f2e65bdeaadb59
- SSDEEP 24576:3u8m+1zqdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:2
- TLSH T15647A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{f64114c5-bf96-4c55-b064-7773b32d1423}_OnDiskSnapshotProp
- Size 6KB
- SHA256 611c327f6afa59e69f6ae470622a0b5033c0cecd1a95035d1eb433daac196259
- MD5 d3b57bc4f6af4d578a0d979c700dc571
- SHA1 738afb29c42be5301cdd3df8397a27a0046e456b
- SHA512 96598f0abd906337db4eeb68df4dc3c2d73e385e3a6dfca5afb6c8fc4bc0789553ebb725af6489cd82b261228789f5ffd49c4c1a3966f3687e4ebbd492066c5b
- SSDEEP 96:FBm0UMDvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:zmSb++ZVmN
- TLSH T163D189085AF54311E2B3AB3129F54557A877B911EF33CB8E0198238E6670A10F876F6B
- MD5 SHA1 SHA512 SSDEEP TLSH