e90d835dd4c37a73ba344159a2638f11c6765b477ea98076c90c092022739240

Analysis

max time kernel
151s
max time network
156s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_6d6ad1ee5c2f8b52304be81c9477f7ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Size 23.5MB
Sample260816-jdrheaseph
SHA256 e90d835dd4c37a73ba344159a2638f11c6765b477ea98076c90c092022739240
MD5 6d6ad1ee5c2f8b52304be81c9477f7ff
SHA1 49a9e07e8ee1f59250d6de8c79da320293436118
SHA512 51d0bdc0d7f4c3a53934c86af57e530813591e32a4a3fc10e82ae4c4698ed96122a7d5cb3d268fd2dcce92faf120886fa91ea28aed35d2d00ee0a1418d9508de
SSDEEP 393216:vyyosX9P9oIDiHQxc/kNWyk9LeoCfTnejFqx7CxjbybQvT4HxEXnl8+a:KMNtDiHtc0azaimxabe8wa
TLSH
T1B1473358F3B025BEF16BE675D9925902D3B2F40C13F0D28F13A59AA45E232E1CA3D761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
5860	pdfFactory.Pro.v9.32.exe
1432	setup-x64.exe
4180	fppdis9.exe
2012	FinePrint.v12.32.exe
4884	setup-x64.exe
4924	fpdisp12.exe

Loads dropped DLL 22 IoCs

pid	Process
5860	pdfFactory.Pro.v9.32.exe
1432	setup-x64.exe
1432	setup-x64.exe
1432	setup-x64.exe
1432	setup-x64.exe
1432	setup-x64.exe
1432	setup-x64.exe
1432	setup-x64.exe
3048	Process not Found
4180	fppdis9.exe
4180	fppdis9.exe
2012	FinePrint.v12.32.exe
4884	setup-x64.exe
4884	setup-x64.exe
4884	setup-x64.exe
4884	setup-x64.exe
4884	setup-x64.exe
4884	setup-x64.exe
4884	setup-x64.exe
3048	Process not Found
4924	fpdisp12.exe
4924	fpdisp12.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fp12_x64_driver.inf_amd64_6f792b0932850806\fpinter12-x64.dll	DrvInst.exe
File opened for modification	C:\Windows\system32\fppmon9-x64.dll	setup-x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC1CF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-0405.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\fpres12-x64-040c.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETE055.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETE078.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fp12_x64_driver.inf_amd64_6f792b0932850806\fpres12-x64-041d.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fp12_x64_driver.inf_amd64_6f792b0932850806\fpres12-x64-0804.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\fpres12-x64-0410.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fp12_x64_driver.inf_amd64_6f792b0932850806\fpres12-x64-0410.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETDFFD.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC1E2.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC271.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-0404.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-0415.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-040c.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\fpres12-x64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\fpinter12-x64.dll	DrvInst.exe
File created	C:\Windows\system32\fppmon9-x64.dll	setup-x64.exe
File created	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC22B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\fppr9-x64-0419.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC271.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-0412.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-041d.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\fpres12-x64-0406.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fp12_x64_driver.inf_amd64_6f792b0932850806.ini	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\fppr9-x64-0410.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC205.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC25E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETDFFF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\fpres12-x64-0413.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fp12_x64_driver.inf_amd64_6f792b0932850806\fpres12-x64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC1D1.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-0416.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETE021.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETE055.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\fpres12-x64-0407.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fp12_x64_driver.inf_amd64_6f792b0932850806\fpres12-x64-0412.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC1CF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC217.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-0407.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243\fppr9-x64-0c0a.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETDFFC.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC228.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC22B.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC24D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETDFD8.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETDFE9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETDFEA.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETDFFD.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC1D0.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC22A.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\SETC23C.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETE045.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\fppr9-x64-0412.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\fppr9-x64-0413.dll	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{c64dca89-9e8b-b64f-9ac2-5a76abf35c85}\fppr9-x64-0804.dll	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{887fb4cc-d55a-1542-87a4-0e5154b1c4b3}\SETE045.tmp	DrvInst.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
5808	wscript.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0415.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-041b.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppdata9-x64.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr932.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0419.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0c0a.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpdspl12.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpui12.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0404.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0406.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpdisp12.exe	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0410.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0412.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-041b.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppui9.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppdata9-x64.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fp2pdf9.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fp2pdf9.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0410.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0411.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpdata12-x64.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0407.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-041d.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppdes9.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppui9.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0407.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0411.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0413.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0416.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0416.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppdes9.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppread9.txt	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpinst12.exe	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpdisp12.exe	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpui12.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpread12.txt	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0412.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0413.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0405.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0412.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0804.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpread12.txt	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0410.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0804.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0c0a.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0406.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0419.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0416.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0804.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0406.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0412.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0c0a.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0413.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0419.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fpphelp9.exe	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppdata932.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-0407.dll	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpres12-x64-041b.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\pdfFactory9\fppr9-x64-0415.dll	setup-x64.exe
File opened for modification	C:\Program Files\FinePrint Software\FinePrint12\fpinst12.exe	setup-x64.exe
File created	C:\Program Files\FinePrint Software\FinePrint12\fpdspl12.dll	setup-x64.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2120_2101663061\protocols.json	msedge.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	setup-x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem1.inf	DrvInst.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2120_1823825841\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2120_2101663061\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2120_511361798\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2120_511361798\nav_config.json	msedge.exe
File created	C:\Windows\inf\oem1.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	setup-x64.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfFactory.Pro.v9.32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FinePrint.v12.32.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5976	msedge.exe

Checks SCSI registry key(s) 3 TTPs 32 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom	DrvInst.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313392536265976"	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	fppdis9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{ADE02C2F-3770-44E6-A928-151701A5E93A}"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.FP\shell	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fppdis9.exe	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fppdis9.exe\SupportedTypes	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-08-16_6d6ad1ee5c2f8b52304be81c9477f7ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.PDF\DefaultIcon	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\OpenWithList	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.FP\shell	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.PDF\shell\open	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fpdisp12.exe\shell\open	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	2026-08-16_6d6ad1ee5c2f8b52304be81c9477f7ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D346D601-85CF-4E32-82F2-CCC6EB23A8DD}\ = "FinePrint file preview handler"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithList\fppdis9.exe	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{D3DBBA59-C324-4F3D-BE38-269106CF9EC8}\DllSurrogate = "%SystemRoot%\\system32\\prevhost.exe"	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97176753-AEA2-4BD9-AD15-A6EB0515E423}\InprocServer32\ThreadingModel = "Apartment"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.PDF\DefaultIcon	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithProgids\pdfFactory.PDF	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.FP\shell\open	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fpdisp12.exe\shell\open\command	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fppdis9.exe\shell\open	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.FP\shell\open\command	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fpdisp12.exe	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.FP\shell\open\command\ = "\"C:\\Program Files\\FinePrint Software\\FinePrint12\\fpdisp12.exe\" \"%1\""	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.PDF	setup-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B24AE869-7EF0-406A-A49F-04FC2AB8C306}\ = "FinePrint file preview handler"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.PDF	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithProgids	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithProgids\FinePrint.PDF	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fppdis9.exe\SupportedTypes\.pdf	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.FP	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B24AE869-7EF0-406A-A49F-04FC2AB8C306}\InprocServer32\ = "C:\\Program Files\\FinePrint Software\\pdfFactory9\\fppui9.dll"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	2026-08-16_6d6ad1ee5c2f8b52304be81c9477f7ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.FP\DefaultIcon\ = "C:\\Program Files\\FinePrint Software\\pdfFactory9\\fppr9-x64.dll,0"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ADE02C2F-3770-44E6-A928-151701A5E93A}	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.PDF\shell\open	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\OpenWithProgids\pdfFactory.FP	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D346D601-85CF-4E32-82F2-CCC6EB23A8DD}	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.PDF\DefaultIcon\ = "C:\\Program Files\\FinePrint Software\\FinePrint12\\fpres12-x64.dll,1"	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.PDF\shell\open\command\ = "\"C:\\Program Files\\FinePrint Software\\FinePrint12\\fpdisp12.exe\" \"%1\""	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	2026-08-16_6d6ad1ee5c2f8b52304be81c9477f7ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.FP\shell\open	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ADE02C2F-3770-44E6-A928-151701A5E93A}\InprocServer32\ = "C:\\Program Files\\FinePrint Software\\pdfFactory9\\fppui9.dll"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\OpenWithProgids	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D346D601-85CF-4E32-82F2-CCC6EB23A8DD}\InprocServer32	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3A2CDC79-8006-470B-B1DC-18F32DF39E83}	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}\ = "{B24AE869-7EF0-406A-A49F-04FC2AB8C306}"	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{97176753-AEA2-4BD9-AD15-A6EB0515E423}"	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fpdisp12.exe\SupportedTypes\.fp	setup-x64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{3FBD85F5-B3DB-402B-B827-F1A802E0B0A8}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B24AE869-7EF0-406A-A49F-04FC2AB8C306}\InprocServer32\ThreadingModel = "Apartment"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.FP\DefaultIcon	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\OpenWithProgids	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\fpdisp12.exe\FriendlyAppName = "FinePrint"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.PDF\shell\open\command	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fp\ShellEx\{8895B1C6-B41F-4C1C-A562-0D564250836F}	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3A2CDC79-8006-470B-B1DC-18F32DF39E83}\DllSurrogate = "%SystemRoot%\\system32\\prevhost.exe"	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\pdfFactory.PDF\DefaultIcon\ = "C:\\Program Files\\FinePrint Software\\pdfFactory9\\fppr9-x64.dll,1"	setup-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{97176753-AEA2-4BD9-AD15-A6EB0515E423}\InprocServer32	setup-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FinePrint.PDF\ = "PDF file"	setup-x64.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1432	setup-x64.exe
1432	setup-x64.exe
4884	setup-x64.exe
4884	setup-x64.exe
4964	msedge.exe
4964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe
2120	msedge.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeDebugPrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeSecurityPrivilege	1432	setup-x64.exe
Token: SeSecurityPrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeLoadDriverPrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	1432	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeDebugPrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeSecurityPrivilege	4884	setup-x64.exe
Token: SeSecurityPrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeLoadDriverPrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe
Token: SeRestorePrivilege	4884	setup-x64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2120	msedge.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1432	setup-x64.exe
1432	setup-x64.exe
1432	setup-x64.exe
1432	setup-x64.exe
4180	fppdis9.exe
4884	setup-x64.exe
4884	setup-x64.exe
4884	setup-x64.exe
4884	setup-x64.exe
4924	fpdisp12.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 5052	3500	2026-08-16_6d6ad1ee5c2f8b52304be81c9477f7ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe	89
PID 5052 wrote to memory of 5836	5052	cmd.exe	91
PID 5052 wrote to memory of 5860	5052	cmd.exe	92
PID 5860 wrote to memory of 1432	5860	pdfFactory.Pro.v9.32.exe	93
PID 1432 wrote to memory of 4180	1432	setup-x64.exe	100
PID 5052 wrote to memory of 2012	5052	cmd.exe	101
PID 2012 wrote to memory of 4884	2012	FinePrint.v12.32.exe	102
PID 4884 wrote to memory of 4924	4884	setup-x64.exe	105
PID 5052 wrote to memory of 4364	5052	cmd.exe	106
PID 5052 wrote to memory of 5808	5052	cmd.exe	107
PID 5052 wrote to memory of 2120	5052	cmd.exe	108
PID 2120 wrote to memory of 6028	2120	msedge.exe	109
PID 2120 wrote to memory of 2436	2120	msedge.exe	111
PID 2120 wrote to memory of 5976	2120	msedge.exe	112
PID 2120 wrote to memory of 2436	2120	msedge.exe	111
PID 2120 wrote to memory of 2436	2120	msedge.exe	111
PID 2120 wrote to memory of 3180	2120	msedge.exe	113
PID 2120 wrote to memory of 3180	2120	msedge.exe	113
PID 2120 wrote to memory of 1600	2120	msedge.exe	114
PID 2120 wrote to memory of 1600	2120	msedge.exe	114
PID 2120 wrote to memory of 1600	2120	msedge.exe	114
PID 2120 wrote to memory of 5772	2120	msedge.exe	115
PID 2120 wrote to memory of 5772	2120	msedge.exe	115
PID 2120 wrote to memory of 5772	2120	msedge.exe	115
PID 2120 wrote to memory of 2200	2120	msedge.exe	117
PID 2120 wrote to memory of 2200	2120	msedge.exe	117
PID 2120 wrote to memory of 2200	2120	msedge.exe	117
PID 2120 wrote to memory of 5048	2120	msedge.exe	116
PID 2120 wrote to memory of 5048	2120	msedge.exe	116
PID 2120 wrote to memory of 5048	2120	msedge.exe	116
PID 2120 wrote to memory of 1616	2120	msedge.exe	119
PID 2120 wrote to memory of 1616	2120	msedge.exe	119
PID 2120 wrote to memory of 2312	2120	msedge.exe	122
PID 2120 wrote to memory of 4868	2120	msedge.exe	121
PID 2120 wrote to memory of 2312	2120	msedge.exe	122
PID 2120 wrote to memory of 4868	2120	msedge.exe	121
PID 2120 wrote to memory of 4496	2120	msedge.exe	124
PID 2120 wrote to memory of 3664	2120	msedge.exe	125
PID 2120 wrote to memory of 3664	2120	msedge.exe	125
PID 2120 wrote to memory of 3140	2120	msedge.exe	128
PID 2120 wrote to memory of 3140	2120	msedge.exe	128
PID 2120 wrote to memory of 4604	2120	msedge.exe	130
PID 2120 wrote to memory of 4604	2120	msedge.exe	130
PID 2120 wrote to memory of 4604	2120	msedge.exe	130
PID 2120 wrote to memory of 4980	2120	msedge.exe	131
PID 2120 wrote to memory of 4980	2120	msedge.exe	131
PID 2120 wrote to memory of 4980	2120	msedge.exe	131
PID 2120 wrote to memory of 1876	2120	msedge.exe	132
PID 2120 wrote to memory of 1876	2120	msedge.exe	132
PID 2120 wrote to memory of 1876	2120	msedge.exe	132
PID 2120 wrote to memory of 256	2120	msedge.exe	133
PID 2120 wrote to memory of 4764	2120	msedge.exe	134
PID 2120 wrote to memory of 5652	2120	msedge.exe	135
PID 2120 wrote to memory of 1604	2120	msedge.exe	136
PID 2120 wrote to memory of 1604	2120	msedge.exe	136
PID 2120 wrote to memory of 4928	2120	msedge.exe	137
PID 2120 wrote to memory of 4928	2120	msedge.exe	137
PID 2120 wrote to memory of 2652	2120	msedge.exe	141
PID 2120 wrote to memory of 2652	2120	msedge.exe	141
PID 2120 wrote to memory of 2304	2120	msedge.exe	142
PID 2120 wrote to memory of 2304	2120	msedge.exe	142
PID 2120 wrote to memory of 1760	2120	msedge.exe	143
PID 2120 wrote to memory of 1760	2120	msedge.exe	143
PID 2120 wrote to memory of 4964	2120	msedge.exe	144

C:\Users\Admin\AppData\Local\Temp\2026-08-16_6d6ad1ee5c2f8b52304be81c9477f7ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_6d6ad1ee5c2f8b52304be81c9477f7ff_cryptbot_icedid_luca-stealer_njrat_stealc.exe"
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\INSTALL.cmd" "
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\system32\mode.com
    mode con:cols=100 lines=15
    3⤵
    PID:5836
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\pdfFactory.Pro.v9.32.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\pdfFactory.Pro.v9.32.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\setup-x64.exe
      "C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\setup-x64.exe" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1432
    - - C:\Program Files\FinePrint Software\pdfFactory9\fppdis9.exe
        
        "C:\Program Files\FinePrint Software\pdfFactory9\fppdis9.exe" /source=Install /runonce
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:4180
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\FinePrint.v12.32.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\FinePrint.v12.32.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\FinePrint\setup-x64.exe
      "C:\Users\Admin\AppData\Local\Temp\FinePrint\setup-x64.exe" /silent
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\Program Files\FinePrint Software\FinePrint12\fpdisp12.exe
        
        "C:\Program Files\FinePrint Software\FinePrint12\fpdisp12.exe" /source=Install /runonce
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4924
- - C:\Windows\system32\chcp.com
    Chcp 65001
    3⤵
    PID:4364
- - C:\Windows\system32\wscript.exe
    wscript //nologo "C:\Users\Admin\AppData\Local\Temp\Msg.vbs" " ?? mr professor" " Installation, & Activation SuccessFully ??" " Silent Install " " ?? absba.co/vb ?? mr professor ??" >nul 2>&1 && del "C:\Users\Admin\AppData\Local\Temp\Msg.vbs" 2>nul
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:5808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://absba.co/vb/
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ff9d17dc188,0x7ff9d17dc194,0x7ff9d17dc1a0
      4⤵
      PID:6028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2096,i,17169402137720930293,18137899475043424452,262144 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
      4⤵
      PID:2436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,8167687500304920453,10941526383178678811,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:11
      4⤵
      System Time Discovery
      PID:5976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,11992098922072760954,5835524520130200422,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,11075492371350467503,12988058330845908569,2097152 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,16653487232356117942,7729365108119202588,2097152 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
      4⤵
      PID:5772
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,6042367869044927521,6014353207735746619,2097152 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,6384688871561405814,13942235792459888125,2097152 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
      4⤵
      PID:2200
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,15503983115157643515,16412361881811548165,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:14
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,5050843644379105359,12260083398558327187,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
      4⤵
      PID:4868
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,9254648577198678500,13077549541001609353,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
      4⤵
      PID:2312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9161216796266698738,9212849270873407986,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:5692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9161216796266698738,9212849270873407986,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:4496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6272,i,1299470540259844083,6577756343317600830,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
      4⤵
      PID:3664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,1223453622366487450,2167252505685684555,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
      4⤵
      PID:3140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4272,i,4444873572218751331,10737599363240330849,2097152 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
      4⤵
      PID:4604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4644,i,3791573326755587431,6209321822886666126,2097152 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
      4⤵
      PID:4980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6344,i,6514811653847859023,5673806101199112863,2097152 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1276,i,15417366795041020959,13909429310007753548,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:14
      4⤵
      PID:256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,7166580340102517266,6083677638341266519,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:14
      4⤵
      PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,18376650780883828649,18032439198647795725,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:14
      4⤵
      PID:5652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,14314907477492378064,17720545145998584083,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:12
      4⤵
      PID:1604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,6474644665823285188,14007436673479130007,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
      4⤵
      PID:4928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,16368637624380058751,17026252550658245605,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
      4⤵
      PID:2652
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,13857242672959712620,17062463480446957801,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
      4⤵
      PID:2304
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,9788376891543415738,4546503831608630642,524288 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:14
      4⤵
      PID:1760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7068,i,5559006933081877401,8492323322237450284,262144 --field-trial-handle=2576,i,16638150846268556431,16224051360046627665,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:5040

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{fe654587-bb9c-e94b-8d3c-ed12938fb361}\fpp9_x64_driver.inf" "9" "4e9729d23" "0000000000000164" "WinSta0\Default" "000000000000017C" "208" "C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:3164

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{7d2a8106-f322-574e-9640-f39123f839a2}\fp12_x64_driver.inf" "9" "4bbfe247f" "0000000000000164" "WinSta0\Default" "000000000000017C" "208" "C:\Users\Admin\AppData\Local\Temp\FinePrint\x64"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

fpp9.ini

Path C:\ProgramData\FinePrint Software\pdfFactory9\fpp9.ini
Size 74B
SHA256 7e92374f569f781c7d4153281faa3238e36c0e3dadf6ce6a1aa4f245ad8dea36
MD5 581ebc06aebe62b1d64929ec2c36f3dc
SHA1 187ecb5abdb72278ac7ae263ba16403d614e4118
SHA512 448c773802af66583945b4c9420cd2c7517d16a9b823cd7db27efbb5d4587ff1a199a120514de286454e648ede1528ac18cc59891b3675878960aea71f66aa9f
TLSH
T10AA022AAE000220308C0B0C3CE80C28082F88802AE0F0E00C2ACFCA200320C3C08C00E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0ab53b98845a10d0f2dbd2e5bfa8354e7c39a74c00ce4a41dbbc07cc5210265c
MD5 c62b2fceba713195ce575205a4d049a3
SHA1 40828a1925986041f3f5f4e63d0cc66bfe144a59
SHA512 ab2382abe32845b313c536734f7d4f7700e9f436571aff3b64ca9aac795c2d2698c80ca35a4aa2c27fed1cc5bf3edeb4758b362f3e4ade9f4edd76fbcb2ce19e
TLSH
T13D41BBA0471B0DF0DBD940FC60D9AD09B3F624E902477F73435829B9AC4EB906BC9E04
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ac12e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5ac12e.TMP
Size 1KB
SHA256 65dfe6364f492f9a652628f21a08a8248541702236d3fbdb267e9daf0c9a5356
MD5 669f02921bd1a33013939690ec209b49
SHA1 9d8d2c34a3ff63bc06d1da1cd84bdec7528c87a4
SHA512 0d114e6a4126aff09a991341858732971e70940a7868f1f53b0381c86edc2c28018c277be6c8aac5ac2586d5e1a555406720040a8f597b3d2e97c26e41626760
TLSH
T1C83182A04B2B0EE1D3DA41F1A0D9ED9D33F7A4E8054B7F72864862B8AC0D3125BD9E00
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6a37095c2c87b6253ec34fbb6b95cdf334fe91b5ef6dbb50355b577d7559de0a
MD5 644f1365f5ac31aa07e0d0cffe8e6546
SHA1 db7b077a9e3c9e64d7a35fdd723cffc1a79ef9bb
SHA512 452c83a21dcf68a06b56483e811f1b90f3799f5fb26584fddcdb0998bedb7250d5441c4fa8d8b9e693e59048d21c5e265d8c1157c471890483d149bfb4c3a575
TLSH
T14A31BEF3C6E8567D894146F87B143E2BCE2D0955832C7D5AC8D4AF5FA3E1871D28094E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 12c8d6b5bf6d5a40151436bf8098a058b7557b00f591fe1954280fdd78b563fe
MD5 5202aef54af5fe31dacbd76c5a93f094
SHA1 fdae9244107e81404c71c9c0dcfbd4fe15c19ad8
SHA512 4bf7c576dd5173cc1b5b18c38966c651c983fa949d3f0349de6a16002d38c912e08ab128b456e84bae60d6c53d42aef07f1447d904ec377affaec2747680f3d9
SSDEEP 192:DhAlyXJqHeSJeoNJhkJis0RVaajhnkzDWfsnirPV3+g+WyP11oXPBiuy/llPirKN:DhAly5qHeKeoNJhkJisMVaa5kzDWfsnL
TLSH
T1AF229FF3C3F88A6EC81661F4A618AE1FED1D0615427C3C4AC5D49E8BABE1470D191E5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ff51370158e57178294299801726792b9b43b9a4b3aba6ea246d670481deb31c
MD5 f7c488b6f5accf1602e43821c08ef69b
SHA1 ba9886dc62796cf0e3459f5ab1231cc052b9a4ae
SHA512 ad1f81dfe9480aeea3503f63204c4777f7b6ab283c790573d89e2c14df3f77faed0dd897072fdb78b6827bdcbaf4df8405f01af8977c2c0f4d4f6b5ff58cd0a8
SSDEEP 192:sxRgR3Cg/fxsc5KqdZ0UBkfEzoA8pZlJ/g6+WNx6+/QyhKZFLQyCGJIgVcaJ:sxRg8g/fxsc5KqT0UB2t/55/q71
TLSH
T11342C9166D68AD7B5CC7D219FA15BF53E3F92033A1901E48AAFC8A1C04EB6DD520790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c63e19d4aa0f0cd9fc5abce612d728c90ce4d873cada715ec6c9fd4c8b4bea38
MD5 d5662ba491fe3ef8d76afb6e97b0de40
SHA1 b839e7046878d711a1aec75167c24670972f7b46
SHA512 359acb7fbd9ec98c498b211c2cdeedf7e756b8f94f7a206fbf43aea0a267eec22f35930e4330e141929bafc4a47a0c165b6891bc76900bca341c7a0702f67124
SSDEEP 192:sxRnR3Cg/fxsCp5KqdZ0UBkfEzoA8pZlJ/g6+WNx6+/QyhKZFLQyCGJIgD+caJ:sxRn8g/fxs85KqT0UB2t/55/q7I
TLSH
T1B242C9166D68AD7B5CC7D219FA15BF53E3F92033A1A01E48AAFC8A1C04DB6DD520790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3444fcc6496d82fe4c318ac31794fd7e4b0b16f9e1ed55ec94e8a742e7cf6bfc
MD5 88e89bb5caf87b16f6f9a6825bc3125a
SHA1 bd1a6e39a87b05745429eb7a2881c90f804866f5
SHA512 586e399f3fafbd478bd5f8d2476801244f2ad1006bbd340dcbda14ba365e001812924b2ef99e77a56dd949ce0227b79395c923d96831fdc3360e7420c4a55a7d
SSDEEP 192:sxRnR3Cg/fxsCp5KKdZ0UBkfEzoA8pZlJ/g6+WNx6+/2tGylENwtKkKRZFLPkCGk:sxRn8g/fxs85KKT0UB2t/55/Zkq
TLSH
T19252C85669285D7B5CC7E219FA15BB63E3F92033A1A01E84AAFCCE1C00E76DD610790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 621723e92d7379924b53b8ae163413d61db99a9f5a3a72eb6a33894d97ddad47
MD5 b0b34bd4826b4223108747c6ffd08fc5
SHA1 50816109b4c4021f50af7c51fc99fde273cd0748
SHA512 54eba6658861f894acb99085b3e3b32690bb66b34066208b17e6ccf997f45f98efd5c29f43e6bddda46d6813cb9b8eabfd8994d71f08e2f2b4454370a9e3f291
SSDEEP 768:K80Eo67pLuL7FwWgNhfVN8F1+UoAYDCx9Tuqh0VfUC9xbog/OV24owLWiroLnAH:K80EoSE7FwWgNhfVNu1jaZ4ogW5LnAH
TLSH
T174D2D97B640DCB7E4F804ADDAC197E9F6DA802CB96D8C98047FE845C02C6BEB51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2db5ba267d086da0f8731713ddfb1b12973974cc72c2a37bf681bf418a9bc846
MD5 2c61a3dce2fb9ee8efca1ed42697acdc
SHA1 c60495d4e93f5ea06b10656b7a15db31990fdeaf
SHA512 bf558cff2db38c0b49057a14a27959bac42b1ed841cec23a65c45334f5331ce18765b7ddcf97237af35c83f9812bb845c353a41573af1378d80bc237090f4153
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5F8HtaTHd3LfWTI2gPfK4Ogxfc1NAjij+KQ0L:C3gFB31lERe1JDggH2vHG5F8HtaTHd3o
TLSH
T165913250357B42903C3E664D807DDB1B9683B5623118F83B3BA852668FA7E025DFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5aec36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5aec36.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5c629458709e5f6916d508b8546abc5b175d432d9eae8744232959da89d84c6d
MD5 f3fa8a6b2fc01df6521b6fda7b482bf5
SHA1 efafef4a4cea3f932cba85e9e1b84841651bcc29
SHA512 4595cfd94f14aab558f75a00de5267214f2733277835ac87977d05928b197eb4d9751a8dc4e9fb32dbb4525bfd8145f12ce62c3916c5247e89fefe8ae698841c
SSDEEP 768:grv+4UNbdH3RL+LeSFOUAReX4fouOToPvB2thtA9VAwOeVH1SlX:gbsbh3ssnnwthttrEH1Y
TLSH
T11303CF32A8AC8A33DDE6D388320B72572FF4915395900FC49DDD2B4D069B9DE470BD6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 3fe8247cf55f6d6d3d3e19f8ea0fcce627abb1b01d194977c97ada8fc0d62bce
MD5 1970e17775e5889b2001f6743b153e68
SHA1 f9637c640a3b97bca3646fa884676f6b77aa6cf2
SHA512 69a91895121405d9689cb1fd6369adc584d47e08204548d5018356c4129fecf47a9fc3f6d6891f29eaa011d30333bec99f7d01f61410ff0b9a4203fb19cb7a28
SSDEEP 768:vrv+4UNbdH3de+LeSFOUAtX4fouOToPvB2thtA9VABceVH1SlX:vbsbh3asnnwthttCEH1Y
TLSH
T10903CF72A4AD8D33EDD6D288710B72832FF4506398900FC4DDD95B4D0687A9E1B0FC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0d29330ac979abeb251a2b1ee41aed46f95f4fe0b8c963036f703332023bd253
MD5 fa083f20256eb774511b0fc36d6d3fe6
SHA1 946a55670aa9ebd1db40276a780008b776255b5a
SHA512 b57a707233525cf1cf2764cdcdff9554d63b0d6a473c8e19eaa4877c31907cebfb699e5c5de6ce361047b31792f3efd321c05b6e3a74b3fc6ad9b982dfe5c17b
SSDEEP 768:mH3f8Q+LeSFOUArX4fouOToPvB2thtA9VAgcPi9P2u:mH3jsnnwthttRPo
TLSH
T112F2B0B0A9AD9D63ECDAD395720A33C66FF05063E4D01FC4AADD971D058769E0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 1f121292d863ba077c6102a76d6effb9c1a689bb771bccf760224ed89ac15083
MD5 183c52c2834ddd95bcabad549875cb5b
SHA1 91a3ea42bee3238715620a9c137d94b382c02c43
SHA512 aaf3346267fa19166da14b0b50ab3f0e281df9cf6aaf6ee362b072527f595110c0623698e28f16808261ffc372328f162f760ef345c0ccd37cb95877faa95f03
SSDEEP 768:/H34MQ+LeSFOUArX4fouOToPvB2thtA9VAgcPi9P2u:/H3WsnnwthttRPo
TLSH
T10CF2B0B1A9AD9D63ECDAD394720A33C66FF05063E4D01FC4AADD971D058769E0B0BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 93f1278bbdf7f40e2614501e92f120bcfbc0d0e8307551cef327aa5168c5c77f
MD5 e776002be69cb11686dbd0f13e2f681e
SHA1 539dd242d3270a5a049ece60e5c25e3c4d5b4169
SHA512 d75892c9b5c091f167fdabdcf778c176fc51e5e6a01621393fa7ef1b8c616ace0b1497ac7bc60359a039ac34b9a3b899e58bc80050781f9f4720d67e3150bdc6
SSDEEP 768:eFQW3kwgW3ZE1OUA6X4fouOToPvB2thtA9VAgcPi9P2u:1W34snnwthttRPo
TLSH
T1E11339F194DB8977E89E9787633D2E469AFCD063B4845A84BBC85D0CCC825BFC70A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 372B
SHA256 dc86dff8fbd3b224794d65e8c0974ffa3b17c53a934c92f82e938e524fe823dd
MD5 80c2dfaf9affc09798a4976ae70f1b0b
SHA1 80daf1112206b189525aa4f5b380fbbba97b583a
SHA512 be5ed753856621e4dc5b64324872539291704bf5d2a415ac993b5f475db90e958544f281ac36d3e17af93c554895ceeaccf6fa9b0839d21c60a38443b2081876
TLSH
T15FE06880883D0EC2EBB60A5FE40706FC40C8491AB498187804CEF899A03B0973115C7D
MD5 SHA1 SHA512 TLSH

Submit Download

5a7ccbc4-4e41-4cf9-963f-4d3216d77018.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5a7ccbc4-4e41-4cf9-963f-4d3216d77018.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

INSTALL.cmd

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\INSTALL.cmd
Size 947B
SHA256 25a31c5ead06d13a57f3196173b6adff7760f81f1b6dc6e15a7822a71fa5262d
MD5 32b92bf9018ffe7d14173f73f4bf4328
SHA1 ab110e1aa4f1ed3ee24aaa4966a2a264220de8d2
SHA512 ed974f19ee3f9c1c541965b12fa7fc232147f04588ad1686f7a8e9a7adf530d157ab4d1e23fbfa72959ba6828846d0fe6d5ce32dba267a7293a89c9ec04e9265
TLSH
T16C118CAA7C14EC0602A70B451D76D94FF599C697AA525C80B18F943F27403CD7F8DE87
MD5 SHA1 SHA512 TLSH

Submit Download

pdfFactory.Pro.v9.32.exe

Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\pdfFactory.Pro.v9.32.exe
Size 11.8MB
SHA256 5878390f35b3776ee1643c71973ef201426ad0c2627487013ebe0727af501e40
MD5 ce0b13caf86888d13af446de08d6afb2
SHA1 9025bcc64ddf84b1d0874c2b77efc599a204a7a1
SHA512 dc933dc628a8630a2b60f6f816e8f7599117ed09fc3f92ec6d658599f92d1294f3a428f1eb743f5060cdda82a95617f32f7b58f4a3bc240cf520344a920d7fb6
SSDEEP 196608:GbZAHVJ5KUnPOCk8lonMoZIVEOL5cuaEdvy4JwyjgZy5sQlISmDuZtiH9WiZ4ISi:GoNnXGTOLuufYaziQlI79D4I6ob
TLSH
T1C0C6332EE46528B5D13096FF0B27DA738D5CBCCB0595C40A0296F6B7583C7C7A32862B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9AE1.tmp\System.dll
Size 12KB
SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
MD5 6d08f0d5503bb100b8429fefaad163a6
SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
TLSH
T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fp2pdf9-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fp2pdf9-x64.dll
Size 4.2MB
SHA256 0c948fcde23d3d6335ffe84e78b5d0450173c06763166300d31841096d7e8a05
MD5 76581ecc5eecc32f0336437dd14d2e01
SHA1 fa19b6805f918145075df4af4bb4c603739ab0c6
SHA512 a7a432d5bd2a318402e4a0073130209d986cfbcb05708f99da7da4ca1b0df0d278f7990ffb72161e754a766a521166373c94a1a50e710f3b5d264a8972f6566f
SSDEEP 98304:y9gnGABAz/Vi9TRWY03Q7MfwcA3f01MuJixf5:AgnGJLt3QQf7A3fpuJiz
TLSH
T111266C46B6BB30B5C4B6F078C5AF4B17D6B27C110F3196EB02A066261F23BDC563A395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fp2pdf9-x86.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fp2pdf9-x86.dll
Size 3.8MB
SHA256 80c629c82abe5e3a1c3b70c9d4da159ebba33881214b664f19e3802fe3e35a00
MD5 9cb7346f832534ccd3eeb203ff10a2cf
SHA1 fce3fa666b850968851646dab8520fa4476058c2
SHA512 678244b2cb237078875e20341af1846184b054c7d53dc3cfa6ad595435de28fcbf17c45b2396b78f5384da68984c9082a2e74b95105f6af7b100ac03309099ac
SSDEEP 49152:f3t31AB7yKpMvKwbiGkmsY/0rM0HYGcNJy8Aa9H7guw1XhxcQl/2bGZt9cGKx0EO:f3zAGgMvKoEG0mEa9H7gdXPcy2bGr
TLSH
T13C067C21B833F032D99D3071A6BE9BBE456D5E310F2694E3A3C438255D708CA6735BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fpp9-pdf2fp-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fpp9-pdf2fp-x64.dll
Size 5.4MB
SHA256 557a8c92fc75daea976173a7e6205bd962cd60ace25745acf3617e61a824004b
MD5 75eef53e4bfa0277bc9c65ce40e5ec29
SHA1 ae5217ef6b9f352ff65328b2662302aee1cec212
SHA512 afa04de253d9ee046c825924209b97005668b850e84218c5d9ae4b4395be808b3330d0af6f82df53ed61b4b314dfdc4e2aec18fc814780b572a3c30fd6814660
SSDEEP 98304:GP+f5TjPAZA9rlLyaxOvpd+1ISUWPk1tvoo1:vf5vPAZSmF+mSUWPktwq
TLSH
T121468D5965B630A9D0B6F039C69F8A17E6F278150F3187CF029056762F23BE85A7F360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fpp9-pdf2fp-x86.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fpp9-pdf2fp-x86.dll
Size 4.7MB
SHA256 d17c6a0c2436cb9f7f3e15ee0e987052bea9195f7f510511e9da68d1d1a4e0ed
MD5 37110729353d52c4e95c414a926c5136
SHA1 08d69fd9eb21936c7968a20c36e917f7b3ea02f0
SHA512 4c018638361c3b859540cfaf4fc8ee284a25f22ce0ba0b6c966eea832db5b3b4c818beeafb2449d7eff58270a6f6123122876e7ce270b40388932d48cb509324
SSDEEP 49152:3biIKIYq5Vzq9jNYNvOZu68qqYG+zCCNwRHQ5R8jSPgVurNB67YVkm0b9j3Vsw/h:7d5VzyjN6p6t8uPgkBB67Yibpew
TLSH
T130367C20B563F036D86E3071A9BD9BBEA0296E350F3540D3D3C4396A69705D72335BAB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppdata9-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppdata9-x64.dll
Size 792KB
SHA256 b36170235972b1b4712ce2a1c4cb0cb738c322a457eb476422dcd9d31cd43712
MD5 2d5c2a3b5104a13b13231a86043cf186
SHA1 335abab63cf6e2859b7bac2c988e914e8b8d008c
SHA512 e77005130e2ef6ec79afa2696346f438c4b1f0b735c4dd5e7be3c4551451f48138511ed606fa80b734456578fb8510307880697e8742507dafa76cc98588198e
SSDEEP 24576:Q4s2d1U5G0xuNBK3IOivkaZaYIOoHSFq1Xgo:QwivwXaYahwo
TLSH
T1740533B16A782998F1D26630D0907BBF7B6C9D10FE9B928774C091313A93CC67647F68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppdata932.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppdata932.dll
Size 792KB
SHA256 70ecd3393a2c0edb619ec1a977f61628a25f621dfe2899b75d57f52cde7c4dbb
MD5 1136e713af23db050ebc954744b12149
SHA1 ab9ede83bcc4a84158f492680f4f010bd2f16e4a
SHA512 611651e4502e64ecc3c032e5344f2de92fa36e519165f56eee7c408a997f48f1fb8a1737aeb4e6a5a3deceaa84643e39e4057d3a1a177b16b9a94e67130636cc
SSDEEP 24576:u4s2d1U5G0xuNBK3IOivkaZaYIOoHSFq1Xg5:uwivwXaYahw5
TLSH
T1900533B16A782998F1D26230D0907BBF7B6C9D10FE9B928774C091313A93CD67647F68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppdes9-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppdes9-x64.dll
Size 2.4MB
SHA256 f578d121c1ddf03956e4cc1b0b3f93de23a940c9b54f043d4d759c53757f25b0
MD5 ba6a14a1d11533dd426dee89d5888f0b
SHA1 d0bec19714ef7ba1782559a90c49b6e4d27e0afb
SHA512 cc59147fb2718039f1e432cd6fe9e2f25e2c03625efa6008931f9952ee30977906801a6d570739cc50e0de5632fce4b92e9591727e82a5802ebf81c8c86de4a1
SSDEEP 49152:5i1q5N2w4IyysXsSqbHZPTd7+7sXsxERKoI3Sqp53YwZPhpCAP5aoDjb:iVEdrZPTR+7sXsxERKoeSidd
TLSH
T17BB57B5AB6BD01E8D4B6D13CC953451BE6F27C110721ABDF02A09BAA6F37BE5063E311
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppdes9-x86.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppdes9-x86.dll
Size 2.1MB
SHA256 43ab2318652c3193d46759313c7c7550f5bddf0b1f59de161402122ad03ab5e2
MD5 95220362cc8ce569e24d8432ee7c4430
SHA1 bdf00096e136dfb9ca05efb4516a88d238181bdd
SHA512 aa4afcf4df54bd33f05407ed60418c99fbf007069b1dddd3fb6f229206296cea4687c7f5dc11ada9512821183b7ea68e9b23731285c455f851e827433150d072
SSDEEP 49152:ikoe4UDvUMvwkfBzrREi8i4jnj/n4fMP:ikf4UvVBz+FiWjf4
TLSH
T19BA59E20F9428137D9AA0071E67C6AAF557C6E350B7566C3E3C4BEB92C744C22B39B17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppdis9-x64.exe

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppdis9-x64.exe
Size 1.7MB
SHA256 a401a75770934d10e193e50e0a128ad49b3e94f89e2495e78b68151605787d57
MD5 d73cc797e4631befa1cab07bdba41c5e
SHA1 3c0c1a2588612b40b9266a8701f28ad3acf77fe1
SHA512 24b84f7c6ba5869b709b1bef0dd3d0f777518af27cce166fdf537560533543d6c9ebf678c76f1a70f8dc0e4e1d3a98ea605588136d9965759c5fa280c9551ebe
SSDEEP 24576:8s+eodx1Y8R5Ko+X/OwwquyF6HfzGMFNUVnaG4gkktD5d5FIRo2FD:8sbo/1Y8RY928uyFIbD8aG45Uh+Ro2F
TLSH
T125856F47D1E80195F3E691BB84634B3ADFA268E1C321C6DB015DE6F53B2E6D049FA231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppent9a-x86.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppent9a-x86.dll
Size 96KB
SHA256 5fa0e9a4a37706d698a21a5b1bc9121007c3231721583f1237db3299abcbba7a
MD5 68b485f60fe698c699f1c7a7adb4880a
SHA1 22bfc2a142cec93f4412cd056d78ce984777c4b0
SHA512 c05b070b4863fc5a9d16ec25727466701e92d624b392619eb2a98908f0ab6464c5d88c1410e8d83928c2d1022a4353898dbf72fa975ab2f4b0749dae3c1bd4ae
SSDEEP 3072:f1MwF4nRzmrhbQO/nBoD2epUfwsoVQTehjJ:dMwF+zmVsGmCtWVQTev
TLSH
T1C1A36A0075E0D439D9BE19361864D9759B3EB950DFE0CCEB378906AE4F302C1EE35A6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fpphelp9-x86.exe

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fpphelp9-x86.exe
Size 1.1MB
SHA256 f71acd934d622076acc881ada4b0f22faef94d6404070e669e05b1e257c8acb0
MD5 25503c120e0ea1efdf1b0ccd654317e4
SHA1 fbe30069f1577d845c177a36d64356eae95f2f66
SHA512 0b18e6086fa8bd31f0ad8a593ca890b20d7c38a90d5df4bc0e7d80214fa695c1b85229651165e25f4ab996f31bff8fc60a9344e32d72a53129f4aa31e2fda94d
SSDEEP 24576:g39oCS5UceA5KQj1n2Q672SPTh9Z9eZhAo:HZbUFFN9Z9ezN
TLSH
T14E351723E5C28122F7E101B3497A5F766F2B69F0C766D4D7028CE6F9366C0E11AE4636
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppmon9-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppmon9-x64.dll
Size 148KB
SHA256 c77826bec5d8360d7ed2aa6a7dcdae51de811ca0c8d0ff1148685a55d176856e
MD5 7ad651fcfba09841eb672f588b54e3e1
SHA1 f0c60f8a9d8b29cef4a2fdea820bf69de183f78b
SHA512 110e0ba5e7a08a782aade3cc96449e5749fec45b11fea637249b9713ac516d9909fa9d2e64f2b85013b3c0b074a4e6b97f397371c4856b40d9e92108dd37f28d
SSDEEP 3072:uqtK9gt+7FXXNTUZHKBNTs+agStYlytaS8axf+ffQ5Qj:3E9go7/oCNQ+Wt+uWffQ5
TLSH
T1ECE36C57B2F500BBE5779638C9A70A46E7B3785507609BEF03A0425A2F237D14E3AB31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppmon9-x86.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppmon9-x86.dll
Size 125KB
SHA256 234aff5783f93aaf81038411150cb68ad8ce1094ef34929a6c04b2ac64d34591
MD5 c0b2ab37f93f91ba6e4fd9f22eae17e6
SHA1 03427a475051ef4ff0f85025eeb444f4cf75dc56
SHA512 24061ec395b48dbc0416488879ac519bf28e3ef96c3b6ea9d9a23d419ddccb0994b55298b0898239274975ee55abe2b3ea07f1f8e58824cba88073216ce6fdd8
SSDEEP 3072:Z5P/qybHWtEyWnNCtQkp5Xyud1RH4hA1uQajLEs:DP/NWCy4NCS25jdT1uQGEs
TLSH
T16FC38D41B5C1C4B1D4BE48390824DA729B3E7970DFA09EDB339465FA9E302C19F35A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0404.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0404.dll
Size 1.0MB
SHA256 fa1db283b9ec8845081f810f7c0407d738acd073a7736a7d52e90af170d97b5b
MD5 3e0dd0dcdecb0758279c984bc7973509
SHA1 08f37e9df5d942c62dac1698811ad37796d5d413
SHA512 4e328c77b80a51018ac6b378753ed48cd95f8428067dd3ced6203a0a0fc02bf319a406d4fd4ed8d8676dbf5f995ea9c5797f2e8c910b657434af4dcad6df8db8
SSDEEP 1536:1vRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzJhVgFQClA3UMeykQ7quUsc7/PKU:x4OIbl6LrQ0/UglOmpkz97hsjP
TLSH
T1CB35F593A1C55514FFE177B71A228BA62F5A7DE8A23081CE2069F6F93E7F18305C1532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0405.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0405.dll
Size 1.1MB
SHA256 f8d2a3a8564c82b99880b2be2a79a06bd455467e3bf8011488958ddfe3c60860
MD5 b05706af270ca663602e72af1357d8be
SHA1 07387ce430d1fdb689e4bdefd6118c25c4c8d9ef
SHA512 66f8c5cbd003266fb391b37c10315d10070e06445733b1219cbf4cbb4ef7004554a61203c65a46e695df26bc44f9924b4aba4b25682f89ccbf28ca94ad9e71f2
SSDEEP 3072:R4OIbl6LrQ0/UglOmpkzv/WNVnvEDWjr5:RyELrQ0/UglOYB35
TLSH
T1B4350553A1D55514FFE177B71A228BA62F5A7DE8A23081CE2029F6F93E7F58304C1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0406.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0406.dll
Size 1.0MB
SHA256 d330d8ffcf6df9da203a768441323bafa85699186006cb5db0683197b0d324af
MD5 79fa321de40f615db57d38dc1737d393
SHA1 e94937740882f930d81c62ebec05c37e7bd90545
SHA512 196b53b799ad6ca098d42174b8ae6b2b4771cb6dfcc581b3598fd42397564f3b3effd83f2b624ad72d42368023c4c5888cb37e8356723bb2f83944465c9a7395
SSDEEP 3072:oX4OIbl6LrQ0/UglOmpkzyyF2ocNwvDjI:qyELrQ0/UglOYH
TLSH
T130350553A1C55514FFE177B31A228BA62F5A7DE8A13081CE2029F6F93E7F68305D1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0407.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0407.dll
Size 1.1MB
SHA256 514671e0c0d7d0212766ed809b541cfb8751fff7e5c94e0d9f1e7a389eb90e23
MD5 1114bdea9b0fe24e7f46a31b45ac5b72
SHA1 10ba7c34d880545fdd57d0cf93eb5b37c9b30570
SHA512 6a45ea4324d883a95d1979b29c76d6d21b7f96331aff7baf904e4aa5f96d5caa94752b44e5577a146ad4d244b59142a900f48699177bf43fcec72c8ea3a82c51
SSDEEP 3072:YQ4OIbl6LrQ0/UglOmpkzh4MTv8izkubYI08z3BWVHF7laNPI49p5bjM:pyELrQ0/UglOY3
TLSH
T188350553A2C55514FFE177B31A628BA62F5A7DE8A13081CE2029F6F93E7F58305C1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-040c.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-040c.dll
Size 1.1MB
SHA256 0125065ff680c23154f63253cb793655809d13aaf174b0e70d99a86e5b2fbf24
MD5 5f416037c3d043e3bca448504f241995
SHA1 cfcbb9f636e0492fdb61d2a179a1ce9d9fbbfd27
SHA512 0150cd3f7148e072a1ea52731c9fd2bbc15c9c312de263adbba26e04fbe9bea06efe980a61cb8b4d7de63c99f76db49955375ec712b21501f001146b1fdf17b4
SSDEEP 1536:WRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzIp5ehr+FX7quEo37/La:04OIbl6LrQ0/UglOmpkzQV7hDjLa
TLSH
T1FE350553A2C55514FFE177B31A228BA62F5A7CE8953081CE2029F6F93E7F68305D1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0410.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0410.dll
Size 1.1MB
SHA256 4ab0cca9d84204a6ffcfd9e8998ef7ae3e5900fd8062001848195a8587d08e7d
MD5 96af5a5dbefdb30c5c67f53815aaaa0e
SHA1 4819e4d2b71a82c07104ab555a71373975551e39
SHA512 a538d9cbb5e3821d6e072362c215f2e95d7bb9597ee9a2f69481d6a2c7a2539173404e144e3ba98d601f9202c5496e4bd06c43bfad1677d2c846734bf6d5d98a
SSDEEP 1536:1HRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTz992YYzqeO5b+tvoa7/M:1X4OIbl6LrQ0/UglOmpkzsjjM
TLSH
T1D8350553A1D55514FFE277B31A228BA61F6A7DE8A13081CE2029F6F93E7F58305D0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0411.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0411.dll
Size 1.0MB
SHA256 b04de03b29fa689e54bf295b2b06389f1b423dd29ee8ec9ca0ef209b1a4dccd5
MD5 23800f89913b9a29e11f55e399e1af0b
SHA1 b92bf545ebd9ee1d1f5f11d7c9814dac45468e58
SHA512 c1979312d9eb8a8085fa1042882a67963f76732e7bd6ba133fd09de07f67edbc145c9bbbaf86fe743c72f56d9e1c21e7e21f2dafdf049db6dcb1aadf9de56a55
SSDEEP 1536:1lRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzVwmIoBSTGVXPeKuB7quEoQ7/Gv:1x4OIbl6LrQ0/UglOmpkzWjoBS7hUjs
TLSH
T103350493A1C55514FFE177B71A228BA62F5A7DE8A13081CE2069FAF93E7F18305C1532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0412.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0412.dll
Size 1.0MB
SHA256 e7e5dec67641b8c4fa42da8f5888d224daeb482562439926d1231fd21b53bdcd
MD5 b16deda9acb5ae6d8d7a2dddf68a1bb3
SHA1 ca58378f3fcfb0b4cccc91ebdb6c7bad56c0ead0
SHA512 db8067000604615dfeaa7ddfe4149e8134cdd9a26730d079acaa04c3e64dacfec9bed0375f86fe431d83104bd24dce7485745689b13f4727e337f7a202c1de45
SSDEEP 1536:pRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzC9l7bEskz0kcg2ikPwmMQkaYbe8M:94OIbl6LrQ0/UglOmpkzea7hkjE4
TLSH
T16035F493A1C55514FFE177B71A628BAA2F5A7DE8A13081CE2029F6F93E7F18305C1532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0413.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0413.dll
Size 1.1MB
SHA256 a094678ba5c0a9921752673a005dd94ab4e58c11c94cffe0b0c9505f686d169f
MD5 eabd7ab191175296960f3bcf58448799
SHA1 16dedf05bbce340f42fd1c65a92f126e65e5cd0a
SHA512 dcd78ea407789f39c1fe5aa8c1362ad9d6a135c2ab2fe04671333c647cca2eae202ab8ef4999ea1c0a389ad437b0264cbb08117de117cd1506e32c388d4401a9
SSDEEP 3072:74OIbl6LrQ0/UglOmpkzAJZxrn+XtEuSDbuj+y:7yELrQ0/UglOYG0e
TLSH
T160350553A1D55514FFE177B31A628BA62F5A7CE8A13081CE2029F6F93E7F68305C1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0415.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0415.dll
Size 1.1MB
SHA256 d76cdbdece8cff6d739b5cac1804b33a1714a812a64e40a746b0c9500ea4efdc
MD5 45bd407818f269d5201962eebbd91547
SHA1 9e392ae8eb6f976f55fa11bb67b771f3bd032d02
SHA512 0d1e0b2096fbe137326fb7396d23bea6e0792bc61e44939aedffd9b495ce0b098d56871c9c351400743216d2be2de76cc2b1fff4bcd9c3300bfbf41a8033987c
SSDEEP 1536:nRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzksNnFJEOlgdXifAJoh7/DG:34OIbl6LrQ0/UglOmpkzZFlzjDG
TLSH
T117350553A1D55554FFE177B31A628BAA2F5A7DE8A13081CE2029F6F93E7F18305C0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0416.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0416.dll
Size 1.1MB
SHA256 a08cf78d857643d2f9ada565f6d35c8c306ad4436471ce4f819d4ac9a0287ae7
MD5 7e6606bf7a42ef9211e809a183aae805
SHA1 e82ed952b549a64ca503512b30d05bb6d599a3b5
SHA512 f3d607ad36894d0484e15ab3ac3e877b5a87791a0d5d07c22ec431af32acd80019132dd965a7cd69596c55fa747c8c1ae3bd39a0b33a944f54de3b9f1ffec81a
SSDEEP 1536:6RvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzSfg4ZLWI/OQQiboX7/Exs:g4OIbl6LrQ0/UglOmpkzGOjExs
TLSH
T1F8350553A1D55514FFE277B31A228BA61F6A7DE8A13081CD2029F6F93E7F68305D0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0419.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0419.dll
Size 1.1MB
SHA256 8633a28193a9ffb73de4dc2d618c78e00b5049a8cbbc2edbf4b4041801974c0d
MD5 43564aec825791e3faafe9c20a74e802
SHA1 1105c9072247adadec28a12838eb9ae11c51fa64
SHA512 7c489d3855cee691e66732d7a2ef3924618445b61e66706271fb3035b77f7e5421d21268413cdd31599c30a5b817e149339c9d800ce09d32c5fe79aab0894323
SSDEEP 1536:d9PIHRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzoB0wVZuLzOai57quEok7/:Hy4OIbl6LrQ0/UglOmpkzc0wv57hIj
TLSH
T11D351657A1D55514FFE177B31A228BA62F5A7DE8923081CE202AFAF93E7F19305C1132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-041b.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-041b.dll
Size 1.1MB
SHA256 ac56a66140cea50e5cd7080b4037924c6e66dab4ff58e8b7ea49b8d1e49eba04
MD5 e9a2fd396edd4a0de6d30005295461ce
SHA1 81d189c47dc8ff66ee1b0bd58e777b277d742259
SHA512 e1e497bba33caedd63a89e48126baeb633868a6a299d0a235bd2f4ce86af5277baeb4f63402ce2ba153aabb9391c41510f27ec1d7d208ae853e1360c56987b6f
SSDEEP 3072:s4OIbl6LrQ0/UglOmpkz7h3ds651IXGj:syELrQ0/UglOYCG
TLSH
T135350653A1D55514FFE277B71A228BA61F5A7CE8A23081CE2069F6F93E7F58305C0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-041d.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-041d.dll
Size 1.0MB
SHA256 d11d47cc12ba214e7e5258d6a347910142e9f69bab5be7900a15efa48d98ccb7
MD5 8841cca3525ee0428cbb05b9b7865978
SHA1 a01afe38e4413655c6da107ff1502e3a5462d6cb
SHA512 4d6cff42c909f3bf118e048ff423200b86acb45f61baba44e899ebedf4ffef5ca33d743e5666510bdce3819c2ca436f176dc7df1264acfe7d6ed83113ff46582
SSDEEP 3072:b4OIbl6LrQ0/UglOmpkzbI2jy5D4KsUwcAKPOE9D5jb3:byELrQ0/UglOY
TLSH
T1F2350593A1C55514FFE177B31A628BA62F5A7CE8A13081CE2029F6F93E7F58305D1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0804.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0804.dll
Size 1.0MB
SHA256 42516bad838bc9ab08b41f9ab6c59c345a1cf9dc91b8d84fbddec3fd6fce3cf7
MD5 dc7624e8b02ee2c0381c2b28d05f8ce1
SHA1 3562bb56ff4215d42bdd85e73fe10b0f134f58b1
SHA512 a4abadf504d9c799ef4ac29ad7e09e86941ecb817f928f4e4fbe9fed32ceb094f9ec10bb535ed1050b84de5cc14272c828cf3e15173c4202a1f342b5aeb91aea
SSDEEP 1536:VRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzgBgZOumoWEH+s2oC7/:B4OIbl6LrQ0/UglOmpkzkgOj
TLSH
T1EA35F453A1C55518FFE177B71A228BA62F5A7DE8913081CE6029FAFA3E7F18305C1532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64-0c0a.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64-0c0a.dll
Size 1.1MB
SHA256 446d1ffe9e5425811ace2bb4cf0b4ad4167e5a1fb085238d44cd715f6869e526
MD5 89c5680317c0440cb57b537db36601fb
SHA1 338a5f6603f103cbe09aa4e8b764b2e76fafc1e9
SHA512 9872538029e8264028b5a51130f1bc54de90cb80114ba23346b2de10b54376db972f24af0c9c9aad6e23d95328efd90c1dba85aca8460462388ef3567c8d9424
SSDEEP 1536:wy0RvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzCw58wXr8O61J7quEoy7/6fK:wH4OIbl6LrQ0/UglOmpkzLW7hujUK
TLSH
T1E4350553A2D55514FFE177B71A228BA61F2A7CE8A13081CD2029F6F93E7F58309D1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr9-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr9-x64.dll
Size 1.0MB
SHA256 7067b74939ce4a72cbb488ad3ea080bb580332b9a670d65754e0e35378dec855
MD5 b2d3b41bf381cc12fa4c94f100fdf473
SHA1 ceb85cbc1a5471b8146542f1cc0f603b03e5bd40
SHA512 3bce2af5357d78087265448f0b97d11261803451b0b80d47a21d48476edffd3957a4958ffa89ce269b716d44ac3d1c3987c0750f851077138451820f736f3d3a
SSDEEP 3072:wk4OIbl6LrQ0/UglOmpkz4DvBRYP7ZD4o15CgYc7hmj8Z:wkyELrQ0/UglOYpPa7hv
TLSH
T18C350593A1D55514FFE177B31A228BA62F5A7DE8A13081CE2029F6F93E7F58305D0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0404.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0404.dll
Size 1.0MB
SHA256 32c3b844f91033aa3dfd6a73bf256b7d094b99eee264eda0ffe51075d14117ea
MD5 02a75f95435c369ed0b1797daf2b877c
SHA1 14800d6e0eeb0c9c9815b2b12477266bd9df172e
SHA512 1fc40330423639e74603d26ff31915bed8f1c6db0bf76f2cbecbeadd4e505dadc7478cbca4a96e7e3418f510dd0c59f7e21004b2466e22311e4e83528f20aacf
SSDEEP 1536:PvRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzJhVgFQClA3UMeykQ7quUsr7/F:34OIbl6LrQ0/UglOmpkz97h7j
TLSH
T14635F593A1C55514FFE177B71A228BA62F5A7DE8A23081CE2069F6F93E7F18305C1532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0405.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0405.dll
Size 1.1MB
SHA256 524f623ab12a7b6a4b5896dab9516f174081b2c7b106f2b64f4917bff1708317
MD5 56f485aee9560b5c1f7edcd13eb31dd1
SHA1 3efaf96103ec98a8597fd14a1eed49bb71b06799
SHA512 fcf2cdcb444013353ea31d3ac6a7f8ded6755a62bad89bfc742c17f23748ebdf7ff2147824c49ceaae2653ab2360ade6c715c160d4c4bcd04b6394efa5f93905
SSDEEP 3072:k4OIbl6LrQ0/UglOmpkzv/WNVnvEDejtb:kyELrQ0/UglOYBd
TLSH
T1A0350553A1D55514FFE177B71A228BA62F5A7CE8A23081CE2029F6F93E7F58305C1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0406.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0406.dll
Size 1.0MB
SHA256 82f67355a70907e60afdcef9df2638bc618f04df3a442292a3a87911b6ff2486
MD5 46e677b3b9603117b6f942ca02164d9e
SHA1 137412d3fd70fbf7f592bae23d9cbf761691bf22
SHA512 a75d6169f885afd8cef092796059a1f65d30d14e4f62f76ff9907a95e15bb89b8c8016db4426db98fc8cccd6009231cd43405fc8b2ea0199a6cdb0a920661173
SSDEEP 3072:cX4OIbl6LrQ0/UglOmpkzyyF2ocNwvYjA:uyELrQ0/UglOYy
TLSH
T180350553A1C55514FFE177B31A228BA62F5A7DE8A13081CE2029F6F93E7F68305D1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0407.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0407.dll
Size 1.1MB
SHA256 58ae0e3cc3f93639d8a6161c0aa9f9df4c5c802c80e95bd29a69f114878cc9ef
MD5 68512d8b6c974819d5ba8596034e2e38
SHA1 16915c2d77c69d0f4843ba1562c8fba3ede159d9
SHA512 4aab969b28bc0619dc5be44aef854a8f1e89326c9de92912fa2376797a6626585aa87b59e89faac4725096ae6ffe7b0a658d3de923fa39fa1a195aa395f8d4a6
SSDEEP 3072:YY4OIbl6LrQ0/UglOmpkzh4MTv8izkubYI08z3BWVHF7laNPI49p5ejr:RyELrQ0/UglOY
TLSH
T12A350553A2C55514FFE177B31A628BA62F5A7DE8A13081CE2029F6F93E7F58305C1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-040c.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-040c.dll
Size 1.1MB
SHA256 cc5f98aa5b994d24f3fd21d94c51b17222a51d1e2faf5b4e0b9b79bffd4ca389
MD5 c8afff53cbdb66e70455208ca2a1c75a
SHA1 74905393295d03127429ec726fb271dfbef6bdae
SHA512 353a467c79e07a42e9d9bfdf377384d87d50a39b0f9a4243790c9a79d571c08799ed2d16e7ab2c2035d85d960e355633ad988b1683e0adddaf94f23b85ed0f62
SSDEEP 1536:vRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzIp5ehr+FX7quEoi7/V5:f4OIbl6LrQ0/UglOmpkzQV7h2jv
TLSH
T1A3350553A2C55514FFE177B31A228BA62F5A7CE8953081CE2029F6F93E7F68305D1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0410.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0410.dll
Size 1.1MB
SHA256 0a31477454fef0374164434631fe1f3b3a233b3e9079bbcc5755c0c431895295
MD5 629ed4f9403e68d6bfe038dee24b7ecc
SHA1 cf5d55632552c56915e9988523040b6dad20d0d2
SHA512 4c6f78f5daa6d60b84f790ff414e17031f73398a4fe3963264767b2896dbcfe2acf54429883e256756e02bf94a6383fd74d396b8fa17e20b5f97d740f0188fb9
SSDEEP 1536:oHRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTz992YYzqeO5b+tvod7/:oX4OIbl6LrQ0/UglOmpkzsYj
TLSH
T122350553A1D55514FFE277B31A228BA61F6A7DE8A13081CE2029F6F93E7F58305D0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0411.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0411.dll
Size 1.0MB
SHA256 574fc09c34d48d83634ffa064b4ce6caa7c879e8608a888bc2ca6f787a56eee7
MD5 812af40461df17f0de17406641b19f03
SHA1 62b1fcf735959473fbbac8ca852668310abd3365
SHA512 8cef0a087d9e763c19d42e76f8fb6a3a12b7b4e1b40024efd81418e6428243b5f91decbb27e773eb78fe8e04b59b31f9f5dec8d5d2de6d8f9e75349b688ddd6c
SSDEEP 1536:+lRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzVwmIoBSTGVXPeKuB7quEoB7/p:+x4OIbl6LrQ0/UglOmpkzWjoBS7hVjp
TLSH
T1D635F493A1C55514FFE177B71A228BA62F5A7DE8A13081CE2069FAF93E7F18305C1532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0412.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0412.dll
Size 1.0MB
SHA256 6b27ecd8a5b292e9fd51b9a64bbc2d49d6a021557bd2ff5a4c125848c641e619
MD5 ab7cf7ddb69883df3bccd2e25c2beb94
SHA1 ce589bc16699310786d4c109e5a8c62980141e71
SHA512 ae2f6e84b14fd4afffc00a286cfcee9d721e2bf7f524d6eeee6a3111573c1bbb83dbb01a6d589c1d476e934e708032e1d34acce991e69dd76d9ed4bbeed4a6d8
SSDEEP 1536:PRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzC9l7bEskz0kcg2ikPwmMQkaYbe8T:/4OIbl6LrQ0/UglOmpkzea7h2jte
TLSH
T1D535F493A1C55514FFE177B71A628BAA2F5A7DE8A13081CE2029F6F93E7F18305C1532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0413.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0413.dll
Size 1.1MB
SHA256 4678d425e86268d0779dfee90bfc9b2643a28fb545989c0944cd1ac967e63bef
MD5 c8ba97f5f0c7cae4f09a936affbb2837
SHA1 23f0316c0410c58d09e271420bcd8500c99aac6f
SHA512 e786c9ba5bac0179fd92994584320a5a817d3456c6079b3288a1d1ef08d6e7cd5d973355509b38ac156c0cdba3f51fcdeb1a067cede157fa53775690b3b84431
SSDEEP 3072:a4OIbl6LrQ0/UglOmpkzAJZxrn+XtEuSDbwju:ayELrQ0/UglOYG0j
TLSH
T1A7350553A1D55514FFE177B31A228BA62F5A7DE8A13081CE2029F6F93E7F68305C1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0415.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0415.dll
Size 1.1MB
SHA256 50353d9e51d7ffbd897e40c028f955e1f724d22c313bdb6fac3a9ffef939fdeb
MD5 d538410379fb09ace449512fe4b713d2
SHA1 525c6ddd5fa79bcddcdfca2a6bd35cccc3c89be5
SHA512 b7d9b5bb2e8b82424b65a7551cf15c922e7c874be41fd6761c9aae663996e223f1838763f25a85094b94b25bc272e52feee32e1303de411ac143c2f6157ae195
SSDEEP 1536:ORvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzksNnFJEOlgdXifAJoc7/0:s4OIbl6LrQ0/UglOmpkzZFlKj
TLSH
T114350553A1D55554FFE177B31A628BAA2F5A7DE8A13081CE2029F6F93E7F18305C0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0416.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0416.dll
Size 1.1MB
SHA256 dca9fe571bf0a027ab4c92e75a440db1b62075d7953ac7f0cf734f52cd799e34
MD5 83c817bdcb86d8ae9b685be8f1406160
SHA1 733d6c3e8e913b596fe85193876b279ccfbebe5c
SHA512 ec49b3b33babca2c97f1ef9cafeaf9ab54a7706ffde5e99a11bb5f616cb9d583d7d4b6a452cafc493e8183db42288b46bf475f0178d763574b341acf69cbfc37
SSDEEP 1536:xRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzSfg4ZLWI/OQQiboO7/t:F4OIbl6LrQ0/UglOmpkzGfjt
TLSH
T127350553A1D55514FFE277B31A228BA61F6A7DE8A13081CD2029F6F93E7F68305D0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0419.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0419.dll
Size 1.1MB
SHA256 7cc2a9b5dd1fec30a34cecd5baf48597d6d4bbdd204ff498e89ec2fbf5ab61be
MD5 6362fc69aa746a35b77ba226fc517878
SHA1 f26d4afa403102e61d8b19d615a57157c4e11404
SHA512 d364482c9964a0da6ccc4a4a5b81e7c90a2d380c1fff52a8a9589dc6e15d939e1f6bbd5f183a1b29d4363dfa223d2a2637f2fe2f054c3c67b014259db6a7fe36
SSDEEP 1536:v9PIHRvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzoB0wVZuLzOai57quEot7/4s:dy4OIbl6LrQ0/UglOmpkzc0wv57hBj4s
TLSH
T140351657A1D55514FFE177B31A228BA62F5A7DE8923081CE202AFAF93E7F19305C1132
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-041b.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-041b.dll
Size 1.1MB
SHA256 342c10df283c765476bf4acc1a483839c9bff1ab1e2806786db8dcc128993ebb
MD5 ec1fdbb5e17723d422dc4478df25877e
SHA1 fe09391c81bef500d25ad8d7e4a17bc881e12744
SHA512 1bd30070412641672d804e211301de797de28b2d4718aa2b128cc6b8d189b4f4e060ce562deae18562ac43a46d4b52252243b9aba103244ba49bd48975b7a12d
SSDEEP 3072:f4OIbl6LrQ0/UglOmpkz7h3ds651IXQjVS:fyELrQ0/UglOYCGiS
TLSH
T106350653A1D55514FFE177B71A228BA62F5A7CE8A23081CE2069F6F93E7F58305C0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-041d.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-041d.dll
Size 1.0MB
SHA256 24f00883d332c9f1b8d4bd5ef391bfd9735441b75c5653943efc6307c6cf86fe
MD5 9af061b878561366307d8d0320338c79
SHA1 37cdcd395a0fd4a13378d679832e05b03f56734b
SHA512 5ef0df20ac5405263a234ae1ef03f579347f0d68a7f9401bd72ad4534b901c1a74230cfd4c995d8750ec1019089eb6fb951aa99f6680380783fcad4e83263734
SSDEEP 3072:r4OIbl6LrQ0/UglOmpkzbI2jy5D4KsUwcAKPOE9DFj5:ryELrQ0/UglOY
TLSH
T153350593A1C55514FFE177B31A628BA62F5A7CE8A13081CE2029F6F93E7F58305D1632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0804.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0804.dll
Size 1.0MB
SHA256 b930a111b6505321d54bc882602f79d9a16202a0d5edca8d6fe3fccce44c8c44
MD5 6ed5c10d7e7e54a6913dcf4eaf957da4
SHA1 65830ee88c698d59bb75045b84617eb1f60b3d44
SHA512 9488f7b9a943947bbd80ae1b37b4827824c46a0e6264650d424ab5e121888dc1bb6e75649955457a803f98d134d11660fecb645a4ce3ecd4a0c640d01c0ce4ab
SSDEEP 1536:ERvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzgBgZOumoWEH+s2os7/G9:W4OIbl6LrQ0/UglOmpkzkgojs
TLSH
T19835F493A1C55518FFE177B71A228BA62F5A7DE8913081CE6029F6FA3E7F18305C1532
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932-0c0a.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932-0c0a.dll
Size 1.1MB
SHA256 d7f4a7bd18e4579cafec4e122e7fff43b1f00f50b9ebbdce4982bc835fef8e5f
MD5 b691d4e4daa8959ecb4d94dda6615c70
SHA1 3de0c76780eb38c95020964afc80c2ba833a8f95
SHA512 6923231d4bf174aafbf19c5b0d8a9ab7f23cbc4ed920dfa832194140b1953e1494a4ae87164d2c7de33d9a3c76f380cea88539466bfece1a2e5a1c5093768054
SSDEEP 1536:Gy0RvFfHE1Hf4WAIbl6LrQ0/UglRiFmIuJ3uTzCw58wXr8O61J7quEoy7/A7tj:GH4OIbl6LrQ0/UglOmpkzLW7hGjC
TLSH
T10F350553A2D55514FFE177B71A628BA61F2A7CE8A13081CD2029F6F93E7F58309D0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppr932.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppr932.dll
Size 1.0MB
SHA256 98401ace9b66df49f52496909f4f24c3b1591d1045d8bd96e8a5e722c6b0c818
MD5 4dd73676d26067cd7bc789bf531c0e8c
SHA1 8647446ecb06a6ac3032b9e5b62b14664e88394a
SHA512 47b546a2ab5df0a21af15e9a8c93eea4814dde423da50494cd29e5a1995fa5c950bf8aeeb0f3853cc1c9d57ed09bd25784338f76e02b2534c216633be5a17e8b
SSDEEP 3072:xk4OIbl6LrQ0/UglOmpkz4DvBRYP7ZD4o15CgYc7h5j:xkyELrQ0/UglOYpPa7h
TLSH
T19B350593A1D55514FFE177B31A228BA62F5A7DE8A13081CE2029F6F93E7F58305D0632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppui9-x64.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppui9-x64.dll
Size 3.6MB
SHA256 156a8baca6a8467a9c5a44dbd57b7e434d70189c40f037fa65a031a65800d31f
MD5 d851e093236fc6dc9238dd0808790001
SHA1 fa29946a1de6148ecb90cb0832a0b946ec4cf379
SHA512 eca7824235551e52a5f5518450550d0f7f5b47b61431cd478fc9be2fba00cb6bce1c88a09c8526621d1715fc53d47c2fbfc0b3c818d7676e078705af9ee58040
SSDEEP 49152:+kEuH+lpVoV+JKsWofayN50TNhY7CwfA+sm527uKxEKzklfTYjfZFpiB41/nQ7Ep:yunWKEayH07dmxl7E2
TLSH
T12C067D9A71BC01E5D0BAD13CC647492BDAF3790603329BDF02A14A6E2F17BE2567E351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fppui9-x86.dll

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\fppui9-x86.dll
Size 3.3MB
SHA256 753c9c51c6d02334e157d8f5e148394f539726876672d54bc439ff70e5346b95
MD5 cc0cba750816f436469012fe93ab2dd4
SHA1 9e4a2369a68aac2a335e29c62719e66e5573b34a
SHA512 03a9be1f24163477572b1a56027e24c73ef76ff543be45e98b4e5d1291262299572e529a3accff025627a2dc104f7cfe346bd0ee736fb1c0d480769948f5f2ce
SSDEEP 98304:Urg1uP8RgY1/iGRSNXelvCJng9o+BZN/EWaCSRu:UrN6gYjIXel8g9o+BZeWau
TLSH
T104F59E307506C53BD96D0471DA7C9EAF626DA6700BB550D3D3E8296B2CF44C22B3A72B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readme.txt

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\readme.txt
Size 9KB
SHA256 093688815086c37244586f063291dfaaca1fc476e28911f573f18b5b9a377ba0
MD5 dd60254f7254981a5925d224c1da3fa9
SHA1 9f608940f2c36d8883e9b7b4327f90154af8a59d
SHA512 25a889a6cbc7f5e2a5db0b3763530cac02092a0d1c18673cac7e5c7ebdb9755993364947ca59f0209d62ad0e6515732963c0f4edc8597c5457634d71167465b9
SSDEEP 96:NPI3VYv1tR4OHacmzlWVRZWhSmGFpTL3yg/Dzh0+D32RbrzyBVAj1sDbkW9x:PT1oybkSXFpnXyrjKEW3
TLSH
T151120EE37C0F7A69617240827796695DE708803F4366919234DCB62CBB09DDC87F62AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

setup-x64.exe

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\setup-x64.exe
Size 2.3MB
SHA256 691d7e9ecf99cca99119ee35da41cb269599c5cab2898dd63c494aa532f7eea3
MD5 636ab8264c985e214fab7fbb89291324
SHA1 db9e72290e8b9eb5badbfcaca29117da99f6c213
SHA512 444ab9fcd157d7b2f98a5190a7a0fbdbc9f11203b7873ee1d7b6bc80f35e337c1c314ef9bd6ae3508860a609c22d6f58f9991c9025510ef75e1654ec44464adf
SSDEEP 49152:yurdORvD8+CXTR3ML4wCu9af7qjcGiTc493qO+:H5OR03l1u9a/2
TLSH
T1F4B57F07D2E401A4F3E691BB84620B3ADFA274E1C721D6DB0558EAF53F1E6D14AF9231
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fpp9_x64_driver.inf

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\x64\fpp9_x64_driver.inf
Size 2KB
SHA256 864e202cdad48579cb29a5fb03041f58c585f0fb52458fb4b3394185d6e99833
MD5 8f94e0c99fb37be6f2fa7bf6324be846
SHA1 b1a8e84130f271cefbbf4e5de4550071dbdd496c
SHA512 459b82af84857c2a3aecf45c50a2b421f4bee7ed281d8782840b949b03dc8d7a5de8f312f73b455c06f4eb5c84b33d831b1f13b0a3f2e6a8802d44a704012e0f
TLSH
T12C516B6DDF97D70458290C38B327B55FF687AA6A379031147CA8089F0CB6EC5E9A4838
MD5 SHA1 SHA512 TLSH

Submit Download

fpp9_x86_driver.inf

Path C:\Users\Admin\AppData\Local\Temp\pdfFactoryPro\x86\fpp9_x86_driver.inf
Size 2KB
SHA256 82ae54f33e6693c21f47676bef483621215437beaaf86e726f55a260f52c1753
MD5 d65cc71d52853c037ece477cea89dc46
SHA1 e72e1845f632f7a8571871f3ce5f2de862410ab6
SHA512 a8108ae729f8ce20ed3af2bf3fb2cd195f7c736550242dcdb93ef38747fb451dcb5d68309d71532965fd4b7e3868db235d256ba72f4c18db9645c8fb79a0a3a2
TLSH
T1F9417F4B9D55C70408300C3C3367795FE28AAED6F7E13E586414559E08AEFCBFDA482A
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2120_740897286\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

~FPDDC4.sta

Path C:\Users\Admin\AppData\Local\Temp\~FPDDC4.sta
Size 1KB
SHA256 0af1c6e4d3799d52cef5d1e528181cef9082c00ecc9de5baeb7aade0999d20e0
MD5 c887ba249ecce50231036a4e9455e8a8
SHA1 97ed7fd3972d2cdbaf904bd5903e8a79425fd71f
SHA512 e99b9a73c662a0ff2de9a41927846c09e7c641977b39d878f10340e8a911b0e11228fea4ef3d23e92ce7e3f94ce64f8ad714b3269dab01e6361736561190b812
TLSH
T16A311512D3CB7B29F9F713F5397B879C8AA3FC389A21821E21A1245C3CB1B769D10255
MD5 SHA1 SHA512 TLSH

Submit Download

FinePrint Help.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FinePrint\FinePrint Help.url
Size 126B
SHA256 c792be9444cbf791946f8557337bc266d4a8ae4c3c79e91f1900f010675e527b
MD5 49bde8c6580d5b1378bbf2d4fbf5ce37
SHA1 0df30719d8246594a3ee6b03c9f63352ffa4cbf3
SHA512 f13db5eec824502c073cf64fc7b4d275a2f6b4de1c763c39ca18225fc16df51d791f9acb1f28337bcf38632429923b4b0f8fea5f643f9c48a91da74febf867ad
TLSH
T15FB09B7DC0054645D141440F8061F545C40F7D611CE6E46DE544DD8A1D040D1D484625
MD5 SHA1 SHA512 TLSH

Submit Download

pdfFactory Pro Help.url

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\pdfFactory Pro\pdfFactory Pro Help.url
Size 127B
SHA256 c65c43cdda58cca2de9b494ae7e60c37a7c5a0ca6fc83ec68e2e8a21683fc530
MD5 d0e886a2ac7d757c2b7d0f8f1e05973e
SHA1 4f06c6b5d1072bd80ace455b3f86dbca65e9c65e
SHA512 73810cc5053b4c29f8baa10b04dfe82a3cb7ebcd9f647c51af3dd304e8baf1f709bf9f15c462e5c7f80dce50a318912ae0a7c546fba17cdfa7f5bca14bcbb4c7
TLSH
T192B092BE804A8689E241481A8062F848E81F7DA20CE2E0ACA5C9DECA1D580D2D684A27
MD5 SHA1 SHA512 TLSH

Submit Download

fp12_x64_driver.inf_amd64_6f792b0932850806.ini

Path C:\Windows\System32\DriverStore\FileRepository\fp12_x64_driver.inf_amd64_6f792b0932850806.ini
Size 2KB
SHA256 4ac196227db17ebcef78ec6c86c1b3389285339212b8560175c3e360b598d87e
MD5 7ddf7d8ba3757d8c911d4c737c74228e
SHA1 61bec4af2ac8d70291770253ec330e4ef356e19e
SHA512 5137146bd796557f1c55b3c8d0dc3d6f85bd56a197e644a3136afc7183b66d0d25e455d23acf8b7523d775fc47763c06a7af4a1d3131203f2bff76f5adc64cda
TLSH
T1E451E19568E3D48E314095D3AB3B17BC9105632B4DB6BB647CA88544EF17D9F2B283C3
MD5 SHA1 SHA512 TLSH

Submit Download

fpp9_x64_driver.inf_amd64_57db7bb9105ca243.ini

Path C:\Windows\System32\DriverStore\FileRepository\fpp9_x64_driver.inf_amd64_57db7bb9105ca243.ini
Size 2KB
SHA256 136a6550d26c103e03d2a0e58279549aeab819b246ef52959afb984ed924b4ca
MD5 81dd3ecc709d7937343a974c180b153c
SHA1 60897501a22c0ac5d26313fb90fdb21c56c27a1b
SHA512 f49df6dd5564bf81498dcc2307a674a6659626c9d64876ccaf43d2c88b1632d5c169d2845df3915322ae68cdf85a762c681cabe5e22e76a655249dd9af68112f
TLSH
T14A518C5998E1E58E7000481BA72E532DA012F71F89918BE47DB86C44DF57C9FA8D0EF3
MD5 SHA1 SHA512 TLSH

Submit Download