da8a9f52ee2ac60b913d5929e6f189f45d500ebc9502d2757d5e43d2a403e9a3

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 16:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
FinalDraftSetup.msi
Size 85.2MB
Sample261107-t3hlxads7y
SHA256 da8a9f52ee2ac60b913d5929e6f189f45d500ebc9502d2757d5e43d2a403e9a3
MD5 98e66f941177ee7d16d10bfa61f49c84
SHA1 3daa0f611d96d81a7e12d4c4122c42728b7c68e3
SHA512 83f921827ed48beb1ba91338945159da79a3fa3ad44c77bde17fa23b169567a7c29f379d765e661a34486f6f882f9daf5b3db0d531c927c338cbd32cc5a8c08d
SSDEEP 1572864:xKD/te44jjqLVNS88bnj6f1TnL1YANe5yyzaCapVeknzHViqvVGNs3yLYqT:x2AFsj8P69Tndyz5a3bn5FVd3y8y
TLSH
T18D183311FE13DD2EE8EB0536786E8A3602A87C048F5145DAB354363D1CB3E9D237A5B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\parcel_tracking_db\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\GraphiteDawnCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\7698948c-8dc7-4736-b8a2-579f4520b88f.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\Reporting and NEL-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\AssistanceHome\AssistanceHomeSQLite	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\bcc0c3e7-ab9c-4e37-85a5-401f3d172578.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Data\Fonts\BIZUDPMincho Bold.ttf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Favicons-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\Cookies-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Shared Dictionary\cache\index-dir\temp-index	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports~RFe5a2b38.TMP	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Session Storage\000001.dbtmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Sync Data\LevelDB\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports~RFe5a2b47.TMP	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\TV\BBC Screenplay for TV.fdxt	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\README	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Extension State\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Code Cache\js\13620a73b88b7d58_0	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\5ec0258d-a362-4940-ae97-97e3e77dc922.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\shared_proto_db\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Local Storage\leveldb\LOCK	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\7698948c-8dc7-4736-b8a2-579f4520b88f.tmp	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Cache\Cache_Data\f_000003	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\TV\Multi-Cam Sitcom.fdxt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Web Data	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Extension Rules\000001.dbtmp	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Extension Scripts\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Login Data-journal	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\DawnCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\GraphiteDawnCache\data_3	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network Action Predictor	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Crashpad\throttle_store.dat	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Data\Fonts\Courier Final Draft version	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\Graphic Novel\Image Comics Graphic Novel.fdxt	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\Structure\Michael Hauge 6-Stage Structure.fdxt	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\Text\Text Document.fdxt	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\31de652c-0c47-458c-9e83-195985ca14d3.tmp	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\shared_proto_db\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\icuuc58.dll	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\Text\Treatment.fdxt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\GPUCache\data_0	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\GrShaderCache\data_2	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\GraphiteDawnCache\data_2	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Session Storage\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\AutofillStrikeDatabase\LOCK	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\DawnCache\data_2	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Shared Dictionary\db-journal	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\Script\US Screenplay (French).fdxt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Extension Rules\CURRENT	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\shared_proto_db\metadata\LOG	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Extension Scripts\CURRENT	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\GPUCache\index	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\GrShaderCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\Script\BBC Screenplay.fdxt	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Data\Fonts\BIZUDPMincho Regular.ttf	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\Script\Screenplay.fdxt	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Tutorial\Tangle & Moss FD 13 - Outline.fdxt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\ShaderCache	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Extension Scripts\MANIFEST-000001	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\shared_proto_db\metadata\000003.log	msedgewebview2.exe
File opened for modification	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\GPUCache\data_1	msedgewebview2.exe
File created	C:\Program Files (x86)\Final Draft 13\Templates\Text\Query Letter.fdxt	msiexec.exe
File created	C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Extension State\LOG	msedgewebview2.exe

Drops file in Windows directory 49 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSID551.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID69A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\concrt140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\mfcm140u.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\msvcp140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\Installer\{4910975B-DA4C-4BB9-ABE9-AB477B32BC09}\FinalDraftSecure.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e59b80b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\mfc140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\mfc140u.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\msvcp140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\SystemTemp\~DF437D558DBA233644.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_304165389\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSIC676.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\mfcm140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\mfcm140u.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\Installer\e59b80d.msi	msiexec.exe
File created	C:\Windows\4910975BDA4C4BB9ABE9AB477B32BC09.TMP\WiseCustomCalla.dll	MsiExec.exe
File created	C:\Windows\Installer\e59b80b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF920B9B71B041C57A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9835A777AA126378.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\concrt140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\mfc140u.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\vccorlib140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\vccorlib140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4910975B-DA4C-4BB9-ABE9-AB477B32BC09}	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\mfcm140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\SystemTemp\~DF064F24C3F6E693D0.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_304165389\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC975.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9E4.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\vcruntime140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_304165389\crl-set	msedgewebview2.exe
File opened for modification	C:\Windows\4910975BDA4C4BB9ABE9AB477B32BC09.TMP\WiseData.ini	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIC5D9.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICBAA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\mfc140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90\13.2.5\vcruntime140.dll.DD9E5F57_575A_3083_A3AA_32686CDAE903	msiexec.exe
File created	C:\Windows\Installer\{4910975B-DA4C-4BB9-ABE9-AB477B32BC09}\FinalDraft7.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{4910975B-DA4C-4BB9-ABE9-AB477B32BC09}\FinalDraft7.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC461.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC7A0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICC18.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\B5790194C4AD9BB4BA9EBA74B723CB90	msiexec.exe
File opened for modification	C:\Windows\Installer\{4910975B-DA4C-4BB9-ABE9-AB477B32BC09}\FinalDraftSecure.ico	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
3816	Final Draft.exe

Loads dropped DLL 36 IoCs

pid	Process
4120	MsiExec.exe
4120	MsiExec.exe
2856	MsiExec.exe
2856	MsiExec.exe
2856	MsiExec.exe
2856	MsiExec.exe
2856	MsiExec.exe
2856	MsiExec.exe
2856	MsiExec.exe
2212	MsiExec.exe
2212	MsiExec.exe
2856	MsiExec.exe
4120	MsiExec.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe
3816	Final Draft.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Final Draft.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2284	msiexec.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Final Draft.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Final Draft.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Final Draft.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c1fdf03c8ae10a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380120c1fdf00000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410120c1fdf0000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e320c1fdf000000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e620c1fdf000000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\5 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\ProductName = "Final Draft"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\7 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Converter Document\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fcf\Final Draft.Converter Document\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdr\Final Draft.Document\ShellNew	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\60D863CE0E856494184758C118059E8C\B5790194C4AD9BB4BA9EBA74B723CB90	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdt\ = "Final Draft.Template"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Document\shell\Open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Template\DefaultIcon\ = "C:\\Windows\\Installer\\{4910975B-DA4C-4BB9-ABE9-AB477B32BC09}\\FinalDraft7.ico,4"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Document\shell\open\ddeexec\ = "[open(\"%1\")]"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft 7.Document\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\13 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Template\shell\ = "open"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Template\shell\open\ = "open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdx\Final Draft Xml.Document\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Document\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\8 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\11 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Converter Document	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Final Draft.Document\Shell\Open\ddeexec	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\DiskPrompt = "[ProductName] [1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\14 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Converter Document\shell\ = "open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Template	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Template\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdxt\Final Draft Xml.Template\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdx\Final Draft Xml.Document	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Converter Document\DefaultIcon\ = "C:\\Windows\\Installer\\{4910975B-DA4C-4BB9-ABE9-AB477B32BC09}\\FinalDraft7.ico,6"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Final Draft.Template\Shell\Open\ddeexec	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Final Draft.Converter Document\shell\open\ddeexec	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Document\shell\open\command\command = 75003700270051003f0054006a006800440040005b0075007d0025003f00460026007a002d00260043006f006d0070006c006500740065003e004c006800340039007100630046004200790039007700310043007e002c005b0078005a00790071002000220025003100220000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdr\ = "Final Draft.Document"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Final Draft 7.Template\shell\open\ddeexec	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Secure Document	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Secure Document\shell\open\ddeexec	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B5790194C4AD9BB4BA9EBA74B723CB90	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\1 = ";LABEL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Converter Document\ = "Final Draft File Converter Document"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Template\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Template\DefaultIcon\ = "C:\\Windows\\Installer\\{4910975B-DA4C-4BB9-ABE9-AB477B32BC09}\\FinalDraft7.ico,2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Final Draft Xml.Document\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Template\shell\open\ddeexec\ = "[open(\"%1\")]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Template\shell\open\command\ = "\"C:\\Program Files (x86)\\Final Draft 13\\Final Draft.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\finaldraft\URL Protocol	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\19 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Document\shell\Open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft 7.Template\shell	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Document\shell\Open\command\command = 75003700270051003f0054006a006800440040005b0075007d0025003f00460026007a002d00260043006f006d0070006c006500740065003e004c006800340039007100630046004200790039007700310043007e002c005b0078005a00790071002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft 7.Document\shell\open\ddeexec	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft Xml.Template\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdxt\Final Draft Xml.Template	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Final Draft Xml.Document	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\finaldraft	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B5790194C4AD9BB4BA9EBA74B723CB90\SAPI_voices = "\x06"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B5790194C4AD9BB4BA9EBA74B723CB90\SourceList\Media\12 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Final Draft.Document	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4672	msiexec.exe
4672	msiexec.exe
2856	MsiExec.exe
2856	MsiExec.exe
2212	MsiExec.exe
2212	MsiExec.exe
2212	MsiExec.exe
2212	MsiExec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
1548	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2284	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2284	msiexec.exe
Token: SeSecurityPrivilege	4672	msiexec.exe
Token: SeCreateTokenPrivilege	2284	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2284	msiexec.exe
Token: SeLockMemoryPrivilege	2284	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2284	msiexec.exe
Token: SeMachineAccountPrivilege	2284	msiexec.exe
Token: SeTcbPrivilege	2284	msiexec.exe
Token: SeSecurityPrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeLoadDriverPrivilege	2284	msiexec.exe
Token: SeSystemProfilePrivilege	2284	msiexec.exe
Token: SeSystemtimePrivilege	2284	msiexec.exe
Token: SeProfSingleProcessPrivilege	2284	msiexec.exe
Token: SeIncBasePriorityPrivilege	2284	msiexec.exe
Token: SeCreatePagefilePrivilege	2284	msiexec.exe
Token: SeCreatePermanentPrivilege	2284	msiexec.exe
Token: SeBackupPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeShutdownPrivilege	2284	msiexec.exe
Token: SeDebugPrivilege	2284	msiexec.exe
Token: SeAuditPrivilege	2284	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2284	msiexec.exe
Token: SeChangeNotifyPrivilege	2284	msiexec.exe
Token: SeRemoteShutdownPrivilege	2284	msiexec.exe
Token: SeUndockPrivilege	2284	msiexec.exe
Token: SeSyncAgentPrivilege	2284	msiexec.exe
Token: SeEnableDelegationPrivilege	2284	msiexec.exe
Token: SeManageVolumePrivilege	2284	msiexec.exe
Token: SeImpersonatePrivilege	2284	msiexec.exe
Token: SeCreateGlobalPrivilege	2284	msiexec.exe
Token: SeCreateTokenPrivilege	2284	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2284	msiexec.exe
Token: SeLockMemoryPrivilege	2284	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2284	msiexec.exe
Token: SeMachineAccountPrivilege	2284	msiexec.exe
Token: SeTcbPrivilege	2284	msiexec.exe
Token: SeSecurityPrivilege	2284	msiexec.exe
Token: SeTakeOwnershipPrivilege	2284	msiexec.exe
Token: SeLoadDriverPrivilege	2284	msiexec.exe
Token: SeSystemProfilePrivilege	2284	msiexec.exe
Token: SeSystemtimePrivilege	2284	msiexec.exe
Token: SeProfSingleProcessPrivilege	2284	msiexec.exe
Token: SeIncBasePriorityPrivilege	2284	msiexec.exe
Token: SeCreatePagefilePrivilege	2284	msiexec.exe
Token: SeCreatePermanentPrivilege	2284	msiexec.exe
Token: SeBackupPrivilege	2284	msiexec.exe
Token: SeRestorePrivilege	2284	msiexec.exe
Token: SeShutdownPrivilege	2284	msiexec.exe
Token: SeDebugPrivilege	2284	msiexec.exe
Token: SeAuditPrivilege	2284	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2284	msiexec.exe
Token: SeChangeNotifyPrivilege	2284	msiexec.exe
Token: SeRemoteShutdownPrivilege	2284	msiexec.exe
Token: SeUndockPrivilege	2284	msiexec.exe
Token: SeSyncAgentPrivilege	2284	msiexec.exe
Token: SeEnableDelegationPrivilege	2284	msiexec.exe
Token: SeManageVolumePrivilege	2284	msiexec.exe
Token: SeImpersonatePrivilege	2284	msiexec.exe
Token: SeCreateGlobalPrivilege	2284	msiexec.exe
Token: SeCreateTokenPrivilege	2284	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2284	msiexec.exe
Token: SeLockMemoryPrivilege	2284	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2284	msiexec.exe
2284	msiexec.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2284	msiexec.exe
4672	msiexec.exe
4120	MsiExec.exe
2856	MsiExec.exe
2212	MsiExec.exe
3816	Final Draft.exe
3816	Final Draft.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 4120	4672	msiexec.exe	90
PID 4672 wrote to memory of 5664	4672	msiexec.exe	96
PID 4672 wrote to memory of 2856	4672	msiexec.exe	98
PID 4672 wrote to memory of 2212	4672	msiexec.exe	99
PID 4120 wrote to memory of 3816	4120	MsiExec.exe	101
PID 3816 wrote to memory of 1548	3816	Final Draft.exe	102
PID 1548 wrote to memory of 5920	1548	msedgewebview2.exe	103
PID 1548 wrote to memory of 4160	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 4160	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 4160	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 4160	1548	msedgewebview2.exe	104
PID 1548 wrote to memory of 5144	1548	msedgewebview2.exe	105
PID 1548 wrote to memory of 6036	1548	msedgewebview2.exe	106
PID 1548 wrote to memory of 6036	1548	msedgewebview2.exe	106
PID 1548 wrote to memory of 6036	1548	msedgewebview2.exe	106
PID 1548 wrote to memory of 1348	1548	msedgewebview2.exe	107
PID 1548 wrote to memory of 1348	1548	msedgewebview2.exe	107
PID 1548 wrote to memory of 1348	1548	msedgewebview2.exe	107
PID 1548 wrote to memory of 1348	1548	msedgewebview2.exe	107
PID 1548 wrote to memory of 1348	1548	msedgewebview2.exe	107
PID 1548 wrote to memory of 1232	1548	msedgewebview2.exe	110
PID 1548 wrote to memory of 1232	1548	msedgewebview2.exe	110
PID 1548 wrote to memory of 1232	1548	msedgewebview2.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\FinalDraftSetup.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2284

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 85DD0CABBF93BFF2B10C2EB815409E5A C
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Program Files (x86)\Final Draft 13\Final Draft.exe
    "C:\Program Files (x86)\Final Draft 13\Final Draft.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3816
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Final Draft.exe" --webview-exe-version="13.2.5 Build 94" --user-data-dir="C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=3816.2656.10894483122123461151 /pfhostedapp:d704c7dee24b827acc1b420502c1e16438e3160d
      4⤵
      Drops file in Program Files directory
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of WriteProcessMemory
      PID:1548
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView" /prefetch:4 /pfhostedapp:d704c7dee24b827acc1b420502c1e16438e3160d --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x18c,0x190,0x194,0x168,0x19c,0x7ff9e9645fd8,0x7ff9e9645fe4,0x7ff9e9645ff0
        5⤵
        
        PID:5920
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView" --webview-exe-name="Final Draft.exe" --webview-exe-version="13.2.5 Build 94" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1724 --field-trial-handle=1748,i,10540981768092472762,12344909957059101571,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:d704c7dee24b827acc1b420502c1e16438e3160d
        5⤵
        
        PID:4160
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView" --webview-exe-name="Final Draft.exe" --webview-exe-version="13.2.5 Build 94" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2300 --field-trial-handle=1748,i,10540981768092472762,12344909957059101571,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:d704c7dee24b827acc1b420502c1e16438e3160d
        5⤵
        Drops file in Program Files directory
        
        PID:5144
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView" --webview-exe-name="Final Draft.exe" --webview-exe-version="13.2.5 Build 94" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2328 --field-trial-handle=1748,i,10540981768092472762,12344909957059101571,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d704c7dee24b827acc1b420502c1e16438e3160d
        5⤵
        
        PID:6036
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView" --webview-exe-name="Final Draft.exe" --webview-exe-version="13.2.5 Build 94" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3440 --field-trial-handle=1748,i,10540981768092472762,12344909957059101571,262144 --enable-features=MojoIpcz --variations-seed-version /pfhostedapp:d704c7dee24b827acc1b420502c1e16438e3160d /prefetch:1
        5⤵
        
        PID:1348
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView" --webview-exe-name="Final Draft.exe" --webview-exe-version="13.2.5 Build 94" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4312 --field-trial-handle=1748,i,10540981768092472762,12344909957059101571,262144 --enable-features=MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d704c7dee24b827acc1b420502c1e16438e3160d
        5⤵
        
        PID:1232
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 65356D3BABA3B566E473665884E49C1B
  2⤵
  - Drops file in Windows directory
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2856
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5589709F2097B735963ED5FE86342295 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2212

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59b80c.rbs

Path C:\Config.Msi\e59b80c.rbs
Size 52KB
SHA256 8f51d65ad2f40ecbae7e8d2c59fae49ec8b701a0124bad07784b198c5ae0da0b
MD5 8ba7dcfe091160c2dd01efb90c517b09
SHA1 d35cc81251d6562f5723a35465edf2468bd3a13d
SHA512 d34004c21a2b50ab1c155cdc4d676a77e9f878487a25c393d8d5f31e38fdb830ade7bd38baa5a2a4549dc968da1f8d0b63fb49f6cdd8c4475655b36ee2fe9c8e
SSDEEP 384:E5/nEiDbtjtVstQt3SptVzcPd0ltxwDx+u4YWQu4YWiqmY:EhEintjtVstQt3wtsmtxwDx+pYzpY7qX
TLSH
T14E331302B603D683D5DB1E70DAAB1B163773DAC85385834702DD86258BC6B552FEFA0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BIZUDPMincho Bold.ttf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\BIZUDPMincho Bold.ttf
Size 6.5MB
SHA256 24993da857a424cdb8bbc430df3c5312a90bb2ff289cddfc4f29240b9bce56a1
MD5 4a2d31aff8446a6940c6890d63574576
SHA1 ee2d7b7f0205e9028cd8ca972e9216d61d53e154
SHA512 241b208666dc8d55d264b7defec214b48e1f59755b1de8401f886bb38b9d202a736c2b6e052c69aee28a0ad755678d94dcce2f5b17368cee87c53a5cc39aac1b
SSDEEP 196608:Fz+KG3yPV3v/WKYb7gnxS9ruP2BtbSEhbTICVGgW:FzZtPxGp1HVPW
TLSH
T14A667D91B904BBEAC2E1659C7540A0A08CFFF1CA6FFD4580BD67CE63D17A009D259B93
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BIZUDPMincho Regular.ttf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\BIZUDPMincho Regular.ttf
Size 5.7MB
SHA256 2b5415e97d5edb55e8c5319278bd4d7a81bf37e8c0c9e1f703a27de83ea5d092
MD5 d999fdcf29a15844d6145d702eb49ace
SHA1 a5ab4b1506deee5dad60be2fd95a2b29cd537b73
SHA512 57acde2333d19dcb3421b7d16dfc11cf801da24e5a7f4cfbca1a1fa58fbe9c914e02bf6225823ad3182d64986f60c8157e5a7d7bc40769e6c91373da3af9ece0
SSDEEP 98304:5BrftAqlEzxmKs/MjaTHdSPqFGvjci+kd4+YijrdCurRemFPDbs:xvlwsUOSLvwi+kXjrdZ8APs
TLSH
T1B85629C0D678BD25E1E8F968B484E4473DBE72C1EE5C02005F77C2F9E069A89CA6D563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Courier Final Draft Bold.ttf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\Courier Final Draft Bold.ttf
Size 74KB
SHA256 b590f18f68191566e133d23cc6e0d14adee673534fd7caa2554968eb919208fd
MD5 f609c86e91b694f775560f7ab5f42ccf
SHA1 d7e9ac0e8cd011f7ba9a3e1fa4cf79d97173851c
SHA512 c5e5cc7418fa70993037622f11fa08c1dab9da6b9acc324f0f367e3e72162ddf0abe7bdbb9ca83cf373fb1b713e83f163a735025c2521f2cabcda59a37230375
SSDEEP 1536:/k+cl8ghT8HUJAP4i8pRUs0kR+4LWoW1fBZ6ydI:k8rPcQkRjLWp1fBZ5dI
TLSH
T10873180FDAB5B9B5D308A339A099634F61B69508FB50CA276D87F6DCD184B308F0D1AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Courier Final Draft Italic.ttf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\Courier Final Draft Italic.ttf
Size 70KB
SHA256 0e0ffc340599260628c4f5c20e0f4d1d4833520541cee5d73d3b837e0163dce9
MD5 0931e6cd460c7d089f0edbb4d193139b
SHA1 2f9c1c4a4143d2bfd0b283a198667a8a44a7bd76
SHA512 398d1402e748ca1bc5db3100c241448bcd719e74672958f1a1c1538e96ccaaa0c20e1858158f10289947348aca1d065aa5f7d48ede0394591d734a659e03ad76
SSDEEP 1536:pk+honjXU8tu488D32llnHnpKcKjdTM9dI:jqI488kHpKkdI
TLSH
T1E8636C8FDB52C4CEE304A178C54A3B57A7B16709BF54830F6F97994CA0586B8C8B731A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Courier Final Draft Regular.ttf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\Courier Final Draft Regular.ttf
Size 62KB
SHA256 3c47a2d28a95b6e3ad162e74dd2bb551eb2392a584ce671727620ae3fdb37ab2
MD5 0fd66a66d66b69db20776ae2482cba7d
SHA1 4dfdf88a0e57eed6971b6ef3e03be94eda3b46dc
SHA512 e73c5c29d5aa12af230720a40cbfa0c7971686247c1f38e01a35aafc86d81c47452bce891251dbd3a1ae713590673707fdf304c74cbdd82325244776735afc1e
SSDEEP 1536:Zk+TGMCITwQn9rLOF/sCqLQxg4M5/nhyFySH8he2KdI:9G+Txn9rLOFUFmtMZhyFySHVtdI
TLSH
T1C8538C4FFFC1C95AF304D138D12A372B96567505AB0D829FAF8A9A6CF64C232801B719
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Courier Final Draft version

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\Courier Final Draft version
Size 3B
SHA256 0fa04adf7214e7f48f259079f7fae9332d5c37a43070769f3d052f1a98e2952f
MD5 80a938c3318798274305870f8cec3271
SHA1 f5b7c2ab603729527be3f6a212c411bcaf06e4f7
SHA512 c2ca0788455dfd9d2a9e7c165b1c92371e13a7e7653057b06bd4453a55b2e86979fd151afe964dad34ea69e7d86dadae249f06c5eaa003b9fa95eb96b27a6dc8
MD5 SHA1 SHA512

Submit Download

FDGlyphs.otf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\FDGlyphs.otf
Size 65KB
SHA256 fbf33827fd5abdf3e2b417e1bd25d0862dccd714042f7ecef5f3198ad0d2f6bb
MD5 18546a72269778d1e77385ebba374aee
SHA1 97a948370509fcfc8d5a466256d3631c1a4fc3f5
SHA512 17a2748bf3ed51c0b50c9765c39929a8fb2095c115761f43c81e478238b7100067460b44fd53711cd33b2a6c7cb2df2f921c95288d137d6a3b11004814c65acf
SSDEEP 1536:i6HOoOpLet2a4kRMVnJIPJSsHaFOUHqme3XKq4:i6u62a4mIoSWaFOUHBT1
TLSH
T165631921F79CC66CE6525731E8A2CCF83977BEC1784410A17ACC7CFF6486E1684A7986
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sans Devanagari Final Draft Bold.otf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\Sans Devanagari Final Draft Bold.otf
Size 146KB
SHA256 1ed2f240f7fe76ae119cc39d40fbb659311ad2cd2ffbed1af6da86c1d2fd3b3e
MD5 7fadd6157ec0ecfee4830c31797c5772
SHA1 88ba7a2a75a38b2177da8850de744a81c9656d58
SHA512 b43af29c8405122ac6d7acf8251c267a02f402254cec61ff3d4ee164b70f166beeb90e7f4209d95a9dc6b9b21c0ca8fb3d411f6f5a2689b8db961a666142df43
SSDEEP 1536:Vt+MV5fgByXiMaaWpVr6lsn5aAUqduw54rZJlhTdOBmPp3VQuyq7+3z:KMUB4V8/n5aR9p3VQuyq7m
TLSH
T1E0E33B11DB93EF42E533977D827BD346A575A090BB2F371F228837F6AD1A1C09D82891
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sans Devanagari Final Draft.otf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\Sans Devanagari Final Draft.otf
Size 147KB
SHA256 1b1810529d4daf6e359db1a4880f207f1d38b15347b9619f4867cf72bb5b2d9b
MD5 d7b81692140b8dbf3ee39cc3199c59f6
SHA1 80a7b72c4db84792d961f5edf32c9d395a435704
SHA512 eccc4ff384c806a51664304c21ccbb0b218e0ec7b51c3f40965e5fd2285ba34b6ec27248e580c01071b2a2b6f31f09a5e3111d4c6de230c29a8d49172ba582f8
SSDEEP 3072:0YQX+BTU6ln1AGsg7PdQpMTbK+XBwsjw3Y1HVk1lgFHW7N5E:0UBoyigbKaysjw3UHVk1lgFHW7N5E
TLSH
T148E34A14DF93AF02C233673CD17BE35A5634D1C1AB1B3B1F26846BF5AC56080EE8656A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sans Mono CJK Final Draft Bold.otf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\Sans Mono CJK Final Draft Bold.otf
Size 17.2MB
SHA256 2da72e89c478c9b6923081e093119671d301ef33ee05733468885d52425ce24c
MD5 567c226028fcb70df532cc1046893361
SHA1 c3e044fd6dfec16133f95f4ccc9f04ce181e2818
SHA512 2eb19b1b84b1dd2fc54c2e5b6ae18aa3404588c75b96f59018211c6da936a9a4ab47d55a8474f203637ca73ba78e710cd214885f3b1cf61b130600a63c1d35ac
SSDEEP 196608:H+tXv0gkyz/jwCiBuW31wkGMG6Xy5l8iD9EULzHtPT6CCTydofZwrI:HWXMgkyauWGMGgHOtrLwydps
TLSH
T183075CC196C4BE69EA11BEBDC5C2601BF389D4249B0683D1DEEEDD2C6875AF80C44DE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sans Mono CJK Final Draft.otf

Path C:\Program Files (x86)\Final Draft 13\Data\Fonts\Sans Mono CJK Final Draft.otf
Size 17.4MB
SHA256 46692dfa1743cf7548771ca6dd7ab34fe216ebf4aab1f25fa3d772615ba5d531
MD5 64454fc507a86fd4f911ea9ccf1bfd55
SHA1 ef7796867204f840ee7ae1ace1132cbbd919b4d4
SHA512 7c5a78154c3acac99f12e6082b8e286f4c2fdc5c3cfe942a0c348fe0398ec69a0cfdfcf648591e30c3179ab509aabd9e420f5ec7ef63e613ba5f5c72ee32682a
SSDEEP 98304:9+f9CFKHOnmD5qgFHOVop6PKdVfVu7KmVdR8WcQXrYTkntxEa1oMqW9aFOwBAx1w:9+f01gfHI2CUVfU7DVdRIDo4yFNO+uKi
TLSH
T158076CC246D4AD7AEA10BDBDC5C3A01BF385D5249B0583E1DEEED92C2869EF80C45DE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eula.rtf

Path C:\Program Files (x86)\Final Draft 13\Data\Misc\eula.rtf
Size 859B
SHA256 e70ddc0a3a1a5a16d46f4b76c57df2ae4f40f27a34c303e27dcf0eb252f77e54
MD5 3088fb2ab2c3ec4ff48788c976b35f37
SHA1 a5a0c0de3bcc8827c9078d58d5edd6792852eb71
SHA512 e484bc1c45b6c07e2b9a884ef038d80370e65243b8fbc442d19a10e15662c9b3d1d6f4bb8d5225ee235bcb4c6aa237f0f4ad6e5cae59b5e5ebd937cebe096601
TLSH
T17A1100B9D4B183B48FCF2905F4A5E96FB7D2E270F683C52671B09005A03248DB355C00
MD5 SHA1 SHA512 TLSH

Submit Download

Name Database.fddat

Path C:\Program Files (x86)\Final Draft 13\Data\Names\Name Database.fddat
Size 939KB
SHA256 2dafe8587e11ea58dfb8d5d7b89e31f825888b94e9003442d3236331ef41c336
MD5 96c5b3277e59644a29656c7e570a6273
SHA1 7c11c2211829ddc8619e708a19136ca88146ba73
SHA512 c72799c46433249b5ddf163ef0854716c798a78fe3ac0ebc19042be2c22823c3f3f2b5a440831f43fd4026143fcc03f3d85a054d2bee967596707febc9e9ef3f
SSDEEP 12288:jQvWympJhlwIqrrg02P6+AE2hUk/HDIivsale3pi/QUqUuBHCFWxt6:0v0Jrw/rrV2b3pi/QIupU
TLSH
T17615DC676498B627502BBB3BC4579153B3F39811BF160D8DBBDA5B4EC2E8C84CD207A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Acknowledgments.txt

Path C:\Program Files (x86)\Final Draft 13\Data\Resources\Acknowledgments.txt
Size 30KB
SHA256 51a19d552f3e4d2c59a883473ca0b4750d60026be4465b19f0688770b98df1f6
MD5 123cf6d43213c315efa19e9665b97426
SHA1 e7ff7cd611f73d1ba814ea08495426de733a1b07
SHA512 686075003e969420aef667e9aef74ee33c2aa43ae4b81aa328b786bd677eedcc79830a13f13608e9ab198160bd1da209aed02287185fd2cd0b818a02a7148603
SSDEEP 768:19xvtF/bg33FRtyHFk5vKkjHwWEUvV+3a8/CKAC5fDgh/K6klzEyvV+3aV:DxvtFjY1RtaijHwYU3a5TofR5U3aV
TLSH
T128E2082F7E49037219D1C386AA66EDC9F21E602D379B2985346DD14C237B83983FF598
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FDAdditionalStrings.txt

Path C:\Program Files (x86)\Final Draft 13\Data\Resources\FDAdditionalStrings.txt
Size 18KB
SHA256 6266c7980ee366fb8fd5fa26cfdb3e446150b31df53592e89bb5bd04444980b7
MD5 719fa5b0f727e90a275735c05280336d
SHA1 47ec6d0fff4359b74188f8f011a1f57a92bd6a4e
SHA512 07fb5c64399525a0db8715bdab8d40c256e8e527769a94e7c6d7022ea36dfe0d1a70e27ad055ace0df256f9320f3e8cae647df481f21a624111fc4aef7f87bfe
SSDEEP 384:kdw409MH7CxC3c6emavjl+hJL2KcVlDi+zWWZJcE5RKiZPjHHVa+FpDZIhMRcliq:W09MH7CxC3c6ema7l+XL2KcVZi+yWZJq
TLSH
T1FB8240622BBB722E11D535B393C7E713F6BFA09C01404774A17AD08D21D876C9A972EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FDCoreStrings.txt

Path C:\Program Files (x86)\Final Draft 13\Data\Resources\FDCoreStrings.txt
Size 3KB
SHA256 6bee3e069aa87abc00f280b5f08c7b6cf8a9648e18f31065d1974f5604f4f84c
MD5 98028e06990df17fa528a7130f38564e
SHA1 b5a71f927a539e317f44bce34c39c6d0430aafa1
SHA512 43e9f655c418c0cac123793359d05bc809c21d7858c6dddd0b418c37cf8674b33d5f8142ea225b736d762d4869e5a876ce40c2b11b401a628931748f972a84b1
TLSH
T12681B54FBACF31B706C346A5FA5956A3FEA2A04C09204318F55E708C51CA60CD6F71CA
MD5 SHA1 SHA512 TLSH

Submit Download

FDFinalDraftStrings.txt

Path C:\Program Files (x86)\Final Draft 13\Data\Resources\FDFinalDraftStrings.txt
Size 30KB
SHA256 297c68e3c723484be1dc5ddcfb209a907f50eac168d3b475a127cebc3c4e77fb
MD5 b4e86449e8a43809f6da73a1a0788fca
SHA1 8317079220c16606cbe4d217b1721b87adbc47d7
SHA512 f2dbb1569370e65af14b209dd7a88fffd8f7769dd55c4c014b9cf96be6184a2e111485654bb1a7108153bce067f129bbcc2a71bfa9ebf4ecf829d9d1ece7e9e0
SSDEEP 768:sGqzE7npK6foYcAEXNHxo1LNIVA7IH1TPs+4Sp7TdfRkr5NQOHwv11/9ayZ4C3yh:vqzKpREXNSvIKa0J1j28
TLSH
T1C8E2967A3B5B623F05D525E3A2C7A363F72B806C02711372546ED08C22D9B9C5BA72D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWCoreStrings.txt

Path C:\Program Files (x86)\Final Draft 13\Data\Resources\FWCoreStrings.txt
Size 407B
SHA256 b684cd167835402ba776cb8892bd0125a13e15d880b8bb14b6afd2ae2f0b7b57
MD5 538bd971772264931afea87425b04800
SHA1 a8ab07f8f747e25052e180c6755d505c729b9c2a
SHA512 faceb2e7d4e560887095c323ee3cc20df462ea7b226621af87ce716e061e207de209dd7851bb7df26ebd89926b3a0056e175c7b7ff7995abd1f17eb9ae25001b
TLSH
T175E0F1C755DB42F609B11364B70F92C5FFB140791CB22AA670ECD12E71468AD93322EE
MD5 SHA1 SHA512 TLSH

Submit Download

th_en_US_new.dat

Path C:\Program Files (x86)\Final Draft 13\Data\Spelling and Thesaurus\English (United States)\th_en_US_new.dat
Size 11.4MB
SHA256 dae98495b21959557613c757f28272529e7af7e76dda4352292f2da503b58ee5
MD5 1d1c1b3d82400e454f10ff72feb349dd
SHA1 b7bac4eef15d684ec09143e245ddbd7952a89266
SHA512 4fe1bf51a0fd5b4446992ea88f423ee5e5f2b3342c3ad45e1e8734547150688c0d92c3eee9c0989c86c15ed7a3f43eca759b9998dc63426ca4327052f6a0218c
SSDEEP 49152:c+7V3QyhHOOWmiXkpu75SuYm3yKVKhEbC/8F/6dXn6/DPjseSQ1ZiqEu/RSFvFwb:kx4a
TLSH
T13CC618E4ABDAD4134C831319CB5ACA3281317A223A26D72DF46D371D07079979377EEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

th_en_US_new.idx

Path C:\Program Files (x86)\Final Draft 13\Data\Spelling and Thesaurus\English (United States)\th_en_US_new.idx
Size 2.8MB
SHA256 1e8cf4b8087719daf9c5bd2bb22251a4e9047dd032801eb80e1c7a1b76705236
MD5 ff62e0111872f9b25619b44c8dffedcd
SHA1 894bc599783501a6cf9b499bd41136a7e139a38a
SHA512 2445942543059337ca78cc24f0921aa67b59bbdf42869a2dc6834b61b96d1106c4c5d7d4ec0367f2414cf948ccaefaa86428010a7c47a3e8c79685c5e4f42677
SSDEEP 49152:at8Hp8FbLajMVaYMicXZUXNlE29It9BmxQXA4:as
TLSH
T155D5BF61FDD071518AD399CB56CFEBA3423B0672EC0F0489A268078D2B476AD535FD2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FWPFControlLibrary.dll

Path C:\Program Files (x86)\Final Draft 13\FWPFControlLibrary.dll
Size 1.8MB
SHA256 2a111c8d7f55b00de2d7cbab0bdd42dad42126e755570242fb21534c088c6b98
MD5 a83dbbf7acb66b55f40b2f2209bd892f
SHA1 bd5b138b9380779f5fa789185aab7d426f492afe
SHA512 71ab58f2ff92ffdcf264124650dc60df8537ea23c77b8519b04849b5cbec3223ddf9acd14583e5f0cb1ba3c5c78cb9a6526733052a17f938fe33ef918eff4753
SSDEEP 24576:3MMHv/mhHJGpUg8CSiHrOhDTwtxHYSm1D7gvggzjUOLDNiv+fw0CBIhTxwKGhkLI:3agJryDKHYSm9+ZztL5Rfwb4wf
TLSH
T19F9502015524A828CC6B07F95861CAB47A371FCB73CDDF1DA6E90CAFF9D3722461612A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58d408bc-d60a-4bbb-ad17-c8354a2f9ba8.tmp

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\58d408bc-d60a-4bbb-ad17-c8354a2f9ba8.tmp
Size 3KB
SHA256 31c6d1c4e7be47bf2d44d99afe0f1177d059c089059465f41d0cc7c5b0582959
MD5 f2d0cd982c602621275ec0260eba70ba
SHA1 e46c53f7263588487c46b0af2d8ed67c88bb63bf
SHA512 3a0bbedcc1a6cb8dd0b27a671ef1a00814050cf0e0f58a3a769acb249c7ada8bd93c9476c4a944320dcee968b370ee5cbed8f0cdff890e511b33e9658d26ac50
TLSH
T15C61A7736974A6378FF29B4478826F16E7A15123E5953F68CAEC0F1C11E72980342C26
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 aa2700208db48b41ba218692faf2afe72cabff357d20a3f2861107f58db36bc0
MD5 fabe5fba166b94712ca4baaa14a985c2
SHA1 ea89090f961413d9b9da8f1ec8af87043ef1e78e
SHA512 e34e4e299c9c0ee84736b80a094454a74668b4c7ec9768333e6b29ae7c661116c48389be84fc077dd84ac198831b3c5a433e0d35bd068ed700b1c97871d38842
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 93d2b812e899ec31792f728db1d0ccb693af2a5d6ea5ad1b9604fb7e89da1f18
MD5 6a17a8d6d9133276257201bcae200c82
SHA1 a1cad3caf1dc97f19ca0a58e87682558a2d79e0e
SHA512 e7815423e7a8373392975d7834995e88952df62b4e312c283e604a43ff1ec905b9485927e3305abeaa22f48e5c1f11cb957423094f26b4534e15184a5a9eaa41
TLSH
T1EAD01212360189B4C02022B3141272482400C14B41068040782C851E1B540550903442
MD5 SHA1 SHA512 TLSH

Submit Download

505d3e66-320e-43b3-a30a-94eb1c206540.tmp

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\505d3e66-320e-43b3-a30a-94eb1c206540.tmp
Size 6KB
SHA256 187ea92ec8bb6ecadeb36d071107b7493ffbf9b127c0800c2360acfeadd4a43c
MD5 140874cd05a5da240eae730a60d7a4f7
SHA1 05dbcc08487cc3556fccaf8e8e8f6cb8b59f5630
SHA512 3607fe876532706fadf8299cce4f2424ee18e405b88b3ddafde22847c5302093b2f35c5a752071156e86f766ffa7ef6248ad92936dea0443508b61f38eac15a1
SSDEEP 96:st0/dcDaBb9Xk4o5h16ZHRCs7/x+6MhmuecZ0Ix1eje+K+gt+28XM1C7K:st4KSRoY8sV+FNlxQjmb+G6K
TLSH
T197D1C6025E28797B8CC6E159BA35BA17E3F5943270D61D58E7F8852C14EA5DC2307D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_2

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Cache\Cache_Data\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Cache\Cache_Data\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

temp-index

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index
Size 168B
SHA256 9884494919bbdef374be8ee5eba9c97a2fa2f18b9e377246424f8aa4bff64a37
MD5 f649a796ea32839ad233fff4ca3d69dc
SHA1 d8ea6e27dfc1e2d1c0c85500c57d124d53357179
SHA512 c89aff1276da4ab4ec3ac3eb4853967a776733797d0677ae2288c50885325cf7ddedd2167c35551cbae3ad7c35bc3c3ce612e527264bb4963d70d5d89c2e4e0a
TLSH
T1A3C09268650C4581C328D6B786EB7006BF37684549370F1985E940719912F8953C5DD4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 50ee17941f1aef1e55d86cef29096d397f7f966c17ae8f1dda971d2e05448192
MD5 a1b787bc9f438244bdf4ebbebefcd38b
SHA1 38bf54f3d6e653437455aca06c0b7bfb34053b09
SHA512 01c08bbf3f20b9864146ff0e572286d0ad99ed2facdf7695ac79f77c85861cf67f256159ca174ecd42668badf3d800c2c7c2975add066e05c9e095e3cb75480d
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

bcc0c3e7-ab9c-4e37-85a5-401f3d172578.tmp

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Network\bcc0c3e7-ab9c-4e37-85a5-401f3d172578.tmp
Size 959B
SHA256 b878b4f150591a36fa29b50563bc5e03fd4b3e92ae809955ec15bc8e225eefed
MD5 c045dc5d248d77fe24ce830a3f4a9f00
SHA1 8102077f65f290e954afdc7b19aff8d98f5ff2cd
SHA512 ea2e15ae8b07092bbfc641d4e515a00cd2155a8c0c00bb90bf3fb44431b387830af082eafded1f0f0951eb8dccfe165260e70a4de6a49e79b1742cc74cc85ae6
TLSH
T18E115EF6C7D4862ECD8212F857252D1BCE2E042657A82A27CDD9EBCB93E1473E14490F
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\Local State
Size 1KB
SHA256 f7ea7dca6d02fac10586730041482fbd7b38131e9f12321a7b99aba4f050f57f
MD5 847fd2636f37a33a4bad1591f60fcc52
SHA1 70c86698bd94d2e5566b0f914072d031ddbd70a5
SHA512 50f7242eda7787ac9818f655a4b0901bb7eed0c74fa071dc49d8ce6bd41703956613a189ce7db27839500c35dc4c980d929a07bcf5336e90a71d4c920fb2151a
TLSH
T1282145F2F5E46B32AFD167892112FF579E71605641614E0896DE472C22B315CC627C35
MD5 SHA1 SHA512 TLSH

Submit Download

bb4958e5-4198-465c-8539-413b9f3cc407.tmp

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\bb4958e5-4198-465c-8539-413b9f3cc407.tmp
Size 2KB
SHA256 9d734eefbbb4f8d1902638f021dbfc0422bfe52d8c7d312001d2ffe08fcfdbcf
MD5 8dc8db255f88ae01dbdfdaca7f8902e4
SHA1 4a6250dbb1fa5b486d547d70a86051f0a6748973
SHA512 df18d73e95e05e2157e57b520adb3398716dbfe6a02ffc1d6c2155b49e7efa9ce95861f60339b25bd4a0efd5ab54046d823255a6e85db7d17114f7865c28ffb9
TLSH
T14151B573B8547B37DBF24B483946BF63DA75A1519A622F248AED0B1C11E722C0342C36
MD5 SHA1 SHA512 TLSH

Submit Download

c2e0e186-e0a8-4af2-9abd-3a62dc63c585.tmp

Path C:\Program Files (x86)\Final Draft 13\Final Draft.exe.WebView2\EBWebView\c2e0e186-e0a8-4af2-9abd-3a62dc63c585.tmp
Size 15KB
SHA256 2ccc18b717575578941bc45cb95b7aaa4b34c9b7f9a0246052edc23ec4050650
MD5 786741f8effde89f212bc39cb5e28935
SHA1 3cf9f40301602dbb36d9374792b8d864aa3dd041
SHA512 74925b1ef90a6da8568ec7f03ca12243df7573b38226567822cb2601644ab495906a160488b3715dfca25d6febbeb14333670063ed9e7ed7a8cde164605c597d
SSDEEP 384:o+OBqImmJvGBLx3NaFMJFNNBSF2F83g6re:RcvGtlNXql6
TLSH
T15472AE7A29656F277CF78A497A8A7787CB70A653C0D53BE8CDEC5F0E213B0440352915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Core.dll

Path C:\Program Files (x86)\Final Draft 13\Microsoft.Web.WebView2.Core.dll
Size 451KB
SHA256 af0e477405aaad87424cf3930818b4e7901a0077b13b8e0882e9b435ed6f4b4c
MD5 7e2bc58a005e0f41d74ce4b762e0fe89
SHA1 c2afc3173048be6f8b678c42e833e7835913b0b8
SHA512 d4cd340df3787e6c839c9b349069a425fd4f272e5e7478251e435d13a3a7d4ea9a5048cee6386be3874750baab14ede8ebf6009aa1db07b9cea4aa90bbadfd8f
SSDEEP 12288:0GZv/0rx3kSq+iKdRFNne1+imQ9pRFZNIEJdIElxPrEIgcvLcglxMwCepM1STUCy:0GO3
TLSH
T1D3A4721223FD425AFAF67FB5957012604AF6FCD6B97AE35E459C612D0C32B8089A1333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Web.WebView2.Wpf.dll

Path C:\Program Files (x86)\Final Draft 13\Microsoft.Web.WebView2.Wpf.dll
Size 43KB
SHA256 7a6b8c5658fe8ffb05f8df283fe7ee5d2b68bd34aaf70cc847fc7c935fb14767
MD5 021975a0451ec73478b2a7a5759105ee
SHA1 e9fbb98a24e8d9ae67d948fbfcbd227961d8c7aa
SHA512 69683b1b8caf1bb6a200b31661ca085b3d9ef263c1d588f8b40d00c2c695f0f6fce3884a52741e9c1051961ccc25dd4c9518d5b17b4be48948577b04a03f41bc
SSDEEP 768:38+1YnVAe2rTdiNE468vRZ8cDP/ryEH0yBy4JjrD1h2j5h3URGvkz7FKKa5/Bi/g:oVAthiNW8vRZ8cDP/ryEH0yBy4JjrD1U
TLSH
T1DC1329A443EC8526DBEF6F74A1B492A10A7AFF837D60D7881AC4B0E50DB77C055503AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dark Horse Graphic Novel.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Graphic Novel\Dark Horse Graphic Novel.fdxt
Size 423KB
SHA256 0283326b3a9a8313b20bf675c052f1013662c90e25332698caaf595bbf327183
MD5 542e7515a90f52b1f51a29d80a8fc7d8
SHA1 d178ae08f008f238bdaaa9b5120597d1000744a1
SHA512 12f69dcb41f2a3019d8c701301378d0bba77f7398cc0e495f66a9734ac083f9d88248fe40fc9051c4d6a05f7bceb184db98a579181ebf14d9e8625a6fb8a947f
SSDEEP 12288:/CmW73uMicpwptPdOxDkmmuZXudhbUxDjc:/CmW73JiAcs71ZXCeHc
TLSH
T17994E14990D44CE5EB730146BA725596FF13C69B068684C8F40F193FBBB3EE84A271B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Graphic Novel.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Graphic Novel\Graphic Novel.fdxt
Size 446KB
SHA256 ad78bd058152ee6d193f384553e287f0372db5f1fd80e982f67a3f4f20143bea
MD5 bf49b6d223cb41e15dc05a939dc33aee
SHA1 d55cfb5419b802658555ce95ba7c60b1f42e5843
SHA512 8c8ad9ddfb98791a15b4c9cea750ded5a21a1a79889eadba7c71cb843698d3169d12c39a4e0d52d854dd8638bbdc4dcd4ecb8ca1f32e32f6c47fde9ee2989aa3
SSDEEP 6144:ksLfdR3SUtSF4h7EeP3vds59cZYJWAKXcRJwnfDP6+RxWztBXm0lMrqnyO1Fbhlp:bD3SUQmNEIYyZY4A8ywnDdW3X1yO7d3
TLSH
T12AA4F04890D95DA597B31126B722468BEF13D5CB064A8498F80F293FBFB3DE44E270B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Image Comics Graphic Novel.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Graphic Novel\Image Comics Graphic Novel.fdxt
Size 279KB
SHA256 ef2000ae217eb1904efd1974d4f1e430054ce053f943cdf63336107594193f71
MD5 65004246098c45a2a08b4e14c3debdfa
SHA1 233028ca8837f47a6096d3e7cfc723050dcb01cc
SHA512 591189bee946c590f311b9e1a4f9dbd61bfcdf10ee1e955607c8b9c81194c66fb6795683d221421aab7981212da52306a104b9f06410e859adc773c809f24f91
SSDEEP 6144:8XtXgESTO7f/LEWlzOXRaq8b1fsovv3NC0cHo4vJrJS6NS:89g4rEozOXRadJ300cHo4vTS6g
TLSH
T1D654E148A0D4AD9583B3166A732249D9FF63C5C70245805CF91E6D3FBBB3DE8887712A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

New York Film Academy Comic Book.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Graphic Novel\New York Film Academy Comic Book.fdxt
Size 352KB
SHA256 e6f83e6209cefef8ad75dcf58692c62c1fb15735b3a5537197531fa2592716be
MD5 017f3a5050fbe3b03e95708ffaeb0898
SHA1 49eb1a64205390c910a6e93ca12a7a06d5d8c555
SHA512 c584ed67304114d64047c36fed54ccc81ff97cef835ff80bfd64d76e16382428114248c35552862b27c9d6354a4e60b4cde0db396d9067e53270260a8b923f5a
SSDEEP 6144:8Q2XPUbBLbRYkwz90LicUhnX20zXUgmixr6qGpZypGxeiA2B8TfbD:p/b79G90LAXUgmz34pGx22B8L
TLSH
T1F074F154A1C0AC6563772266736289D6FF63C8C3124944A8F40F293FFFB3DA844B756A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Plot Outline.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Graphic Novel\Plot Outline.fdxt
Size 497KB
SHA256 8f0225012d7c9a415d015ece110f47fbc2bf8d8b341cf80ab892e3771f22f3ca
MD5 2cff9bec570593f3bfd4e9e48ded204e
SHA1 ca7ae8a52f0ea3133aa1b15e37117ea9bc70378a
SHA512 75e8265e90bf7ebb457458ee20906fdc0d3959847b65b35fe9f912c33839b503ead8b222d20afa0705c733f2b6cb9ecfad2fcfaa9f22520815805cf3724b1806
SSDEEP 12288:nmplUbQx0qjbVU1R5kYiaG3B5ZyguDTlJnsZ7TygzWgJqgbPdc:mplUO0q9UviIG3B5SlJsVxqKPO
TLSH
T12AB423CAA29DCCA142551534FCA1009FBF428FCB8D20D7EFF98D48AA7598D654A3F274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BBC Screenplay.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Script\BBC Screenplay.fdxt
Size 395KB
SHA256 f2d3fee9819a011316f19848fbc04461468171eea3bfc0c30555c4041038fd19
MD5 39e1bb88eab5ca48429078325a22a9cb
SHA1 121619be936b35824e42243991d12bb260ce18be
SHA512 737ec08d123bd6884980df88b3ab5b1bd55354aa956037335add7b0f448dc9d1339224b4749a755e6c99b6caf6ca968d61e3ae1d5fa128e892ad45637233f51c
SSDEEP 6144:rmmBgWwbT3F62EksRHCxbnosYoUCpWmayRO3yEx5GaxzI1Wx0aACocBNkgfkDHo:amBgb4VhixUsXxIyRrE5I1W0Akg7
TLSH
T16484E04491D05CA5A7B34526B732469AEF53C6D70605C0ACF80E2D7FBB73CE84C6B16A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Beat Board for Outline.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Script\Beat Board for Outline.fdxt
Size 1.1MB
SHA256 a2808390ef73bd2a0063f6dfe97ae35f7c805ef4f7dd7529c1fe69467a3220bc
MD5 94eb5be576d6077d03968fbb9c22b985
SHA1 7c4add31ee64e9b4e10823953639d2639f35bfd4
SHA512 dc56ccd3e5f8aa8e165574f3b679e01bf23a8b9bb56dcb59221f952de0f7333dce0b084e1b58918c06fbcddc8a4ec7a9c32bb2f02e01feb6e47a80a238a810b7
SSDEEP 24576:eqhNUaTgiWdtAaD+gwam9moqSl7jQm5BGMFd4IN/TST:eAJTgiWd8gw7FFB3n4IN/TST
TLSH
T1AE45129480D139E55B7500D6FE740AACBE128A9B067880FAF85F2D6B7FF3C901D27526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Beat Board.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Script\Beat Board.fdxt
Size 150KB
SHA256 0e2ba05a7ddfafd077992d6573c63eabe22d9c86d1423899226061c62de06d92
MD5 482978f67af55d92022fba65d0e1a8a6
SHA1 ba9f7cc3b993ebb07ec7a7b1608acdb20808ab48
SHA512 46f4c24d056bf0766c7aa95176f6ad8403a834843d278c68eed0a704310261006a564f4b9cfbbd3f52a41eaf8d4c3a43ee99e43bda94b0282c2663af07f263a5
SSDEEP 1536:s3h1pXjTg7ZplvLqlARFe3uNe3O5cvjEwB94hVG33PgJBLXLs/LO1pQkjDouq7qZ:SXVjTS2ARU/O5mEwP0U33PorGO1D/qvW
TLSH
T124E38B4881D06C51E7771656B3B106E6EF639ACB0944C19CF80E2E3FBBB3DE94827166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Broadway Musical.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Script\Broadway Musical.fdxt
Size 364KB
SHA256 d67c13c0396e9070da1a7204a6cf514d38189b1cd8c3ade6a8fefe09ab09e092
MD5 97567945f535239fbef65cd921e9724d
SHA1 48688b7c91a82988cf2402aa1fe8a53269991c42
SHA512 0bff2a4d1f7f510d98bbf759aaa50014b4af48e37b22cefe9646a68fc0e3fd4b944baa0de18c493f02fc46bc55bce8160c452b2bb9f757b4ab635c66b8fc3954
SSDEEP 6144:XzjtrIbGvrPa1ir2Triy0XMzkgXIFNIr/vmpVbkf3x:XtHTPafiy0XEdXIFy/vmpSfh
TLSH
T1CF847A4891E05CA1EBB34556F67106D6EF138A9B089981DCF85F2C3F7B72CE64E1B026
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dramatists Guild Modern Stageplay.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Script\Dramatists Guild Modern Stageplay.fdxt
Size 292KB
SHA256 69c0efc31ac6b02b25dfcfec49422dac0d5492a1b3a03587f362dad8af48512b
MD5 d7e4b64b3049e1ae11f6ba698e2fda1c
SHA1 9c7314b20296e63afb7ae255524a741af799c690
SHA512 832191d3650942129ad8c67157abc9577c65e47b09183901c0acaa3efcfdb2525b3ab4919c4d3017cb17aa881e2f61cdc4642af2fc4621ead9c26acfdb47ac4d
SSDEEP 6144:xAw55S71iEQgYTnU5RmbcHl/3wIaQ9SJQmKevlxllllllllldRwuyyyyyyyyToKT:xAw55SWlU5IcHl/HaQ9SJpnf
TLSH
T12954D048A0C19C94E7371266B7620696FF6385CB0A4484D8F90F1D7B7BB3DF4892717A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dramatists Guild Musical.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Script\Dramatists Guild Musical.fdxt
Size 314KB
SHA256 d4112d47fef82dd9d662be6f759c8f5c1275b40dfea96a8ca7828b8016a6f472
MD5 e8d461fd01233eace58d8efd9a7be211
SHA1 57064958e3e29ac80d683f1d30a0d40425c63ed4
SHA512 996fc082ebd92e5c7683b58c9bde62835b508f77a7b8bd2583ec0e0e570f0b1cecd3b28e5fdabc7c11f12fb9accd4caae2b405385b730d4ee4f5926d908e2568
SSDEEP 6144:+6TUJq/dC2tjAVu+A8eQgJfN6sC8QC9X+L/S5kOsLRRRRRRRRRRRPOt+RRRRRRcC:+Gr6VDgVMsCvCdcq5Cn
TLSH
T19864BE4991D44CA4A7770016B6B24196EF23D9CB0E9484C8F84F1A7F7BB3DE44E2B07A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Dramatists Guild Traditional Stageplay.fdxt

Path C:\Program Files (x86)\Final Draft 13\Templates\Script\Dramatists Guild Traditional Stageplay.fdxt
Size 340KB
SHA256 8d0a87e989319f30527dad8a4fae47e5b1a6acfa64d09e808d6c0800a7bde8aa
MD5 cf0c6866e90cccde140409a526e9f03f
SHA1 abd4b9074cc3ec4c6e50015eac52799db74e41f8
SHA512 52df6fb63849d0e998e07e9660124e083e969c05d67482ee0cbbea47567f691ccbd024ccdfa24b66d18a0c6e6588ed56f8b50c2c6fb0e3efb8b2d153bc5e7326
SSDEEP 6144:sQeBgTSdTYdkfG78ZCOCB/KE3lh78FnhKkL+GRq0NNNNNNNNNNptJ4ZN8888888p:jYgTShgT78dCwIlRoKkue
TLSH
T149747C4981D04CA5ABB31411B7B11256EF23A58B0E90C4CCF49F1A7F7BB2DE64E2B176
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudt58.dll

Path C:\Program Files (x86)\Final Draft 13\icudt58.dll
Size 25.0MB
SHA256 598dc848e6f0a5467dae90596699bfeb0d8e88118cfab3c6ab2a2159c3d2b733
MD5 536035d6c9493eb97c96326f43e8282c
SHA1 80df7501e2acd3f9f1898d44e7835d4a85505eda
SHA512 2a1f91dc2c9bf2ad8c1ef655c15e325d7e12c48d65d53b1a719d65c9ba205f0b3ea885877ac46ae8e2b95b8cec3157d32820786b0e302ce7f1353b8b6b8f2c48
SSDEEP 393216:O/AzEB2RBoFgsiXUx4YhMWljacUl2nAg9WbkntyemS/wo47Tt930PpUxQFV5eitT:3o2vm
TLSH
T11847084266FB4DC0FEF79F31AAF652679467BD01BE30814D12082B3B5D732A09A55B23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icuin58.dll

Path C:\Program Files (x86)\Final Draft 13\icuin58.dll
Size 1.7MB
SHA256 d1e4758aedeaf796f7221684e37c275a8d6ddb06cd7caa9f4a69cf0425f4e2c0
MD5 8f4b043fb9dbee4c35c6e5167a3ca4aa
SHA1 cebbb7e9c93fade8e4c9212629e97438763d4cfe
SHA512 bda52e6d9a6add6d251a25532bb1de213a20c5e321afe71c5eb975ffd522ef98494837b9627aa92ad48f59bbd302e9b439613852e10a3b381d54677f3bfd3b3d
SSDEEP 24576:jRQGVEsp6nmUPmNcxhbgZxlJ6QkhdAfmQADrnv0uVI90j8:j3KPmNcxtElQxgf4Drvuu8
TLSH
T1A8854C33B6C18233F5D1907298AD653B701DE925076991C3B38A473A2A378D36F7A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icuuc58.dll

Path C:\Program Files (x86)\Final Draft 13\icuuc58.dll
Size 1.2MB
SHA256 5e7929d4d8c66cddb918826ec3823bbf7ed295d5bec9a8990e7f4d2caa463b42
MD5 0645b2097ee8a5f81c7b78b796c6fc4b
SHA1 211dce7ac381d6f5c3b48d689b1957a64d4148af
SHA512 d5cda75a04268c272041a5d3d03f5c27236cb4b1e009e6f68a9a5e59b4edf22f2238d6bce0eacf26faf1913d34c2c75733a1f22993d883ebf5809a878fedb06c
SSDEEP 24576:PBTLkadN/X0pOrRsSH8htsLelpkknPrMkkkskkkkkRkkkkkkkkkkkkkkkkkkkkkV:PlR/X0gcQeaRF
TLSH
T131456C23FA839133D5E68072A5BFAF3A156DCC209F5544C3BACC4A342D639D22639797
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Final Draft 13.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Final Draft 13.lnk
Size 1004B
SHA256 633dc3515e4665477dfbc28fe5fcdff47d96d056fba8c59d3f9327592b25da19
MD5 3fca7b684e90b8e32b9f16c5d9af366e
SHA1 5363ea5b77cacb8a46ec82053e94a634f22b5bbc
SHA512 02c57e45739aa19f7756f79622e2e7a7f836e8b761b79948c4e0db88a86318d746c3af55459db3dae2020d0807bb6b3afc7127f41de3919628d58041a4ad021c
TLSH
T1A311CE044BDB1B05E2738731EEA6030595A7BC00E3B88B4A808712CC2DEB25284ACF6B
MD5 SHA1 SHA512 TLSH

Submit Download

~inal Draft 13.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~inal Draft 13.tmp
Size 1KB
SHA256 1eb1a508dfca306e3d051f1dd1fdbe6eaf4080fcb01249f01c0929d5c7ae4028
MD5 9a113797659553617c2e20d7420fae66
SHA1 1f1e2854d014e5dee695fb1d600728be1c3bd375
SHA512 1b7828a26e04b5afdd9352d44ecc300383d79439420cc4b44df160cc92290366fe84d2ab872afa34c8f2bf7af9686640bb3b3fe33dae4221fdd04242b84e0efe
TLSH
T1F311E7048BDB1B05F2738731ED651305955BBC41E2B88B59804711CC2DEF65284DDF7B
MD5 SHA1 SHA512 TLSH

Submit Download

~inal Draft 13.tmp

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\~inal Draft 13.tmp
Size 1KB
SHA256 062fc2d912166b9dce5570b6ce1c428da6d707ac7b9caf7107c2f354f9cac433
MD5 3af920a052b3c5879777a625a89aef4e
SHA1 e12d4099d0cc8d79b1db17645ab065133b7e5e12
SHA512 66232fdc4e242a8edb8484c4daa9eb40519ab3f2d3821388ac8dea9335c94cee91052fbba0e53f060b0eb746bad22516d4ab533c36a87de90853afb993dde2f3
TLSH
T1EA2104058FDB1B05F2B38731EE65131595ABBC41E2B88B09808751CC2DEB64288EDF7B
MD5 SHA1 SHA512 TLSH

Submit Download

MSI10DF.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI10DF.tmp
Size 211KB
SHA256 c8d190d5be1efd2d52f72a72ae9dfa3940ab3faceb626405959349654fe18b74
MD5 a3ae5d86ecf38db9427359ea37a5f646
SHA1 eb4cb5ff520717038adadcc5e1ef8f7c24b27a90
SHA512 96ecb3bc00848eeb2836e289ef7b7b2607d30790ffd1ae0e0acfc2e14f26a991c6e728b8dc67280426e478c70231f9e13f514e52c8ce7d956c1fad0e322d98e0
SSDEEP 3072:/Jz/kyKA1X1dxbOZU32KndB4GLvyui2lhQtEaY4IDflQn0xHuudQ+cxEHSiZxaQ:/t/kE1jOZy2KL4GBiwQtEa4L2sV
TLSH
T1ED249D316094943EE7FA0936997ED671AE3DF2341760C9AEC3848C0E6D644C16BB7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIF0A.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF0A.tmp
Size 19KB
SHA256 e8de00b8005898b808f511537dc3c0c66f65a47ea9c4a14aa9fb59e8f30ac880
MD5 2a7a294b93e5ece144b049fa9d4dd0c2
SHA1 356d46b2e28db0da79fbc3c8659506f535d065f9
SHA512 1ca5a665de38a8714f68cf6c7527fdc7560515e55f98c3367c31b7e4891bb06167d0649cb3226e369faa3bd36872d14af04524639d47a9d512bb552933661152
SSDEEP 192:tPExTv9lnY4+HYfG2vioYpEVT8P/X8HDqSQprqF7s9c01+y0VDdagt6KidX/:RGTTY4+KYWVQX8jqSQZ47o1+yuf6KidP
TLSH
T14D92721A3B1388B2E2EC1C3834371439A7B6CD79EC955953EB5FCD59386938299A7C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiseCustomCalla.dll

Path C:\Windows\4910975BDA4C4BB9ABE9AB477B32BC09.TMP\WiseCustomCalla.dll
Size 318KB
SHA256 8415934aab8f984fb385e5b0b9746cf1a07bc4153be1521968d9409fafe41b6a
MD5 6a666ae09527f7051a97281cfed3ce87
SHA1 b9084e9d90e52c6c896f7647e6c73004c29973ea
SHA512 a39294dd263300e6cfa47093a493190fa8a31d617ee3e0e8eabe74b66aa78c5efab45a0075421bbab5e89d22175b5982ba9bb822260e39a33223c10736e346fc
SSDEEP 6144:8jOUcBkaL2vV+8yhXFm8x5ynmTUnRA1vron/Js1jjG:eOUcBkaL2t+8y1TURUaJcj
TLSH
T18E647B20B641C437D9AF2475695DD6BA26AD7A304BA4C0C7F7C40EAE9F722C35B3460B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiseData.ini

Path C:\Windows\4910975BDA4C4BB9ABE9AB477B32BC09.TMP\WiseData.ini
Size 4KB
SHA256 c301c48b0f60f3e3a58effcb86574006280df7c820b704285a80e724853a3a38
MD5 56de6ae101aea457f6cb39119248a4cf
SHA1 7a0b8189b6c530036d1e5905e83b285297ed00ed
SHA512 20b37502324fe2027d2e7d29d055dfef5d0cd8be3a3ea741ea75350d4ff06dc03b8246d6c33d3ed268334ff51022ee02e8c4e4a81c42b535395c54b3768ec2e6
SSDEEP 96:t4IbKDFe8l0M1827OAeIePeMGke0oGDzlewnmGwKz2eX5uxu18lZuBuqe5rHzlEX:t4mq0MWbNDzP6z+Y6cMwm
TLSH
T1C0A1C88581EADAC378E2B1A307FC1D05EAD0DD45BB61722A13D4014FE392E5C97AA473
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WiseData.ini

Path C:\Windows\4910975BDA4C4BB9ABE9AB477B32BC09.TMP\WiseData.ini
Size 997B
SHA256 b9f9c84476ed1ce4cfb059008528ed081e59d3c739bc306ed2509917c2ec06be
MD5 73ddd39b54f91322931aa36c673094a5
SHA1 0284a2b05284b76d2cced61666cd8a94244ade2d
SHA512 2971ef284bf710043dd70e45ba64b2b89e0bd58530fedc5dcbd3404e1b4b2e3255110493b94f75ca736c861da1fed6089b34dca468b01bae6dc410d2b54c4398
TLSH
T1211125CA8B19677ABCC217F646221705FFD150480175270C12BA10C67BB980C87F345E
MD5 SHA1 SHA512 TLSH

Submit Download

WiseData.ini

Path C:\Windows\4910975BDA4C4BB9ABE9AB477B32BC09.TMP\WiseData.ini
Size 1KB
SHA256 7feed6e4bf793aa9035080776449918f52f61538d7eb206b05c69533890dd03e
MD5 e9e133b6c60727d4a986d6cd7f85a9f6
SHA1 2e4267223916f9725b13519e10e5909531870f12
SHA512 79e0520ee5f627fbecf8a8db2f3fd11709b5056ab5772c0da5b0bc1714e1bc5fc74438311993a526adebf12714b4b11cab2e7f13981c6f300b0c6bdee5a45b2c
TLSH
T1C821F1869E1D977BBCC217B656221605FFD1449D0265760C13FA10C6B7F990C87B351A
MD5 SHA1 SHA512 TLSH

Submit Download

WiseData.ini

Path C:\Windows\4910975BDA4C4BB9ABE9AB477B32BC09.TMP\WiseData.ini
Size 1KB
SHA256 5602d0038edbad84c321cb3813961e65d8381f781052490956a2822be54bcd23
MD5 2ddac5e02e65731b4f169352992dbd58
SHA1 1ffd4e31d0dd0f9c7a9607770a909ff1a6eb69df
SHA512 6b8799df5a227b8bc53a6f62da77ed4a6daae7272c291e4b8cbd9df989afe1ac208bb4c39298929996469b4dfc97c5901a4a15fd08f45f54b34eb5d86a37c2ae
TLSH
T16E4160C7892BF7BA6CC207B89A611606FEC258884132754C13B610C3ABF914C97F782B
MD5 SHA1 SHA512 TLSH

Submit Download

WiseData.ini

Path C:\Windows\4910975BDA4C4BB9ABE9AB477B32BC09.TMP\WiseData.ini
Size 2KB
SHA256 2f678dcc3155e15bc60f718412bc68ca9c1350e71e0a51ef9d34fe2c2f4943a4
MD5 6dd3ad663623fe3165650d11e119c0fb
SHA1 2b15f5fb654c76a41cfbf609ad8566263ecc2027
SHA512 4a48be9a5f1cef280faab435b85af4f2ff3ceb8c7e0c2f0bc86e4b44b9902c8256e1f14726e24c5c95c236f986bb89aacadba9a894668e44c15618c377dbaace
TLSH
T18C51B6C2816BE7E378E226B147AD1A05EEC19C896722351D13E40187D7E6A1C8BFB423
MD5 SHA1 SHA512 TLSH

Submit Download

MSIC2F8.tmp

Path C:\Windows\Installer\MSIC2F8.tmp
Size 48KB
SHA256 3dde600d3381f19b1116c8cd744d60a38c6bbd64e98cf086247815a0ae4e297b
MD5 4c7f85585ee17df3dc9aee808592fc6d
SHA1 29df86c62ca6556d9018277c740f941d51b69b78
SHA512 614efe83a4d1fa617a8e368df27d486ace74e719af25c991aa7a14a1d82fb07eaad97e43b1b2d4dd483d451b14c74f06b2b567e4d14424a19ab6eedcf00e2378
SSDEEP 768:GT4eVe8UT99au46NwpWIPRJG8TI4MUfW6idyW7SyDonuK7:G82UT9kubNUNHG76jPeou
TLSH
T1DD237D21346242F7D2CB877145E78F2B9F7EA6500BE154839FB5184A2E316F1B63B386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC5D9.tmp

Path C:\Windows\Installer\MSIC5D9.tmp
Size 108KB
SHA256 cfae900920871f92cb9ab92a1732aeb7b0734464f33390dab49a193d4ae2a451
MD5 91315b4c9aae41d5d5ecb33225c485e0
SHA1 56b5f9bd3b8c2f3e46f4d75ecfedd0e3e27e8c17
SHA512 7419942b34ef561a9834ea449242f34907b53db7472268f037c395100b88b95c8d9bd50635637f3cdafb6caa7721560458f567fba97bf1b659d13f1dc6334762
SSDEEP 3072:txIKzIPKNvY9QkzbdmXhRS3W6Xb6WrXoJeG5JgWPcLH:7lNvYEfCW46WrXGa
TLSH
T1E7B39E83B3E580F1F956187C1567573B8A3BB41D852D9E83AB60FD046FA1382B7983C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1548_304165389\manifest.json
Size 118B
SHA256 cc33e26f3b2efe862336389207db045cc7a916940213b9d33d845c82c12c8712
MD5 acb0c12cc7e5345764763e37bcebbec8
SHA1 4147b2615955c51a6054c807c2397e4d7d10ee03
SHA512 6777da8af66a77c28049eaf1b49ba7cdfaa08a8f381c27dad4af0e980e8d5a7ea0df0c3f1fd0cbc0cbe93a83a07d130ae24dc4057471de830fac60036b1c2f3a
TLSH
T10EB09222DC80D832697693A84E2246D0F238234B2568AA493630048C0B2E2F182A2721
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 bfe768c37eb4a2a90ddcd23bc32ca6928cd9459d43cf7e4b2829e25289f8edcc
MD5 b90a8feb51e290419bfe26ae871b627a
SHA1 927289943a963e8646cf39d9424bb92bf60bcf69
SHA512 d7195fd003b6bb95834774581ed904149c810cd16959d8d0e9f04ca186afe5f687dcd69b0aef4c1eef0ba65c862bbd9650d5ed19f35bf3b0e3453b7fe7f81436
SSDEEP 24576:DFo3DMPZdoO/vvTL/igWWyFgPbuMdLxlULwEd7I+gDY65hX2cYBmWPMXyu4:zHA
TLSH
T19557901436F92150E7F79E3CA8F0AA2349397D5B9C1ADE8D05411F4E0861FB1E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6edb6582-66e1-4a32-afe2-c06bfb53202d}_OnDiskSnapshotProp

Path \??\Volume{f0fdc120-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{6edb6582-66e1-4a32-afe2-c06bfb53202d}_OnDiskSnapshotProp
Size 6KB
SHA256 c2e8473ec42d41af398e5792c917e31c2ef99ff9d2d5a86e562744039ab77d4b
MD5 09bdc89c84b8a7833ca9dd8a0f94896a
SHA1 d133ed87835897c02539c4f7e9f6fffef4e9ae43
SHA512 3665e8bd53121c5205d62c4b63f5a9405787da22f929d320332e31af38dfdda26970fca57ac1e4bc6a616574b1fd1ef278179923c03adb50da59c21a62fd4da4
SSDEEP 96:FnWD+Lvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:JTb++uVm
TLSH
T1DED189085AF54711E2B3AB3128F18557A877B911EF33CB8E0198238E6670910F875F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1232-666-0x00007FFA0CB70000-0x00007FFA0CB71000-memory.dmp

Download

memory/1232-665-0x00007FFA0B230000-0x00007FFA0B231000-memory.dmp

Download

memory/1348-491-0x00007FFA0C310000-0x00007FFA0C311000-memory.dmp

Download

memory/3816-380-0x0000000010100000-0x000000001013E000-memory.dmp

Download

memory/3816-363-0x0000000009D70000-0x0000000009E84000-memory.dmp

Download

memory/3816-362-0x0000000009D60000-0x0000000009D6E000-memory.dmp

Download

memory/3816-361-0x0000000009CC0000-0x0000000009D34000-memory.dmp

Download

memory/3816-360-0x00000000099A0000-0x0000000009B76000-memory.dmp

Download

memory/3816-358-0x00000000097D0000-0x0000000009991000-memory.dmp

Download

memory/3816-348-0x0000000000400000-0x0000000004154000-memory.dmp

Download

memory/3816-379-0x000000000CAE0000-0x000000000CB72000-memory.dmp

Download

memory/3816-381-0x0000000010140000-0x000000001014E000-memory.dmp

Download

memory/4160-612-0x0000016F9EA00000-0x0000016F9EAA8000-memory.dmp

Download

memory/4160-490-0x00007FFA0C310000-0x00007FFA0C311000-memory.dmp

Download