Versions

3, 19, 0, 0	70.59%
	29.41%

There are 2 versions of vpdagent_x64.exe in the wild, the latest version being 3, 19, 0, 0. It is started as a Windows Service called 'Agent' with the name 'Agent' and described as “This service delivers virtual printer driver notifications to user mode clients. Part of the EMF Virtual Printer Driver software.”. . In addition, it is run under the context of the SYSTEM account with extensive privileges (the administrator accounts have the same privileges). The average file size is about 134.75 KB. The executable is a .NET framework assembly utilizing the CLR. During the process's lifecycle, the typical CPU resource utilization is about 0.0001% including both foreground and background operations, the average private memory consumption is about 1.46 MB with the maximum memory reaching around 3.07 MB. Addionally, typically read and write I/O disk operations is about 30 Bytes per minute for reads and 0 Bytes per minute for writes.