hxxps://www[.]pdfgear[.]com/pt/download/

Analysis

user interaction
yes
max time kernel
190s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/04/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.pdfgear.com/pt/download/
Sample260429-v684psd15s

Score

8^/10

defense_evasion discovery installer spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	4824	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	pdfgear_setup_v2.1.15.tmp

Executes dropped EXE 7 IoCs

pid	Process
2856	pdfgear_setup_v2.1.15.exe
2100	pdfgear_setup_v2.1.15.tmp
1072	pdfgear_setup_v2.1.15.exe
2632	pdfgear_setup_v2.1.15.tmp
556	RegExt.exe
4588	PDFLauncher.exe
3496	pdfeditor.exe

Loads dropped DLL 23 IoCs

pid	Process
2632	pdfgear_setup_v2.1.15.tmp
556	RegExt.exe
556	RegExt.exe
556	RegExt.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
4588	PDFLauncher.exe
3496	pdfeditor.exe
3496	pdfeditor.exe
3496	pdfeditor.exe
3496	pdfeditor.exe
3496	pdfeditor.exe
3496	pdfeditor.exe
3496	pdfeditor.exe
3496	pdfeditor.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates processes with tasklist 1 TTPs 5 IoCs

discovery

Process Discovery

T1057

pid	Process
5016	tasklist.exe
1192	tasklist.exe
4872	tasklist.exe
1108	tasklist.exe
5852	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\PDFgear\is-EBN9G.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-6SM5V.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-T0MK3.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\es\is-7LUNJ.tmp	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\nl\pdfconverter.resources.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\System.Linq.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\System.Threading.Timer.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\NsOCR\Bin_64\jnsocr.dll	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\es\is-Q9CPO.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\nl\is-UB11R.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-1BUPF.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-89JKB.tmp	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\fr\CommonLib.resources.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\GongSolutions.WPF.DragDrop.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\it\PDFLauncher.resources.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\System.Security.Cryptography.Csp.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\System.Threading.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\System.Xml.XmlDocument.dll	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\fr\is-C4OLB.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-HSS4Q.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-QA459.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-IJGVA.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-IEDVP.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-4F59M.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\PDFgear\fr\is-HALO1.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-GS579.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-LSQKI.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-CFM8O.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-9Q8KV.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-0BT5C.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\tessdata\is-Q81K7.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\configs\is-LOKTK.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-FORF7.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\tessconfigs\is-GCSG7.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\ur\messages.json	msedge.exe
File opened for modification	C:\Program Files\PDFgear\System.Runtime.Serialization.Json.dll	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\sl\messages.json	msedge.exe
File opened for modification	C:\Program Files\PDFgear\CommonLib.dll	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-UQ3A3.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\de\messages.json	msedge.exe
File opened for modification	C:\Program Files\PDFgear\zh-CN\PDFLauncher.resources.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\System.Runtime.Serialization.Primitives.dll	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\es\is-PG4G9.tmp	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\ja\pdfconverter.resources.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\Syncfusion.DocToPdfConverter.Base.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\System.IO.Pipes.dll	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\NsOCR\Bin_64\NsImgLdr.dll	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-FBPD0.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-VDCIV.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\asian\is-CGUHE.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\tessdata\is-1NHUT.tmp	pdfgear_setup_v2.1.15.tmp
File opened for modification	C:\Program Files\PDFgear\System.Buffers.dll	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-TC5JL.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-D87IG.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\is-0SEJ2.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\configs\is-Q5KEM.tmp	pdfgear_setup_v2.1.15.tmp
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\as\messages.json	msedge.exe
File opened for modification	C:\Program Files\PDFgear\e_sqlite3.dll	pdfgear_setup_v2.1.15.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfgear_setup_v2.1.15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfgear_setup_v2.1.15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfgear_setup_v2.1.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	find.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfgear_setup_v2.1.15.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4824	chrome.exe
4260	msedge.exe
388	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/2856-152-0x0000000000400000-0x0000000000528000-memory.dmp	innosetup
behavioral1/memory/2856-178-0x0000000000400000-0x0000000000528000-memory.dmp	innosetup
behavioral1/memory/1072-183-0x0000000000400000-0x0000000000528000-memory.dmp	innosetup
behavioral1/memory/1072-213-0x0000000000400000-0x0000000000528000-memory.dmp	innosetup
behavioral1/memory/1072-244-0x0000000000400000-0x0000000000528000-memory.dmp	innosetup
behavioral1/memory/1072-1237-0x0000000000400000-0x0000000000528000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134219578693063947"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	pdfeditor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\.pdf\ = "PdfGear.App.1"	RegExt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	PDFLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	pdfeditor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	pdfeditor.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	pdfeditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	pdfeditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	pdfeditor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\shell	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\PdfGear.App.1\AppUserModelID = "578ab678-3bcf-4410-8b82-675d5d214865"	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	pdfeditor.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	pdfeditor.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\PdfGear.App.1\shell\open	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\.pdf\OpenWithProgids\PdfGear.App.1	RegExt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	PDFLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	pdfeditor.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	pdfeditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	pdfeditor.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	pdfeditor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\PdfGear.App.1\DefaultIcon\ = "\"C:\\Program Files\\PDFgear\\PDFLauncher.exe\",1"	RegExt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	PDFLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	pdfeditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	pdfeditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	pdfeditor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\shell\open\command\ = "\"C:\\Program Files\\PDFgear\\PDFLauncher.exe\" \"%1\""	RegExt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	pdfeditor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	pdfeditor.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	PDFLauncher.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\DefaultIcon\ = "\"C:\\Program Files\\PDFgear\\PDFLauncher.exe\",1"	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	PDFLauncher.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	PDFLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	PDFLauncher.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\shell\open	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\PdfGear.App.1\DefaultIcon	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	PDFLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	PDFLauncher.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\PdfGear.App.1\shell\open\command	RegExt.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	pdfeditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	pdfeditor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Documents"	PDFLauncher.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	pdfeditor.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\PdfGear.App.1	RegExt.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	PDFLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	pdfeditor.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PdfGear.App.1"	RegExt.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	pdfeditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	pdfeditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	pdfeditor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\PdfGear.App.1\	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	PDFLauncher.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PdfGear.App.1\DefaultIcon	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	pdfeditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	pdfeditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	pdfeditor.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	PDFLauncher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	pdfeditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	pdfeditor.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	pdfeditor.exe

Modifies system certificate store 2 TTPs 6 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 040000000100000010000000866912c070f1ecacacc2d5bca55ba1290f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e720b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000520053004100000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b69140000000100000014000000dd040907a2f57a7d5253129295ee3880250da6591d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb190000000100000010000000787d09f953c59978ecd8d6e44b38e24f2000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	pdfeditor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB\Blob = 5c000000010000000400000000100000190000000100000010000000787d09f953c59978ecd8d6e44b38e24f030000000100000014000000b7ab3308d1ea4477ba1480125a6fbda936490cbb1d00000001000000100000000d48ee33d7f1af8f4b002527f82a344a140000000100000014000000dd040907a2f57a7d5253129295ee3880250da65962000000010000002000000085666a562ee0be5ce925c1d8890a6f76a87ec16d4d7d5f29ea7419cf20123b6909000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200052005300410000000f0000000100000020000000489ff6233f3d3c5da77604be230745657fe488cb05257da551bfd64c1f179e72040000000100000010000000866912c070f1ecacacc2d5bca55ba1292000000001000000e1050000308205dd308203c5a00302010202087b2c9bd316803299300d06092a864886f70d01010b0500307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920525341301e170d3136303231323137333933395a170d3431303231323137333933395a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f726974792052534130820222300d06092a864886f70d01010105000382020f003082020a0282020100f90fdda32b7dcbd02afeec6785a6e72e1bba77e1e3f5afa4ecfa4a5d91c457476b18776b76f2fd93e43d0fc2169e0b66c356949e178385ce56eff216fd0062f5220954e865174e41b9e04f4697aa1bc8b86e625e69b15fdb2a027efc6ccaf341d8edd0e8fc3f6148edb003141d100e4b19e0bb4eec8665ff36f35e67020b9d865561fd7a38edfee21900b76fa1506275743ca0fac82592b46e7a22c7f81ea1e3b2dd9131ab2b1d04ffa54a0437e985a4332bfde2d655347c19a44a68c7b2a8d3b7caa19388ebc197bc8cf91dd922842474c7043d6aa92993ccebb85be1fe5f25aa3458c8c123549d1b9811c3389c7e3d866ca50f40867c02f45c024f28cbae719f0f3ac833fe112535eafcbac5603dd97c18d5b2a9d37578037222ca3ac31fef2ce52ea9fa9e2cb65146fdaf03d6ea6068ea8516366b85e91ec0b3ddc424dc802a81416d943ec8e0c98141009e5ebf7fc50898a2182c4240b3f96f38274b4e80f43d8147e0887cea1cceb5755c512e1c2b7f1a7228e700b5d174c6d7e49fad0793b6533535fc37e4c3f65d16be2173de920af8a0636abc96926a3ef8bc65559bdef50d892604fc251aa62569cbc26dca7ce2595f97acebef2ec8bcd71b593c2bccf219c8936b276319cffce926f8ca719b7f93fe3467844e99ebfcb378093370ba66a676ed1b73eb1aa50dc422132094560a4e2c6c4eb1fdcf9c09baa233ed870203010001a3633061301d0603551d0e04160414dd040907a2f57a7d5253129295ee3880250da659300f0603551d130101ff040530030101ff301f0603551d23041830168014dd040907a2f57a7d5253129295ee3880250da659300e0603551d0f0101ff040403020186300d06092a864886f70d01010b050003820201002018119429fb269d1c1e1e7061f19572937124ad6893588e32af1bb37003fc252b7485903d786af4b98ba5973bb51891bb1ea7f9405b91f95599af1e11d05c1da766e3b194070c3239a6ea1bb079d81d9c7044e38addc4f9951f8a38433f0185a547a73d46b2bce52268f77b9cd82c3e0a21c82d33acbfc581993174c17571c5beb1f02345f49d6bfc19639da3bc04c6180b25bb53890fb38050de45ee447fab94786498d3f628dd87d8706574fb0eb913eba70f61a93296ccdebbed634c18bba940f7a0546e2088717518ea7ab43472e02327775cb690ea862540abef330fcb9f82bea220fbf6b52d1ae6c285b1740ffbc86502a4520147dd4922c1bfd8eb6bac7edeec633315b723088fc60f8d415add8ec5b98fe5453f78dbbad21b40b1fe714d3fe081a2ba5eb4ec15e093dd081f7ee155990b21de939e0afbe6a349bd3630fee777b2a07597b52d8188176520f7da90009fc952cc32ca357cf53d0fd82bd7f5266cc906349616ea70591a3279790bb6887f0f52483dbf6cd8a2442ed14eb77258d3891395fe44abf8d78b1b6e9cbc2ca05bd56a00af5f37e1d5fa100b989c86e7268fcef0ec6e8a570b80e34eb2c0a0636190ba556837746ab692db9fa18622b665270eecb69f4260e467c2b5da410bc4d38b611bbcfa1f912bd744075eba29acd9c5e9ef53485aeb80f1285821cdb00655fb273f539070a9041e5727b9	pdfeditor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4CDD51A3D1F5203214B0C6C532230391C746426D	pdfeditor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4CDD51A3D1F5203214B0C6C532230391C746426D\Blob = 0f00000001000000200000002b3cbcdeb5afcc4d44496bd72b688b5789edfcf6c49b33fee10c5572d64e212a5300000001000000850000003081823022060c2b0601040182a9300103010430123010060a2b0601040182373c0101030200c03022060c2b0601040182a9300103030230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b0000000100000058000000530053004c002e0063006f006d00200045005600200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b0601050507030862000000010000002000000022a2c1f7bded704cc1e701b5f408c310880fe956b5de2a4a44f99c873a25a7c81400000001000000140000005bca5ee5ded281aacda82d6451b6d9729b97e64f1d000000010000001000000052ad927837cafaf0d54c13ccf52e9ca97f000000010000000c000000300a06082b060105050703047e00000001000000080000000000e4add325dc010300000001000000140000004cdd51a3d1f5203214b0c6c532230391c746426d200000000100000098020000308202943082021aa00302010202082c299c5b16ed0595300a06082a8648ce3d040302307f310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3134303206035504030c2b53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313532335a170d3431303231323138313532335a307f310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3134303206035504030c2b53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004aa124790981bfbefc3400783204ef13082a206d1f2928661f2f62168ca00c4c7ea43005486dcfd1fdf00b841625cdc701632de1f99d4ccc507c8081f611607513d7d5c0753e335388cdfcd9fd92e0d4ab6192e5a705a06edbef0a1b0cad00929a3633061301d0603551d0e041604145bca5ee5ded281aacda82d6451b6d9729b97e64f300f0603551d130101ff040530030101ff301f0603551d230418301680145bca5ee5ded281aacda82d6451b6d9729b97e64f300e0603551d0f0101ff040403020186300a06082a8648ce3d04030203680030650231008ae6408937ebe9d513d9cad46b24f3b03d8746581aecb1df6ffb56ba706bc738cce8b18c4f0ff7f167760e83d01e518f02303df62328264cc6608793269bb2351ebad6f73cd11ccefa253ca61a81155bf3120f6cee658ac987a8f907e0629a8c5c4a	pdfeditor.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4CDD51A3D1F5203214B0C6C532230391C746426D\Blob = 190000000100000010000000923609efb6dbec56b1fc77114f67c7f20300000001000000140000004cdd51a3d1f5203214b0c6c532230391c746426d7e00000001000000080000000000e4add325dc017f000000010000000c000000300a06082b060105050703041d000000010000001000000052ad927837cafaf0d54c13ccf52e9ca91400000001000000140000005bca5ee5ded281aacda82d6451b6d9729b97e64f62000000010000002000000022a2c1f7bded704cc1e701b5f408c310880fe956b5de2a4a44f99c873a25a7c809000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000058000000530053004c002e0063006f006d00200045005600200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000005300000001000000850000003081823022060c2b0601040182a9300103010430123010060a2b0601040182373c0101030200c03022060c2b0601040182a9300103030230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000200000002b3cbcdeb5afcc4d44496bd72b688b5789edfcf6c49b33fee10c5572d64e212a200000000100000098020000308202943082021aa00302010202082c299c5b16ed0595300a06082a8648ce3d040302307f310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3134303206035504030c2b53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313532335a170d3431303231323138313532335a307f310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3134303206035504030c2b53534c2e636f6d20455620526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004aa124790981bfbefc3400783204ef13082a206d1f2928661f2f62168ca00c4c7ea43005486dcfd1fdf00b841625cdc701632de1f99d4ccc507c8081f611607513d7d5c0753e335388cdfcd9fd92e0d4ab6192e5a705a06edbef0a1b0cad00929a3633061301d0603551d0e041604145bca5ee5ded281aacda82d6451b6d9729b97e64f300f0603551d130101ff040530030101ff301f0603551d230418301680145bca5ee5ded281aacda82d6451b6d9729b97e64f300e0603551d0f0101ff040403020186300a06082a8648ce3d04030203680030650231008ae6408937ebe9d513d9cad46b24f3b03d8746581aecb1df6ffb56ba706bc738cce8b18c4f0ff7f167760e83d01e518f02303df62328264cc6608793269bb2351ebad6f73cd11ccefa253ca61a81155bf3120f6cee658ac987a8f907e0629a8c5c4a	pdfeditor.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B7AB3308D1EA4477BA1480125A6FBDA936490CBB	pdfeditor.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
2864	chrome.exe
2864	chrome.exe
2632	pdfgear_setup_v2.1.15.tmp
2632	pdfgear_setup_v2.1.15.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3496	pdfeditor.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe
Token: SeShutdownPrivilege	4808	chrome.exe
Token: SeCreatePagefilePrivilege	4808	chrome.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
2632	pdfgear_setup_v2.1.15.tmp
556	RegExt.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe
4808	chrome.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4588	PDFLauncher.exe
4588	PDFLauncher.exe
3496	pdfeditor.exe
3496	pdfeditor.exe
3496	pdfeditor.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4860	4808	chrome.exe	86
PID 4808 wrote to memory of 4768	4808	chrome.exe	87
PID 4808 wrote to memory of 4768	4808	chrome.exe	87
PID 4808 wrote to memory of 4824	4808	chrome.exe	88
PID 4808 wrote to memory of 3380	4808	chrome.exe	89
PID 4808 wrote to memory of 3380	4808	chrome.exe	89
PID 4808 wrote to memory of 2716	4808	chrome.exe	91
PID 4808 wrote to memory of 4220	4808	chrome.exe	92
PID 4808 wrote to memory of 2716	4808	chrome.exe	91
PID 4808 wrote to memory of 4220	4808	chrome.exe	92
PID 4808 wrote to memory of 1656	4808	chrome.exe	93
PID 4808 wrote to memory of 1656	4808	chrome.exe	93
PID 4808 wrote to memory of 1768	4808	chrome.exe	94
PID 4808 wrote to memory of 2148	4808	chrome.exe	97
PID 4808 wrote to memory of 3532	4808	chrome.exe	98
PID 4808 wrote to memory of 3788	4808	chrome.exe	99
PID 4808 wrote to memory of 3716	4808	chrome.exe	101
PID 4808 wrote to memory of 2856	4808	chrome.exe	102
PID 2856 wrote to memory of 2100	2856	pdfgear_setup_v2.1.15.exe	104
PID 4808 wrote to memory of 1072	4808	chrome.exe	108
PID 1072 wrote to memory of 2632	1072	pdfgear_setup_v2.1.15.exe	109
PID 2632 wrote to memory of 3284	2632	pdfgear_setup_v2.1.15.tmp	114
PID 3284 wrote to memory of 1108	3284	cmd.exe	116
PID 3284 wrote to memory of 1692	3284	cmd.exe	117
PID 4808 wrote to memory of 2864	4808	chrome.exe	118
PID 2632 wrote to memory of 5380	2632	pdfgear_setup_v2.1.15.tmp	119
PID 5380 wrote to memory of 5852	5380	cmd.exe	121
PID 5380 wrote to memory of 2128	5380	cmd.exe	122
PID 2632 wrote to memory of 3788	2632	pdfgear_setup_v2.1.15.tmp	123
PID 3788 wrote to memory of 5016	3788	cmd.exe	125
PID 3788 wrote to memory of 1852	3788	cmd.exe	126
PID 2632 wrote to memory of 3520	2632	pdfgear_setup_v2.1.15.tmp	127
PID 3520 wrote to memory of 1192	3520	cmd.exe	129
PID 3520 wrote to memory of 4616	3520	cmd.exe	130
PID 2632 wrote to memory of 3748	2632	pdfgear_setup_v2.1.15.tmp	131
PID 3748 wrote to memory of 4872	3748	cmd.exe	133
PID 3748 wrote to memory of 556	3748	cmd.exe	134
PID 2632 wrote to memory of 556	2632	pdfgear_setup_v2.1.15.tmp	135
PID 2632 wrote to memory of 4588	2632	pdfgear_setup_v2.1.15.tmp	137
PID 2632 wrote to memory of 3712	2632	pdfgear_setup_v2.1.15.tmp	138
PID 3712 wrote to memory of 4544	3712	msedge.exe	139
PID 3712 wrote to memory of 4260	3712	msedge.exe	141
PID 3712 wrote to memory of 3628	3712	msedge.exe	142
PID 3712 wrote to memory of 3628	3712	msedge.exe	142
PID 3712 wrote to memory of 3628	3712	msedge.exe	142
PID 3712 wrote to memory of 224	3712	msedge.exe	143
PID 3712 wrote to memory of 224	3712	msedge.exe	143
PID 3712 wrote to memory of 2952	3712	msedge.exe	144
PID 3712 wrote to memory of 3008	3712	msedge.exe	145
PID 3712 wrote to memory of 2952	3712	msedge.exe	144
PID 3712 wrote to memory of 2952	3712	msedge.exe	144
PID 3712 wrote to memory of 3008	3712	msedge.exe	145
PID 3712 wrote to memory of 3008	3712	msedge.exe	145
PID 3712 wrote to memory of 4044	3712	msedge.exe	148
PID 3712 wrote to memory of 4044	3712	msedge.exe	148
PID 3712 wrote to memory of 536	3712	msedge.exe	149
PID 3712 wrote to memory of 536	3712	msedge.exe	149
PID 3712 wrote to memory of 4176	3712	msedge.exe	151
PID 3712 wrote to memory of 2024	3712	msedge.exe	153
PID 2024 wrote to memory of 2284	2024	msedge.exe	154
PID 2024 wrote to memory of 1172	2024	msedge.exe	157
PID 2024 wrote to memory of 388	2024	msedge.exe	158
PID 2024 wrote to memory of 1172	2024	msedge.exe	157
PID 2024 wrote to memory of 1172	2024	msedge.exe	157

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.pdfgear.com/pt/download/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffac64c728,0x7fffac64c734,0x7fffac64c740
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,892149695124973023,3287746192900928840,262144 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,14028155099951321749,1120891231230810313,524288 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,4229650053663914894,16605322839300476586,524288 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,4854275510265140578,3779256128583322963,2097152 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,17045390253879383697,2821973025294486449,2097152 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4396,i,12890886346214547064,9604583623084662954,2097152 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5332,i,4165378919102089837,8127976671100874469,524288 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,2229723969217406379,11804340427292018707,524288 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5804,i,8028202726979450347,7550298304194897064,524288 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5816,i,1227568294145704528,11522850026752666028,524288 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5300,i,8818794936059077476,17288191599694767575,524288 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3716
- C:\Users\Admin\Downloads\pdfgear_setup_v2.1.15.exe
  "C:\Users\Admin\Downloads\pdfgear_setup_v2.1.15.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2856
- - C:\Users\Admin\AppData\Local\Temp\is-PFN2J.tmp\pdfgear_setup_v2.1.15.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-PFN2J.tmp\pdfgear_setup_v2.1.15.tmp" /SL5="$F0040,139244751,1157120,C:\Users\Admin\Downloads\pdfgear_setup_v2.1.15.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2100
- C:\Users\Admin\Downloads\pdfgear_setup_v2.1.15.exe
  "C:\Users\Admin\Downloads\pdfgear_setup_v2.1.15.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Users\Admin\AppData\Local\Temp\is-MI0Q6.tmp\pdfgear_setup_v2.1.15.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-MI0Q6.tmp\pdfgear_setup_v2.1.15.tmp" /SL5="$501FE,139244751,1157120,C:\Users\Admin\Downloads\pdfgear_setup_v2.1.15.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "FileWatcher.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3284
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /nh
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:1108
    - - C:\Windows\SysWOW64\find.exe
        
        find /c /i "FileWatcher.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1692
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "FileWatcher.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5380
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /nh
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:5852
    - - C:\Windows\SysWOW64\find.exe
        
        find /c /i "FileWatcher.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2128
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "pdfeditor.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3788
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /nh
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:5016
    - - C:\Windows\SysWOW64\find.exe
        
        find /c /i "pdfeditor.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1852
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "PDFLauncher.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /nh
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:1192
    - - C:\Windows\SysWOW64\find.exe
        
        find /c /i "PDFLauncher.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4616
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c tasklist /nh|find /c /i "pdfconverter.exe" > "C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist /nh
        5⤵
        Enumerates processes with tasklist
        System Location Discovery: System Language Discovery
        
        PID:4872
    - - C:\Windows\SysWOW64\find.exe
        
        find /c /i "pdfconverter.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:556
  - - C:\Program Files\PDFgear\RegExt.exe
      "C:\Program Files\PDFgear\RegExt.exe" -A54C4E30729A469DA8F0864FDB400881 -name:pdfgear_setup_v2.1.15.exe -pintaskband
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:556
  - - C:\Program Files\PDFgear\PDFLauncher.exe
      "C:\Program Files\PDFgear\PDFLauncher.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:4588
    - - C:\Program Files\PDFgear\pdfeditor.exe
        
        "C:\Program Files\PDFgear\pdfeditor.exe" "\\?\C:\Users\Admin\Documents\TraceWrite.pdf"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Modifies system certificate store
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:3496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pdfgear.com/pt/congrats/?action=install
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3712
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2fc,0x7fff81f5c188,0x7fff81f5c194,0x7fff81f5c1a0
        5⤵
        
        PID:4544
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,12668899229137521681,14013321877972940836,524288 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,8170115373746221538,43025175668788392,262144 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        5⤵
        
        PID:3628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,12845544940959427455,11546203132104429238,524288 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
        5⤵
        
        PID:224
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,304923209769125179,3080868291827786223,2097152 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
        5⤵
        
        PID:2952
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,13181820487936454098,4812529711321433981,2097152 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        5⤵
        
        PID:3008
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,15639536390396813590,17092457316938264090,524288 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
        5⤵
        
        PID:4044
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,6313098297444357326,3367490435979856876,524288 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
        5⤵
        
        PID:536
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,16370749241652127784,11856225337574399543,524288 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
        5⤵
        
        PID:5924
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,16370749241652127784,11856225337574399543,524288 --field-trial-handle=2252,i,2474960109065372478,9233333201499302994,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
        5⤵
        
        PID:4176
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:2024
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff81f5c188,0x7fff81f5c194,0x7fff81f5c1a0
        6⤵
        
        PID:2284
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,8230712997292061501,6341305878395121364,262144 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
        6⤵
        
        PID:1172
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,5951907870488111596,2058833219551340461,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,9429325397877926020,2139325319499476414,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:8
        6⤵
        
        PID:5632
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,2258216085315274355,16595246056456882244,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
        6⤵
        
        PID:4416
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4468,i,2258216085315274355,16595246056456882244,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
        6⤵
        
        PID:2640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,1037506487230794723,13129993674278954672,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
        6⤵
        
        PID:1280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,8601410122789811357,10429600305148523244,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:8
        6⤵
        
        PID:1764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,9258180995888254558,3538383389152988150,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
        6⤵
        
        PID:1612
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,5728708772782857018,17538480282568773143,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
        6⤵
        
        PID:2388
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,12868411613988840315,8395381781102382386,524288 --field-trial-handle=2400,i,10688930863360240447,3312777330386098057,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
        6⤵
        
        PID:1764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6132,i,13186755363555123014,10591764514743708248,262144 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,6310385337460756698,18316052168609912013,524288 --field-trial-handle=2020,i,6011125681653273645,14168635113959874152,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:5692

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2500

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CommonLib.dll

Path C:\Program Files\PDFgear\CommonLib.dll
Size 831KB
SHA256 5313fd3203af998d3d3f18caec19afa5ce1f28c681654821cdb4c627834a89a2
MD5 16e59960eb6ca660a7401bbeebef345e
SHA1 c84aa48e88a2fac1990f23e742d7c4e3a78f99dc
SHA512 9b5705ba01e5b859f4442218b3ba6eedd586a88d6e31a486fa558e658cdbbb6f5299208590d7ed90ce6210fd5f2d1cd43a11c717cfc0bed09c143f1b844a2f43
SSDEEP 24576:HAGWNjO754dOJeU1QmgPTUuh5UThzU+I7UATKU/ioUnWMUN5:SU7545U1QdUuh5UThzU+I7UATKU/ioUY
TLSH
T17E057E8233E48579D5AF4B78B02511184773BC06E682E75FA68E79ED1EF63824F017A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.Mvvm.dll

Path C:\Program Files\PDFgear\CommunityToolkit.Mvvm.dll
Size 112KB
SHA256 e81f937cb4a70645e5106b22cc4972d4009f0527f19efa10eb74115c155fc66b
MD5 634fa35f5855bea7fda4f5631ecb7aff
SHA1 982159403969b8d4a5ea31d99d18e3ba927c9ed8
SHA512 339d20de6ed61e7b86d43305198beba32a26d7e7721923219d475e0112f5429e01998404c4fdd10c0630813e55ad766ef3f2f8aa1df3c937c2b3a3f88bf22061
SSDEEP 3072:H+c+yfwDziGuqRGia5iKYR2l+EaXcw+MP:H+8wHiGuri8iI+c
TLSH
T104B37C0263E85E13E6FF0F7564A8504A8F32FA07B932E39A598C63F519837905D533B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Program Files\PDFgear\Microsoft.Bcl.AsyncInterfaces.dll
Size 25KB
SHA256 0b6f9b5ef96cf05fbe679787615fe7dd7e213e888a2802589dc8bcd0cdf30d64
MD5 ce24cf5922ec53a5f36b8e82166fc7d7
SHA1 b5349dc28c96a0413870c3ae282b535438125d71
SHA512 41ec49ddb1dcefd61534c336c4014b93707ec9b0c302626a317c73b79f547d5fd6c68f89b1de7e62d75da44e9e006c87d4d3589a8803b3dc83341688898586ee
SSDEEP 384:rBOJWqnwGBbNAJTt0VES2j0cX6dAl+NWlVzrdcTVWeP/WLOwnHRN7k9YMTR9zmA:NulwGBhMOVv2wK5bdcT9QrX5g9zJ
TLSH
T136C26C1AD36C5317CF6A2EB5E5B486422E35D38A2C13EB3F1288F2D91D97345A730639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Data.Sqlite.dll

Path C:\Program Files\PDFgear\Microsoft.Data.Sqlite.dll
Size 168KB
SHA256 988fcc9427ab190b4ca3eae9e6330e95b2f90d6abba08c3a10b5cb51dcdef18b
MD5 6aca8bc546b40196b3f5aeebfa56ba22
SHA1 d407f1883dc734a1a8e212812c9ed8189c58d752
SHA512 3d195aee8dfcaac10c106c7bbd05ad1a6a64ac51638fdaa6fc7858d0cdaae73f6ddcc5571de1ceac6e695b14ac60544a836fabd76b560bac59784eff788ff093
SSDEEP 3072:HRSyOAvNY0Bamq9GVo1Gp69xyi8gxATCerwr:wIfBamhogIDLcCe+
TLSH
T1B3F34AA547981053CFEECE31707AAC8907786517E9A2D747AC90E4EC3963324BF447AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Program Files\PDFgear\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 62KB
SHA256 61560b34c66fda00374708e91d382206dc2cd0be567e25403f804d4d8c30d89e
MD5 25186aea27c425bbf52ed05de76f7678
SHA1 93140c3e0b1e31ad397ef4ba76fd374f295c19c0
SHA512 20e97bce8167c0a51b6f6fc941a740456e7e995f1515f86496aafddfcd99be224edc364d20fa6cbbb2e59238c389bb3de34850a2df515c8acd03f0482c86eed2
SSDEEP 1536:H6DVJaJ3loULUr8nKvhXhwBTgidJaXQcKz:H6DHawULUoKvHw5giHaXQr
TLSH
T1FA533B6423FC8726C7ED0AB4B87395005F35FE476203DB0E2A4EA0A515B7FC895A1BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\Program Files\PDFgear\Microsoft.Extensions.DependencyInjection.dll
Size 95KB
SHA256 b90b465db7051df80f13cfd91ba1ff59038d6753eae9f37d30975c5d2d35cf53
MD5 6a7a6e7de73091ea4be84b42bc85348e
SHA1 fe07027a747d59be980129bbeaad999fa6762e42
SHA512 af05c56ac1b34ea29f6b2c5a3ba7518135fe655d535882d5a7db6cac68ad11b836bef46b5b2fd7bee75e2d84dc2127cd78d48343eb285a0360a7ddbea2740985
SSDEEP 1536:N6Mn8aTptaddsV0dSE0jq/QjJXpZoRR4nWB7u1hIatvmapwGqrdLcMQc1zUizPM:N6Mn89dsOdS+mm7WY7u1hIatv5pwGqrO
TLSH
T18D937D3963FC8B66D7DB1DB4A87841050F75E6CA7002E35D1E88A46E1E57FC20A233B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsAPICodePack.Shell.dll

Path C:\Program Files\PDFgear\Microsoft.WindowsAPICodePack.Shell.dll
Size 529KB
SHA256 e6fa9d9e34ff3bf63ce782654b14e4b54a3abd1022c87bc099032c2948157672
MD5 54fe9a2748c4a0f282d4ec91e3cadc16
SHA1 970b783a697d893ecd4916dd86b5ff7574896c9e
SHA512 c7d567e3c039f98f3a99249b2d9bc2186c34efd73eec421331732d2307a8af940911381e27b015f58d0f65871bb4b038cc0f27d3fa495acd08994226bb033b7f
SSDEEP 6144:KRAFnp++R1yj124hKX97kANqQHlWBwn9dgPan1W86b8c3v6n9c6KwZErn+LYHtA:iApI2D97kANVFWBwn9iPIL9Mwh
TLSH
T19AB429207BBA811BE19F477CE5F61721D7B58602B213EF0D0E8462AE2DC275645839FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsAPICodePack.dll

Path C:\Program Files\PDFgear\Microsoft.WindowsAPICodePack.dll
Size 102KB
SHA256 418b5e7a96f9a6105cc6fe45896a9164e79c8849f40be23a411b5563a8e3a0d0
MD5 9531b41519156855a45c46f0b379a784
SHA1 00b857f09dcf0c71dab40c1a8c4c54d411fdb197
SHA512 10034288101d235cb7af984fd6a0db11c7f56dbed648a71596b8b0c93f68d5ac5cf00be033153a91e71a311374b220507f07aa5b6e1849a80930d37a5c2577f0
SSDEEP 3072:3BPJ2fTauHhiiWPCeOMt0ImL6HKgqYR1FliQ:3UpWPCeBHxZ
TLSH
T18EA3396173BC467AEAFF2F78F8255120CBB2F9862213DB1F2C94754E08927809959773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files\PDFgear\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFKit.dll

Path C:\Program Files\PDFgear\PDFKit.dll
Size 1.0MB
SHA256 99db5bfc60c00fa30dca9ddb953ec1384b8ff58c197267ef6873ec1031477dca
MD5 7d92c08d859561b4e684002e8d884c92
SHA1 b547b2f90b532b238a2d70791c0618633c652fac
SHA512 a3d2d60b1ae53bdccf6ce9679bc4e64d7dfae203c0dcfd35b50182108fb22363069681ded14e51d81c2476ae85d8a9957ea3b5c783cdae0efb69247a0caee0b4
SSDEEP 24576:wl/fMd2Yp+opXMZBdIbUXSGzZKumrzjiVgsAWKa:wl/U4XopXfUXojiVgFU
TLSH
T134359E9937E4DA16E8BF1B3BA4710114C3F0D545A383E74F56C0B8D92EA37A14D89AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.exe

Path C:\Program Files\PDFgear\PDFLauncher.exe
Size 1.3MB
SHA256 ee71d49cbe994ce07032a9941fb3ef8b9207464db30287fb5a0ec49c655c9001
MD5 ce5abd9cf61580c8157e026572a136e3
SHA1 bbe23c2e9dab963d4063929db4159ee9ddf14241
SHA512 accba5ad609f4f00191773d83831eadcebbe4847481ba394c6a18befa0136222dd1366cd5325c0a1b902a0f7652e58ce9083cf06e1be644384f0a1c681bd2d65
SSDEEP 24576:uZ0ctsrQu1vGiuLgs3T1Q8XLdSZzEPkxOs621yvGbuLgsxT1B8XLd3G:ZrQu1vGiuLgs3T1Q8XLdSNEPkxXkvGbg
TLSH
T14D55B5596E204D84C5E6C834E534991899BAFCB7D2B9C28018BB3C55CFFF3B26922CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegExt.exe

Path C:\Program Files\PDFgear\RegExt.exe
Size 765KB
SHA256 c6d861f973c11008d34ee5ed8a21c7353d85e839e4d949a8f156fc8e68cbe890
MD5 f01d7871b3339fee6eaeafe6c1040a00
SHA1 ff4c57291f283d10ed04260bbda9dbd466f0454d
SHA512 0bdb2de39675b85a9e2976c596bf64802290181ea5cc80b6d3dbadd63dc3077e2effba6bd2eab9618afd22bf51d771ad2d2f60f33ec6c4b2d81f3b4e25f8cf04
SSDEEP 12288:OvGOTuLgs3T1Q8XLd9vG1TuLgsMT1L8XLdIN:OvGiuLgs3T1Q8XLd9vGtuLgsMT1L8XL2
TLSH
T17CF4BE191E205D85D5F5C834E674591899BAFCB3D2B9839108B73CA0CFFF7B26A628D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegExt.exe.config

Path C:\Program Files\PDFgear\RegExt.exe.config
Size 19KB
SHA256 34b32542bff5b97386f0044748425a31797bb634d22dc1bc7253dd01aa350345
MD5 c80f25ab27aa5339e13dca21169c17f3
SHA1 459c53201181d672308a26771ee56ad50241d90e
SHA512 8772f0d2c7c4af18959f6a75bae570c6a3703b61f6d71933a3b9a33c6fff6fb948bfb91149b3ee6fdc6022b7a92544e4c451dee1950f8be1481d609aaa06680f
SSDEEP 96:hrd4hjo0Gli606Uwfx0GReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhuG:hrk8z5PUDRTHffIz
TLSH
T1D492192091C4AB998FB255E23E7B7428CB6D0377288C419D70ED6E4B8F26DD66607077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.batteries_v2.dll

Path C:\Program Files\PDFgear\SQLitePCLRaw.batteries_v2.dll
Size 11KB
SHA256 ad70b8db3c16ed9625d29084e649f36a466082d390a6e3d5de261f1782b6e918
MD5 0a41faf291ac8f84d09a0013f7a2560b
SHA1 337661f711183f51c5417a7cb15bf6b5444a8191
SHA512 1e43ab0da2958344c0974b9190602c416233b8aa1c71431f48c2d5bf8e664e3022069afc2cda472f531d7a71bdee83f4e2d271046c3d7882b97d70e2686480d5
SSDEEP 192:dLhQCwvA9yV+FOdJNxzYBH8aZ2L13pS9mWgcUcTVRqAAWJ:1hKpVrjMBH8aZqmg2TLqAAg
TLSH
T14532F849ABE24626EAFE0F3178F306004271BAB9F931CB1F09C5A3795D72305A6117F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.core.dll

Path C:\Program Files\PDFgear\SQLitePCLRaw.core.dll
Size 49KB
SHA256 979edcc9056ac06d5f52b12d9b7733b1217914ab50bf123ab312e027e7ac57a5
MD5 b2ba7e54a020ab0461cc7e575f6edf66
SHA1 004884df52183290966e2fb61c3575df11e58148
SHA512 fcaabe2a1610939034196d3d6275d78f2f17587c8e36bc8528848312c11766eec1f83b7dcfbfcfd8a824eace484a705ad7953cfac718dd67df4f6bd2dfc32d0b
SSDEEP 768:JmOGveifSTtyXEQ3nPGLb4PFvSMJCD2j+XIfHq1wJd9P581Iym/DskE:3LTtyXEQ3+bO6U+4lrPi1uLsF
TLSH
T1E033D9750BA19E2BF6CE5174A03F0096A674C119B77BD717AA84E0F0AD733C607A11BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.provider.dynamic_cdecl.dll

Path C:\Program Files\PDFgear\SQLitePCLRaw.provider.dynamic_cdecl.dll
Size 63KB
SHA256 4843586486334848317a3a0019833ab6e4749655c31dcf418de5ce2be93abc67
MD5 2ac53c084d23691473d38def1bc0a938
SHA1 6fa5a53472388355c62229270d4c6ee246981f9e
SHA512 70528521ff9f894265913385df3d3158c21dd357e84d4af4a4a481c37764b33a36105b22b679aadfbf44287afcded3e7e1ff7d05d155f5ddd3182046b0249fb3
SSDEEP 1536:jjb2NmqeZsE64aEKbMsZG0EN3ovewf86nWE7LJ/ZECig:jjbUmqWL3MfWkVRR
TLSH
T11F53A596BBDB0F91C4CE8AB57D72098E52F0F28EF693D717A149E234BF4232146C6164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Program Files\PDFgear\System.Memory.dll
Size 141KB
SHA256 b8fe216aff0f6d162f8eefe7be1712162b7d8199e20ce2e70ffac36c7ce20a4c
MD5 35e6237ff5533342516bf01a46e4b7cd
SHA1 f8a118f07eea37ce732b487ab730646dedc46235
SHA512 dce731c61aea73d16813b0932d47ac94926d84d9077115ef147971b1e1c76a88e333ccd0f88b34fca9e2533f54c140947316fd63415199fe5f20a45cd0aef033
SSDEEP 3072:wPgSRYPuMbrhcabqwwwUtiPmu3XxNtvckP:2uPaaWwww7OuR4k
TLSH
T1F3E35CBC67C6DD12CB5F4C70A028621A5A31C63FAE42F7E215C9F4F436A27A935193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Program Files\PDFgear\System.Net.Http.dll
Size 193KB
SHA256 b5d20736f84f335ef4c918a5ba41c3a0d7189397c71b166ccc6c342427a94ece
MD5 665e355cbed5fe5f7bebc3cb23e68649
SHA1 1c2cefafba48ba7aaab746f660debd34f2f4b14c
SHA512 5300d39365e84a67010ae4c282d7e05172563119afb84dc1b0610217683c7d110803aef02945034a939262f6a7ecf629b52c0e93c1cd63d52ca7a3b3e607bb7d
SSDEEP 3072:HeruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgEQ4:aW60VcTvakcXcApOW4
TLSH
T1A2146C14A7E88A2EE79F5B75F038466086BAF7C37902E76E1C54A4FD1443B90C6523E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Program Files\PDFgear\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 2d6f419d641682d8efc4a40e850d2e85de519d6823b93daf2aeee63206d4e32d
MD5 aa7a54f5a3ba48e60d51e6eeb378404d
SHA1 e5d644311a6087c6a500f0e79bae4af305430b3d
SHA512 b033330695b4edc1bef5d36d98e1a68f5862469598cd6a71cafb8f72732d29403d4e8b9e4df3809c2f49dcd59d5ca751ada97ea9b7e268298effd6e19eb52399
SSDEEP 384:hkGbUzdrbbxHKWgr2WXTX6HRN7K3/7R9zXL/Lq:WGAdlQTWoF9z7zq
TLSH
T1B7826D20C7D44543FE673B3055ACE583BE38E7D51806A3763585E97A2C963C8AF3562C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.RuntimeInformation.dll

Path C:\Program Files\PDFgear\System.Runtime.InteropServices.RuntimeInformation.dll
Size 27KB
SHA256 8bb9d52ba5c67f05c8f632deb1e7e98a909318b10e1388b47e919515fdd42cbf
MD5 568b53398bfc0e54aaf448b68f5c77c2
SHA1 76b0b6e65e38a90a4ecdb3f6dfe16d5a803081e9
SHA512 6052ee3664fd2095de3338cf6d24df022dc13d00b4bf14c57572f2a34ac078e07bd1f634a50028db0952ae8067ffcf19079177fa534240d9526f33ae1e1459ac
SSDEEP 384:OkUwx9rm5go1fWKmmW6oqN5eWjaWsFm0GftpBjZNaQHRN7ZtnlJCxJ:lrmoFmWdOMViLNLZhCb
TLSH
T1EED25B55DBFC8602EDDB0E7079B0E5876D3DEBC34D21AA2A0499E4881D973C86721F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Program Files\PDFgear\System.Threading.Tasks.Extensions.dll
Size 25KB
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ValueTuple.dll

Path C:\Program Files\PDFgear\System.ValueTuple.dll
Size 77KB
SHA256 e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
MD5 8c9424e37a28db7d70e7d52f0df33cf8
SHA1 81cd1acb53d493c54c8d56f379d790a901a355ac
SHA512 cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4
SSDEEP 1536:6784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAPVGHMc:67NV8v36tI0XCKAt6
TLSH
T1CC73E92823583663C73E853318AA9AC75BB8D30BD746177B7DEAE5E818E1774B301274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\de\CommonLib.resources.dll
Size 21KB
SHA256 94f48ae11968f5c552f6f126ce2165e5a5744c49b7ea6e28b0b19aa9faf11d15
MD5 f36163483a646e8a820a2601b5691b1f
SHA1 f71289089db2f1e353662304f9e3c58c16282bfe
SHA512 f2ef31f27480df62efed8820528b0f50a738b1be4ecb24ecd9f1a78bd9638d6ea02d81c2100deef8e1c4e71e0c71cf1cc8f4d0e371edec356f65adcd9c1a0810
SSDEEP 384:hy4VI4sJWa+g9DRErvpUU+InTN+MhCm/Gv:Yv42WaJErvsITN+pKC
TLSH
T155A2C49217F5206DF5F38FBCB9F49966AE32BE621D18E41E4094405E0A92FE0CE71336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\de\PDFLauncher.resources.dll
Size 18KB
SHA256 1dcdf9c2566596a9302f0323f47128de59a3da1edbee725dd2c9e471f630bef0
MD5 ea62f40cd5f26bc67bc044f863e18cd3
SHA1 45449aabc03c99abeae552e31a4b22b94a1f68f2
SHA512 1f1c99a51bb0536bb0986cefbe466b823cb292dc0d8e2d2c45e4ecda2a9a0122ee34eb40f92f53d6b7f40cce9e850b6bf7eb40ff1d3c19dd935bdcea89ff24bb
SSDEEP 384:xRjZHgZ3osybC75y3G0KA2AoUU+InTN+kbzhCm/KJ5:dAZ3osybQU3GA2A/ITN+VKs
TLSH
T1D18291612EF95009E2F3AFBC76F85265DE37FCA10E14E41E0568504E9852F80ED62B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\de\pdfconverter.resources.dll
Size 30KB
SHA256 61c7fd8bf09318a34b40f8081041b38d21ce7b85ce50929580d1d79c09b47a56
MD5 0d62ef293cdc9f6fcaed7e3620e47066
SHA1 df6fd564cbaae8140c4fcb1dc801dd13227064b4
SHA512 62eb9ff1bf00786bf1898b120b55d91947bc2d980459279e9f15cb9aab8c14bdb5fe50f1f2b4e7a087ce46df4ad319a9193f9ccff054be198177ddbea5af9c19
SSDEEP 768:t7fywXcrd6oUpdfn3LTdbcxDcLvutpzQNs+D5ITN+xKJ:tfxXcB6oUpdfn3LTdbcNcLvwpzQNsS5s
TLSH
T14BE25F523AF9140DF3F3EFB87AB84558AA3BFCB41E21D49E4045604D2972FA08966337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\de\pdfeditor.resources.dll
Size 127KB
SHA256 fd88e165093f9c05c35e71e40d462bb2f91e560a0980f9435628d3c75780146e
MD5 8b77282a023d58a062f0713db20b7034
SHA1 4cd67c70e7c00dbc3e6d03a93c6f7e657e4c40b5
SHA512 bb84f1d2505d01f6c3439a2dea56d3cabb87d1475a4446631bbc05b48ce912b0483b7ff345bfcaa0b1f0098084db3901787fb4233bf6c0cd1c93790196315bf8
SSDEEP 3072:BFWJK6AUByilC1ZgST4KPyY8rC6Abu2BgKFb3rx6f8q0x2caRoE3GAiuly05Kljl:/1IlrXkUPufpoY
TLSH
T1DCD34F126BFE110CF2F76FA83BB89659AA36FE764E11D45E0425908E0672F90CD64733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\es\CommonLib.resources.dll
Size 20KB
SHA256 0facd1673a3da728a7e7289aab91f0ea8a406ec3c0138061fe7ce99e6345bfe0
MD5 d7be8bd914889610783a5a5507a93768
SHA1 d3b9070a9ac20d87abf8689a7eff8e2d35e46e0f
SHA512 3f10d64b589a292e829fc46f77b515703b3e2f67187df2f83e563efa53d13053fcb75a927998ebff8e852cca04fddcacef015943da6954450a67364da4b1174c
SSDEEP 384:Yy4VIjb31HIkLMqSjGDhmXdiPUUU+InTN+MHhCm/Qq:lvjJHII7bGdiPLITN+xKP
TLSH
T1B592C7925BF81559FAF38FB9BEF59515DC32BCA22C18E4AE8054405E48A1FC4DE32336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\es\PDFLauncher.resources.dll
Size 18KB
SHA256 e3b8a91f7b77596c560c662a240d090c15e00d2efa24b0b74df308e13ef94955
MD5 52d2550cc479029fb9e88dd4acb7cc1a
SHA1 5a3577a37ffabd704ad5adfb1cbb4e9e731baa36
SHA512 dba99caf002b5d01802bc896b98b879911ea9e6e1ba44d2a2ca8ac99b13fe75618d095b016ff6178a5a092867637e19a266b89acba3c8211bd9183de92a8327a
SSDEEP 384:59jch8l4pBDa5KJelcwxUU+InTN+FhCm/mSG:U2l4pBDOKJelcwEITN+qK2
TLSH
T1C58292216FF91119E2F3AFBCB6F99212DD32FCB11D14E45E4154408E9852FC0EA62B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\es\pdfconverter.resources.dll
Size 30KB
SHA256 e6d926d21534fbba2170255819fa77f4fb80df0011f9c328476729f9baf2924f
MD5 10533adc6a0f19d104f513dc089db40c
SHA1 011fbb83efc389aaa274db00b2957b5f9a842be3
SHA512 334b1c2222f79bfb323d7b968c33aabefb01c25b68a8242f070200ed31e6e4c7ffe6eb484cdf50c3a8389b7ce531446ff73c23ee5986157c67cc79ce7de39487
SSDEEP 768:AVbok3bXCGx75iLUdBHXUUmDTITN+BtKN:MbzbXCGx75iLUdBHXUU6TITctKN
TLSH
T14DD24D123BF9191CF3F3AFB87AB69605D93AFCB12D11D49E8021544D2872F90896273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\es\pdfeditor.resources.dll
Size 124KB
SHA256 3fa39a27020b272fb601d34b139d4bd1df1b0b865916ac63f66e7b9344cd41ce
MD5 d07cd11c1fcf9f0fde5c14dfa3f846fd
SHA1 b64871b4114869453f2b64c2e80ddb5c2c4abd0b
SHA512 8b85278cdc823c24c3905bb4b4a1c52798ca823be94b05ab8e4abdafc69662d504a7fa0c4e4844f4124cf3b9c4d3d58bc39e2a699b2632eabbbe90797d9442ed
SSDEEP 3072:uFWJK48rQSMcxqWAFMYbfSLwA8JA6umXgvnbuqP2TxpvwlEoW1yc3Ifbwk2LrGMd:O1LUAGuHYh
TLSH
T11CC33A227BFD261CF2F36BA87BBA9619A836FDB62D05D45F0021518E0576F80C961733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\fr\CommonLib.resources.dll
Size 20KB
SHA256 de3cf76d347a631b6b8d8b166433ca00da135782034dfcefcfc2d91f75d42841
MD5 710a1e964419744424e144ad74748eab
SHA1 91927f8da834db7357005530c39b9d6570ba300a
SHA512 13a86e8a8c18c7272956d793c1d0e0211066afe21f010420424b0c4ef69922b9779f233d11ddd13f0a0110eb6b38a48c55a6092b6924789ffdfd71fdd1607509
SSDEEP 384:/y4VI5Nf+7/YE9AQF2xnnaic5AlLPqUU+InTN+nhCm/3UD:avm7/Y0Dz5AlLPhITN+8KED
TLSH
T16992B58657F9115CF8F38FB9BEF09A69DC32BC61AD14D46E0045015E08A2FE0DA7233A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\fr\PDFLauncher.resources.dll
Size 18KB
SHA256 427613facb314d13f0e02d46a564229ff84593ba2931a79cb8f9f78e65ffb508
MD5 9db943f58d26d9ffb0209fca97f5b041
SHA1 f5fe6c56832520369ba1ac5ade200824de90747f
SHA512 b58b90be2f4afcac4630331ce3094b982dfac8423b132347307fe446b60e445c3ec260cc811edfe7c1116f6e22ce1045e85dc9e8488ce2d392684fdc8febe1cd
SSDEEP 384:61ju2QlpwcfqZXVvc9cycr+wUUI1nwPUU+InTN+VhCm/3B:h2QlpwcfqFV4cH6/UI1nw6ITN+aKR
TLSH
T10182B3616FF91119E6F3AFBC76F592168D36FCB21E01E52E0548004E9852FD0E962B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\fr\pdfconverter.resources.dll
Size 30KB
SHA256 373e9700580235c1eea00664f2646a3c572f4b06c4575cf4e3bc2aec20760814
MD5 af708ab4e264ddc728e9fc0427e5a38a
SHA1 8c54b74f543b0f7f1a32a3322c155e3bae19ae92
SHA512 17278a6055e90000142ca40c7a04b2a7597e487c378543746cd321592fc3fabe763a26391d3a506798e51e62284b63ad7e5a2c65d8a7a2c690de43e5d48629d2
SSDEEP 768:9yXyzlnKM6USS3LEdz9T9VrcCqWwUhV7DsITN+6GKf:cX8lKM6USS3LEdz9T95sITXGKf
TLSH
T1F2E25F123BF9100DF3F3AFB97AB59106C93AFDB49D10E55E4046644D2972FA489A233B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\fr\pdfeditor.resources.dll
Size 127KB
SHA256 d92c46b6517a52baf54eb3bf4cd37550557cad95cb8bac327159bb58c89bba2f
MD5 2636c82300d08c87089b823d8d1fd57c
SHA1 72aab892537a34da3fd4f623f44a86f0415da2bb
SHA512 b924cf21c2e39c9226b247c7f1a52ed8a7819d78fdd59f206e0cf9acb6c09c4926a6dad17f2d3fc0654f9dc46b42da7d666b8a32745ef5a39dbe6d491080c332
SSDEEP 3072:zFWJK2u4dJgJZ2QH7QqSFyeYI9qCA3uE4g3hbs29BdP2Z8M5ckDRzVINorA4ymho:F/qt9OnEThKOtv0
TLSH
T1F3D34D16BBF8210CF6F36FA87BB59219D936FE7A5D01D55E0429408E0672F94CAA0333
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\it\CommonLib.resources.dll
Size 20KB
SHA256 1f2670c607ea55440d8c8b124dca2759077ce205137f11bcc324f511e68b5610
MD5 13533e98af055d09287387da1a7708b0
SHA1 0adac2b88f042c4236567c97135891eadb586bac
SHA512 b9ee0c342c594c401d9772d39da4402881bcaeb33b99b98e10007687b90978f741770223e31f2b850260ea6ac99c3c716e1e801f87707ff67c0807f59ff286fb
SSDEEP 384:8Gy4VIUI+nx+Xh/lav64GqPbUU+InTN+76bhCm/2em:KvUI+kdA64GqPWITN+eIKU
TLSH
T18392B6565BF91128F5F34FBCAAF59A55ED73BCA22D18E02E4054004E09A6FD0ED3233A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\it\PDFLauncher.resources.dll
Size 17KB
SHA256 f12bbb9f132c99cfe6673755b7cf67df2d8ac733a45a4e818d14b9b5e660e468
MD5 076ebd175bfcf03068344aef9185ca74
SHA1 309fd41cabec205025b3159b321a0d23b0d45ba2
SHA512 3accf5a9c6e4f4e2da202609ebef65d19d5dbab18f8f07c2762e2caad549f02c89e7656d541562288f505936128948b1c5dbe484f47ca35083d889970c67907a
SSDEEP 384:vhjUp9WuxB5cTVO+EXKewZUU+InTN+kohCm/yN:2p9triTQ+EXKew8ITN+kdKm
TLSH
T18382A1616FF92119E2F3AFBCB6F55116DD33FCB11D14E42E4194048D9852F80EA62B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\it\pdfconverter.resources.dll
Size 29KB
SHA256 db87bd6ce10cba6f7071cadef18297150c0b18b7b654e1a2e49521ad8210a330
MD5 ddd20fd02b9103239392fe3657717f3b
SHA1 eebc94de031c16e5fa9c3e1fe59cd61887ec52bb
SHA512 a22be29dabfcefc2e7f378152bbbdb388807709e94672093c949c393de229794850ff6be005d7812e244a3df5d8d6f94da5d2e4dc555fff2f62966d19fc2539c
SSDEEP 768:UMNkJ8IxANxNizXLrd5bY15t9XL6M1g9IWWpYiopDdITN+gQKn:ZNlIxUxNizXLrd5bY15t9XL6M1g9IWWD
TLSH
T1BCD20D223BF9250CF7F3AFB83AB99104993BFCB52D21D85E4005544D2972FA0996273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\it\pdfeditor.resources.dll
Size 123KB
SHA256 f4726ebdb9623033d44541b8f151a2406c706bbcf46146dd72bc97b262c928cf
MD5 56df338e93297a1c3daca808b1958aa2
SHA1 bd2e5537db1ecf352a7b7eaa5e4213a51e08db93
SHA512 a3d6b8d96e643c21170136b12453800cfb6c3c9e106948e5db1db1876f3dded2deed94952e9e0859f6c3f9ddb17722ebdec54fff616fdeb9c6dd18e247972d03
SSDEEP 3072:bFWJKh0RbRXYOB0Yk03MfuutN7oiAEub3gPqb/dEu6f6g0fAsNHiIpoKERWGcF+T:twif7cCGiofv1HohM/7qzIJIevO9VZQA
TLSH
T1E3C32E217BF9211CF6F36FA87BB9A208A936FCBA6D11D81E0425458E1577F80C964733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\ja\CommonLib.resources.dll
Size 22KB
SHA256 eac2591c03c72c3f6fa11defd4739020105150ec7cecf188d0b3d5b69d444c73
MD5 7282f54242282ba8e99036daf57ef6d0
SHA1 0bec46713433bd1ef9002886be4cb5c784ae79f3
SHA512 9836cdff31852306f684e2f11af040d8aa02510049f558723622727e534f3d49c9a402bd917ad0a14985841b4ab730bd33addf7f37ec232d81e7dda2d9481b7b
SSDEEP 384:zy4VI2jmVLDDj4HNz4anfpUU+InTN+xshCm/Wp:2v2OD/Wz4anfsITN+nKI
TLSH
T15CA2A55D93F91029E8B38FB5ADF86985EC32BC62ED55E03E002D805E5961FD9ED20336
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\ja\PDFLauncher.resources.dll
Size 18KB
SHA256 954e80097b30b2bae2513f44737040a104e25c05dd8c50695ae8d4eeb444db6a
MD5 5a321c1d17ab4fb517368e0b891bfd22
SHA1 1bd48606d618f7abddef22af3ca6681750697808
SHA512 87ac1592804d5e88700865bd25c01ad0718a53bcb2571592096b81f42473c61c903ca0f5b0d0f00045b6221b25b4a1a8a8a1f8a3baf1c0d65bcfc98fbc4e5329
SSDEEP 384:XxjejLb8G3m3aANrq1lzn7bQGUU+InTN+ghCm/Cn:oLb8GfQralzn7bQdITN+VKC
TLSH
T1788294585FF91018EAB3AF7866F911919937FCA1ED10E52E005D904EA852FC0FA52B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\ja\pdfconverter.resources.dll
Size 31KB
SHA256 22c59b0d5ccb29b1ba3a837085b442f7738fa6734bdc309a2e1146f59bc110ef
MD5 28bd25cb85e31452ebf3a56e7407733f
SHA1 71f9dc821f3e0779944e1f05216877608c2f2f16
SHA512 956f21f82d9c92a80fce56ffeaa94c29f2b20b020e5e320bca94679451434b2b92730d68d0ee7a5b0ed751ca02cd2610d1f0c93e243e89cbf5d8f6ded7ec1872
SSDEEP 768:7ZUtLo2IDRSBZ3LSdsI5TT9Ev0Y9DbITN+bK9:9URo2IDRSBZ3LSdsI5T5E/bITMK9
TLSH
T18CE21D197BFA140CF7B3AFB979B851848836FC65ED10E86E001E945D2872F98E911B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\ja\pdfeditor.resources.dll
Size 131KB
SHA256 9f1a08c40108799b82d4e2519d9b6a16e526a9896330aa3f50a4e17c78dca0c7
MD5 2a79d24deb8ad9b19d2c5601f151de16
SHA1 aa9330a2245cc763098da2e256a3cdabb5ea1542
SHA512 b827a3a5061d2482d5a7dd44052af33d1763b9ad3cb9cdc8cbbeb0f59f806da8753d89554af769b62463bd5fe950187698d9edbeb3f4ea0792ca87cd9b061c79
SSDEEP 3072:GFWJKfnU60fAePVoPEBT9FwgW6WYOAluSbghdbqZWqw/SZfd93FZwr/SS8VyEq2a:mMjDNWqYcLYx
TLSH
T1BFD32D1D6BF9141CF9F36BA52E7862849536FC7AED12E52E003D909E5972F88C920733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\ko\CommonLib.resources.dll
Size 20KB
SHA256 b91802f018f217d4c68daf4f44a2be5398df0b2ddaeaae7809399c1239654f77
MD5 50a67cd2e15becc782db1f8e4d9ae57f
SHA1 7f71d35e8e7beda9f24c35a6f07f7871458cb02e
SHA512 53dcdd6f4cbe73e31cf147e54c602eca6e443b04bfbe3448e96e148abf181ea1f9290916fa9ee1a73bc032b5fe112ec3f4b4c2c686c6f0f4aea3031e9868a8b0
SSDEEP 384:Vy4VI4GNSYHqjXP32QmuqcIFY3BfEUU+InTN+uhCm/Rh:Uv4GWjXP32Qm/Xm3BfbITN+jKn
TLSH
T18E92B59217FA1158F5B38FB8BEF8AA168D32FE626F06D45D4440485E48A1FD1CD3273A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\ko\PDFLauncher.resources.dll
Size 18KB
SHA256 1d84b727c04a6f484c9ca487a09849a3bf3fe55041d00f8dbebf8acafefff978
MD5 a12ab39a21792ad78b8ccd3e63e86f49
SHA1 d26ee57dd6b4b3f6ee4dea0bdea7925b7f766511
SHA512 58e76bb4a92a8e7c1bf90cfd6c1121119c4ad34336f0b2a3eecdd553281d5710df149cdbf04065e2c68c4607497b94e1e78e9c95c76c4db11ba3c5e77eac4e46
SSDEEP 384:LRjNuUz5/6+sn3t8gPjjVOgVUU+InTN+DhCm/oE:juUz5/6+O3ygfVOgYITN+wK/
TLSH
T11482A2912EFA1019F6F3AFB87AF45259DC36FCB15E16D42E0550444E9882FC0E962B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\ko\pdfconverter.resources.dll
Size 30KB
SHA256 c33d8969e179806a6aed47f8ef89081c90439b4e36af03f70c3cf4285d101f90
MD5 b320a83073a22e05b9d8928b9b5fc8be
SHA1 adc79594c638d69e4f9b798ceeec5b8af1f9fd65
SHA512 ce92f56b929e438d22d9afa8e1f5c46f5c68068d8ff0fb3ab4f5ca562b91241af1ae32c4b1c420a66b6af0d0b51ca3e8689d1a1ced1f97101423f54eaf2c8f50
SSDEEP 768:l+1bx7286QD4kvLad7tuk7T/i85DWITN+e0Ku:k197286QD4kvLad7tuk7+8xWITl0Ku
TLSH
T126D21D923AF9150DF3F3EFB87AB89204887AFCB25E26D45E4441584D5C72FA0895273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\ko\pdfeditor.resources.dll
Size 125KB
SHA256 c119430d0b46d5bb7a25587ff6770228ab2080efe1a535fdbf025da3d232161d
MD5 4a4cd576a176c6596e54c0f59fab60c8
SHA1 b39ea52954a5d2ae51d3348bd48dbb7311e2dc1e
SHA512 324f449e877ba359698c73b5076fb08483d837f9d648f9eda0279ef8d3ba20e7a60288e503a0695b2025e374750dabaaefeedb0fd683a79cdd19c39584db8810
SSDEEP 3072:5FWJKlJanBJ/EnaOi5pIaSjrs33AuuTQgfsbutjOW8DSlVJ+hh9y5vjFAkZBzZaG:3oQXseOlm/ZP
TLSH
T1AAC3FB923BFA114CF1F3AFA87BB8A6589576FD765F02C45E0820488E4972F818D60777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\nl\CommonLib.resources.dll
Size 20KB
SHA256 db4fe59e74ea8bc54be8a88f2bd8794bce2a275a9fa445c682a4725ba337d705
MD5 697a00b893db9cfce84413eb1a96345c
SHA1 c2ff60ba2929652e4961e00c45f95065866e4790
SHA512 4e1cffe7f83bda0f880ca1a67af7a3b9cbc4780bef4df664e2d3fd0ab8b7b20a4a87cc16b9605ead0c537f1b5a055d3002ed11cfe5e4f8bb11a773494e721c32
SSDEEP 384:dy4VI3fvYv4Xcn+v6RvkMiNfz8/yUU+InTN+NhCm/Z4:sv33K4M484f4/5ITN+yKa
TLSH
T13A92B54217F9112CF5F38FB8FAF49926DE32BDA25E18E46E4095405E4861F90ED7233A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\nl\PDFLauncher.resources.dll
Size 18KB
SHA256 293338dbfd7b7e41d1165ffb2ee206af597ef521741ac576413ba20ce9822aa4
MD5 313f1d0526ce05710329c02fef65e321
SHA1 df144e7c919835b3353f2706a1357c1221c30938
SHA512 edeada52e1e9a23bb8af8ab366c30e08d464099c3ce748427cfb427a5e648c982994c839ce5c94674ffc58a72a81783be6936eec3ec4c4ae6db8f8df58a9a0f8
SSDEEP 384:nNj9waMd92hS52v7+Q8UU+InTN+ChCm/6p:MaMdE77+QjITN+fKG
TLSH
T17E8281116FF95019E6B3AFBCA6F85212CE33FCB51E14D82E0158545D9852FC0E962B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\nl\pdfconverter.resources.dll
Size 30KB
SHA256 ddd03e86b82bddfa4eda223d309eaeb335b288d7fe3b66148328982193f03dec
MD5 ed09274bbfb9054c38831d72abadb232
SHA1 9496135e6fbabd60df43fa0392069371833dc992
SHA512 0863bfafeaaf4f932177e07f50cae98a3fd778fcbf04bc54e5a2443fa8622c3b98aa6983c1f5249637475c4412329e31b7a13275c5ef6e87984d005a79005416
SSDEEP 768:K8H96tUlWMrzhwLddLGpnAzKVZXxxltDDZITN+yKq:Z9uUlWMrzhwLddLGpnFxpZIT7Kq
TLSH
T17ED20C023BF9140CF3F3AFB8BAB855569A3BFCB45E24D85E4049544D1872FA18962737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\nl\pdfeditor.resources.dll
Size 124KB
SHA256 4aec871090d9b9dcbc92581e514211a7ca9d31f8f9e8a884bb4cf639fe016c66
MD5 719020911a6b144201bc1cba7125baf5
SHA1 e0dea38f8ce4193ba6820b7335639a7bb89ad51b
SHA512 2538cced6f197d698d39419b06815bbf101f7fbced7a134c03c414407b082a21cf891a67d9bae3780531b30803db8e94ea16e6fd15ef5dcda897085a2ee4d1ab
SSDEEP 3072:QFWJKt67/hm+NLxakNaGxUA3E7CDA4uTQgpUb/xHCD3Dh2cf4uA3rGw37xR1PzJm:8jmU7pVLb
TLSH
T1E7C32F026BFD101CF2F36FA87BB896599936FE7A4E15D86E0065849E0933F90C964733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.exe

Path C:\Program Files\PDFgear\pdfconverter.exe
Size 1.6MB
SHA256 51a0dba0a33c23e6939288e7f81ac34c5781ad804a00ef564f500f80a7f9bf72
MD5 d7e8d8ea3723dac8cabd884be07df8fe
SHA1 68c4897f739972d98cd216ce09302fe6b0cc0ea7
SHA512 7016a930efc672e2e07743e86f99915caeb18405d9fe4582824f16f5701f4a8c1737e74d057e594fc7ce21dc5ab903394a68677f8bf4287b2b14f7eefea5befa
SSDEEP 49152:qD63/mwZV7zOavGiuLgs3T1Q8XLdbHFVXivGDuLgsBT148XLdx:qkvGiuLgs3T1Q8XLdbHFVyvGDuLgsBTB
TLSH
T18985D8082E244D55D5FAC934A17059089A79FCA3E2F9C39508BB3CA4CFFF3B259129D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.exe

Path C:\Program Files\PDFgear\pdfeditor.exe
Size 7.9MB
SHA256 447a92273987cd4c1a3e77c93ad27bc1ba95adc1770e830b9dc1a9b4ea5348c5
MD5 d7e5ba9937cf20f65823a710a44170e0
SHA1 a92303574074671a02531ab255efd9c965018c13
SHA512 9349ffe81e6627c98a5b503812fb6162282457e2a3f1c511bd288129a8952f7267dea69b3549c8674a97c59afa2930e3e9b92643058f808c0c8f0a8414cc284e
SSDEEP 196608:wQ0pvvGiuLgs3T1Q8XLd0zsN4FeRPzd2SddvGouLgsdT108XLdC:mzQ/RPsqR
TLSH
T1FD866B971BA48924E0BF863564B10908D6757F579BE4E24F38FE38D88FFB3524A111A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\pt\CommonLib.resources.dll
Size 20KB
SHA256 0ccca42f5d15bbb0c0c91a6b4e60f28374d66141dbb9fde940262ff02989438f
MD5 ab8d1d2438ff01565e739e5df3b9726e
SHA1 c65c1acc625edf203d25f64350aaba45e8e84995
SHA512 ea64fa4b896e4667467e99679e85b587f70cb6e0210facf3c5af05c124afa8e07cc6c1b6a691a6aa7f43408b9b7510d316c471fc0016a4bc7d5e2befadf1ec3d
SSDEEP 384:Ky4VIBYMJ/ezNsBLy1m/AUU+InTN+jhCm/JD0S:TvBYq/68Ly1m/HITN+QKRJ
TLSH
T1B292C5925BF8121CF5B38FB8BEF55A1ACD72BD622C18E45E4194044E49A1FD0DD3273A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\pt\PDFLauncher.resources.dll
Size 18KB
SHA256 3ceb6fd4a7453e2aec9094acd3c466c46b0c383bdf7001918d48b9357a61a852
MD5 c0840493f1db201898acbb0342aad713
SHA1 c7ab3de5ecd091b062fbe401a0dfd7d47bc84828
SHA512 5691e5e278016c6f0b3d7a1d7beeba37f8d6db79d8310d610765a4d9211a0c642bed74b4f828c12a0f8b43eaeef769e8288f4f2781a099d11a07572ec93a32ef
SSDEEP 384:bljBbwwhONkgOJUqWWk7QsUU+InTN+bhCm/iX:jcwhONkaq1k7QzITN+IKG
TLSH
T1E98293612FF90119E2F3AFBC77F55112DC36FCA11E15E42F4254014EA956F80E9A2B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\pt\pdfconverter.resources.dll
Size 30KB
SHA256 7cd1bb63120dd932a045a5dbbb6460a4848428d02de3f3b3d4d81704fe8a80ec
MD5 4aae7a44dcabd08bdbf0fb02c53fc446
SHA1 a5cc46c50f3361a3179e9b087a7e9ccc6dadebfe
SHA512 a21ef2b0a4fc1c27d199ca379d83453ff604b6f6b995db42ff35f62630dda76907b5391ed56128e542be2af0e37250fc249d2fb9a75a37314ff331d81bad5161
SSDEEP 768:o2fNAudLB8Dp95LedAglR9MvDDj57IxDSITN+PKj:nfiuxB8Dp95LedAglR9M4SITwKj
TLSH
T19DD22C123BF9250CF3F3AFB87BB59515993AFCB52D21E45E4006144D2972FA089A273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\pt\pdfeditor.resources.dll
Size 124KB
SHA256 f4c1dfbfb3dc33f22f5449dd22a9810fa4e7917f8c79157a7a9bdaa60aa4d4df
MD5 b7d907ec3ecfc37cfc2a679dd5a7e484
SHA1 6288f0094c91f1494f47754d53968e6e1550c093
SHA512 f7a0b71b53f4a73dd2204229f85ff311f196fa357ad520c536c0be9b7b593346fc3ca5538c1b2a00fd27d4a69067a1e8de58f4f8fd8b9ba467609ce439b1f9d4
SSDEEP 3072:hFWJKkTcVuNJDuUHS6lhNJcVXroAhuzzgQPbzGSRMf6VuxXBtBWf+IzolM1qDAK2:fIfoX2b6XlHAX
TLSH
T121C32A123BF9111CF6F76FA87BB99219A936FDB62D06D45F0426418E0576F80CAA0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\ru\CommonLib.resources.dll
Size 23KB
SHA256 5b19cb4774af86187524051f35d602c826b604b6a4d870cdb2a1794c7de3131b
MD5 a141104e0be63e1d013bbacbca8f4164
SHA1 ff852d26b4cf572686acaa5812ae936f0016b115
SHA512 b6220af301471ca0c14420b539f6e815cb457ce94736b5c6b5a2145ddae1f3ee757b142fc13ae13c8f378dcdbe63cfe83aa1c9b47ff3441b284f97051217976e
SSDEEP 384:cy4VIxutqlDqJLSL+U04EpPsdWCPQUU+InTN+vhCm/oUI:Rvxu8NqVSSptqWCP3ITN+EKQ
TLSH
T145B2645157F9249DE1739F7AE9B06D09AC727DBE3E19D21E00501C6E24F2B60C93A23A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\ru\PDFLauncher.resources.dll
Size 19KB
SHA256 681c4c39252613ee271b5757b9cc6d0d7a882f046ad7423c8bcc0ea9ffac43e8
MD5 35a3bc697999cb6b4580003403e3cac0
SHA1 4d746c2dbb6aa65795528b9f34c34929f22c139c
SHA512 336682ec4ed43085555d74df736c63e65f355602d680687d6cf6e5f5e473f2bbac5eafbfa5767046a4de242e2d31c630e14afb14272f2ed28aa81bbf067239e7
SSDEEP 384:S5jB2fwHYpUduS0VYg+UU+InTN+KghCm/3m:CeSYC/iYglITN+4K2
TLSH
T1E592C7201BFA204DF1B3AF7DA9F459059C36FCBE2F19D51E0150186E68B2F90DA26739
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\ru\pdfconverter.resources.dll
Size 34KB
SHA256 a19808383e4d128031f868858cdd8e1caf9a45a9b5e3ef366484101a1d691476
MD5 0feb7bd3512f1b7a81f7bdf47222042e
SHA1 61110d65920bc63d3cada193df31a335a0dd6f1a
SHA512 fa261e026190325bd05a5e5efee72b52334900338a2c1e784ef18c2f59c548cb748be9639940e8630045cef3fedbceb62d4da65c42980ed593518e66f6f9ad9f
SSDEEP 768:7UsCeb4iEQ9y4mr8Lsdph7/8e7Z4ROvjkITN+oKR:AsDb4fQ04mr8Lsdph7/8e7aELkITrKR
TLSH
T15AF2F01136FA244DF3B3EBBAB97469095C77FCBD2E66D25D00101C6D29B2BA0852533B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\ru\pdfeditor.resources.dll
Size 151KB
SHA256 7b4088a5976ffd61f7e1b0fb727ce060babd708a30e7d80a6ead95f50225d208
MD5 1fba2868a720e464b59496ee9ae8c560
SHA1 ea075dc0ebe74a08629f5ab661fcd935cdfe85c0
SHA512 b743e8be22a6709e1034f6a77ba5a868fc11f568276e1594770db20a3a55f1cb427c35e549fd138584b465a257cad51810dbf37942bde6154f672a7481a24017
SSDEEP 3072:OFWJK4zysJYZuCcdaH6Q6ZGBztRARucKgl1bkQyuAbaVJIJHg1QTn2/2DRvPjpI0:uBSqzq6ntCnlCLQNhIR5Ht1
TLSH
T106E3CE1127F9205DF1B76B6AEE7469086C76BDBE2E16D21E04201C6E25F3E50CA39337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e_sqlite3.dll

Path C:\Program Files\PDFgear\runtimes\win-x64\native\e_sqlite3.dll
Size 1.6MB
SHA256 957066af365f43e7b35b04dc9bcfcf4984c2dd7ed0640e7425f9c0ca014d836a
MD5 6a67f4751ef45ae84549a109c0128efe
SHA1 e5a264bb80be05c60095a74b3f9eea89cd2ca41d
SHA512 219983369ea2023db4ba6530adfbf54f901d119191da31c25ff5f89ce76ecff21296921618cce171d7a3a4625a2bcf56788dc8bbd7b1c8a803977175057cb4d3
SSDEEP 24576:H8vNkN4aHKDqpny6GU+NTpmn2icMI/R5gl9iYfZnt1Ko9ppdyi4+Nf:HyiqD6TcTpm2ijk+ZdKEJ
TLSH
T1A8757D47B3B9009CD46783788913971BD7F274052B64ABDB55A08A992F23FF61E7A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\zh-CN\CommonLib.resources.dll
Size 19KB
SHA256 1a989538b1691ff05aa1bbbd99df3557260bd189002c73c5cce898c496c722bd
MD5 b3c845cd864e859660438155d9f33c8f
SHA1 59eebbf3724fea35b1f094fe448ba39e17f69c8d
SHA512 c2f86c679152ef27ddc49f021f78beb3cd715fc1781f196e8cac1f0b547be2396fc3f41cfee04d45bf7b6646e78099bbe869259bc09ae86b7753e5f1a1c08b1c
SSDEEP 384:ry4VIKJW0nESdsL6fIUU+InTN+GhCm/Lq:evBEsL6ffITN+bKO
TLSH
T1A392C5920BF9255CF5B38FB8BEF4551ADC32BDA26E19E46E4150004E49A0F91DE3273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\zh-CN\PDFLauncher.resources.dll
Size 17KB
SHA256 850d1fc915e50d79c9f8362bf67222a7e14ea1a716b18cc11e0ff754b00ce49c
MD5 14c67b84230f0e53e6f3cda9e5f3bf9c
SHA1 c340f19eac94b8120b44463063d9135acbac094e
SHA512 3750e44d8c5105e2637db38d23c738c49f76ac95a0aa43492cd392fbf1c8a02ad07c378b39f45038e8ba67e9a7b1c21ab782d7528204da3b852ae22d900b29a2
SSDEEP 192:Neig10glACmYFsxDhJRZ/v1mEvMLSpg3OGgQQlw+qxoNG4oInfrN+R4lhei3i64V:Nji0AyTvMLGv5QQBUU+InTN+ohCm/s/
TLSH
T1C282B3511FF9511CE2F3AF7C7AF91226DD36FCB15E14E41E4550008EA992F80EA62B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\zh-CN\pdfconverter.resources.dll
Size 28KB
SHA256 f00d60058709923f0693bc3a186aa35595a1754b0dd014c5dddcefaae20e0a34
MD5 af66f8a6dca8dafb7ea3d665031a5949
SHA1 8682d0e5494d5330439fefbf2bf7b59feb8fffc2
SHA512 a6ebc1a67c826f3d1b30387726b9ace02aa6a5e2c8116ac0c365186f45d8178e9ff2c7845bf7eb645c12ed16a5f1e3141f7e33179098045ceb6b5005d2ae48dd
SSDEEP 768:ZJuebFs7zXgiYLLdyaisxo97kEPfYfuDTITN+4K4:rukFs7zXgiYLLdyaisC79Q6TITzK4
TLSH
T127D20C523BFD140CF3F3AFB87AB94215983AFCB55E21E85E4841245D1972FA0896273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\zh-CN\pdfeditor.resources.dll
Size 115KB
SHA256 4c517bf196d7af9764ff64dbf7b254b5125b4415d0b5cf2256a5e71792e3f288
MD5 4044a80c3325c21809382a3b3c25cd18
SHA1 160dc901d1fda1af72e608dc6ebf71c519e50c03
SHA512 8e538d7165902d7d16d5c60e9a32fd40f7999ee9e3bc18e1f6e0b41561b248c0c74530e8e4efe862e391f5ee18b0954f525ee16aed56e8f350e50063daaabb6b
SSDEEP 3072:GFWJKaFxQKkFFyrrk8gpLmn0IHwZATuHWgkPbjJdPiZGFnMHzpsYgyNm/iAaThql:mKdVHburs
TLSH
T1CCB31C117BF9251CF6F36FA87BB99618E936FEB65E11D85E0421148E0A32F80C961733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

128.png

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\128.png
Size 4KB
SHA256 ff702ca753a7e3b75f9d9850cc9343e28e8d60f8005a2c955c8ac2105532b2c9
MD5 d056cec3b05d6a863ddfa7ee4c1c9f0c
SHA1 dcd15b46dea9d234f13d7f04c739a2c516c973f1
SHA512 751274949b04c7cdc5e8f5f20fd062bfe130f1415eee524d9d83bcf1a448fbfb4b82dff8bbf7495250a852779c3d11ac87e33275508a4064f9d52417f4ca230f
SSDEEP 96:YpjISYK9mvKBG4+43tmidWQX3DJQoWQpzYKL:Yp7nG4j3tRWQX314QpzzL
TLSH
T1EDA16DDEF15935355323E89B282AC458C69F5302D282D6AF940DD4C572C3DBE68B2DC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping2024_1612867501\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6403e444ef9c1ed30466c7bc2c99f49fd4c2cb6ef4ae31d398ac0ff8cf190fac
MD5 2ae0256ab9f4fdb12f500cb590c3d2cc
SHA1 f06e32720eb35e157ce1f60aadf845cc19455c0d
SHA512 7f0292cf5b9312b6967fe72fe3aec9c9157699b8a1a0fca0e4f84581fedb24f57a58f1ff32d3c0991f2147cd0e2f5da55030608d749f93256e5858c9edcd8378
TLSH
T192E02BA6C820983B08FD0728615D4745DB5513173B809D4B763D810CCFF1A36AA9AD3C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 288B
SHA256 09f6303e0ae33bde8330d222ba4e4de55ed19fd9f906084bcd1e551b3af9e453
MD5 4e269d244965688be2db48badee69d16
SHA1 d202a22e1378d43582d7972101f9997a25c878e2
SHA512 baf3ee9e7fdd3ba5d26508a5d212d89a02c953da3e04fd52940e18db0adb4b57f6b586452a35bb20b0ba75c3eb5cf64473d39b12fdaa24800871eefa5f490482
TLSH
T1FFD0A7CA76B0035BCF404A306D700C156233110404133B7B81D723BA54973E13E9731C
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 896b428cc57236f4cab167bb5e3cd743267399b245067f3db7e91562520e241b
MD5 fa536c801dcd464f8483172bd5635340
SHA1 8b287993c7a4ff43769a7f083cba66e4ed2c4b93
SHA512 2d468a1396a563838dbfd00b5c00cc8e57057cc76d150ad7023e23cb96b78807373fe236ba219794ac3185727119e87559af24c726b67aeff511e43972e081be
TLSH
T10F7190F783E48A7DC51196F8AA156E1FCE6D0924035C3C6688E86E4B53E25B3D24074F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 44bfee94343ac5d06405487b6c2374b4ebe858a10097e345fea5540e0a7c49aa
MD5 7b081267111e822cc0e6f4f17e3a19d3
SHA1 7f1cba9c8672bf303f2dd68b1142ba243aa5b9ba
SHA512 510c714aaeb89cad65b3322ae951330641504de7ec96eb8a9d143fb9cab71fa9c3ffe6c4d1ace89a6498a32792f8feeff5cccad939c96629b6a16d36c0e54909
TLSH
T1D9818FF783E48A7DC51155F8AA156E1FCE6D0924035C3C66C8D96E4B53E25B3D24074F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 4151b53eef003edf83d438a09ee2918b05ddd1c219b28b3387591c7942cdb4c7
MD5 d4ad2cb877655b6c85c7eb5ab35b3252
SHA1 4fcec6b33bcfd84bc9da1027db1b970b937c3dec
SHA512 d62206868af1c35304e3acfeddbe6468a948df90cf5568a8c400e01e0bca7d98001c8c07759fcaf9e3f286aeb2333f4e6d312ef05749576fdf779f0613802e82
SSDEEP 192:sRG7rKd7/ce9Qsnbv73pEPRpKhp49YHsb+WNn/Z5RmYyu80y64kw4aaVyIsnAUg/:sREKdzcunjT4Xy4CwByY1hyBYaavaw
TLSH
T17252E91EB918397B4CDBD22AF9A17B57D7F41021A1941E84EBFC9A2C14D76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 1724a9f951f4cd7b93c147eac0d76df361f0f19afad9385230773359aa827dab
MD5 a214d73b057de50dda988799d8d033ae
SHA1 dc5872288aff57497bd56a71474c8570488ff0ca
SHA512 f5957edb938c05ea766c09bacc31b0b3c55b33b357a1713f3e0491c0003fd9918bcae2bf2eadbf3eda7a9f076cd3240fe29ad1df01230a599f7da43e7cd7e368
SSDEEP 192:sRG7rKv7/ce9QsnCv73pAPRp2V9YHsb+WNn/ZPqu80y64kw4akVyIsnAUge:sREKvzcunOTUX6CwBP9hyBYage
TLSH
T1F442E72EA918357B4CCBD22AFAA17747D7F5102170942E84EBFC9A2C14DB6CD322B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 446302005636250254306a2ad034813e768c94bfbc48ab1dbffbe74a31324093
MD5 27ee2fd7daa1cf95e992aa779805fd1a
SHA1 6c8b6e818d546258a11965fb08f97a8dfae3ab91
SHA512 c2bdb414326b397086b0dfd2295b008ab0245f66775b60dbf32878e7d36663552178eaa8b7f91917ce7da5b6aac620ac3a8b55bfb29ac463dbb5394358504a3b
SSDEEP 192:sRG7rKd7/ce9QsnAQv73pAPRp2hp49YHsb+WNn/Z5/07ZeeQu80y64kw4aGVyIs0:sREKdzcunnTUX+4CwBiekhyBYaevaw
TLSH
T14E52E82EA918397B4CDBD22AFAA17B57D7F51021B0942E84EBFC9A2C14D75CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8f44837e29e4321353efd81f1c3b98bd4c2716b9dc06eebd30e1d71ec919393a
MD5 881c652f76562737a489328dccb6ef93
SHA1 e23ab2484f5fe43243a8b6516e8368e3e9e4a93f
SHA512 241e3500e914fbc97ca21d85a82fad5468a325e20deefc314a20bf306cd70b333cb54cae21da2bcb4968f73dc477c4c8a6e2ebd251744f1a89acced7b430781e
SSDEEP 192:sRG7rKd7/ce9Qsn6v73pAPRp2hp49YHsb+WNn/Z5Us82lu80y64kw4aGVyIsnAU3:sREKdzcunWTUX+4CwBy2UhyBYaeE
TLSH
T1BC42E62EA918397B4CDBD22AFAA17757D7F51021B0942E84EBFC9A2C14D76CD321B017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 faf205f38f14aaebb964cc4c6cac86c1d9eed1cc4597cf300d120c12563fcb8a
MD5 cfbb6fe69b1dcf37ae21233f58e196af
SHA1 ed1c796023f5198d2aee9d10882084cdf4376191
SHA512 b9f045a63479b9bdf49685c0d4fc4c6a89a446e520e63af89b50cd1c6be690f1e59e8fa198935484ea5c349cca94ef2e2362cf52b4b372d92b7c9f519f144eb0
SSDEEP 384:rVjn27KxkXqKf/pUZNCgVLH2HfgsljM7pLuLcifx8XODnS+ErU3iIHGk0cvXwv:rFn27KxkXqKf/pUZNCgVLH2HfgslM7pd
TLSH
T14A7209A77C4C9E770F94C6CCDC267E4F9CB5024A65E9886883FA982903D5ACF114A1F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 fb810f57f148b018ae023019598065ed7628943c65d52c7da79a08a4b0f87381
MD5 11706747ec9f9992985d59c7e057e46c
SHA1 6b3423a34e6e883d7f9f13e7d018b3a35bca8139
SHA512 029b2d061fda4ec36fd5f7c93d8d6c8279a50a8eb3741413e405b89ee6e0a9a91843df604614f3ec50d806c4f97b29a1b858c8e84ead9cb90898d81b79f40ee8
TLSH
T1E9B0121180815511C86302F411D7548C71245F2D8705130993F4B971D8261A24118264
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5854b3.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5854b3.TMP
Size 96B
SHA256 9845a31ee12a3b8e5f63aa68369e04afd7b080b1c8dd5e97810e1d2361b84293
MD5 0b151251092a68e802d5f94fe215de13
SHA1 e9ce6228605beb4ecd1c72b02b33bda8c4d6ac4c
SHA512 360b82e823ec6ea2e1b2d33b728cdf8b060e427ac5b8be936485a9e35187b18c4b87288559e018c55ea9254e7ff1606845a50537d27b89552538b572ce60271d
TLSH
T10BB022C0E0C2A223C00383B022A2E8C83020CF3AC203230282E08F22CCB0A308C22020
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 a1a5a73899f9a2345afee26a422618419bd04e75aa44a1af483a35bcf40cf6d8
MD5 1c196742bc5ad0d6c28f966aa96306a3
SHA1 8befc3d60b2db7412eaa961f771a5b9a8fef9329
SHA512 f5a2c5001c0f75db0827703e8236dd6397d61430488e856770b1025136bc1b083724d2903466f3cebde533b8d86faccddd6a185015bfc654803b157511bacd24
SSDEEP 1536:ofcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3T:83Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1779302B94E1A4AF799BE5691729E7C09CD12130E715FB88C7268A38C21D41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 a079d5e68d3896de9eafd6680a3a46111a2216d1f3d698a719af33fe421c3e19
MD5 c64fcfad4e60e42ca8d3443e0ea36d96
SHA1 6f6d8fca7890d1c65ef32040d38c712afaad35d8
SHA512 01d95e95715c1bb0df63d413afb36ef6535c99ad645a446171c930d9f857886545ef39bfeba84a9985733404e37d334da8286191de7f8f5f24ba44b8b63b919f
SSDEEP 1536:xCKxTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9t:McT3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T17D9312BA5E1A46F755BE4691729E7C0ACE12230D715FA9CC3268A39C21C41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 60af0d30ad01780793cd40c3c07c737f22ac49f2fe6c42e196ae046fdaf7ce3e
MD5 6850223ba2ebc8701a7593dd9515668d
SHA1 d9724d2aa3e5fd194b28423319ea8d54f64f8811
SHA512 c65e095715ab84ca35ed49b506bed2560798e2fb94070ce15833304c21ab5be5e6015820b15c2f6208defa78b4accd2fa0fc5c53efc653cb8d9cc5de9e2f87aa
SSDEEP 1536:oCKxTcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9t:PcT3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T13D9312BA5E1A46F755BE4691729E7C0ACE12230D715FA9CC3268A39C20C41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 ee5b5dbcdeb9f7c8aff55aba7e62b5e90c4d92ff6742a20cb25f407bebf21280
MD5 2de1c4f6c44329e9234b49ee9945fedf
SHA1 069aa28d63138bc6a4a15d80360d111ef23d76ac
SHA512 6e472209e0cfa753f9567d65be97e38a5de4798ec5724541c0665e1fdba220f24f2b70b56174c47321a1f69c06f026fcd4463071c46392bc211a0eb0311da7e2
SSDEEP 1536:QfcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YE3T:E3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1FD9302B98E1A4AF799BE5691729E7C09CD12130E715FB88C7168A38C21D41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 c7012993955bc89fd55f717a82151a1541dfbb6acb94c4e0b621436054ad5a06
MD5 0b7f73123a93180995b7506972dd2c66
SHA1 696478f1e487466679b21343752af43a57094297
SHA512 67fa1f111abfeafce0c8e2693ac69d8ef4d8816f07c5ade7e0b9fee3903950db9428790cd714d9499cda43f254b6a1f0a5fb20100d02657ec40f070f04d41e92
SSDEEP 1536:5C6cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEj:D3Qw/xLANk0mUW5GmRntSFCjEENV
TLSH
T1609312B94E2A46F7957D468276AE7808CE12234D709FA9CC316CA39C61D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c87a64e1d2125148247c09afb02df2782122b54d8a0688711dc68ff824403145
MD5 7e8f9fb22a99c46f608448a001e8101d
SHA1 51e079b978173aa097c5a765f786f2f79f4cf20e
SHA512 0dc870e3c1f47e8da84071b590634241433c132c2da810ca6807faf22406f455c4d3b35effeae4aac48bc300a17be405ce0adebd94c8a591e22ca177817b3cc9
TLSH
T139D023757795B007C29D04B2005186D5254BC48534CFC3C5F129404D58E91DD77E75D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 647954b82abb9de4022226081588459c8ceb67b4912d74e63627ccf0a00cda82
MD5 09708fc324df48dd02c8d3aa2edf78ff
SHA1 53b44269df4c6c5150c3fef840580f3f43078c21
SHA512 b46e1d7c6bec709b31b0ed22db7bc614632397659e81ccd6794e427a79ded02d298eae9c77de83895e87f9694ed2a3fef7f5859120ca294fd8029e25bfd276f5
TLSH
T134D0A7B97B59A403C28D04B284C086E42657C0C521CE93C56035451D58F118862FB697
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5042361df91a9fb5f0eeba4bb176421ac973db18478bfa3eaa775803acd7a2c3
MD5 cd0fc00af1e588670c5a07b831ed7118
SHA1 3be9b2ca69571a0676fd93c8d572a5c558a0f2b9
SHA512 3447ea61f9eba9d31d97a678825c97b343b1efac1be016200e19ec254f9a540d07e32c3fca0de1e7244953cbba914d3e5fdc976600f1ff12e9723c21410d78e5
TLSH
T1B1E0E5AEC822983B05FD072964124A87EA51139B6B50880B3B3D93088FB1A364555C9C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 951eaffbb1f6a5664c4783b7c344f2b34c7cfeb3afe8acf361b6032ec6ae1715
MD5 ba55ccd01f2a26b0166a972a825e6466
SHA1 2c965c9ab57de78177db2c289c2df20a39d58846
SHA512 080a38f79c00050da8945df48d9ff8e395e9d3099813b0e6eb4142db1187f9efb5ec09e712255956806697bab10140f21b8083249b9d46bd79eea1365536f51d
TLSH
T10A512B8580A2C71BEBE218B159D1587572B0AB481C0F2F4A3AFD09BDD97FB504B7270C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4c9b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4c9b.TMP
Size 2KB
SHA256 1cd96de95984cf1685a1cf9652c86ff3b1e4a35d87d958cd4edf953a0a63ff1d
MD5 a9c5c18f45b9b95ba6158d1ff5a8d976
SHA1 2de6b226778f075fc69bf2d61496ef5a2e19d4c9
SHA512 011d3792840d5d245f1a0910d1715e0cdfb8edb927eb0cb071c17a0e1d5ed0148d5142e1a81488cbde959dbf1e3b8072b114bbddff8737a25c355e99f1be1cd5
TLSH
T1D4510A8440A2872BE3D214B549D2417573B4AB49080F2F5A3AFD05BDCA7FB50533270C
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 20de1c107da07f39f28996216ce67ae69ab871c1435f5ff3177cf4836b95a948
MD5 79f58341742c748f5c7cf7a0fe3926c2
SHA1 88100fbededbc42b6cf0df4caa1d03e7e9948e82
SHA512 ce56ddfd0f1b4d8e59cfe1b7a09f1adf195659b5cb7547a8ea369a4a6472e6cda81b99624566788a7b8e5728d56f979332de938530df615327dbcc3f6d66306c
TLSH
T1DE51B1F783F48A7DD90151F4AA187E2BCE5D0915435C3C66C5E86F0BA3E24B1E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 3b33c4494de79ce8fc269bdc6c7f1d3b68d90367765e87393f4ad7d495928c5f
MD5 7737922994a8131faab8d24806b80f63
SHA1 55b83fbfed42d512f1971c4579462107aa268475
SHA512 720477fca8887c44c96974c264386e66f4ac76b25e8e2df99d73b00df3a46fa39b4c3e3833d4179ff91e37e7aea8fe3046065d347fcbf1f89176b93e66ef871d
SSDEEP 192:sxZqRkyMqZ/K1Ml8/ja/fvsxWpVjmpZZELgvUOfzodpbJHW6+WNcSi2/A7EF79uK:sxZqFKa/fvsxWvjm3hvUO0tHb1/DN/Z/
TLSH
T17B82D716693459BB8CD6D22AFA557F63D6F50523D2944E44AEFC9B0C00E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 35c68162c4c4044d5db273814a2ce2ae31c20e6207cd92cb968ebd4b90e1e55a
MD5 631d1213ceb92f4b0756dd70d449a35d
SHA1 ef49b47d027a704794d48e0355d7e358932e60e6
SHA512 612cc938e10d9dd36b5cbe58a3f24a006d3358ca780d4ded6cca1f8472694830e38a2e07660e4e92db259e48fe6ea4bf19a5ada54cfab7da4aff792a300a2901
SSDEEP 768:A9sqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVkEx4Llhf51Yro8:A9sqZl+E/BlWvBDeTu1japEx4LXB1jyz
TLSH
T127F2FA3B6C0CCB7E4F804E9CDC2A7E8E7EE8018B9698895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 961da9bcb39792566fc8d66df3e8d866ccf337fe62ee5c0abf1601cbeacf452b
MD5 b3a50c60e2a20e3bce02b3f4dd8c90bd
SHA1 d9cdd6fcf8985a534348520b9fd6ffa6310bf9b3
SHA512 6d110d33d8bcc9463dee1200b2513a8732e3c99ab7457299ce99b25e9bafe71cc774e97fc1c2d1bce4f2686d18b6d0ed3a3069956eebd6b28c50ef161a51fed4
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qnf:+BOVglYXrbtZqRvJDJt
TLSH
T19AB22D11763A0380397F258A8194B56E62C270A37198B42B7BB944A74F6BF20DDFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 39e2f9b0d0fd53e10f00258ed7af7a719746095bb512e2fab227e67f84978e95
MD5 1a9fcd6a9988c5d6eca11979a897671a
SHA1 afeccbbb8235eafac80435d30ddd57787093f168
SHA512 766bd20782f9f5710c2fc547458d664ff333fa51bdfa57e77ecad94a04383f3bd03ab0b62b0c5cbe3182c47569ad1a9e23ddab1ace1052308b19b138f264e066
SSDEEP 384:numiFavqMg3sNu8TUNTUlIm2RihY9prmbfYYUUzGgG6tAdGQ8S7o1dKuiNjX4rNB:uNFayv39wgTierYIf58mo1tiVXsP
TLSH
T19EC24B35EC98D9ABECE69FCAA74A7A07DFE00297D58C0AD4DAE85D0D10D319D1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1f88902523ffe3e01fa47cf52123dc5b35dd5ea6decb04c6f355ae065195ba56
MD5 9bb81fc26285f9f084ffe0bf981a6eb1
SHA1 8311df0ebc2e0f68308a6271197d397ef100d20a
SHA512 1f78fdfcfe6c0817e2341466b25deda30eaecc167156fbf44049b9a1c969edbfab6e822147c16bc0661e99f32431086673482f7eac6d4a1139bfd4b7d8e4b479
SSDEEP 384:ndiFavqMg3sNP8TUNTUlIm2RihevMHmbfYYUUzGgG6tAdem6n4S7o1dKuiNjX4rP:UFayv3UwgTivPYIfBg4mo1tiVXsP
TLSH
T19FC26C31E898DDABECE69B9AF74A7A47DEE001A7C98C4ED4D9D81D0D10D31DD230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 a7ef51edfe33d0c6efe5d357a9b51e426f1a76aae7adf1e10c2cc3424db9e27a
MD5 c43888193c3df6b540bd3d5baf730717
SHA1 4272a2dc4e60fe6489a230137e0bcd9be7b13e5a
SHA512 c5785f1179ba78c8ab94c78ed3bcaf1f35ef1eef041ec92899c2ff2506ef36a5f9893163c8499cc5bd310aa3b7f926ab0fa3cb4a162f0313dd87485b1d52731b
SSDEEP 768:DFzZEwgDiLOYIfBgTSFoaE9deWm5mFmmU:1ZypJToaG9mmFmZ
TLSH
T1BAE22971E894CDEB98D6CBC9A24AF542AEE00173C98C599CE6F87D2C309B5FD1707815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d7e21a6cc69ef38ede6a99177041e429ebf647fe378af940f7ab3ce80c1b653d
MD5 083ef3f9e656443d5a82250845cdb0f6
SHA1 fa92d2c078a1a2278f0c97e3d974dffb60d64838
SHA512 e45f6bd2b5ddd9a4b044b0e66d2570891a7da424abb5c4a2a5b567e908cc7935303232fe895c89d2d899cce1274de859f731e1f884e83f77d14988d70170a113
TLSH
T10241F948A6F91148B3776E5AAFF7686D487EBC772F07D49D10110E8E0A22B44C861737
MD5 SHA1 SHA512 TLSH

Submit Download

pdfdata.db

Path C:\Users\Admin\AppData\Local\PDFgear\AppData\pdfdata.db
Size 12KB
SHA256 fe193839a124191372dcd4e0ab69c270b7b38c7ca091dd075a210dfe61d13743
MD5 9693bc15858cf23f9b4fa92354c3a492
SHA1 9e6f952f8e70e1bfce51cdd2e3c5d2bc9479c7b0
SHA512 a00cbe45fca3fcd0277842ff671bbb0e835c614e83c2ccdc48dfbc14124d0ce876b2af54a1499093440b91eb6019712ab1522a2a1f31855355931f8afdde920f
SSDEEP 12:TLmkHVtUUa7YeerSY3C+o4DW6TCWKfElliznvt//fH0QoE7svi:TLmiXZmOCedC7fAlWnF//fH05r6
TLSH
T12342DC735ECB5917CCE28F36EE4214E50F0B823F9340DB83187120964E2080E0E2E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a5b717d-66cd-4e58-96c9-28a16f74d25d.tmp

Path C:\Users\Admin\AppData\Local\Temp\8a5b717d-66cd-4e58-96c9-28a16f74d25d.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

findSoftRes.txt

Path C:\Users\Admin\AppData\Local\Temp\findSoftRes.txt
Size 3B
SHA256 13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
MD5 21438ef4b9ad4fc266b6129a2f60de29
SHA1 5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA512 37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
MD5 SHA1 SHA512

Submit Download

isxdl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-M1J2B.tmp\isxdl.dll
Size 121KB
SHA256 b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
MD5 48ad1a1c893ce7bf456277a0a085ed01
SHA1 803997ef17eedf50969115c529a2bf8de585dc91
SHA512 7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
SSDEEP 1536:dohlISko4eZHOMazWpdYoEWSekaDnXUq5o5dInL:dkIM4ehDaqEpMXUq5o5dIL
TLSH
T18FC36B317350D433C06B193A191A87BA637FBA3195B5984B7B840FBE6F30691DA3631B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfgear_setup_v2.1.15.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-PFN2J.tmp\pdfgear_setup_v2.1.15.tmp
Size 3.3MB
SHA256 3919659ce2e67bf7868ecf5486a8ab447d1d22436ac950a07e706885631ad0b2
MD5 3744ac4a905776dfda52d06e055541d3
SHA1 090f33f9fc877960729ca5afaf4a40c6e8f2657f
SHA512 88a3cf178415c4066851a679a211d110b2e0fb990c51c463bfb49340f7e50ed3136cce2440b644f1408f774cf13f85b5800afcd781e0433569ed75aa54e2a94d
SSDEEP 98304:B92bz2Eb6pd7B6bAGx7yvGiuLgs3T1Q8XLda333P:B9Q57yvGiuLgs3T1Q8XLdk
TLSH
T1ECF55D16F744763EC0AB8A31473385989837BE6175268C5356F83C4CCF7A6902E3E6B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\af\messages.json
Size 772B
SHA256 aa12205b108750cf9fa0978461a6d8881e4e80da20a846d824da4069d9c91847
MD5 7bc8fed14870159b4770d2b43b95776b
SHA1 4393c3a14661f655849f4de93b40e28d72b39830
SHA512 7e943b672700edd55bfd2627f4f02eb62eee283e29f777f6660fbdbf04f900757272c5fb8a0c8744c197a53eadacd943598b131fa2d9594d39e20baa2a9b79f1
TLSH
T10D01BD01B7522F3C87CEE0C67D1AF65341240BA1A1D8B9B26CEC6659048BD2C721B620
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\am\messages.json
Size 1KB
SHA256 64e01bc292ba2ea1699576fcc445367047520ee895e290ccee20c24c9336d8ef
MD5 83e0e58d0752ff7c3f888e6406413b84
SHA1 14a8981e4355301bb3073db6d7ffb337ef8482e3
SHA512 fc772bd3d6ac64110562aaca7d320f49ffba4e1f9ac2e10456fcb75e172d086d3ce8996cfc64b33b2ecdf4f6b96e38905e671c1e6ba5205fede9af4a183812c4
TLSH
T13F41184CC989A599E7F7908FACB9A0F54CF70E90D580B8391DBDA20E526543DA04BCDF
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ar\messages.json
Size 2KB
SHA256 47652115cbb912907f405992fcfc64f987642158f0cb35c9d6e0d4742d833802
MD5 c825621044e4d5c504404dae9752285c
SHA1 68c1e29daf042487cb76629abcdc03f16fccc92a
SHA512 4aef3e7a747e290be8ba10e22e670c1c2dc653d4311020a4fd3060205fd88bb5d13d9edf388fc18919abe353c62d6841a4ef87e38064430299e52ca16c81941e
TLSH
T1CE511EE4BBB6695C051CEB0399BFEDDC18553DC188EB90321B7C13C882296097E5D3A3
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\az\messages.json
Size 1KB
SHA256 614470da3c5034ace649f1786beaaad2c94f4475bcc8858390b721f06fb7bf64
MD5 c603747b8578c1324dd262565f643e06
SHA1 5cd18bb971af007d9a589377a662688daafe7519
SHA512 59a5b29459e6a10628ab95ed620ab159dacde2d98dc2c3dc7949d0e5e253f2be7a21cb13f0ee8ae0e2f85191a520c9daf797fd93b27c39f53b1faa8aef1b706a
TLSH
T13E216AA321F1FF5CCB064146FA74734E14609E5410A9A4E17CB2A9BF072E5DDF152A2D
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\bg\messages.json
Size 3KB
SHA256 22bc37b47ce8a832f39701641dc358357676e9be187a93a4c5d4b016e29238ae
MD5 361b516edf253851044dae6bad6d9d6f
SHA1 d64c297cf1977cd8ad5c57d9b0a985a4de4fd54b
SHA512 b2614c53e93e705a93b82db9fcf5259ca44b10b5e5237967a34f68607ab2380ea0c8e5df4ffd941d914617fa3538fd40c18df7d3c9808c5f652852f01e214c77
TLSH
T1C351B2E2C0F7165C29C87996FB71BCED38987881E128E73FDC7E2287D21462566D131A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\bn\messages.json
Size 2KB
SHA256 3e3ceaa214d8079b02c9c941635f5d45e621236d9c3f82e06ac604f0772670e8
MD5 b1101fac65ce2faa3702e70fd88957d2
SHA1 06ebd889fad9ee2d5d5083b10abf7b2a4d0e1724
SHA512 398d03bd3b51e2789d0573f5e4792c13193c36539e8fa35261bc3b9a991a155635e6d44a9999b42d3dfa264e3fc329e11dd65d6e1408c4076a49576e7e5ef4ff
TLSH
T12D513D0AB0E5FA89060D3066DC3064FE5BAC599741301B3A8D8FDACA7E1E17DC16F9B1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ca\messages.json
Size 843B
SHA256 de6d7b7c2427ec4e738407d7834b71941f69166b030355e00f325ff1391df5a1
MD5 fbb841a2982166239d68907361f41f61
SHA1 4a8d76a6fe1bb111fdbdfd42d1af0019a97fc540
SHA512 8db540b4c9e250d3781797238b1d16ad820c568edc563bfb912872ab99950def7e89ee432c696ba9876e3d7b24a4e4c26fa5b0fa9e76a54e11ae63996e02a561
TLSH
T1D201AF5E75807EAA4B0ED0A33E3BB20FD0B81AC12745E0D7A2A4421D124AD4DF3637B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\cs\messages.json
Size 953B
SHA256 5a701d67910ba6c7ccedc26e02fa707cc86a1be57cd7d36290a3d268732a42c7
MD5 48663a88dcf0ef6c9fade9bee4935b91
SHA1 af7cad1498bb4b0f05c1468abe3563d0182a97b4
SHA512 3c3e5b9e56535efe1e20d6024b6fa46d3ea969c971d5ec8f5af1c933c1feb75d25e7f26c9e2bb8d200bca70ea1f1bd7e93e4e1c09dbc447340cdbeefa91cc33f
TLSH
T17311595B53F22C9E871ED0967C36B26542B046C1119CF46262BED18BB10ED2CB57B276
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\da\messages.json
Size 764B
SHA256 94cddb998c2c5ab40b6f074c359a60e6eebaaa2d52a9649c22f4ea4c1b9936f2
MD5 0e451c9c8453577e513aabf630c275f2
SHA1 5912cc58aa82bc75691540c8aeaca7c68641539e
SHA512 a89dcc1ec8c79e7cf702692e20ebc952907b2fb1d76a3beef60d7415baee24e055e2988b55e12ce00bc112c115ddd9d46d63bf0a1c511fffb041da7054391f80
TLSH
T1A101D09292E27E8B4B2F9117BC217A15517C07CB51A6A013B0CAE95E594385DA16F370
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\de\messages.json
Size 927B
SHA256 22e2828bfdbb9c340e7806894ae0442bd6c8934f85fbb964295edad79fd27528
MD5 5daf77ae7d2b7dbef44c5cf7e19805ee
SHA1 48c06099aee249dd05b268749836e3021e27cfb5
SHA512 b9fe759ba6a447ebf560e3ac6c79359e0ad25afca1c97da90f729dcd7af131f43c1f4bfcb2cd4fe379fff2108322cf0849a32995b50188b52258bfff9e5ca34d
TLSH
T1C611108373E20E1D578FD1637C3A7685D76442E6D284B113B8CCE51E618F42E1107630
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\el\messages.json
Size 3KB
SHA256 728d8cbd71263680a4e41399db65b3f2b8175d50ca630afd30643ced9ffe831f
MD5 32886978ef4b5231f921eb54e683eb10
SHA1 9e2626e158cbd26a2a24a50e4e8cfd98a49984e9
SHA512 416832f007470bf4d9d915410b62bd8159029d5ddabed23d2bbc297e4bbae46f4346feb68c54163428a6932c537967ae9ef430b9fac111f15cfb001a480799b3
TLSH
T13F71612E3676BA790BE9D24BA5316CEB7E4E4FE0C1B015F2656AC2D8544CE19D07F02C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\en_GB\messages.json
Size 708B
SHA256 c7255e9b784c4b8df7df7b78f33a5737a9ab7382f73465351597b1da9b3d5fe7
MD5 c4e77421f3361277f7e3aa3472b5eb10
SHA1 f8ddd7cd0cce742e68443d173196471e8a23bd83
SHA512 6c11cccbfa6e841d90fa5b41f46de5489359335dd59ccb06d5148e7d2ce3af1422b93eb574360be4695e69d851befed8a2588dd411a7b0a553cb621238d474d4
TLSH
T168014C5363417F554717F05BB9023441A5B44AC52784E07775EC982C665ADAFB24B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\en_US\messages.json
Size 1KB
SHA256 4f70eca8e28541855a11ec7a4e6b3bc6dd16c672ff9b596ecfb7715bb3b5898c
MD5 64eaeb92cb15bf128429c2354ef22977
SHA1 45ec549acaa1fda7c664d3906835ced6295ee752
SHA512 f63ee02159812146eee84c4eb2034edfc2858a287119cc34a8b38c309c1b98953e14ca1ca6304d6b32b715754b15ba1b3aa4b46976631b5944d50581b2f49def
TLSH
T153213806EA14BB37825F6036BC657585A3300ADB2600FC3D7EDC941C1B059AA91BB3D4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\es\messages.json
Size 878B
SHA256 02168993a23e074e0800cbb338fe279f99ef420e326bf92916ffed83c1f06533
MD5 59cb3a9999dfbd19c3e3098f3b067634
SHA1 bcfdf1c9c7f5d0ce35d7918060ce704a99803bf4
SHA512 9968acb9821bfff6f427aabfcde3023f5a6f588bbfc0efd2275f201930ec5e16d64ff228c76f77958d36091a3dbd510e95385f0cb99a3e4dde693f34e9e3ebf5
TLSH
T1AF1136CBA6A1BDF60B2BC1A17C3BB213E1684AC12D80E493BCA84129014980EE063759
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\es_419\messages.json
Size 880B
SHA256 e848603b7a73a88e3fe7bffa20e83397f5d1e93e77babb31473cc99e654a27b7
MD5 94bc2d5609f6d670e181e1ff0d041869
SHA1 58d2c17878e7b6e73daa544b8ca7774e5d902a17
SHA512 04bf79f675888c79b270c82e3a0e7a07e24205e2159e2d98eb4585aee5c0d14c6be3a3d169d4ea702a74a76f9e622e70a181dcd9ae0cb9f2472550fb33e9565e
TLSH
T1031180CF79E1BCF50B6FC1A67D7BB217E1280AC11D81E8E77C984029014980EE163764
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\et\messages.json
Size 914B
SHA256 7ccc7b17bfe01c3c7dd33eff8f80d0b57fc9b175815e766c9c1c1e893725e20f
MD5 b18007bfc2b55d2f5839a8912110b98d
SHA1 842ecac418424b2fff4db81e4385d59e098b65de
SHA512 166937891553597d585d17fda2e7ff2bffbd3731841ea6cdcb7add528a55aa7c257fc191d029dd1f57afd4349194c0cc7413c3752641e8217d465674b62b8ae0
TLSH
T177119C6EB2D83B5D4F1BB0637E76790EC8A99BE11AC1947224DC4364808EC1CF162F1C
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\fa\messages.json
Size 2KB
SHA256 e758273c25fbad804fe884584e2797caefbbd1c2877dfd6f87ab1340cd25252e
MD5 e578e08ee604158d674982ba060396fd
SHA1 fd601092203317fe9f576fbfd675e274001efa80
SHA512 131c75cdbc4a40068cf97d7becad08f49e77a9bda3fb1cc50501b0007273ee5c6eae2f84047d97f72b6fd9f28f65ae544eb807057a54a6e009b9bd8fb8ca4df1
TLSH
T1545158DCBF767A5C152CDA029D7DDACC04493CC088AF90799B7897C4C5A45847EA93A3
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\fi\messages.json
Size 840B
SHA256 a822b0e66d04644d1cfbd2517736728438743162c3213f15d986e2db85bd0213
MD5 1d4778e02337674d7d0664b5e7dfcbbe
SHA1 fe1763ac0a903a47446a5896a2d12cce5d343522
SHA512 771c7ba7f93a6e9db94593897d495e190e58a9b9c490523cc410059e72538005e2de96864dbbed8bd1f01eaa4d1cd022443dddbf759a606e2903c9ddecac43fe
TLSH
T117018E6763763E9C970BE1127E32340BD1B52AD600C4D9A321DC4B6F25AE92DB277734
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\fil\messages.json
Size 799B
SHA256 41ce6a7b18364efecced0419b42165d4f86c43643bbe1043014d4142cf86186a
MD5 f954b2e970dc96e5889499db7392fd59
SHA1 39f56f0ebfe92c96e8bf91f82cc4fddbed1e0aaf
SHA512 23610477834ff51e93fe9467df997f9aeee63ce3a8a51464b87b1828dce25d50e0bf2f28df139ec59e6c6425b81613258de211735ab2e470dc63c9cb5a1860e0
TLSH
T15501891362002E98EB46D0A77ED1381641E916D53FC0701B67FDAE0A668B81DB51BB70
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\fr\messages.json
Size 902B
SHA256 6713b69b6c9e80b03e0a9d4a7d158197b0c7ec8a853c64c0af0b1a05ce54d74c
MD5 85718fe4820c674c5305d33dfb5cbddc
SHA1 d4170743349f3e037718fde17bc63a369c2e218a
SHA512 678e934f8d4a1bf0b98844b796eaa2471a78911d4020bf755871650dd0adad6bf7b475d9e5bf68b6a911ed330308a08698706d9460df003648b612d97848e652
TLSH
T129118009A3343EAD5F279172BD3564878A7C45C5738071127189970F52AA86DF2F3770
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\fr_CA\messages.json
Size 901B
SHA256 af889c1deb6f9248961c2f8ba4307a8206d7163616a5b7455d17cead00068317
MD5 681422e3fcf8711af8eefbb75a607c8e
SHA1 3d3576a989c8010a397888429476f2800052e79a
SHA512 2546c274749a75c09e8255b6fa53a080a14bb141c748a55ebd530b6f2ac8adca3111320511628d4eec2b39a8710578ff16929b06ffb1f9c2093d3f1ee4c6f601
TLSH
T19011AF4C97393EAD9F2780B23D36A097897C56C07340B252758ED30E029A8ADF2B7774
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\gl\messages.json
Size 927B
SHA256 9890710df0fbf1db41bce41fe2f62424a3bd39d755d29e829744ed3da0c2ce1d
MD5 cc31777e68b20f10a394162ee3cee03a
SHA1 969f7a9caf86ebaa82484fbf0837010ad3fd34d7
SHA512 8215a6e50c6acf8045d97c0d4d422c0caacb7f09d136e73e34dba48903bb4c85a25d6875b56e192993f48a428d3a85ba041e0e61e4277b7d3a70f38d01f68aab
TLSH
T11B117D9E6AF1BDF6470BE0627C3FB10BD62856C21E80E8DB28A9D1281108C5AF163765
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\gu\messages.json
Size 2KB
SHA256 cc3e9077fcc9bd0dfc5dd3924c6c48b8345f32cee24fccc508c279f45b2abe61
MD5 86de754c2d6b550048c9d914e55b5ff0
SHA1 5b6654101b3596742be06b18ef2a5d81da569ee5
SHA512 3a8d326b91141b18cb569a93bcd295075e94a0488f2ffe5afb80a4cb36e4523e28c87d91a64ed255445470ad6c8a34948fe091e709e8097dcdd06eba1cc52887
TLSH
T18751C5CF51E0DA7A061E2435583CA0EA4BAE0C6A403C1335DE5FA6B9795C6BFC16F1A1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\hi\messages.json
Size 2KB
SHA256 14895bf43ce9b76c0ff4f9aef93dbe8bb6ca496894870cf0c007b189e0cef00e
MD5 4a9c9f947b479e5d89c38752af3c70ea
SHA1 799c5c0ba3e11ad535fa465ab87007c36b466c6a
SHA512 293d9fd5b207c14d1ffc7945f80d3c2dc2d5450bdf1e7b7962767b8d330c9255da16dfa677234198569f4ddfd00bce82d70086df974afe512769597039e21cf9
TLSH
T1165162D2F3F2F9C9810C7071D43A96ED5A849D920161E8AB5CEE9ACEC2872448253FE4
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\hr\messages.json
Size 863B
SHA256 985976b776e729835e047c81d3d731a6c488a6459aa8918dbc8ec808c0bf73a1
MD5 eb6c5133c1fe7f9e8e4449a917d185d9
SHA1 9be42ac75487a77dfbbf01ea2098886e69956356
SHA512 1aba115b30c99e786845c137ecb8beec4b5162c59d10724dcc083ff6b91a47af45ca850fc0b3072d44be189b31abb67423c88369171b0c411ccf7ae884fd831e
TLSH
T1DF11C2A382667F4A830FC1967C38F31698F482C85BC5D47316FDB338424EE74A102224
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\hu\messages.json
Size 1KB
SHA256 cf26310b073b0891996ecd761c6cb53f00193dee524213a9fb34225d636ec4b7
MD5 fb8d08676aa88683f27a2759c5837529
SHA1 80badd0de6a8d87a8e14232f71fbcbe231eee443
SHA512 5c4307b653cd841af14a4b57f225938be54d718c979fa4008513461fa6f8409bc82e050f0b32e587f8e52d5580aa7c6d667aa94b30a588cb87de585b015fe176
TLSH
T19F21CC8DA3F62E1DA30B9195BC317DCD877886D21044E05E62E5C6BF978A43E6137732
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\id\messages.json
Size 718B
SHA256 35872a3343d4b4768fe4702a8dc18b749933e81210db13466ad172bd2880f6eb
MD5 3fefe403f5f537d9a2d28ab36b2c1a94
SHA1 dd674520092f333aff63138f660987fbd8fa51e0
SHA512 45182775ac13b1f9406bc9595e822f24a9d8b854254e0d71514e1d99625b12b9cd8bc3226f04b1dfc79248f786f925b9b88a70e0d57bdf9a8dc48d79175ec60d
TLSH
T19C01974326C03D6F530F908379A2320665A503C64B80B06B62ECCF782A6F46DB08B331
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\it\messages.json
Size 756B
SHA256 3377a873db531113d79919e7a89369a79a602bac6ae09b9864b9378dc285f345
MD5 88a9acd41521d1d00b870e2da3044a88
SHA1 36716937ce047463dbfa5cf1f5ef4277fe354d9e
SHA512 a56ffa200c5f8b312d8ed77ea40df931b86074adf1577941726d184497531d1c89d77382983f01797604e6a5c34029fa88f3aae0d52c368e2046c0c6f21cd956
TLSH
T13901285285C37E555F1FA24375527006D9BA06D27AC171137BCE892C238F84DF417B28
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ja\messages.json
Size 1KB
SHA256 c1094a1d8457e782f229910b70fc7aece356aa779a423e869104946814660d35
MD5 113a674f2e4c66cc4d2a9c66ed77adea
SHA1 f5d38b743efa022d6f886bacd3afa850557e2762
SHA512 e7cd847d87dfea3228a1899aab7f27f59d7ba2919e81520501a9236c55fcdea418f1d29c3c9eb36e34cdfba3278e3bbd149ddf324c94295e029031fcd5a75677
TLSH
T1EE31B41EFC1506BB4EAB81CD6C5D1AF5A8E30D1B06A5A06FC7CC354A2F2096F7B2A510
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\kn\messages.json
Size 3KB
SHA256 5fa00c465c1c5eed4bea860ceb78da9419ea115347ba543ddb0076e5c188feed
MD5 f55ce2e64a06806b43816ab17d8ee623
SHA1 27affcf13c15913761d0811b7ae1143e39f9eea4
SHA512 a0e7d0f7beeca175c67a783adf5ff614c8e3b731311f82bc24eb0f0798938d79f15a5cfa012b3cf06d7a138d88e6f78eb3d3d57a3edebb60116de2dc706e2b0f
TLSH
T11461119E7379DACC1B1D200A9830F89DD95CA48110F643BDD8EA928E350E52ED2FFD61
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ko\messages.json
Size 1KB
SHA256 57f81a5fcbd1fefd6ec3cdd525a85b707b4eead532c1b3092daafd88ee9268ec
MD5 e71a91fe65dd32cac3925ce639441675
SHA1 91c981f572497a540c0c2c1d5fb28156d7e49416
SHA512 2b89c97470bae1d55a40f7f1224930480d33c58968f67345ca26e188ff08cf8b2f1e5c5b38ecfdbf7ebfd9970be0327cbfc391cf5e95e7c311868a8a9689dfb6
TLSH
T18B31488FC3341AE54246984FBD5273FEB68217E2008CA972D2B9E9453F0E47DA023734
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\lt\messages.json
Size 1002B
SHA256 b42ebfe071ef0ec4b4b6553abf3a2c36b19792c238080a6fbc19d804d1acb61c
MD5 8047409dcc27bfcc97b3abce6dab20ef
SHA1 d85f7a7a3d16c441560d95ce094428973cbad725
SHA512 4dffe23b4168a0825dc14ed781c3c0910702e8c2b496a8b86ca72fdbba242f34fe430d6b2a219c4a189907e92b1a7b02ce2b4b9a54088222f5af49878e385aa4
TLSH
T14311AB62C2953CAF171FE19EBD78F69548385AD09156F05110FCD129428FC9EB007219
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\lv\messages.json
Size 959B
SHA256 80d64f03dc2cc5283faf1354e05d3c3cb8f0cc54b3e76fdae3ad8a09c9d5f267
MD5 20fa89ba92628f56d36ae5bd0909cb15
SHA1 52d19152e2d5848ebaf0103d164de028efecdbb7
SHA512 5cb534fdba0f66a259d164040265c0e8a9586bb41a32309f30b4aab17e6a99f17baf4dada62a93e34cc83d5ec6449dd28800ee41c2936631484cc95133e3956f
TLSH
T1CD11D08AD3B22C885F6FC04BFA3DF9D6E2899AC06580E1D145FC854C171A49E710B338
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ml\messages.json
Size 3KB
SHA256 907f2709d1d3c8fa26294938f4080bc477e62281c4c50a082c22db0195cda663
MD5 ce70315e2aaeda0999da38cc9fe65281
SHA1 d47fc92d30ec36dcc102d5957bb47a6c5b1cd121
SHA512 af5c78feaacb689d9d50d0196ba9428e4f02b07876995e8b77e3bc0fee7fbf43f3ad2848d58940f193966c54f13652476e1fcfd6a827465caad32b0b2d3f97e2
TLSH
T1DC7170EBB777669F1D177003D9BDD98E188BAC6060A0D0EE5CE7190BC508264EA743B7
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\mr\messages.json
Size 2KB
SHA256 275e7fadb93a810328e3adead8754dd0a19a062d5d20a872f7471ffab47aa7b3
MD5 34ce3fa84e699bce78e026d0f0a0c705
SHA1 5c56d09af53d521fe4224a77aa66e61a3b0165ca
SHA512 3a6cd2ea06b664689f089d35fcfa41b36c22b1d77cf78f66d0f5dcdc52a6bb29f7566d377b81edce6001b71cb7f1e1247d3d71965baa2e8ea9e6deaa208cf25b
TLSH
T1975182D2F3F2B5C8810C2071D43A96AD5A859D9312B1E8AB5DFB9ECEC287254C143FE0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ms\messages.json
Size 796B
SHA256 9b32c491d0bfebdca1455f73c3c6f71796d433a39818c06c353da588de650f81
MD5 db4d49231c88c11e8d8c3d71a9b7d3d4
SHA1 4829115ace32c4e769255cf10807f3bdb1766f44
SHA512 c8b4a982abf61eabb1b7280f3e10fdf1350b20f38ca9878f33ddaf979fd617ca8e5ff4df6099c395fbae86c8affbae77653ba9cb736af22466e3cb85d4d92e56
TLSH
T1DA016B4F5399393E470AA19B74C5790228C90BD94F81B55718CC9F78016EAADB702B24
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ne\messages.json
Size 3KB
SHA256 34c00e5e0690a2dfe5e5d47c6e7acf7052510df82d902cd2b3ebcdedd7c1a61c
MD5 7b543c28436599bfae472d7469d8388e
SHA1 0efe6f5903a89809455b1528c3751b57e80a085b
SHA512 3524de1a556d5a2281961fa4a075f3e1ccd7c8e7f02bed454fd25f19fe670023d9197851c2f72133aeacbe65d9006070dcc3ac0ee306475ee6f00319367a7ce6
TLSH
T18E5140D6F3F6B5C9C50C7072D43E96BD6A889D934170E4ABADAA9ECEC6831108153FD0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\nl\messages.json
Size 771B
SHA256 e98c5cfe277a338a938e7277deec132f5ea82a53ebdb65ff10e8a2ff548ac198
MD5 d448e11801349ab5704df8446fe3fa4c
SHA1 6e299363c264fa84710d6dbeaedc3b41b7fe0e42
SHA512 49c2c05207c16f1c9393f9473cc77fd28e1b1f47686ae1eeb757676019a0ad4a6478e5a76004911f4ae299b3b7331cb6dfdca3eed2078baa5da901ea44cc4668
TLSH
T11F016D125A027E658786E052780633034DB443E912CDF067A5CCDD6C19D6D2D111F230
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\no\messages.json
Size 758B
SHA256 b3ece279943b28c8d855ec86ac1ce53bdfb6a709240d653508764493a75f7518
MD5 66439ba3ed5ba0c702ef94793e15de83
SHA1 2b3ca2c2be15207deae55e1d667c9dcdc9241c74
SHA512 8b393f3be96020181a12a16fafdae9df555b09a7b03cc855009b26a48b0c7d583476a72bb28224e419d300013fe272316c2cb35de8d67dbab454b7cae8df6b94
TLSH
T1EF01D04292913C5D1B0FE166BE30F12A95B40A845B44B08275CDDD5B69C7C8870632F2
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\pl\messages.json
Size 978B
SHA256 6538f562bd1baa828c0ef0adc5f7c96b4a0eb7814e6b9a2b585e4d3b92b0e61d
MD5 10ba7fe4cab38642419be8fef9e78178
SHA1 fddd00441dccff459f8abca12ba1856b9b1e299b
SHA512 07e490d44f8f8a2bdc2d4ad15753ad16e39d17693219418b02820d26558fbe3fce8a8583bae0ed876acc6326080867d05a732cd9a4c24b620753b84bda4ac031
TLSH
T1BE11E157E4D07D9F870FC5A2FC77720EB4EB05C2352DD15736FD8204665AC1CA886654
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\pt_BR\messages.json
Size 814B
SHA256 29a8dd3a07dfdb6dd90b49fc58ea8ef13fa92639205b8ae127b6702efaab0446
MD5 0e9a2b6827955d0897678940cc5c2de7
SHA1 d8624417b10fdf9886d263ac8c23612e55be1ece
SHA512 72267f539b9916342d7563a9f0124f4ae67ae4dbdd434ba89e86aabeefc43feff543533a5f02c7b5def34098520dfd1f9e0c1704b56474a8d1449e48dab63737
TLSH
T124018923737A6E680B6B8152BC373909967C4FD21A85E4DB64CF484E029288DE1332B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\pt_PT\messages.json
Size 855B
SHA256 156fc7ba9b5728908e1a74950b97474f73d8f58933d345c8eeea8284565c8357
MD5 aa431ec252b4339a49d172c6b9292ba3
SHA1 26fd7003368d5342620464a53af547ddea7c7328
SHA512 c47c2e530ee2dd0bcc1ed1c2f8c54aeea3dcfac277bd85026dcc6c07e2da693b35577bac4924c45bb8423ad9aaecba324eec74291ef5cf2586a8b0b9f0084cba
TLSH
T136114C1657731D648B5F9012FD367547517C4BC61185E0EB248D994F219582DE2B32B0
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ro\messages.json
Size 930B
SHA256 4ecedb9c1f3dd0d0e3aeb86146561b3d7e58656cbdbed1a39b91737b52ec7f2c
MD5 ee122cf26ebe1ad0cc733b117a89ff3b
SHA1 a7c21e40ab7c934b35d725b3e21e4cb8ea85bc1e
SHA512 4866fbea6c8698eb3c8923b9875186c800519488784683c18e5e6523681c52429e7ba38a304e0d1b17a3997a2f4c8c3a5e9fb518466a910b119f65d7dd62b77d
TLSH
T19A119C8350025E4C5F5B90977C3CF3C2B4EA49D16489B27365FC757A534AD4E7023614
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ru\messages.json
Size 2KB
SHA256 887bc5f4575c717ae7a498a3d61e99232327170a333cfcbd9880df1e8bcc546b
MD5 1cfef8b745c04e86c62aef09371f6489
SHA1 127dd004884754a7e52b2f3ab75c2a2f0aa00066
SHA512 cb620b2d50edfe7e8346c788d1e2f22e263e0f0b7cf592efb30587e4ef9c48748b063af61a4baa74edf1cdccbc1e0040c7f556eceb052c17439ff44e487d6bcd
TLSH
T16051B7E2D1F7175C29887592F772BCAD38D47D80E118D73BCC7E268BD200A2566D071A
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\sk\messages.json
Size 947B
SHA256 5e886e7b616fbff3671dab632d1b6d8dceeff9004218485f1b911dcd8c9694a3
MD5 a46e08b45be0532e461e007e894b94f4
SHA1 387b703c55af0cf77874a1b340969ece79c2705e
SHA512 388992752bd1efaebbd420fd5a8f2c6c775f2be4c61d690b46a418c72abaffe44ff8a4c332b45a8b75a243ae8d61f3d6da6e55fa768d17d2635079b03442a55f
TLSH
T10711009B43F53E5ECB2ED481BC32B26543F8AAC555C4B05322FD844B6041828F67B220
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\sl\messages.json
Size 855B
SHA256 75d018cc8525605ddc591f6bfe5bdaa2efb164934e9d5438972651f8c818d581
MD5 9cdfa5371f28427f129d200338c47494
SHA1 19653347e92967564bd8df14fde2eea2dc87bceb
SHA512 e6122fd5c8d387a999ef57c877bb70c896c1012b592333bcf2b93e44f7e8ba487f264e83cdefbbde972040cf6dc8f14a4a9e0e0bca85cf1f9eaa35b817dd2869
TLSH
T14411CE3358653E491F0FD1AE7C7A72579D44198C60CA708222EC3B28028BA5CF98F730
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\sq\messages.json
Size 923B
SHA256 ea42c8f96c26ccb55a95f1f7bbbaf151ed36e9c737c54bb3c5081f3fdb9e9066
MD5 68af7db6b1284f3b184ebab97e1ca89c
SHA1 6f31a1fb5c8b75c25be3a4d6773f98df8f735208
SHA512 424b5491bf84f7a612d0676d49c11eef4d9822b62f1e9cf58d5dcadc76fcee7f72c314b54418ab5aa08322d33f0dfa8d3bcf995a92b0be5692388281cb7b9d50
TLSH
T1DE11EF9727FA2F9D831B9483FF35711D827412EA1D84E8A2BAC88A1F518783F5037120
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\sr\messages.json
Size 2KB
SHA256 a3eb276fbd19dce2b00db6937578b214b9e33d67487659fe0bf21a86225ece73
MD5 c2026342237e7686b1932af5b54f8110
SHA1 5af235b29947c7f770070f0a693979d9191fadb5
SHA512 2ce6fffa4ea16aac65acc8b5c1c9952eae1ac8891589266735c3ef0a0d20e2fa76940e6401d86eef5c87a1d24c1cc9a1caaf1c66819c56505b0b2860bfe5acfe
TLSH
T1A951D8E390B3164C298479DBF771BCED38987880E218D73BEC7E328BD218621659171B
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\sv\messages.json
Size 800B
SHA256 5f4229d18e5606330146ee13bdf726e10c1e06cbb15368c47f1ae68abe9ce4ba
MD5 f008f729147f028a91e700008130da52
SHA1 643fff3dc0694fd28749768314150b30572caa54
SHA512 f5890cc08a9a40366cfffbbdb9b14e8083897a2950deb4bb23566d641dd4b06ab02479a2b83bd5001c179abff889506a3292cd92e31a6b92cad917dff760ab27
TLSH
T1EA016683A6B13C986F1AA11F7E31718AD4780BD12380A45270DC5A2FE16B91EA0A7732
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\sw\messages.json
Size 840B
SHA256 2c6b42d122943dc0ca92a33074d1a607351d3bc7f9768e174617fa7011a3de9f
MD5 84eb1d6e827e40c578469eaab778e368
SHA1 3f53de16ab05f7e03ae6c8605c2339043c1a385f
SHA512 7a7ce81fa8be309d347ae0975fd6fcd904bc1ee86342dc0e88e789e7cf5967edd0ddccb9ba156510e74b025a23d479b6058101ffbb648c5d30c311f5ba1dfc6b
TLSH
T1C9014673642079F7576E524F3AC43A32A2D9DBE055E8B40311485F9F1103D0E13ABB30
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ta\messages.json
Size 3KB
SHA256 3fc7f56f6d6d514b32547509b39f6380fc786efbcca4b9859f204456ca2e7957
MD5 24626ad7b8058866033738380776f59b
SHA1 a6abd9ab8ba022ea6619252df8422bf5f73b6a24
SHA512 4fa2f084175d71923ae3186c8195781e1946f6c19b1a4bf659d3ae2dc45f1ac2f84d794b4487ec5e030ea899ee1decf07b3cdd3eb0d3dda996c5ff8a272cf97a
TLSH
T11161BB8E6075E64907FEE21B06319CBE299D48B52033937A594BC1D735EC61ECF6F120
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\te\messages.json
Size 3KB
SHA256 90868a8a4a4dbf48770c14a161faea406ef9a453b75f4cb7a53c1b4e96a88599
MD5 50ab4deabad394d13c265b8b80d9f9c3
SHA1 ce9c786cc92359ca34483bd57ce121f699920ddb
SHA512 3ba6498cde1fe4c8f012a75ee546e9793b812cb7306c927054427fc697cb729549196f8e45db1a7a7dd1e485e6a3d3950168e33b03b669f5d4676c372f519a6f
TLSH
T1D36132E77379A3C8C91B705AD83DE8CD1A4CBF9140E2D1ED5CFA168BC20765493A2321
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\th\messages.json
Size 2KB
SHA256 d299aa0c4f29c5c8248a1c51afdb7439f4cf7bc28ee02408a598f8aad9f70810
MD5 0875b0bad81161ccf2c16e13ee49af9d
SHA1 686663983a022689dedf5ba22c0f169e1a654e64
SHA512 d569dfda9f0851fb0d5b2b8454704461e0185b573f3839416f3237f2d89c372e58fdce7d871f44f6f3777c7f4177009bb1fd3cdbe2f4f3d62015bd130851e8ae
TLSH
T17F5115DEB3B71A5D094AF2BADA7EFD9E2989CFD00060F1A74FFA458FC6062161590301
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\tr\messages.json
Size 1KB
SHA256 ac2894cea6332450095a7f8fc9b97550da87e4b4b6e6fb95df1a1f49f25e0e35
MD5 3104bcd0d4ad6b47fe36f36c1b5aa333
SHA1 36ec46c7230487c0d26e185aa82f340d8312a265
SHA512 873a8e1ec1eb2b482794c51dbfdd5b96cb9e8e2b5a74db3c3b54ae78a396585faec402a054ff332551b5ebcfc4a57bfc5bd92d08f9f73acb433efe9a18d89cd3
TLSH
T1AA218B47B0F5A849C70E825EFEB5238F88A40B86122DF0867CB4E59DC95A75DE137D34
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\uk\messages.json
Size 2KB
SHA256 08978a1425dec304483bbb7dd0e55a7d850c4561abd41bac1be5d93d70465174
MD5 ae938164f7ac0e7c7f120742de2beb1e
SHA1 fc49041249eaef40632f27faa8561582d510d4e3
SHA512 b3f252885f9d7e4d74a5880b5fa60447511d4e2dce64db8ede5bd1b144f0f09a3c784649c2e1623a034ddd50b6b7ff990a3a6fc58c3ae124646c31f35b0b20fd
TLSH
T11F51F6E3C1B2164C298479E7E772BDAD38986E84E108DB3FDC7E129BC20C614B9D0725
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\ur\messages.json
Size 2KB
SHA256 504549057a6a182a404c36112d2450864a6cb4574cd0e8f435ca556fac52ab0a
MD5 f6e8fca4fd1a7af320d4d30d6055fa6d
SHA1 1c4aae49c08a0e4ee3544063c10fe86e7fdab05e
SHA512 241e8505658e09d5559ec3a91fc6d1a88ba61f1b714d3cfc0e498e13908ba45aed8b63b483ecc5008a5ab07b24e1d123192fbd90b4a2289d52ad7bef4a71c9e7
TLSH
T1A2511EED6F77BB5D052CEA0299B5DACC084A7CD0446F62398B1897C5D1DC08899FA3B3
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\uz\messages.json
Size 737B
SHA256 a464016d7743a4147d8dc047c64afcb8b736d27ddde4213068667712c97ae3b9
MD5 36b68813ed13440b319d1596caa31825
SHA1 6dd6ef8b2c5e5187552ecb47f9571698fa7c6716
SHA512 6918c3df8d8d6b88cd3120e8d1c1b93ed4de80adf0b74923669ae61ec7595d33a041824c8781f75a627850ef6468f8701d617bec7871afd7f1eadbce86a93f3d
TLSH
T184014C82B0516EB4DB2E92D779017C1601D952E066D0A47679D83A2D0287D68BBD7B30
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\vi\messages.json
Size 1KB
SHA256 f1da95e1d58e933050cd8a4fea12f3d1b9a2759479ffdb74fdc1cfbf89568327
MD5 1e54afbacca335be3a050920ddfbe863
SHA1 fabd5e9d6bda46c9708a0ee26302156ca413a1dc
SHA512 dfe60c51c043da92dec81fedb250dc60bcd97daba831261de92cdee35c0760610c1d436d04d74b65ef0a22e8cdf5201e3dde176cd9b7d5ccf1cc1ff9c884870c
TLSH
T1F721578693F7B94D8B0BCC23BD7A60DADA3654C6039444F233B27B0F742952D6536121
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\zh_CN\messages.json
Size 1KB
SHA256 31eb4ffddccec09f1d797d5c250b096e12022290b07a9ab0304e9751a145e815
MD5 17136b589bda9ce7e2e5b3577b89fcb1
SHA1 e80ee457ad8a3094b2f9286f5bfbf69ca7c5b13e
SHA512 1e3c26e223a907e6a27a3c68d98be96b8265847b8b48aa6a917e33855c90da7c23e85cb0c78c016c7c62146562cac96aa5e608f69f0eef9eca3de9645e7e38bc
TLSH
T12B213DEEB50A166693FE91AEEC183D0BDDD90DB060A2D0B780FD888D371552C1475D38
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\_locales\zh_TW\messages.json
Size 1KB
SHA256 16b8f7be42b982d5ad9f638e71da38d134394b9bab9255f73cf514abbfaaf146
MD5 b571e4cefd96a2651ffb6621c4d3d1b4
SHA1 9fce97192139d1ec0885fd62a059fa81e473f9c5
SHA512 6a315031b7c3e7b2cdee7a835aaad7fceb07d2889e4401e3be6b3a8c6492a47a9a065aab85fe2a69a1eca6bfe4a733f8ccfe8c5ec2fef681aadb77c9f5e57eff
TLSH
T19C2129DEE6457C5A07A9C1DEFE583D4FC1931E5010A3D23380FD598D270296C58A2971
MD5 SHA1 SHA512 TLSH

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\manifest.json
Size 1KB
SHA256 609995e8dbdba5ba968a6c604750e725059902b4e8c1f693851c738d3938317e
MD5 8afea622647be84467127ef5cb12745d
SHA1 dbbecddc500f406b199dabaa7cd38b1bd3d34557
SHA512 51e562c06c99d5a7bdc56df7b61d8b420a42e18e46d9d7ba182c07ac6fd671f68b9c65c0a2356d4ab17e7c6b4f22920d94f57514ac831a46d0fd60450a98034a
TLSH
T1744169F7BC00AD634BA49898AA1E710EFB29B24D55CFD4DB8298107342CCDAE1D601E5
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2024_1874038242\CRX_INSTALL\service_worker_bin_prod.js
Size 121KB
SHA256 ed3803ef5bac39e8b153d283695ee3562398e5d771a6c7fe5d1a85805672ab3e
MD5 aac97879e3f1c5a71cfb46b0fdbb29a1
SHA1 0cb02f7bbcbf207606888361be551e6d682c4c05
SHA512 8878736f8500a668e51e1f543ad7fe13eb7b4e19632918714dc64e952cb1f8400fa2026cfdac9ec757f4a285eacf6ce89f606a395500c56d2f2f39f8a64aa760
SSDEEP 3072:L3zCum5nHBRKbYK2ANj6a/4rxMwDLE2sk:LwB34GASx/DLETk
TLSH
T15FC3E9CCB7A574664363A5B6002F000FB23AB8AAE44C85A8F188D9E97D7446D4377F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFgear.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\PDFgear.lnk
Size 1KB
SHA256 21c187b4b19ad8aa030eecc9b70a9b3c233850e709461fdba453139aa4d70104
MD5 bfc441d1c16f6269a232c856de34f0ee
SHA1 73f99e508d0627908a76e16ffae13b7869e1d56e
SHA512 49881bbacaa55f329b6742d0f2254d394d235c7874f2b3a858127ac657ecf85cdd32b683071bf01e079fb1aae684c2c55540e219de8f3305c9efb1f36c878fd0
TLSH
T18D21E1250BD72F2EE3B7C23597711722AF25BC11F2552F2E40C652841CB52006D9EE9E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-1144-0x0000028B720C0000-0x0000028B720DA000-memory.dmp

Download

memory/556-1156-0x0000028B74140000-0x0000028B74156000-memory.dmp

Download

memory/556-1146-0x0000028B739A0000-0x0000028B739B2000-memory.dmp

Download

memory/556-1186-0x0000028B74300000-0x0000028B743CD000-memory.dmp

Download

memory/556-1185-0x0000028B72060000-0x0000028B7206C000-memory.dmp

Download

memory/556-1148-0x0000028B72080000-0x0000028B7208A000-memory.dmp

Download

memory/556-1150-0x0000028B739E0000-0x0000028B739F6000-memory.dmp

Download

memory/556-1164-0x0000028B745D0000-0x0000028B7465A000-memory.dmp

Download

memory/556-1166-0x0000028B741D0000-0x0000028B741F0000-memory.dmp

Download

memory/556-1152-0x0000028B73A40000-0x0000028B73A68000-memory.dmp

Download

memory/556-1154-0x0000028B739D0000-0x0000028B739DA000-memory.dmp

Download

memory/556-1159-0x0000028B73A10000-0x0000028B73A18000-memory.dmp

Download

memory/556-1161-0x0000028B73A20000-0x0000028B73A28000-memory.dmp

Download

memory/556-1180-0x0000028B74A40000-0x0000028B74A62000-memory.dmp

Download

memory/556-1179-0x0000028B74B00000-0x0000028B74BB2000-memory.dmp

Download

memory/556-1143-0x0000028B72090000-0x0000028B720BE000-memory.dmp

Download

memory/556-1137-0x0000028B71BF0000-0x0000028B71CB2000-memory.dmp

Download

memory/556-1141-0x0000028B74220000-0x0000028B742F4000-memory.dmp

Download

memory/1072-214-0x0000000000A50000-0x0000000000AE6000-memory.dmp

Download

memory/1072-244-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1072-1238-0x0000000000A50000-0x0000000000AE6000-memory.dmp

Download

memory/1072-1237-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1072-183-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1072-213-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/1108-242-0x00000000013A0000-0x0000000001436000-memory.dmp

Download

memory/1192-279-0x0000000000C20000-0x0000000000CB6000-memory.dmp

Download

memory/2100-159-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2100-181-0x0000000000D30000-0x0000000000DC6000-memory.dmp

Download

memory/2100-169-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2100-158-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2632-1235-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2632-215-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2632-231-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2632-246-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2632-929-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2632-1236-0x0000000000B70000-0x0000000000C06000-memory.dmp

Download

memory/2632-273-0x0000000000400000-0x0000000000762000-memory.dmp

Download

memory/2632-216-0x0000000000B70000-0x0000000000C06000-memory.dmp

Download

memory/2640-1680-0x000001D9DBE10000-0x000001D9DBEDD000-memory.dmp

Download

memory/2856-151-0x00000000004C2000-0x00000000004C3000-memory.dmp

Download

memory/2856-152-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/2856-179-0x0000000000B00000-0x0000000000B96000-memory.dmp

Download

memory/2856-178-0x0000000000400000-0x0000000000528000-memory.dmp

Download

memory/3496-1688-0x0000020DFE380000-0x0000020DFE3A2000-memory.dmp

Download

memory/3496-1719-0x0000020DFF370000-0x0000020DFF37E000-memory.dmp

Download

memory/3496-1686-0x0000020DE3350000-0x0000020DE3B42000-memory.dmp

Download

memory/3496-2315-0x0000020DFF3E0000-0x0000020DFF3EA000-memory.dmp

Download

memory/3496-2318-0x0000020DE3ED0000-0x0000020DE3EDC000-memory.dmp

Download

memory/3496-2319-0x0000020DE5730000-0x0000020DE57FD000-memory.dmp

Download

memory/3496-1744-0x0000020D82000000-0x0000020D82099000-memory.dmp

Download

memory/3496-1743-0x0000020DE5730000-0x0000020DE57FD000-memory.dmp

Download

memory/3496-1742-0x0000020DE3ED0000-0x0000020DE3EDC000-memory.dmp

Download

memory/3496-1726-0x0000020DFF4E0000-0x0000020DFF4FE000-memory.dmp

Download

memory/3496-1720-0x0000020DFF880000-0x0000020DFF8F6000-memory.dmp

Download

memory/3496-1687-0x0000020DFE400000-0x0000020DFE510000-memory.dmp

Download

memory/3496-1718-0x0000020DFF360000-0x0000020DFF36A000-memory.dmp

Download

memory/3496-1711-0x0000020DFF650000-0x0000020DFF7B4000-memory.dmp

Download

memory/3496-1710-0x0000020DFF3F0000-0x0000020DFF41E000-memory.dmp

Download

memory/3496-1709-0x0000020E00000000-0x0000020E006DE000-memory.dmp

Download

memory/3496-1708-0x0000020DFF1E0000-0x0000020DFF1F0000-memory.dmp

Download

memory/3496-1707-0x0000020DFF310000-0x0000020DFF338000-memory.dmp

Download

memory/3496-1705-0x0000020DFF180000-0x0000020DFF188000-memory.dmp

Download

memory/3496-1704-0x0000020DFF240000-0x0000020DFF30A000-memory.dmp

Download

memory/3496-2320-0x0000020D82000000-0x0000020D82099000-memory.dmp

Download

memory/3496-1690-0x0000020DFECC0000-0x0000020DFED6E000-memory.dmp

Download

memory/3496-1689-0x0000020DFEBC0000-0x0000020DFECB2000-memory.dmp

Download

memory/4588-1232-0x00000265F3220000-0x00000265F323C000-memory.dmp

Download

memory/4588-1197-0x00000265EF6D0000-0x00000265EF6E4000-memory.dmp

Download

memory/4588-1231-0x00000265F36F0000-0x00000265F37AA000-memory.dmp

Download

memory/4588-1230-0x00000265F3100000-0x00000265F3108000-memory.dmp

Download

memory/4588-1227-0x00000265F0740000-0x00000265F0748000-memory.dmp

Download

memory/4588-1226-0x00000265F0710000-0x00000265F0718000-memory.dmp

Download

memory/4588-1218-0x00000265F0450000-0x00000265F0482000-memory.dmp

Download

memory/4588-1234-0x00000265F3200000-0x00000265F320E000-memory.dmp

Download

memory/4588-1215-0x00000265F03F0000-0x00000265F03F8000-memory.dmp

Download

memory/4588-1211-0x00000265F02D0000-0x00000265F02D8000-memory.dmp

Download

memory/4588-1205-0x00000265EF870000-0x00000265EF87A000-memory.dmp

Download

memory/4588-1233-0x00000265F3280000-0x00000265F32B8000-memory.dmp

Download

memory/4588-1199-0x00000265EF6F0000-0x00000265EF710000-memory.dmp

Download

memory/4588-1193-0x00000265ED9E0000-0x00000265EDB34000-memory.dmp

Download

memory/4588-1201-0x00000265EF850000-0x00000265EF86C000-memory.dmp

Download

memory/4588-1684-0x00000265F37C0000-0x00000265F37CA000-memory.dmp

Download

memory/4588-1203-0x00000265EF6C0000-0x00000265EF6CA000-memory.dmp

Download

memory/4588-1682-0x00000265EFF80000-0x00000265F004D000-memory.dmp

Download

memory/4588-1637-0x00000265EFF80000-0x00000265F004D000-memory.dmp

Download

memory/4588-1636-0x00000265EF680000-0x00000265EF68C000-memory.dmp

Download

memory/4588-1651-0x00000265F39A0000-0x00000265F39A8000-memory.dmp

Download

memory/4872-281-0x0000000000A00000-0x0000000000A96000-memory.dmp

Download

memory/5016-277-0x0000000000CC0000-0x0000000000D56000-memory.dmp

Download

memory/5852-275-0x0000000000C20000-0x0000000000CB6000-memory.dmp

Download