5a3329af9cb71b6e58262a0533f36e0f6210a6628248c4e868b78fcf6966566d

Analysis

user interaction
yes
max time kernel
103s
max time network
85s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
revpdf_editor_winx64.exe
Size 58.4MB
Sample260715-ch7lvscs8v
SHA256 5a3329af9cb71b6e58262a0533f36e0f6210a6628248c4e868b78fcf6966566d
MD5 0c30ef71a0b0c280fbf8aa7a1488e40d
SHA1 1e0bb90789ab64a64f25e8256de8c66824d0e97c
SHA512 c1db844b2b7d5e305aa295ead0c758b09f00067e9ff71d6a78b828c0e524c34d7bf4557f8679c95d2d6a9bd53cbecd0a6f7c907b298d499ef148065df5f67465
SSDEEP 1572864:2x8GhUUv3MROplkrsgyB+C7i7Fm7tiHFTIh:4TZMEF7i7gmyh
TLSH
T155D7333BB2DF723DE4299A3A79B292106137796174064C6655F8CCDCCF098B12D2EBC6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery installer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4356	revpdf_editor_winx64.tmp
2040	RevPDF.exe

Loads dropped DLL 21 IoCs

pid	Process
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\RevPDF\is-LW4ZXCZIS1.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\libgcc_s_seh-1.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\screen_retriever_windows_plugin.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-AUWUJ73LEY.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-TH1V3KPFPK.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-47ZWV4OU29.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\packages\cupertino_icons\assets\is-G3HVS2QCBG.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\libexpat-1.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\vcruntime140_1.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-MT7IINO3T9.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-FQ2L0FAATM.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\permission_handler_windows_plugin.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\libgif-7.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-NWUOH6UE9I.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\packages\revpdf\assets\is-BSCYNDW69Y.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\concrt140.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\flutter_windows.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\RevPDF.exe	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\revpdf.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\liblz4.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-VA11DJZ7SX.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\assets\licenses\is-RJ0YYQ7L2B.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\libcrypto-3-x64.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\unins000.dat	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-LDNA5Q3R08.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-0JMNO62V9Y.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-THTRRSXRVE.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\is-2GM0OQDFB5.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\gal_plugin.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-65DNEEL1KB.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\msvcp140_1.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-KPBVURSNOG.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-2LZ7NXZVJM.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\libsharpyuv-0.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-Y71VGSU48S.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-3I61RYX0AM.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\is-X7147QA5DG.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\assets\is-L4M6WPINWW.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-NQ5I7F1D26.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-JJJUR8G5EE.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-W0TD6URMCO.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-S47HV28OYS.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\is-19GKIX3N7H.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\liblzma-5.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\vcruntime140.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\shaders\is-66VJ9MJRY1.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\libtesseract-5.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\desktop_drop_plugin.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-E9UGQCKG9Q.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-OZ26O71FB6.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-4FYIP3UYPC.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-14RJFCFBP4.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-BUXPVMMEFI.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\packages\revpdf\assets\is-1OU5LDUWZM.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\packages\revpdf\assets\licenses\is-J88OCYFEYK.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\share_plus_plugin.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-63QT5DV2R3.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\assets\licenses\is-EEJX0RT9HS.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\file_selector_windows_plugin.dll	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\msvcp140_2.dll	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-78L3NFSY5F.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\is-E8OWE7LM58.tmp	revpdf_editor_winx64.tmp
File created	C:\Program Files\RevPDF\data\flutter_assets\assets\licenses\is-G8TFVEOHUV.tmp	revpdf_editor_winx64.tmp
File opened for modification	C:\Program Files\RevPDF\libjbig-0.dll	revpdf_editor_winx64.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	revpdf_editor_winx64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	revpdf_editor_winx64.tmp

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/2424-1-0x00000000001D0000-0x00000000002B2000-memory.dmp	innosetup
behavioral2/memory/2424-21-0x00000000001D0000-0x00000000002B2000-memory.dmp	innosetup
behavioral2/memory/2424-204-0x00000000001D0000-0x00000000002B2000-memory.dmp	innosetup

Modifies Control Panel 1 IoCs

defense_evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Control Panel\Colors	RevPDF.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0400000002000000030000000100000000000000ffffffff	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	RevPDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	RevPDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	RevPDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Documents"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	RevPDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\3\MRUListEx = ffffffff	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\NodeSlot = "3"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	RevPDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "7"	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell	RevPDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	RevPDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	RevPDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	RevPDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616257"	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	RevPDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	RevPDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\4\MRUListEx = ffffffff	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell	RevPDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\SniffedFolderType = "Generic"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	RevPDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	RevPDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	RevPDF.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\ComDlg	RevPDF.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\5\MRUListEx = ffffffff	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	RevPDF.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	RevPDF.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	revpdf_editor_winx64.tmp
4356	revpdf_editor_winx64.tmp

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2040	RevPDF.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4356	revpdf_editor_winx64.tmp

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2040	RevPDF.exe
2040	RevPDF.exe
2040	RevPDF.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2424 wrote to memory of 4356	2424	revpdf_editor_winx64.exe	87
PID 4356 wrote to memory of 2040	4356	revpdf_editor_winx64.tmp	88

C:\Users\Admin\AppData\Local\Temp\revpdf_editor_winx64.exe
"C:\Users\Admin\AppData\Local\Temp\revpdf_editor_winx64.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Users\Admin\AppData\Local\Temp\is-VEEV4RYHC0.tmp\revpdf_editor_winx64.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-VEEV4RYHC0.tmp\revpdf_editor_winx64.tmp" /SL5="$40212,60054674,867328,C:\Users\Admin\AppData\Local\Temp\revpdf_editor_winx64.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Program Files\RevPDF\RevPDF.exe
    "C:\Program Files\RevPDF\RevPDF.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Control Panel
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RevPDF.exe

Path C:\Program Files\RevPDF\RevPDF.exe
Size 87KB
SHA256 3e21361f322fb09295977ea980c39c78ae9cc9b7f9f46319d7242e9219498822
MD5 f22a9a66302bc89693de675561b28b7d
SHA1 d4b3e99380620078b7cfea367b4435e3e280233d
SHA512 c83b02c65c6584219be5c0a36579c59bef2b6645770ccd4a3a6d80e89e2489cf957016b55fae033831bc0a9e6f15b91ce0e31d2a664ddca1bbba28622d1a726a
SSDEEP 1536:ot7cruYdq4Ci23zFKmPodONcxB0O21pLfXIodxPfFvAGX6f8r3B99Q+L:oVcbnCissSc01JfXIoDfFvbXdB995L
TLSH
T186938D16DA6AC0ABE35B9974C9134E05CE32BC864BB0A6DF57D00DDE4E16ED49F3E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app_links_plugin.dll

Path C:\Program Files\RevPDF\app_links_plugin.dll
Size 144KB
SHA256 c12b726abbdfd484bb3ad4fc00cfba5df8609d7775aa4f759626c0a808b56b28
MD5 e92f90a2fcdddbcfccf2ad9dadb5b536
SHA1 95eff6b432289867b7710648b8e54a52761aadef
SHA512 16bc60b8c312a7ae328aeb35e51eb669f772054ee372ba7572a3c26171f07dd4f4a0bc9db11dfb4fdb8c27438b214a67b11abd4659f8a36590eb9aaa05f69e51
SSDEEP 3072:zst0LYXTzs5ZMvanoqiO2v8Aulhyr5AseE4FgDqa:ot0UXT4P6an/iO2ClhU5AseE4FgDq
TLSH
T1D9E34D2FF66940AFE25AD0B8C6534D06EB72F84607919BCB17404BAB0F17BE95E3E510
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

connectivity_plus_plugin.dll

Path C:\Program Files\RevPDF\connectivity_plus_plugin.dll
Size 97KB
SHA256 6d9b2ef2e6b0617cd403d8173d8b9fcc0d8524d5bdedc62f3a761758a5c4d7d3
MD5 b818efa80b0958ca641fb2c5a2a45a92
SHA1 86f50d2615446e766227fa3176cccb14e982069a
SHA512 10b68e06076e3861d4d7a332752cb0226f33e953bbea34de68fba59533e5746f0fda3d274e384913e39b15d7f8a1734cc8350d5760721e0e24546d9491b6d5c8
SSDEEP 1536:vgnTAo3vykSZi7K6yoolXPrpOx/pcJ2AD5v310SYkRhX:vHZi7YQhU5v310SlR
TLSH
T1B3A3183ABA6940AFE21AD5FCCA574D05DB72B89147A167CF27800EDA0F17BE51E3E500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

app.so

Path C:\Program Files\RevPDF\data\app.so
Size 11.7MB
SHA256 382e81f9a667e542906a5e1c133ebb6fe38bcbc3b5e42f284f28edfc3ac2bb62
MD5 702930f7615fd87d2272be5bdf562374
SHA1 9eb819721ecd7a087530508c8d50659876d3e87a
SHA512 273bc5e6d98f8bae5391ababf6d580f2d0565ba829cd9202e0cbd4ea05ca1ab0256aaee26dcf3446adc2c6b0d6af18e4087522aad5c1baf2cb7db6a57e933f46
SSDEEP 98304:Lu3nJ0bCLtqnog05hnnxsf7mhA2RSux314E1YMKuGRuH9k0cNCeQ:Q28ko5hnnxsf7F2lN49kxcNtQ
TLSH
T1C5C61997C1F48760E432E772B75F76A59E1578DC4E30B78A06C456263E8ACE04ACF632
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FontManifest.json

Path C:\Program Files\RevPDF\data\flutter_assets\FontManifest.json
Size 208B
SHA256 cd7e03645bc44b2dd47b7cb626f51c4ecbf55a197ab77241628b47ac165fbe21
MD5 dc3d03800ccca4601324923c0b1d6d57
SHA1 bca264548730f8b1871672891b0ad0c02444bfaf
SHA512 eda04affa31ef1d3fe4b081762380a6a5a9364a48e7b6998e870c84495f51a9658724e3f496d90a574f7d5e13740dcf47ccc1c7914b77b6ef0826fe87379cdf8
TLSH
T106D0C74B581909F6458D9845F0E11253BC4429579E46DCCDE3A40E54D3A11641739213
MD5 SHA1 SHA512 TLSH

Submit Download

NativeAssetsManifest.json

Path C:\Program Files\RevPDF\data\flutter_assets\NativeAssetsManifest.json
Size 45B
SHA256 9548a31e4a048135c1d94f919328bfb62ae2c7bb3cab96557c7941daa97776cb
MD5 f3a664e105b4f792c6c7fe4e4d22c398
SHA1 adee29ec4f2b3cb2ec37ec3368f37ff805695d36
SHA512 b7df555970e20c6a50f650cd0df6ab782fba7004782b3f7921ccfd314db53bfb61523986628d2e05d085f4c2263dfcf54000ffdfc946b0158c5766fc6f1d0a86
MD5 SHA1 SHA512

Submit Download

MaterialIcons-Regular.otf

Path C:\Program Files\RevPDF\data\flutter_assets\fonts\MaterialIcons-Regular.otf
Size 1.6MB
SHA256 d9865b671a09d683d13a863089d8825e0f61a37696ce5d7d448bc8023aa62453
MD5 e7069dfd19b331be16bed984668fe080
SHA1 fc25284ee3d0aaa75ec5fc8e4fd96926157ed8c4
SHA512 27d9662a22c3e9fe66c261c45bf309e81be7a738ae5dc5b07ad90d207d9901785f3f11dc227c75ca683186b4553b0aa5a621f541c039475b0f032b7688aaa484
SSDEEP 24576:PsSIRolMKvGXtkXKLkMp2fXrNsAxI6zD2/qxDoq4eeeDrG2eOeGr2lkzhlTMrRoV:P9njdzbwc9
TLSH
T1787529100276EF4CC1EF507D43B74A48F4C59AFEA53ABB1AF9B64795220BDBDA1C8181
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icudtl.dat

Path C:\Program Files\RevPDF\data\icudtl.dat
Size 842KB
SHA256 998367809a821d595928089c197b3f7959f0420f81f79d4d0daee53378492ed5
MD5 018361032ba13dfeab636138ab6b9831
SHA1 8f9c259d3a330786ab8bbd49e7e79abfa1d552ed
SHA512 d7d3fffb41576cf2c90cd260727cc0ea23c5a4c458f84b01426c2a4578004b94168047c7282222e9ffade2f082e189cf167146cc3303bd7dbbb252a593236967
SSDEEP 12288:8Mlhw771h0jM7ykPG07rr4c8w0P4N48Rkjt3dPHz982VYhq:Zhw3zVtjLbGu4RjTPHzMhq
TLSH
T199056A17B0435E6FE0C48277C652E7B65637838DEB3317EAB698B5593E8A1C20241BCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop_drop_plugin.dll

Path C:\Program Files\RevPDF\desktop_drop_plugin.dll
Size 89KB
SHA256 c623643a4eca659f24b1d349667866150a8bb190efe8ed631b0270af079be91a
MD5 67860d0d13098f19bc5568c38d759c00
SHA1 742d73bf7f9826e869855717c39f509b99bcdfc6
SHA512 d50615c9d9e83e2a3309e5518d775e8840d57d58d5b77d71130438fc22461c3c453acb76c32ea4a19976067d48d30de766d0db56f139806ee56db99a092af300
SSDEEP 1536:lbWr4qfzjx8ONA/r5imoKponXmfvQUolnQPvGzv6401Ls92Y:lb0j5mr5imDYqvIQPvGzvis9
TLSH
T13E932A2AE65940AFE229D4FCCA574D05DB72F8864BA16BCF57900EDB0F17AE40E3E501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

file_selector_windows_plugin.dll

Path C:\Program Files\RevPDF\file_selector_windows_plugin.dll
Size 108KB
SHA256 800872c87e52d24a069a0344ff6edef69ee4620b23d447152e7f825eeb4af01e
MD5 69243c9a6c74074285cd2aa9d17322e4
SHA1 e8f8d51cfb5550ba1240b192816f781a427e43f7
SHA512 ebd464f9388a1569ddd816065f855c3305b1d202247a01efbb65d82fe0f58d76ad5a0b17898194d10b54fc6cc9a856ffe87561672c52c2b4e8c92526a457c439
SSDEEP 3072:aOIsoS7sno8KeKMicrF3WxAG45F2GwBHW0+:aFsoS7sno8DziORz5F2GwBH
TLSH
T168B31C2AF91D40BBD26AE4BCCA535D05DB72F8861760A7CF67900ADF0E17AE40E3D111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

flutter_windows.dll

Path C:\Program Files\RevPDF\flutter_windows.dll
Size 20.3MB
SHA256 61b77bc881f5c57af5f3eeac4a96ffd9fd87e35b77565f44c678de105c92c2ed
MD5 c78957dc6e139f7590ea0da1fd2408c7
SHA1 b58d3e103cc237da0f479f90bd2cacd7095c7e93
SHA512 5e1fec39c980e2fa1f717700c24fc1d0a99cd3212f046123316e8047e129bd2fa455658176fecc1ff4dd2c011ee5084e501f91a3be12b34d5cfe3ddb808595d3
SSDEEP 98304:b10eUUMRL8G1G27UBqTZyyl0Y0OHjDWVhAjenh+veywfe9uIgbv7XFSbOVXAyvZ0:bqnZyIJDMlWskaOgP/flCnAjyHiA
TLSH
T12C276C03E29640E9C05DE179971BAA27F670B8490B20BADF3B5C47213F66BE05B3E754
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gal_plugin.dll

Path C:\Program Files\RevPDF\gal_plugin.dll
Size 176KB
SHA256 025668b6b7e42bd31bc492e4282e6361f5bb8c16623a2b435c0fceec7a8ca1fb
MD5 cc8933f8bab23a993ef8864ec1016fd5
SHA1 cae710f53a5e594d281f310342327e0dc6edf074
SHA512 80efb06ac157334bafce5ff1f941711811b6f62722fb72eaab59077e98f28bd367a2138b4f28cc2c184d1b16b96331222bdd09e8ab03a0450c1ed55096137136
SSDEEP 3072:btaagMTQ3ygaCTpxVIFa+/qyk+HEjnvqixXkURWOEHm+2vT5rstB3V24Z:YMTQ3ygaCaF0ykjnSixXkUAfH8T5rst/
TLSH
T19A042A5AB7694157D12BE1B8C9874A06EB32B8951B20A3CB175003BF1F13BE99F7F610
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\RevPDF\msvcp140.dll
Size 628KB
SHA256 7c26614e1d733892c2deac7e245ce115504b1d80592dd0a01b08e3e5a55f89ca
MD5 4796bb351c00d47717906bbee4e20837
SHA1 480c725faafa25d2274bde6f8791bcd8b525e5e5
SHA512 2777a9b104f0ac244d90572e02c2f2fb911ce4e8bd9f7b099074d5614c9a7d423c14eb6c46087167e160b6c614d6fbdd9b762b41eb7f023ff66ee65837071db5
SSDEEP 12288:60hIKSLeXl9vce+YtEd5tFYDIpDv5bKwWKBaXzogmIGq2HZ5D13EXwbkDZmaD4EJ:60VkwDIpsezBbkDZmaDH50NQEKZm+jWA
TLSH
T1E8D42923774D02A0D195F2B9A1C74306E7F1B8464323A3C392EADA6D2F5B3D9677B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pasteboard_plugin.dll

Path C:\Program Files\RevPDF\pasteboard_plugin.dll
Size 88KB
SHA256 29b2fa0e445b6409a01dad954772aa34737f24914c5ba401069257e9f08a7b5c
MD5 d96713b814680a7a961c0e4b3117e305
SHA1 c2df48fa022fb32a1b1761564b49a021bef2c84f
SHA512 f5f417e0cdd530469a471abd2b02ae000a4f1f6531b76af1ef2e2b312dc88336788b39cf2d62fe2f789f1a6ba203249ebc6b88eb98ede66c4697c2587362d8d1
SSDEEP 1536:Dma/Mw7h7i0tWT9vIBjrX0pbqRWBDBY5vxCz01IsQ:Dma/X7i0gxurumRiBY5vxCHsQ
TLSH
T121930C2AEA5950AFE21AD4F8C6534D05DB72FC8617A167CF67900EDB0E1BAE40F3E501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfium.dll

Path C:\Program Files\RevPDF\pdfium.dll
Size 5.6MB
SHA256 6825693935fb9ff29e0798577bdba7f324f6cdd532fdbfea6cee1d4c7cb5e85d
MD5 34f2405738666d229215e70e216d8258
SHA1 195f0fe8d4a465f52450dd9d471b051d6fb2bf43
SHA512 1f419f32f008ab593022ff1b7383a215d99eddce5f2e203020774ff9fd017c24354d1cd40af22ebf09290b07694ae287408949657916ed77c843a2ea55d3b36c
SSDEEP 98304:NMZ5Op8tZvgmopcZwB6APPaTHKwn+C4C:zpQo2ZwBFPaT0C4C
TLSH
T116465C03E1A6509CD015F13BDB1BA622F671BC0807F566EF26508AD72F62FE17A78B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

permission_handler_windows_plugin.dll

Path C:\Program Files\RevPDF\permission_handler_windows_plugin.dll
Size 115KB
SHA256 5345a678307b7a0baa9b3b1467b4c786d503bdcc17d1b6b79510932c1ef63156
MD5 a403161cf04584d7fd2f2f72572e0871
SHA1 9874c8554e06866cf5cbe8dd9d625689d62dde8e
SHA512 074ff4eaec8e5881d00669b02d387c39509d29e641833e4230402f564f447e7bb27cc39a667ec3b7416b8cc922eaaed9fc7cb39109330d30bdd374627c25474d
SSDEEP 3072:AQ1QtFT+L8wUiyB5ytmaTmP/G5vT4y+oe7ZO9:F1QthEmiyB5haTmP/G5vT4y+oe7
TLSH
T1DDC33C2AFA6D41ABE22AD57CCE574905CB72B886576197CF53500B9F0F23BE84E3D201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

printing_plugin.dll

Path C:\Program Files\RevPDF\printing_plugin.dll
Size 135KB
SHA256 47215d3e97d063b2212d5905ea56bb56578ca51b33714cc91e33ceb568a0840b
MD5 c5391198cf789bbd49a2b811695dad2f
SHA1 07f143d2d3b9906cd363817eccf52943919c3fca
SHA512 dde64d07383abb3678873ab6664965e7ff31fdbbf7dcd56dc26dbeabf4c9791cfc48d623576f2b53bd67df7bd9906f688ab24fbba6d5b5c6523f1b7c9d1458d7
SSDEEP 3072:ws5Y+ZiaXVrtnUnQilm8Urxd6Wx5v6Tx2mJ:lDlrJilm8m7x5v6Tx2m
TLSH
T14CD32B2AB65C40BED22AD0BCC9435807EB72B8854761A7CF57800A9F1F17EE95E3F611
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

revpdf.dll

Path C:\Program Files\RevPDF\revpdf.dll
Size 616KB
SHA256 055756cd1672537a4c64b347547e1e8ea9dafab7b2211df826b739f7f59cd4de
MD5 c28511b00d458557ded391d3af15e2db
SHA1 7d12312ca7682a0cc7a763a03f53d06c5d290a5d
SHA512 2b58d1daecfdbb2bc35b17e7e6d598fb0d37176a20f38222ccc20880744cf0811bd943ff83f3c1e18bdbe32d313a1149a1314d7e74e3ac4218e18a86de9c3a57
SSDEEP 12288:1dc9v3Z5i/xLOAe32ZUd2LheRWtHLqBrR1nm:1dc9R5i/x63auL1n
TLSH
T1F2D4AF51B7B541ACD12BC0B64267F81BF771781E0370AADB53E08D9A9F1BA241F2BB11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

screen_retriever_windows_plugin.dll

Path C:\Program Files\RevPDF\screen_retriever_windows_plugin.dll
Size 118KB
SHA256 1366c982d9e4f5b762404cd2b6c744fcee80f8f46dd81321c873ab98bd460d99
MD5 eb777e162b51340bc297c69d1345d646
SHA1 85e1631520d662fd9d29fa11ddb0f96edbea73fd
SHA512 220d930bc12c4a30daf8fc4f5028923f63f371fa4c2d70ab51dce1eaeb90e3d97a0317ff3324344249830ee4330e9ccf2f61f81eecffb2de47ffac3f77f8a94c
SSDEEP 1536:ec9Ys2aAdctejCjdpvW+HvEtIiAh4moShi43xrcd8tRHYmIHQA5AuZCp/IxYzE:ecYhcMQLEtIiW/hq5AuZCp/Ix
TLSH
T108C33C2BB65D40ABE21AD4F8CA574946CB72F85547A1A7CF17804A9F0F27BE90F3E500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

share_plus_plugin.dll

Path C:\Program Files\RevPDF\share_plus_plugin.dll
Size 135KB
SHA256 767eca101fdf56cc360f4777a599e9147b461bf34b03b086d2e993249c076e2a
MD5 8bbcb265c46641228678f8ed26a73341
SHA1 e2e52b6fa2728a9e815f641015c07b16ada2d990
SHA512 cf7aa351c923508372b2dcb34446d8fc0906cc8f6d60d02760378774abd0c183c569c99e3899f9285e581458c27ccd79b78b00a18ea97a06318748fed1f64741
SSDEEP 1536:g06FnZOsPXX2SN7JiBibfwixITmmFXZorp8ao8PI/5Fw4a9AtR5KoqsoXi/d/5eP:gLFZOsfxxfwixcISao8P+5Fw4a96wV
TLSH
T19BD31A27BA1D40DBD236A0B88D478E05DB72F8925B9197CB37504B9F0E67BD80E7A211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

url_launcher_windows_plugin.dll

Path C:\Program Files\RevPDF\url_launcher_windows_plugin.dll
Size 96KB
SHA256 814f42da7e8535e3fbcb4c240b80b298c1f180bbb55f767c7bd632fb0f1d8ebc
MD5 d0d6a107fed4c665ca7201f501501c77
SHA1 d32d3981ac7cea05c0e0f4a458252cf4dfacecf7
SHA512 8ae91433bc5b3b99601b73bc23b989af57cd6587da85b572f3fb6d7c81b46d4f752b65e95e2874384bfbd7208869b9db109c381efb913aa79824ce50b708ffe9
SSDEEP 1536:l347yOZcZiRaWEi6X/j27oCZgHEKQ0Y5rUVkJk7p:xDOZcZWnEiibM5rUVkJk
TLSH
T113A32A2BEA5D406BE26AD4BCCA574D01CB72FC85476267CF27901ECA0E67BD90E3E501
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\RevPDF\vcruntime140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\RevPDF\vcruntime140_1.dll
Size 48KB
SHA256 a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e
MD5 bbfa92d8173376c972fd58dcf5ca6aaa
SHA1 b7b4b6e7045caccc0f790e3395e1f514d01f6b2f
SHA512 f5856e7cb7bc8f40efc276f8e7024db9176052ebd47cd02e799aacde650293992a84a6a4856dd974077e94e688bb4ed67f18c1dfd8357afa8698dd0dfead68d3
SSDEEP 768:bmiyc1PGhsryS/TAiblJce9z4Snqdlfe9z1Y:2cF8srygDlSaz4Ez1Y
TLSH
T1DA235E8193BC8086E8B798B480EBDF13BD3DB661976192CF1BA1E15C1D537C0D73926A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

window_manager_plugin.dll

Path C:\Program Files\RevPDF\window_manager_plugin.dll
Size 128KB
SHA256 cc11ee1c2b16bcadef836bb14c48f75a118ff5863fb16966082cd57c30f07f3c
MD5 1e618c8805ecac08a9dc571264042f71
SHA1 012658d0bd8165281fe079e2bebdd81c97a20d64
SHA512 60b465dd12c586b2646f8435eb6787dbe833183af05367eb7c0bd71f2e47278722f6cf408b25002c9470d4f83519868d240a410ccfce4a393ec070e8248cbf23
SSDEEP 3072:Qff0MEKDa6rcmo/xiIIMD21XttrPAsygzTuBadx:0f0Mv26rcmoZiIIv9ttrPAsygzTuBadx
TLSH
T16CD34C2AF65C40ABE126E4F8C9835905DB72F8810B6297CF17904EDB0F17AE55E3F911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

revpdf_editor_winx64.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VEEV4RYHC0.tmp\revpdf_editor_winx64.tmp
Size 4.2MB
SHA256 ad15516bdb8045ced47530661e678086548c114267b7056350684e86378c20f4
MD5 fbca49a24068c885903d268a39911c36
SHA1 2e06a38cfa3b916b4a30629929b680c33bac8e05
SHA512 556c93fb1906fb82522f67fe910f00008919ecb5bce1afcc5a5285d3249bc88935aa8bef8e58b94ccb44b6c1629269ea3b0069e8518cadd024befdf9c2143f68
SSDEEP 98304:+YU5hnuOajWwMPdCpepI3GrwrA+J1333pK:+xuHjWfZIzLK
TLSH
T14A168F03B388753EE4671A3A583FA284983F7A213A26CD4F6BF40D5C8F395416D2A757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2040-217-0x0000023426730000-0x0000023426731000-memory.dmp

Download

memory/2040-215-0x0000023429330000-0x0000023429EE5000-memory.dmp

Download

memory/2040-213-0x0000023426720000-0x0000023426721000-memory.dmp

Download

memory/2040-220-0x0000023429F00000-0x0000023429F80000-memory.dmp

Download

memory/2040-214-0x0000023429330000-0x0000023429EE5000-memory.dmp

Download

memory/2040-221-0x0000023429F00000-0x0000023429F80000-memory.dmp

Download

memory/2040-216-0x0000023429330000-0x0000023429EE5000-memory.dmp

Download

memory/2424-204-0x00000000001D0000-0x00000000002B2000-memory.dmp

Download

memory/2424-21-0x00000000001D0000-0x00000000002B2000-memory.dmp

Download

memory/2424-1-0x00000000001D0000-0x00000000002B2000-memory.dmp

Download

memory/4356-168-0x0000000000430000-0x000000000086D000-memory.dmp

Download

memory/4356-22-0x0000000000430000-0x000000000086D000-memory.dmp

Download

memory/4356-23-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download

memory/4356-6-0x0000000000E20000-0x0000000000E21000-memory.dmp

Download

memory/4356-203-0x0000000000430000-0x000000000086D000-memory.dmp

Download