Overview

overview

8

Static

static

3

pdf24-crea...er.exe

windows10-2004-x64

8

pdf24-crea...er.exe

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    339s
  • max time network
    337s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    27/07/2026, 17:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    pdf24-creator-installer.exe
  • Size 640KB
  • Sample260727-v6pp3axgla
  • SHA256 5c7307d149d4d2cfa1b81751285a3ff333ef66b56529f0cbbaa1601ae8f86f66
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwaredefense_evasiondiscoveryexecutioninstallerpersistenceprivilege_escalationspyware

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 5 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 2 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 9 IoCs
  • Kills process with WMI 3 IoCs
    defense_evasion
  • Modifies Control Panel 2 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 19 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\pdf24-creator-installer.exe
    "C:\Users\Admin\AppData\Local\Temp\pdf24-creator-installer.exe"
    1⤵
    • Downloads MZ/PE file
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\pdf24-creator.exe
      "C:\Users\Admin\AppData\Local\Temp\pdf24-creator.exe" /FromSmallInstaller /SkipLicensePage /SILENT
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4740
      • C:\Users\Admin\AppData\Local\Temp\is-D9G8F.tmp\pdf24-creator.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-D9G8F.tmp\pdf24-creator.tmp" /SL5="$B005C,440965802,835072,C:\Users\Admin\AppData\Local\Temp\pdf24-creator.exe" /FromSmallInstaller /SkipLicensePage /SILENT
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" stop pdf24
          4⤵
          • Launches sc.exe
          • System Location Discovery: System Language Discovery
          PID:932
        • C:\Windows\SysWOW64\wbem\WMIC.exe
          "C:\Windows\System32\wbem\WMIC.exe" PROCESS WHERE "Name='prevhost.exe' AND CommandLine LIKE '%{09E6D117-5330-4A29-8C20-0C3AF9F90A1C}%'" CALL TERMINATE
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with WMI
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5724
        • C:\Windows\SysWOW64\wbem\WMIC.exe
          "C:\Windows\System32\wbem\WMIC.exe" PROCESS WHERE "Name='pdf24-Reader.exe' AND CommandLine LIKE '%/shellPreview%'" CALL TERMINATE
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with WMI
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4092
        • C:\Windows\SysWOW64\wbem\WMIC.exe
          "C:\Windows\System32\wbem\WMIC.exe" PROCESS WHERE "Name='pdf24.exe'" CALL TERMINATE
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with WMI
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3948
        • C:\Windows\system32\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\PDF24\PdfPreviewHandler.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4396
        • C:\Windows\system32\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\PDF24\PdfThumbHandler.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4488
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\PDF24\PdfPreviewHandler.x86.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1780
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\PDF24\PdfThumbHandler.x86.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:1656
        • C:\Windows\system32\regsvr32.exe
          "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\PDF24\ShellExt.dll"
          4⤵
          • Loads dropped DLL
          • Modifies registry class
          PID:4792
        • C:\Program Files\PDF24\pdf24-PrinterInstall.exe
          "C:\Program Files\PDF24\pdf24-PrinterInstall.exe" -log "C:\Program Files\PDF24\prnDrvInst.log" -upgrade installPrinterDriver
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in System32 directory
          PID:1264
        • C:\Program Files\PDF24\pdf24-PrinterInstall.exe
          "C:\Program Files\PDF24\pdf24-PrinterInstall.exe" -printerName "PDF24" -portName "\\.\pipe\PDFPrint" -log "C:\Program Files\PDF24\pdfPrnInst.log" installPrinter installCompatiblePrinter
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:2328
        • C:\Program Files\PDF24\pdf24.exe
          "C:\Program Files\PDF24\pdf24.exe" -log "C:\Program Files\PDF24\srvInst.log" -install -start
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:4628
        • C:\Program Files\PDF24\pdf24.exe
          "C:\Program Files\PDF24\pdf24.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1552
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pdf24.org/products/pdf-creator/afterInstall.php?version=11.30.1&iid=731CBA2C-DB6F-44EF-86DF-1E1E27663EC4&language=en&setupTime=2026-07-27%2017%3a37%3a47&setupName=pdf24-creator.exe
          4⤵
          • Drops file in Windows directory
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:4076
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x120,0x358,0x7ff86194c188,0x7ff86194c194,0x7ff86194c1a0
            5⤵
              PID:1620
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,14261492392497487699,7998570384753145398,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:11
              5⤵
              • System Time Discovery
              PID:3060
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,18184853369350507158,6948308938087184209,262144 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:2
              5⤵
                PID:4344
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,17702210849851571277,17461547672185436275,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:13
                5⤵
                  PID:3160
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,6203449653826555636,15165576571225833386,2097152 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
                  5⤵
                    PID:5116
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,8372165712402945894,5048617641460106204,2097152 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
                    5⤵
                      PID:1608
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,4346975163250999666,14480572657982500778,2097152 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:1
                      5⤵
                        PID:5324
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,13100218705599457934,11893313859782142750,2097152 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:9
                        5⤵
                          PID:5976
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,2408644943080020171,2532240871183008504,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
                          5⤵
                            PID:836
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5476,i,18174996346831123619,2099295902216714447,2097152 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
                            5⤵
                              PID:3000
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,3910428219347326859,11876295509098442978,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
                              5⤵
                                PID:1804
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,2473718161579661971,3698962478735212241,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
                                5⤵
                                  PID:3572
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,10390303096435248298,1991277653518498531,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
                                  5⤵
                                    PID:1060
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,10390303096435248298,1991277653518498531,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
                                    5⤵
                                      PID:5640
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,6649196743184040821,13653218960871329426,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:14
                                      5⤵
                                        PID:4888
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,3962735108330689095,15449097691882393179,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:14
                                        5⤵
                                          PID:4884
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,10551534773337747429,3796314099085338289,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:14
                                          5⤵
                                            PID:2616
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,38435216425610067,17424029291455744758,524288 --field-trial-handle=2648,i,17970760009291829801,2965368328268280046,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
                                            5⤵
                                              PID:4932
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                              5⤵
                                              • Drops file in Windows directory
                                              • Enumerates system info in registry
                                              • Modifies data under HKEY_USERS
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of WriteProcessMemory
                                              PID:1356
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff86194c188,0x7ff86194c194,0x7ff86194c1a0
                                                6⤵
                                                  PID:1424
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,3292336794712931820,8890582730648064642,262144 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
                                                  6⤵
                                                    PID:2068
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13162786083337310352,11408978025952336479,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:11
                                                    6⤵
                                                    • System Time Discovery
                                                    PID:4836
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,15795484806126034177,10793041920937326847,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:13
                                                    6⤵
                                                      PID:4368
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,4301014429160897857,12750967147266981421,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
                                                      6⤵
                                                        PID:2836
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,4301014429160897857,12750967147266981421,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
                                                        6⤵
                                                          PID:2840
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,12032669261523703958,2551183854366957697,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
                                                          6⤵
                                                            PID:3764
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,520037336464500970,16557484362266293157,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
                                                            6⤵
                                                              PID:2876
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,12824674103703971630,13306384170077840235,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:14
                                                              6⤵
                                                                PID:3548
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,8755571325067490095,11741158911266347684,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:14
                                                                6⤵
                                                                  PID:5808
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,10373764236956936547,4305507850642783637,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
                                                                  6⤵
                                                                    PID:5412
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,18317018458096592308,1285152930598641585,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:14
                                                                    6⤵
                                                                      PID:5648
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4952,i,14375111746322985695,13031757238655692953,262144 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:10
                                                                      6⤵
                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                      PID:200
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,11428887555161804940,7006749276440660018,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:14
                                                                      6⤵
                                                                        PID:2428
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2800,i,12264708529483469794,12528778354750895658,524288 --field-trial-handle=2220,i,6190993421383217496,15790975882905060661,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:14
                                                                        6⤵
                                                                          PID:3236
                                                              • C:\Program Files\PDF24\pdf24.exe
                                                                "C:\Program Files\PDF24\pdf24.exe"
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Suspicious use of FindShellTrayWindow
                                                                • Suspicious use of SendNotifyMessage
                                                                PID:4592
                                                              • C:\Program Files\PDF24\pdf24.exe
                                                                "C:\Program Files\PDF24\pdf24.exe" -service
                                                                1⤵
                                                                • Executes dropped EXE
                                                                • Loads dropped DLL
                                                                • Modifies data under HKEY_USERS
                                                                PID:2156
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                1⤵
                                                                  PID:2068
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                  1⤵
                                                                    PID:1004
                                                                  • C:\Windows\system32\svchost.exe
                                                                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                    1⤵
                                                                      PID:5856
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                      1⤵
                                                                        PID:5440
                                                                      • C:\Program Files\PDF24\pdf24-Launcher.exe
                                                                        "C:\Program Files\PDF24\pdf24-Launcher.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Loads dropped DLL
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:4564
                                                                        • C:\Program Files\PDF24\pdf24-Compress.exe
                                                                          "C:\Program Files\PDF24\pdf24-Compress.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          • Modifies Control Panel
                                                                          • Modifies Internet Explorer settings
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:3224
                                                                        • C:\Program Files\PDF24\pdf24-Updater.exe
                                                                          "C:\Program Files\PDF24\pdf24-Updater.exe" -hidden -trigger "appClose"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          PID:2436
                                                                      • C:\Program Files\PDF24\pdf24-Launcher.exe
                                                                        "C:\Program Files\PDF24\pdf24-Launcher.exe"
                                                                        1⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:940
                                                                        • C:\Program Files\PDF24\pdf24-Creator.exe
                                                                          "C:\Program Files\PDF24\pdf24-Creator.exe"
                                                                          2⤵
                                                                          • Executes dropped EXE
                                                                          • Modifies Control Panel
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:5924
                                                                          • C:\Program Files\PDF24\pdf24-DocTool.exe
                                                                            "C:\Program Files\PDF24\pdf24-DocTool.exe" -targetWin 1C0206 -parentWin 1C0206 "C:\Users\Admin\Documents\MountDisable.xlsx"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:2804
                                                                          • C:\Program Files\PDF24\qpdf\bin\qpdf.exe
                                                                            "C:\Program Files\PDF24\qpdf\bin\qpdf.exe" "@-"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:5084
                                                                          • C:\Program Files\PDF24\gs\bin\gswinc.exe
                                                                            "C:\Program Files\PDF24\gs\bin\gswinc.exe" -dBATCH -dNOPAUSE -dSAFER -dALLOWPSTRANSPARENCY "-sFONTPATH=C:/Windows/Fonts" -dNEWPDF=true -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72 -dFirstPage=1 -dLastPage=1 -sDEVICE=png16m -dDownScaleFactor=1 "-sOutputFile=C:\Users\Admin\AppData\Local\Temp\PDF24\2_241058796_2278339734.png" "C:\Users\Admin\AppData\Local\Temp\PDF24\unlocked_1_241058593_4152565589.pdf"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:5684
                                                                          • C:\Program Files\PDF24\gs\bin\gswinc.exe
                                                                            "C:\Program Files\PDF24\gs\bin\gswinc.exe" -dBATCH -dNOPAUSE -dSAFER -dALLOWPSTRANSPARENCY "-sFONTPATH=C:/Windows/Fonts" -dNEWPDF=true -dTextAlphaBits=4 -dGraphicsAlphaBits=4 -r72 -dFirstPage=2 -dLastPage=2 -sDEVICE=png16m -dDownScaleFactor=1 "-sOutputFile=C:\Users\Admin\AppData\Local\Temp\PDF24\3_241059421_3095879550.png" "C:\Users\Admin\AppData\Local\Temp\PDF24\unlocked_1_241058593_4152565589.pdf"
                                                                            3⤵
                                                                            • Executes dropped EXE
                                                                            PID:2024
                                                                      • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
                                                                        "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
                                                                        1⤵
                                                                        • Checks processor information in registry
                                                                        • Enumerates system info in registry
                                                                        • Suspicious behavior: AddClipboardFormatListener
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:96
                                                                        • C:\Windows\splwow64.exe
                                                                          C:\Windows\splwow64.exe 12288
                                                                          2⤵
                                                                            PID:5188
                                                                        • C:\Windows\system32\svchost.exe
                                                                          C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                                                          1⤵
                                                                            PID:3420

                                                                          Network

                                                                                MITRE ATT&CK Enterprise v16

                                                                                Reconnaissance

                                                                                Resource Development

                                                                                Initial Access

                                                                                Execution

                                                                                System Services

                                                                                1
                                                                                T1569

                                                                                Service Execution

                                                                                1
                                                                                T1569.002

                                                                                Persistence

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Event Triggered Execution

                                                                                1
                                                                                T1546

                                                                                Component Object Model Hijacking

                                                                                1
                                                                                T1546.015

                                                                                Privilege Escalation

                                                                                Boot or Logon Autostart Execution

                                                                                1
                                                                                T1547

                                                                                Registry Run Keys / Startup Folder

                                                                                1
                                                                                T1547.001

                                                                                Create or Modify System Process

                                                                                1
                                                                                T1543

                                                                                Windows Service

                                                                                1
                                                                                T1543.003

                                                                                Event Triggered Execution

                                                                                1
                                                                                T1546

                                                                                Component Object Model Hijacking

                                                                                1
                                                                                T1546.015

                                                                                Defense Evasion

                                                                                Impair Defenses

                                                                                1
                                                                                T1562

                                                                                Modify Registry

                                                                                2
                                                                                T1112

                                                                                Credential Access

                                                                                Discovery

                                                                                Browser Information Discovery

                                                                                1
                                                                                T1217

                                                                                Query Registry

                                                                                3
                                                                                T1012

                                                                                System Information Discovery

                                                                                3
                                                                                T1082

                                                                                System Location Discovery

                                                                                1
                                                                                T1614

                                                                                System Language Discovery

                                                                                1
                                                                                T1614.001

                                                                                System Time Discovery

                                                                                1
                                                                                T1124

                                                                                Lateral Movement

                                                                                Collection

                                                                                Command and Control

                                                                                Exfiltration

                                                                                Impact

                                                                                Service Stop

                                                                                1
                                                                                T1489

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                About.dll
                                                                                • Path C:\Program Files\PDF24\About.dll
                                                                                • Size 496KB
                                                                                • SHA256 9b340aab9a9081a3532e3fa1fe1bf13d2cfbf80d21610dc726e02ca23c41ecaf
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Language.dll
                                                                                • Path C:\Program Files\PDF24\Language.dll
                                                                                • Size 76KB
                                                                                • SHA256 c5a92d763f7fb97810afe5618c1cda5b2788ee81482b6cd4ce68daf78232ce67
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                NotifyIcon.dll
                                                                                • Path C:\Program Files\PDF24\NotifyIcon.dll
                                                                                • Size 532KB
                                                                                • SHA256 dd923158f857d29666bf67386946938310f0afd46139fabde78bfd8673a0963b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                PdfPreviewHandler.x86.dll
                                                                                • Path C:\Program Files\PDF24\PdfPreviewHandler.x86.dll
                                                                                • Size 160KB
                                                                                • SHA256 db86d966700e98d247e3e108b4f17c5f33dd90e58a641a07748ee9daae65cf84
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                PdfThumbHandler.x86.dll
                                                                                • Path C:\Program Files\PDF24\PdfThumbHandler.x86.dll
                                                                                • Size 155KB
                                                                                • SHA256 e08ebb6b2160496938c4bcef6fe084531a4d0fd0635e3012e7a38d12f4acd788
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Resources.dll
                                                                                • Path C:\Program Files\PDF24\Resources.dll
                                                                                • Size 664KB
                                                                                • SHA256 33d17bf5fbda12dc54d22f3ce7ac5c9c4c45a3393fcd7367baac67977001f5eb
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Settings.dll
                                                                                • Path C:\Program Files\PDF24\Settings.dll
                                                                                • Size 111KB
                                                                                • SHA256 748acf51118605e360bd65b9c8ca54b2cd5157c5176065524c71444eda2fa97f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                ShellExt.dll
                                                                                • Path C:\Program Files\PDF24\ShellExt.dll
                                                                                • Size 232KB
                                                                                • SHA256 5a6039d49bc9fb6f37a485c5b0bf7bf0c8f1307b790b815a7d8261ca93a69aa2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                VCRUNTIME140.dll
                                                                                • Path C:\Program Files\PDF24\VCRUNTIME140.dll
                                                                                • Size 120KB
                                                                                • SHA256 184146852727a9db4eea06178716bec3cdbb1015c911f6b0f915b184ad7775b2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                VCRUNTIME140_1.dll
                                                                                • Path C:\Program Files\PDF24\VCRUNTIME140_1.dll
                                                                                • Size 46KB
                                                                                • SHA256 e6bfb3662ab4b1969a73441dbe35c96d51441b6bff8cf1fe7430bd5b246ca605
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-3TFU5.tmp
                                                                                • Path C:\Program Files\PDF24\is-3TFU5.tmp
                                                                                • Size 56KB
                                                                                • SHA256 371b3d1981d7f1e47651b3d9eceb5bd53e23581ebe1fab19daa35847e34685b1
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-C9BKJ.tmp
                                                                                • Path C:\Program Files\PDF24\is-C9BKJ.tmp
                                                                                • Size 63KB
                                                                                • SHA256 13e7428c59910e9ce204fd70d3cc63bb7fa954105360bbfbbbfd3627bf47e382
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-0MTKK.tmp
                                                                                • Path C:\Program Files\PDF24\jre\legal\java.logging\is-0MTKK.tmp
                                                                                • Size 44B
                                                                                • SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                is-8O69C.tmp
                                                                                • Path C:\Program Files\PDF24\jre\legal\java.logging\is-8O69C.tmp
                                                                                • Size 33B
                                                                                • SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                is-UO96U.tmp
                                                                                • Path C:\Program Files\PDF24\jre\legal\java.logging\is-UO96U.tmp
                                                                                • Size 49B
                                                                                • SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                is-8Q9QT.tmp
                                                                                • Path C:\Program Files\PDF24\lib\toolbox\img\pageIcons\is-8Q9QT.tmp
                                                                                • Size 13KB
                                                                                • SHA256 b6e8699f64f6d6c25799108196b709526661298468f4331315dc83df96bca691
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-2M962.tmp
                                                                                • Path C:\Program Files\PDF24\lib\wx\i18n\is-2M962.tmp
                                                                                • Size 142KB
                                                                                • SHA256 3b3dd5f8d2994f6d0800ec60e3058115aeea4d5a6e375061dda8bea5ec64944e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-8GIK2.tmp
                                                                                • Path C:\Program Files\PDF24\lib\wx\i18n\is-8GIK2.tmp
                                                                                • Size 135KB
                                                                                • SHA256 6f4cf6a70290247c9e13b84f932c8ee191ef84d4c74ff5b0541e90a15d95a6f8
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-AVAFO.tmp
                                                                                • Path C:\Program Files\PDF24\lib\wx\i18n\is-AVAFO.tmp
                                                                                • Size 166KB
                                                                                • SHA256 f9dcd9c362fb483f917d1fa43e5a594ed9122402b45304fce43a77a140a5351c
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-OMQP5.tmp
                                                                                • Path C:\Program Files\PDF24\lib\wx\i18n\is-OMQP5.tmp
                                                                                • Size 153KB
                                                                                • SHA256 9b81f2ea94a3fe48b5af1639ce2c698986b91aaf38402bdb30e92f80caa74652
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-OPN25.tmp
                                                                                • Path C:\Program Files\PDF24\licenses\is-OPN25.tmp
                                                                                • Size 11KB
                                                                                • SHA256 cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                msvcp140.dll
                                                                                • Path C:\Program Files\PDF24\msvcp140.dll
                                                                                • Size 540KB
                                                                                • SHA256 def46aa6a8f72f27bafac0c43334419486a4d1dcdb6c479a8ef7034b3e1fa4cb
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pdf24-PrinterInstall.exe
                                                                                • Path C:\Program Files\PDF24\pdf24-PrinterInstall.exe
                                                                                • Size 347KB
                                                                                • SHA256 59296b44caf32c82c34d6f58c6abad0890bcd8afe8a778321cabc6ed3bce4189
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pdf24-Toolbox.exe
                                                                                • Path C:\Program Files\PDF24\pdf24-Toolbox.exe
                                                                                • Size 2.2MB
                                                                                • SHA256 1a6d49009179fbe99989c70a6d056f5b8d20a84f1d17fcba8906d4311353f83b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                pdf24.exe
                                                                                • Path C:\Program Files\PDF24\pdf24.exe
                                                                                • Size 664KB
                                                                                • SHA256 9d3c39ea7cd0fa5896b0cc042c5a48b230d6874e510bcc6cb9a39f2e60e58e41
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-2R5AV.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-2R5AV.tmp
                                                                                • Size 84KB
                                                                                • SHA256 9f32630e2c0c5135bf1e86e36cb65b3932e4410644235bc2bd995e9c7f6ff117
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-7UA7N.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-7UA7N.tmp
                                                                                • Size 320KB
                                                                                • SHA256 26318a1467a5e5caf10b04cfa942d079632560cd7a29cec565fd1dc9f7ec5081
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-A6TVV.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-A6TVV.tmp
                                                                                • Size 301KB
                                                                                • SHA256 5b9025dda4d7688e3311b0c17eddc501133b807def33effaef6593843cf5416e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-AOVDO.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-AOVDO.tmp
                                                                                • Size 302KB
                                                                                • SHA256 0e56b17d142eb366c8007031d14e34da48c70b4a9d9a0ca492e696a7bae45e1e
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-B0NC2.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-B0NC2.tmp
                                                                                • Size 191KB
                                                                                • SHA256 4465765f2f6eddcdad34ffd7cab559e56bc0e75e45e192f85e9562b0771481dc
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-ES8ON.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-ES8ON.tmp
                                                                                • Size 180KB
                                                                                • SHA256 ae88fc0d7a961832f809527d30bd3983a6866d42f66a56ade23f543681594db6
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-H4UV8.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-H4UV8.tmp
                                                                                • Size 65KB
                                                                                • SHA256 1a0c024dd1a267c52d5575469ffe8570d1e84164de7d393cf3414bafd17d7a0c
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-J3KLC.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-J3KLC.tmp
                                                                                • Size 85KB
                                                                                • SHA256 9fec87cadbe2413b255f1ec577573a83f1ca2e1c37aa023dbebcd3a7b864636a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-JHRDQ.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-JHRDQ.tmp
                                                                                • Size 188KB
                                                                                • SHA256 c0916a33340d063f7b05679e08031e729d1888444706f04804705da5966d895d
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-LQB8P.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-LQB8P.tmp
                                                                                • Size 64KB
                                                                                • SHA256 874e42222856d7af03b3f438d21d923a4280d47fe67c48510e2174a1579795ef
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-RNM1F.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-RNM1F.tmp
                                                                                • Size 315KB
                                                                                • SHA256 980c8592e5488df256192c999e92db8fd302db8cd8909b7fa266a684e37e45f8
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                is-SEVQR.tmp
                                                                                • Path C:\Program Files\PDF24\qpdf\share\doc\qpdf\manual-single-page-html\_static\css\fonts\is-SEVQR.tmp
                                                                                • Size 178KB
                                                                                • SHA256 983b0caf336e8542214fc17019a4fc5e0360864b92806ca14d55c1fc1c2c5a0f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                settings.dat
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                • Size 280B
                                                                                • SHA256 8e3e7ab37e403b155b837628649f2d3c36101e7bdfcec9cd411c37d143c3b521
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                00d03966-c308-4966-8cc5-f7443c185c2d.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\00d03966-c308-4966-8cc5-f7443c185c2d.tmp
                                                                                • Size 414B
                                                                                • SHA256 443369dc1cf6dd8d37ab6e2286d58865cc9cee344e5241bacd5abd2df6f2cbcb
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                219b45be-c6cf-44bb-872f-4017cca12508.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\219b45be-c6cf-44bb-872f-4017cca12508.tmp
                                                                                • Size 6B
                                                                                • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                9ede66d2-7f45-4871-b0b8-1b57ceef050f.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ede66d2-7f45-4871-b0b8-1b57ceef050f.tmp
                                                                                • Size 14KB
                                                                                • SHA256 8128007b4082930385e6db332c95bbfb8e5c7e20c24ae084449b8784ae6df2f9
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                • Size 3KB
                                                                                • SHA256 bc9ec87abcb0c866cc09a93df70411eb41b5dcb69a58dfade6f91f8633d1a770
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index~RFe5bdcdf.TMP
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5bdcdf.TMP
                                                                                • Size 3KB
                                                                                • SHA256 eb57c919d1787a57957ae11f229cc5ee4331f653300a14a5d18ff952405d84be
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                SiteList-Enterprise.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                • Size 2B
                                                                                • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Edge Profile.ico
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                • Size 70KB
                                                                                • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Network Persistent State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                • Size 4KB
                                                                                • SHA256 e41b77a3e4a1d6d94d81e16b7aa24698297a42c0e24697dc4ac68ea2ca88f239
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                SCT Auditing Pending Reports
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                • Size 2B
                                                                                • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Sdch Dictionaries
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                • Size 40B
                                                                                • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 14KB
                                                                                • SHA256 a71218385e3170b2f082146d291e256e13d967509955cec3bd836d9a0750f0f3
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 13KB
                                                                                • SHA256 bba8dfba9fe2e4dd47429481c175e52beb4d5a6a0fc6a873830288568a62359a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 12KB
                                                                                • SHA256 96be274212bd5598b2f3df63690d8c3d1b4913bc2f575781dc0a0d38be5731b0
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                • Size 12KB
                                                                                • SHA256 05b8cbc9e5b9d793dbc11744bb368adfaa2ac13a7a93eb8e500e8dff11e412e2
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Secure Preferences
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                • Size 29KB
                                                                                • SHA256 9a8428c7c4d6d1db9f1ec61d72c63c370803f1893a1dd2251f8fb810496f3c31
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                the-real-index
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                • Size 72B
                                                                                • SHA256 34f6d5438307a5271f9e94c0f87bfa2382201511fd862c9d8601707b957b37bd
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                the-real-index~RFe5bd156.TMP
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5bd156.TMP
                                                                                • Size 48B
                                                                                • SHA256 eeb255184ffe645e012d424322b75d8a37d18329d68c214fecb4357ebe3e9f13
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                sync_diagnostic.log
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                • Size 4KB
                                                                                • SHA256 dba428ad6755570f7809b26dc1de4100a4983c1e56f195b2381be3f6778afd5b
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                OperationConfig
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
                                                                                • Size 22KB
                                                                                • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                OperationConfig~RFe5ccc31.TMP
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ccc31.TMP
                                                                                • Size 3KB
                                                                                • SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 35KB
                                                                                • SHA256 600279eaae18fe0d53dc335c2f1236939c58ee87b5c50a7ebff80ff12dce92a4
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 40KB
                                                                                • SHA256 081d8a0f73fd00da4ea1902a2a2052d0a0be2e91fbe2e46c205f22e36cbfde64
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 38KB
                                                                                • SHA256 5f82533805ebbfcdb6f2ebf0b6a0ef4239d873521136283b40f43a124c68dd5f
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 61KB
                                                                                • SHA256 4e3cd8c132ba424ca0217bb0365781c68b10f70b6e68a079c11be03592a0f323
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 38KB
                                                                                • SHA256 dcebb12539c0ac696f8eaa83e45092267bde519a2e4d966e4d082b53781665ae
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 41KB
                                                                                • SHA256 0beb5d1ee3f6f4f26f3c8be0be81ffc007021b9aa4f0ed01fc05ba3b121b3340
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                Local State
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                • Size 35KB
                                                                                • SHA256 d97a763e1dfc04a49236d9a724dd1a431d3a28471bcec4088f76d157bd238485
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                data_1
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                                                                • Size 264KB
                                                                                • SHA256 72c3f5f1fb1beb08acb09ec468b4f21775648c6dc399b96e636e03c37f5c8199
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                f100623b-def6-4910-b0a7-928690cadcb3.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\f100623b-def6-4910-b0a7-928690cadcb3.tmp
                                                                                • Size 372B
                                                                                • SHA256 02092b017b3b45a2cf26673a6a2c3fa2b49ab211943cadade98b98777ee73afc
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                • Size 492B
                                                                                • SHA256 9107e613905835c00077a499d2faa20bb70b974e6309d1f2f33ae52933318f07
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                • Size 132B
                                                                                • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                • Size 252B
                                                                                • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                • Size 153KB
                                                                                • SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                a5f28fc2-4670-481b-bdb7-7ad9b59e2dd1.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a5f28fc2-4670-481b-bdb7-7ad9b59e2dd1.tmp
                                                                                • Size 13B
                                                                                • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                metadata.json
                                                                                • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                • Size 132B
                                                                                • SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                Submit Download

                                                                                7cf5191f-7d5a-4ada-b4bf-7942abe5e3cc.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\7cf5191f-7d5a-4ada-b4bf-7942abe5e3cc.tmp
                                                                                • Size 1B
                                                                                • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                • MD5 SHA1 SHA512
                                                                                Submit Download

                                                                                pdf24-creator.tmp
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-D9G8F.tmp\pdf24-creator.tmp
                                                                                • Size 3.0MB
                                                                                • SHA256 57b62ac00d1b150066956ffb2cc45ec23bfe68d3e9c6aaa95e9ecce846b89e6a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                SetupSupport.dll
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\is-GN6SJ.tmp\SetupSupport.dll
                                                                                • Size 150KB
                                                                                • SHA256 ef86449919dd89b40f8972e426ae64036c7bf7db8ef68491cf452cc6117ef898
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                content_new.js
                                                                                • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4076_359242624\CRX_INSTALL\content_new.js
                                                                                • Size 10KB
                                                                                • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                Submit Download

                                                                                memory/96-5739-0x00007FF842450000-0x00007FF842460000-memory.dmp
                                                                                Download

                                                                                memory/96-5764-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/96-5762-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/96-5738-0x00007FF842450000-0x00007FF842460000-memory.dmp
                                                                                Download

                                                                                memory/96-5765-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/96-5763-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/96-5737-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/96-5735-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/96-5733-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/96-5736-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/96-5734-0x00007FF8450E0000-0x00007FF8450F0000-memory.dmp
                                                                                Download

                                                                                memory/1444-259-0x0000000000400000-0x000000000070D000-memory.dmp
                                                                                Download

                                                                                memory/1444-4879-0x0000000000400000-0x000000000070D000-memory.dmp
                                                                                Download

                                                                                memory/1444-4250-0x0000000000400000-0x000000000070D000-memory.dmp
                                                                                Download

                                                                                memory/1444-4294-0x0000000000400000-0x000000000070D000-memory.dmp
                                                                                Download

                                                                                memory/1444-2018-0x0000000000400000-0x000000000070D000-memory.dmp
                                                                                Download

                                                                                memory/1444-3128-0x0000000000400000-0x000000000070D000-memory.dmp
                                                                                Download

                                                                                memory/1444-29-0x00000000024E0000-0x00000000024E1000-memory.dmp
                                                                                Download

                                                                                memory/1444-260-0x00000000024E0000-0x00000000024E1000-memory.dmp
                                                                                Download

                                                                                memory/4740-22-0x0000000000400000-0x00000000004DA000-memory.dmp
                                                                                Download

                                                                                memory/4740-4880-0x0000000000400000-0x00000000004DA000-memory.dmp
                                                                                Download

                                                                                memory/4740-258-0x0000000000400000-0x00000000004DA000-memory.dmp
                                                                                Download

                                                                                memory/5924-5779-0x0000000003870000-0x000000000390F000-memory.dmp
                                                                                Download