2f9c2548233f54ea58c7946accef44b8714f1e23517deaa3249f7286a122639b

Analysis

user interaction
yes
max time kernel
153s
max time network
168s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 15:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pdfgear_setup_v2.1.19.exe
Size 134.6MB
Sample260811-tbmfsafb59
SHA256 2f9c2548233f54ea58c7946accef44b8714f1e23517deaa3249f7286a122639b
MD5 4b6c92185d48195e4e2c2c3b685810e0
SHA1 eb274ad5cf2ac8bed37faec2993ee485891feee9
SHA512 9fc66d95c960a44cb4342e0853e6de7bca959f34884a2d6cbe73a9ed555b1cd607f5aa39b5fe93acfa8b104a315d3d49c0cada48a363240f3cdcc77f943b15c4
SSDEEP 3145728:njckiXqdGjPp2LvH7M4JTD3HhpuSqlNNXFIhXLuj+gdW1yeNhd52ZbGvJxr/i9ff:jTi6dx7Hg4/XCSSNNOgdW1x5aYJxri9n
TLSH
T1D168332F1913AD6EE5F5C8387134A514943ABCA5A126458388F97C28CF7B7F25E3B2C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery installer persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\PDFgear = "\"C:\\Program Files\\PDFgear\\FileWatcher.exe\""	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\PDFgear = "\"C:\\Program Files\\PDFgear\\FileWatcher.exe\""	FileWatcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\PDFgear = "\"C:\\Program Files\\PDFgear\\FileWatcher.exe\""	FileWatcher.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\PDFgear = "\"C:\\Program Files\\PDFgear\\FileWatcher.exe\""	PDFLauncher.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\PDFgear\is-Z8PV640GRL.tmp	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\System.Security.Cryptography.Encoding.dll	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\PDFLauncher.exe	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\Nito.AsyncEx.Tasks.dll	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\QRCoder.dll	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\System.Xml.XPath.XDocument.dll	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-B7MU0LZ002.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-0A35HEVFF7.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-19S7TPZX8O.tmp	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\es\PDFLauncher.resources.dll	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\NsOCR\Bin_64\NsSpell.dll	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-11D3IZ0UWT.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-JIC54DAYD9.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-G8NRVGVUEN.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-RNOIZEU36U.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\es\is-3IBGKUHXVE.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\fr\is-PKUU8LCUZA.tmp	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\fr\PDFLauncher.resources.dll	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\it\pdfeditor.resources.dll	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\zh-CN\is-HHZIQGWZ7K.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-0V5XGZY8L3.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-TMWPCB2XCA.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-QFQLQNZOOP.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-I0FWOCOJWJ.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-7QQNMGXW13.tmp	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\System.Threading.Tasks.Parallel.dll	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\ja\is-O4CUT3S42P.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\nl\is-385E2X7T2G.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-67NS7GD3PT.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-XEI93NIFTF.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-X5Z7ER9DWX.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_common\is-SPHGEZ307C.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\is-PNEOJFPW2T.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-AUZ51TDZIF.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\NsOCR\Bin_64\is-0F78V638FL.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\configs\is-PB24I8GBBO.tmp	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\System.Diagnostics.Process.dll	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-CKOY3ELE1N.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-0SQXWS6JI6.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-TOGGEKQ7LL.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\configs\is-TR820I01YZ.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\configs\is-YLRRWYOBRR.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\configs\is-I9KCMV4JVD.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\ja\is-N7ZYPPW96A.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-LANUP3EYYB.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-T689XZCLY5.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\tessconfigs\is-AQ4VTKXKL7.tmp	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\ImageProcessor.dll	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-XP35HA7WUL.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-VAB3C3O0AD.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-BHD2X3WVLQ.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-WSHUC11W9Y.tmp	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\zh-CN\pdfeditor.resources.dll	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\System.Resources.ResourceManager.dll	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-49TWU4Y8R7.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-P9N9ULH9HR.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\Style\Resources\is-KRUJQP04IF.tmp	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\System.Runtime.dll	pdfgear_setup_v2.1.19.tmp
File opened for modification	C:\Program Files\PDFgear\System.Security.Principal.dll	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\is-5RQZQIS39B.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\de\is-ETJ84W1UN9.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\fr\is-DE8IPE2F5G.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\tessdata\is-AMRC0GN83Z.tmp	pdfgear_setup_v2.1.19.tmp
File created	C:\Program Files\PDFgear\tessdata\tessconfigs\configs\is-KYR64IJ0C1.tmp	pdfgear_setup_v2.1.19.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_2125931697\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\no\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3820_1661520153\_locales\bg\messages.json	msedge.exe

Executes dropped EXE 5 IoCs

pid	Process
5036	pdfgear_setup_v2.1.19.tmp
1288	RegExt.exe
3244	FileWatcher.exe
3008	FileWatcher.exe
2736	PDFLauncher.exe

Loads dropped DLL 20 IoCs

pid	Process
5036	pdfgear_setup_v2.1.19.tmp
1288	RegExt.exe
1288	RegExt.exe
1288	RegExt.exe
3244	FileWatcher.exe
3244	FileWatcher.exe
3244	FileWatcher.exe
3008	FileWatcher.exe
3008	FileWatcher.exe
3244	FileWatcher.exe
3244	FileWatcher.exe
3244	FileWatcher.exe
3244	FileWatcher.exe
2736	PDFLauncher.exe
2736	PDFLauncher.exe
2736	PDFLauncher.exe
2736	PDFLauncher.exe
2736	PDFLauncher.exe
2736	PDFLauncher.exe
2736	PDFLauncher.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfgear_setup_v2.1.19.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pdfgear_setup_v2.1.19.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5012	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/4872-0-0x0000000000BB0000-0x0000000000CE8000-memory.dmp	innosetup
behavioral2/memory/4872-12-0x0000000000BB0000-0x0000000000CE8000-memory.dmp	innosetup
behavioral2/memory/4872-1036-0x0000000000BB0000-0x0000000000CE8000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309373168724723"	msedge.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\PdfGear.App.1\DefaultIcon	RegExt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\shell	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\shell\open\FriendlyAppName = "PDFgear"	RegExt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "PdfGear.App.1"	RegExt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PdfGear.App.1\shell\open\command	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf\OpenWithProgids\PdfGear.App.1	RegExt.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{2B3905E3-26BE-4013-8A55-6D49D989FC7F}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\shell\open\command\ = "\"C:\\Program Files\\PDFgear\\PDFLauncher.exe\" \"%1\""	RegExt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\OpenWithProgids\PdfGear.App.1	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\shell\open\command\ = "\"C:\\Program Files\\PDFgear\\PDFLauncher.exe\" \"%1\""	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf\OpenWithProgids	RegExt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\	RegExt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\DefaultIcon\ = "\"C:\\Program Files\\PDFgear\\PDFLauncher.exe\",1"	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\DefaultIcon\ = "\"C:\\Program Files\\PDFgear\\PDFLauncher.exe\",1"	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\shell\open\command	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf	RegExt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\shell\open	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\AppUserModelID = "578ab678-3bcf-4410-8b82-675d5d214865"	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\shell	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\shell\open	RegExt.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\.pdf\ = "PdfGear.App.1"	RegExt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\shell\open\FriendlyAppName = "PDFgear"	RegExt.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PdfGear.App.1	RegExt.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\AppUserModelID = "578ab678-3bcf-4410-8b82-675d5d214865"	RegExt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1	RegExt.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PdfGear.App.1\shell\open\command	RegExt.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\PdfGear.App.1\DefaultIcon	RegExt.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5036	pdfgear_setup_v2.1.19.tmp
5036	pdfgear_setup_v2.1.19.tmp
5036	pdfgear_setup_v2.1.19.tmp
5036	pdfgear_setup_v2.1.19.tmp
5036	pdfgear_setup_v2.1.19.tmp
5036	pdfgear_setup_v2.1.19.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3244	FileWatcher.exe
Token: SeDebugPrivilege	2736	PDFLauncher.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5036	pdfgear_setup_v2.1.19.tmp
3820	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
244	explorer.exe
6132	explorer.exe
3244	FileWatcher.exe
2736	PDFLauncher.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4872 wrote to memory of 5036	4872	pdfgear_setup_v2.1.19.exe	89
PID 5036 wrote to memory of 1288	5036	pdfgear_setup_v2.1.19.tmp	91
PID 1288 wrote to memory of 732	1288	RegExt.exe	93
PID 1288 wrote to memory of 3004	1288	RegExt.exe	95
PID 244 wrote to memory of 3244	244	explorer.exe	98
PID 6132 wrote to memory of 3008	6132	explorer.exe	99
PID 5036 wrote to memory of 2736	5036	pdfgear_setup_v2.1.19.tmp	100
PID 5036 wrote to memory of 3820	5036	pdfgear_setup_v2.1.19.tmp	101
PID 3820 wrote to memory of 4776	3820	msedge.exe	102
PID 3820 wrote to memory of 4540	3820	msedge.exe	103
PID 3820 wrote to memory of 5012	3820	msedge.exe	104
PID 3820 wrote to memory of 4540	3820	msedge.exe	103
PID 3820 wrote to memory of 4540	3820	msedge.exe	103
PID 3820 wrote to memory of 864	3820	msedge.exe	105
PID 3820 wrote to memory of 864	3820	msedge.exe	105
PID 3820 wrote to memory of 4624	3820	msedge.exe	107
PID 3820 wrote to memory of 4624	3820	msedge.exe	107
PID 3820 wrote to memory of 4624	3820	msedge.exe	107
PID 3820 wrote to memory of 5504	3820	msedge.exe	108
PID 3820 wrote to memory of 5504	3820	msedge.exe	108
PID 3820 wrote to memory of 5504	3820	msedge.exe	108
PID 3820 wrote to memory of 4664	3820	msedge.exe	109
PID 3820 wrote to memory of 5444	3820	msedge.exe	110
PID 3820 wrote to memory of 4664	3820	msedge.exe	109
PID 3820 wrote to memory of 4664	3820	msedge.exe	109
PID 3820 wrote to memory of 5444	3820	msedge.exe	110
PID 3820 wrote to memory of 5444	3820	msedge.exe	110
PID 3820 wrote to memory of 896	3820	msedge.exe	112
PID 3820 wrote to memory of 896	3820	msedge.exe	112
PID 3820 wrote to memory of 5140	3820	msedge.exe	113
PID 3820 wrote to memory of 3692	3820	msedge.exe	114
PID 3820 wrote to memory of 5140	3820	msedge.exe	113
PID 3820 wrote to memory of 3692	3820	msedge.exe	114
PID 3820 wrote to memory of 2076	3820	msedge.exe	116
PID 3820 wrote to memory of 3888	3820	msedge.exe	118
PID 3820 wrote to memory of 3888	3820	msedge.exe	118
PID 3820 wrote to memory of 1556	3820	msedge.exe	120
PID 3820 wrote to memory of 1556	3820	msedge.exe	120
PID 3820 wrote to memory of 5104	3820	msedge.exe	121
PID 3820 wrote to memory of 5104	3820	msedge.exe	121
PID 3820 wrote to memory of 5700	3820	msedge.exe	123
PID 3820 wrote to memory of 5700	3820	msedge.exe	123
PID 3820 wrote to memory of 4544	3820	msedge.exe	124
PID 3820 wrote to memory of 2456	3820	msedge.exe	125
PID 3820 wrote to memory of 5916	3820	msedge.exe	126
PID 3820 wrote to memory of 2524	3820	msedge.exe	127
PID 3820 wrote to memory of 2524	3820	msedge.exe	127
PID 3820 wrote to memory of 4808	3820	msedge.exe	131
PID 3820 wrote to memory of 4808	3820	msedge.exe	131

C:\Users\Admin\AppData\Local\Temp\pdfgear_setup_v2.1.19.exe
"C:\Users\Admin\AppData\Local\Temp\pdfgear_setup_v2.1.19.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4872
- C:\Users\Admin\AppData\Local\Temp\is-3F4FQ9TU1F.tmp\pdfgear_setup_v2.1.19.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3F4FQ9TU1F.tmp\pdfgear_setup_v2.1.19.tmp" /SL5="$401B8,139643596,1219584,C:\Users\Admin\AppData\Local\Temp\pdfgear_setup_v2.1.19.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Program Files\PDFgear\RegExt.exe
    "C:\Program Files\PDFgear\RegExt.exe" -A54C4E30729A469DA8F0864FDB400881 -name:pdfgear_setup_v2.1.19.exe -pintaskband -installWebView2
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1288
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\Program Files\PDFgear\FileWatcher.exe"
      4⤵
      PID:732
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" "C:\Program Files\PDFgear\FileWatcher.exe"
      4⤵
      PID:3004
- - C:\Program Files\PDFgear\PDFLauncher.exe
    "C:\Program Files\PDFgear\PDFLauncher.exe"
    3⤵
    - Adds Run key to start application
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.pdfgear.com/congrats/?version=2.1.19&action=install&fv=0
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:3820
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffce7cbc188,0x7ffce7cbc194,0x7ffce7cbc1a0
      4⤵
      PID:4776
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,9165045904570471939,6670429891309494086,262144 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:2
      4⤵
      PID:4540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,7115838342506605469,4824053071566560537,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:11
      4⤵
      System Time Discovery
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,14531476009813314357,7192482414781425902,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:13
      4⤵
      PID:864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3616,i,5447570179528357527,1598893997938373639,2097152 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
      4⤵
      PID:4624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3640,i,13273468464062485730,14425250278315111154,2097152 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
      4⤵
      PID:5504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,13940484594566233746,1055878955127723562,2097152 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
      4⤵
      PID:4664
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,6301655820272945864,5726246589424683253,2097152 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:9
      4⤵
      PID:5444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,6612336848098851940,10886910161731222697,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:14
      4⤵
      PID:896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,17533457809330991196,6420224299243864023,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:14
      4⤵
      PID:5140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,6474517577268306326,10555829282514764810,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
      4⤵
      PID:3692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10332219251162991519,11038476577824136111,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,10332219251162991519,11038476577824136111,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:14
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,688486708702812448,571954682845140058,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
      4⤵
      PID:3888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,16029592331309998828,5582009856947926875,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
      4⤵
      PID:1556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,12501497713298660835,15785663709754026474,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
      4⤵
      PID:5104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,14596968943382964594,18010412270844711678,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:5700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,10930628877033377723,1547343859893031019,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:14
      4⤵
      PID:4544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,17288575412539374219,7839179030856945525,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,9278143124604650595,11713645077613556762,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
      4⤵
      PID:5916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,838564228265886138,1367680908567858933,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
      4⤵
      PID:2524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,13836715585808760799,3415161274605982578,524288 --field-trial-handle=2628,i,4944564928456668219,6446677325481011315,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
      4⤵
      PID:4808

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:244
- C:\Program Files\PDFgear\FileWatcher.exe
  "C:\Program Files\PDFgear\FileWatcher.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3244

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6132
- C:\Program Files\PDFgear\FileWatcher.exe
  "C:\Program Files\PDFgear\FileWatcher.exe"
  2⤵
  - Adds Run key to start application
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3008

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4816

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CommonLib.dll

Path C:\Program Files\PDFgear\CommonLib.dll
Size 879KB
SHA256 ca9842f0f8b49e406dfac269eff2c5f08d58018fda3e87c141e4924774578e09
MD5 957fecb6886fab6f03a8306af1051fd8
SHA1 d84a0fec921ceb20bf1d1319afcb73365bf1e3c1
SHA512 e22a19bd70cddc26c113114784db30547d70d00027667d3a052fa9dc3f924a28aeeead0c47d67877e2e264e21328ef8ae9d8daf0c8ae3a1be6d5e65449a1d638
SSDEEP 24576:4d91x2UtbAjZ45PhDpU1QmghU96peUThnU+IfUATWU/icUnWFKUN53:E91x2Utbo45PPU1QTU96gUThnU+IfUAD
TLSH
T151158D5133E4853AC9AF8B78F43552184632FD01AA82D7AFA98D75DE2CB2352CD417B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommunityToolkit.Mvvm.dll

Path C:\Program Files\PDFgear\CommunityToolkit.Mvvm.dll
Size 112KB
SHA256 e81f937cb4a70645e5106b22cc4972d4009f0527f19efa10eb74115c155fc66b
MD5 634fa35f5855bea7fda4f5631ecb7aff
SHA1 982159403969b8d4a5ea31d99d18e3ba927c9ed8
SHA512 339d20de6ed61e7b86d43305198beba32a26d7e7721923219d475e0112f5429e01998404c4fdd10c0630813e55ad766ef3f2f8aa1df3c937c2b3a3f88bf22061
SSDEEP 3072:H+c+yfwDziGuqRGia5iKYR2l+EaXcw+MP:H+8wHiGuri8iI+c
TLSH
T104B37C0263E85E13E6FF0F7564A8504A8F32FA07B932E39A598C63F519837905D533B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.exe

Path C:\Program Files\PDFgear\FileWatcher.exe
Size 814KB
SHA256 42d1b837e869a6b8f34d68d8afdef62bf7a5c75e44f7f57f7b8f6bbaf7be6245
MD5 d60cbbbd34d7c8c1b3fd1a25f79fb64a
SHA1 235adac606b2fc359ddaf2e650cb4b004554654f
SHA512 2a9aef4e8eecbcfe00581dcc83e591a56f9c2d3201774defd9a99d218d9a645bbb9d7365eb18f26914eb7b37945adf6029e05a4d30aff684a1c4c1bd16c9d579
SSDEEP 24576:XPvGiuLgs3T1Q8XLdr9UvG2uLgsjT1q8XLdS:XPvGiuLgs3T1Q8XLdpUvG2uLgsjT1q8Q
TLSH
T17005DF191E205D85D5F5C834E674591899BAFCB3D2B9839108B73CA0CFFF7B26A628D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Bcl.AsyncInterfaces.dll

Path C:\Program Files\PDFgear\Microsoft.Bcl.AsyncInterfaces.dll
Size 25KB
SHA256 0b6f9b5ef96cf05fbe679787615fe7dd7e213e888a2802589dc8bcd0cdf30d64
MD5 ce24cf5922ec53a5f36b8e82166fc7d7
SHA1 b5349dc28c96a0413870c3ae282b535438125d71
SHA512 41ec49ddb1dcefd61534c336c4014b93707ec9b0c302626a317c73b79f547d5fd6c68f89b1de7e62d75da44e9e006c87d4d3589a8803b3dc83341688898586ee
SSDEEP 384:rBOJWqnwGBbNAJTt0VES2j0cX6dAl+NWlVzrdcTVWeP/WLOwnHRN7k9YMTR9zmA:NulwGBhMOVv2wK5bdcT9QrX5g9zJ
TLSH
T136C26C1AD36C5317CF6A2EB5E5B486422E35D38A2C13EB3F1288F2D91D97345A730639
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Data.Sqlite.dll

Path C:\Program Files\PDFgear\Microsoft.Data.Sqlite.dll
Size 168KB
SHA256 988fcc9427ab190b4ca3eae9e6330e95b2f90d6abba08c3a10b5cb51dcdef18b
MD5 6aca8bc546b40196b3f5aeebfa56ba22
SHA1 d407f1883dc734a1a8e212812c9ed8189c58d752
SHA512 3d195aee8dfcaac10c106c7bbd05ad1a6a64ac51638fdaa6fc7858d0cdaae73f6ddcc5571de1ceac6e695b14ac60544a836fabd76b560bac59784eff788ff093
SSDEEP 3072:HRSyOAvNY0Bamq9GVo1Gp69xyi8gxATCerwr:wIfBamhogIDLcCe+
TLSH
T1B3F34AA547981053CFEECE31707AAC8907786517E9A2D747AC90E4EC3963324BF447AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.Abstractions.dll

Path C:\Program Files\PDFgear\Microsoft.Extensions.DependencyInjection.Abstractions.dll
Size 62KB
SHA256 61560b34c66fda00374708e91d382206dc2cd0be567e25403f804d4d8c30d89e
MD5 25186aea27c425bbf52ed05de76f7678
SHA1 93140c3e0b1e31ad397ef4ba76fd374f295c19c0
SHA512 20e97bce8167c0a51b6f6fc941a740456e7e995f1515f86496aafddfcd99be224edc364d20fa6cbbb2e59238c389bb3de34850a2df515c8acd03f0482c86eed2
SSDEEP 1536:H6DVJaJ3loULUr8nKvhXhwBTgidJaXQcKz:H6DHawULUoKvHw5giHaXQr
TLSH
T1FA533B6423FC8726C7ED0AB4B87395005F35FE476203DB0E2A4EA0A515B7FC895A1BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.Extensions.DependencyInjection.dll

Path C:\Program Files\PDFgear\Microsoft.Extensions.DependencyInjection.dll
Size 95KB
SHA256 b90b465db7051df80f13cfd91ba1ff59038d6753eae9f37d30975c5d2d35cf53
MD5 6a7a6e7de73091ea4be84b42bc85348e
SHA1 fe07027a747d59be980129bbeaad999fa6762e42
SHA512 af05c56ac1b34ea29f6b2c5a3ba7518135fe655d535882d5a7db6cac68ad11b836bef46b5b2fd7bee75e2d84dc2127cd78d48343eb285a0360a7ddbea2740985
SSDEEP 1536:N6Mn8aTptaddsV0dSE0jq/QjJXpZoRR4nWB7u1hIatvmapwGqrdLcMQc1zUizPM:N6Mn89dsOdS+mm7WY7u1hIatv5pwGqrO
TLSH
T18D937D3963FC8B66D7DB1DB4A87841050F75E6CA7002E35D1E88A46E1E57FC20A233B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsAPICodePack.Shell.dll

Path C:\Program Files\PDFgear\Microsoft.WindowsAPICodePack.Shell.dll
Size 529KB
SHA256 e6fa9d9e34ff3bf63ce782654b14e4b54a3abd1022c87bc099032c2948157672
MD5 54fe9a2748c4a0f282d4ec91e3cadc16
SHA1 970b783a697d893ecd4916dd86b5ff7574896c9e
SHA512 c7d567e3c039f98f3a99249b2d9bc2186c34efd73eec421331732d2307a8af940911381e27b015f58d0f65871bb4b038cc0f27d3fa495acd08994226bb033b7f
SSDEEP 6144:KRAFnp++R1yj124hKX97kANqQHlWBwn9dgPan1W86b8c3v6n9c6KwZErn+LYHtA:iApI2D97kANVFWBwn9iPIL9Mwh
TLSH
T19AB429207BBA811BE19F477CE5F61721D7B58602B213EF0D0E8462AE2DC275645839FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.WindowsAPICodePack.dll

Path C:\Program Files\PDFgear\Microsoft.WindowsAPICodePack.dll
Size 102KB
SHA256 418b5e7a96f9a6105cc6fe45896a9164e79c8849f40be23a411b5563a8e3a0d0
MD5 9531b41519156855a45c46f0b379a784
SHA1 00b857f09dcf0c71dab40c1a8c4c54d411fdb197
SHA512 10034288101d235cb7af984fd6a0db11c7f56dbed648a71596b8b0c93f68d5ac5cf00be033153a91e71a311374b220507f07aa5b6e1849a80930d37a5c2577f0
SSDEEP 3072:3BPJ2fTauHhiiWPCeOMt0ImL6HKgqYR1FliQ:3UpWPCeBHxZ
TLSH
T18EA3396173BC467AEAFF2F78F8255120CBB2F9862213DB1F2C94754E08927809959773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Newtonsoft.Json.dll

Path C:\Program Files\PDFgear\Newtonsoft.Json.dll
Size 695KB
SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
MD5 195ffb7167db3219b217c4fd439eedd6
SHA1 1e76e6099570ede620b76ed47cf8d03a936d49f8
SHA512 56eb7f070929b239642dab729537dde2c2287bdb852ad9e80b5358c74b14bc2b2dded910d0e3b6304ea27eb587e5f19db0a92e1cbae6a70fb20b4ef05057e4ac
SSDEEP 12288:GBja5bBvR8Q0TE2HB0WLmvXbsVG1Gw03RzxNHgKhwFBkjSHXP36RMGy1NqTUO:GBjk38WuBcAbwoA/BkjSHXP36RMG/
TLSH
T166E4394123F98F2BE1AF6B75B4704E1543F9F917A6B5E78F9A04D9A91C43B408E403A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFKit.dll

Path C:\Program Files\PDFgear\PDFKit.dll
Size 1.0MB
SHA256 ce9200cb4185ad61f65d13ebfb5afc281466a63a168188f4de25210d354f0d30
MD5 ff59f3a7660a0c8c3400e08524769d52
SHA1 9db55b033618cc0b48a63dffc228ba02dbe53387
SHA512 fa003c8fe53060d7b2246e283f55e404e7490957f683003d3fb860c9d259d8e37e211c7994e7a8390b4f25671259465ea099d06c02dea2ddd13265391ee6ed6a
SSDEEP 24576:Hl/fMd2Yp+opXMZBdIbUXSGzZKumrzjiVgsAWK1:Hl/U4XopXfUXojiVgFH
TLSH
T1E3359E9937E4DA16E8BF1B3BA4710114C3F0D545A383E74F56C0B8D92EA37A14D89AB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.exe

Path C:\Program Files\PDFgear\PDFLauncher.exe
Size 1.3MB
SHA256 84f9b6b5610a539d4f615dc0e57ed48316363a46427c665ea6b4bce17e18bd74
MD5 27d7346c98f00a78ccfb9f3b0119548b
SHA1 21ec7c10bec85f9562e42ed35227790821e1a3e1
SHA512 a18c0b2c156aeac07e418f7d9cd3d4f0c58cdfc1bef151c897c6aa27b4ad457d7cabb77cbd52dfb1d65f6ad643d257c34cd7784e4ca76691aa7e464e33cde5c9
SSDEEP 24576:dZ0P4hQuKvGiuLgs3T1Q8XLd6ZzEPkxOc62VovGbuLgsxT1B8XLd3I:3hQuKvGiuLgs3T1Q8XLd6NEPkxn2vGbK
TLSH
T17555B5596E204D94C5E6C834E534991899BAFCB7D2B9C28008BB3C55CFFF3B26922CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RegExt.exe

Path C:\Program Files\PDFgear\RegExt.exe
Size 771KB
SHA256 85675fd909c2fefad54432a9b5444a49440c2be5f95a227c2249cfd6e40e4542
MD5 7a481425b57e58a1fee350fc1f1d02a0
SHA1 6f209968af6047879de1c36379eaa62843a5183f
SHA512 0620e781a2be1bcd63811e5954c976c61223f7ebab976d112d17ec0a9736542b1c24d1d10e1b2d4886a8da2a50bc1f47636303baba82895eb3d8efae13456811
SSDEEP 24576:EvGiuLgs3T1Q8XLdHvGNuLgssT1r8XLdf7:EvGiuLgs3T1Q8XLdHvGNuLgssT1r8XLt
TLSH
T1FDF4BE191E205D85D5F5C834E674591899BAFCB3D2B9839108B73CA0CFFF7B26A628D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.batteries_v2.dll

Path C:\Program Files\PDFgear\SQLitePCLRaw.batteries_v2.dll
Size 11KB
SHA256 ad70b8db3c16ed9625d29084e649f36a466082d390a6e3d5de261f1782b6e918
MD5 0a41faf291ac8f84d09a0013f7a2560b
SHA1 337661f711183f51c5417a7cb15bf6b5444a8191
SHA512 1e43ab0da2958344c0974b9190602c416233b8aa1c71431f48c2d5bf8e664e3022069afc2cda472f531d7a71bdee83f4e2d271046c3d7882b97d70e2686480d5
SSDEEP 192:dLhQCwvA9yV+FOdJNxzYBH8aZ2L13pS9mWgcUcTVRqAAWJ:1hKpVrjMBH8aZqmg2TLqAAg
TLSH
T14532F849ABE24626EAFE0F3178F306004271BAB9F931CB1F09C5A3795D72305A6117F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.core.dll

Path C:\Program Files\PDFgear\SQLitePCLRaw.core.dll
Size 49KB
SHA256 979edcc9056ac06d5f52b12d9b7733b1217914ab50bf123ab312e027e7ac57a5
MD5 b2ba7e54a020ab0461cc7e575f6edf66
SHA1 004884df52183290966e2fb61c3575df11e58148
SHA512 fcaabe2a1610939034196d3d6275d78f2f17587c8e36bc8528848312c11766eec1f83b7dcfbfcfd8a824eace484a705ad7953cfac718dd67df4f6bd2dfc32d0b
SSDEEP 768:JmOGveifSTtyXEQ3nPGLb4PFvSMJCD2j+XIfHq1wJd9P581Iym/DskE:3LTtyXEQ3+bO6U+4lrPi1uLsF
TLSH
T1E033D9750BA19E2BF6CE5174A03F0096A674C119B77BD717AA84E0F0AD733C607A11BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SQLitePCLRaw.provider.dynamic_cdecl.dll

Path C:\Program Files\PDFgear\SQLitePCLRaw.provider.dynamic_cdecl.dll
Size 63KB
SHA256 4843586486334848317a3a0019833ab6e4749655c31dcf418de5ce2be93abc67
MD5 2ac53c084d23691473d38def1bc0a938
SHA1 6fa5a53472388355c62229270d4c6ee246981f9e
SHA512 70528521ff9f894265913385df3d3158c21dd357e84d4af4a4a481c37764b33a36105b22b679aadfbf44287afcded3e7e1ff7d05d155f5ddd3182046b0249fb3
SSDEEP 1536:jjb2NmqeZsE64aEKbMsZG0EN3ovewf86nWE7LJ/ZECig:jjbUmqWL3MfWkVRR
TLSH
T11F53A596BBDB0F91C4CE8AB57D72098E52F0F28EF693D717A149E234BF4232146C6164
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Memory.dll

Path C:\Program Files\PDFgear\System.Memory.dll
Size 141KB
SHA256 b8fe216aff0f6d162f8eefe7be1712162b7d8199e20ce2e70ffac36c7ce20a4c
MD5 35e6237ff5533342516bf01a46e4b7cd
SHA1 f8a118f07eea37ce732b487ab730646dedc46235
SHA512 dce731c61aea73d16813b0932d47ac94926d84d9077115ef147971b1e1c76a88e333ccd0f88b34fca9e2533f54c140947316fd63415199fe5f20a45cd0aef033
SSDEEP 3072:wPgSRYPuMbrhcabqwwwUtiPmu3XxNtvckP:2uPaaWwww7OuR4k
TLSH
T1F3E35CBC67C6DD12CB5F4C70A028621A5A31C63FAE42F7E215C9F4F436A27A935193D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Net.Http.dll

Path C:\Program Files\PDFgear\System.Net.Http.dll
Size 193KB
SHA256 b5d20736f84f335ef4c918a5ba41c3a0d7189397c71b166ccc6c342427a94ece
MD5 665e355cbed5fe5f7bebc3cb23e68649
SHA1 1c2cefafba48ba7aaab746f660debd34f2f4b14c
SHA512 5300d39365e84a67010ae4c282d7e05172563119afb84dc1b0610217683c7d110803aef02945034a939262f6a7ecf629b52c0e93c1cd63d52ca7a3b3e607bb7d
SSDEEP 3072:HeruQlNGOhYq0AQcTvankc+8lbKta4FUPAT8xpRI454I/Kv6RpZ8dwPSgEQ4:aW60VcTvakcXcApOW4
TLSH
T1A2146C14A7E88A2EE79F5B75F038466086BAF7C37902E76E1C54A4FD1443B90C6523E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.CompilerServices.Unsafe.dll

Path C:\Program Files\PDFgear\System.Runtime.CompilerServices.Unsafe.dll
Size 18KB
SHA256 2d6f419d641682d8efc4a40e850d2e85de519d6823b93daf2aeee63206d4e32d
MD5 aa7a54f5a3ba48e60d51e6eeb378404d
SHA1 e5d644311a6087c6a500f0e79bae4af305430b3d
SHA512 b033330695b4edc1bef5d36d98e1a68f5862469598cd6a71cafb8f72732d29403d4e8b9e4df3809c2f49dcd59d5ca751ada97ea9b7e268298effd6e19eb52399
SSDEEP 384:hkGbUzdrbbxHKWgr2WXTX6HRN7K3/7R9zXL/Lq:WGAdlQTWoF9z7zq
TLSH
T1B7826D20C7D44543FE673B3055ACE583BE38E7D51806A3763585E97A2C963C8AF3562C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.InteropServices.RuntimeInformation.dll

Path C:\Program Files\PDFgear\System.Runtime.InteropServices.RuntimeInformation.dll
Size 27KB
SHA256 8bb9d52ba5c67f05c8f632deb1e7e98a909318b10e1388b47e919515fdd42cbf
MD5 568b53398bfc0e54aaf448b68f5c77c2
SHA1 76b0b6e65e38a90a4ecdb3f6dfe16d5a803081e9
SHA512 6052ee3664fd2095de3338cf6d24df022dc13d00b4bf14c57572f2a34ac078e07bd1f634a50028db0952ae8067ffcf19079177fa534240d9526f33ae1e1459ac
SSDEEP 384:OkUwx9rm5go1fWKmmW6oqN5eWjaWsFm0GftpBjZNaQHRN7ZtnlJCxJ:lrmoFmWdOMViLNLZhCb
TLSH
T1EED25B55DBFC8602EDDB0E7079B0E5876D3DEBC34D21AA2A0499E4881D973C86721F39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Runtime.dll

Path C:\Program Files\PDFgear\System.Runtime.dll
Size 28KB
SHA256 50ad612d4cf6113de26b2870da099c4817f59e64a2da98f05803b4a2e2304919
MD5 0e35085c130d2d91e5241334be7ef0da
SHA1 fd622ade5cae26353a22b6fa50a83669b72b6c41
SHA512 2498811f4aac308cdc55c3406bea4fef5dc9e6f23559b09fb181f7447474ef586f00038282ddc39c241490b5dc2bca7f41f19bd3e1bb00890da29df6489bb151
SSDEEP 384:fbhigwLAuZtM66g/Id7WVXWbC7Bm0GftpBjyV8aQHRN7mT1lO62gHcX2:fbhzkKsrVi48Lpg8m
TLSH
T11AD21AADED7C9323CCAB5B7075B7D5C279F9F3D30831552610CAE68928873948B21729
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.Threading.Tasks.Extensions.dll

Path C:\Program Files\PDFgear\System.Threading.Tasks.Extensions.dll
Size 25KB
SHA256 4f81ffd0dc7204db75afc35ea4291769b07c440592f28894260eea76626a23c6
MD5 e1e9d7d46e5cd9525c5927dc98d9ecc7
SHA1 2242627282f9e07e37b274ea36fac2d3cd9c9110
SHA512 da7ab8c0100e7d074f0e680b28d241940733860dfbdc5b8c78428b76e807f27e44d1c5ec95ee80c0b5098e8c5d5da4d48bce86800164f9734a05035220c3ff11
SSDEEP 384:1R973o62/KqcAnb05J3w0I5eUGef8s72XBWdvVW2JW8aJcyHRN7WEimpplex:1RZ4nNxnYTb6Blha
TLSH
T1C0C27D0987AC5567DFBB4F74A6A6D9069F30E7476E02F3291D8CF2E40C533892A6113A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.ValueTuple.dll

Path C:\Program Files\PDFgear\System.ValueTuple.dll
Size 77KB
SHA256 e4774aead2793f440e0ced6c097048423d118e0b6ed238c6fe5b456acb07817f
MD5 8c9424e37a28db7d70e7d52f0df33cf8
SHA1 81cd1acb53d493c54c8d56f379d790a901a355ac
SHA512 cb6364c136f9d07191cf89ea2d3b89e08db0cd5911bf835c32ae81e4d51e0789ddc92d47e80b7ff7e24985890ed29a00b0a391834b43cf11db303cd980d834f4
SSDEEP 1536:6784YWau8lqubx6WxXLA+o2SLFyEdux136ytgHo0AuresehSAPVGHMc:67NV8v36tI0XCKAt6
TLSH
T1CC73E92823583663C73E853318AA9AC75BB8D30BD746177B7DEAE5E818E1774B301274
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\de\CommonLib.resources.dll
Size 21KB
SHA256 e2a85f48610e16ba649ec10ab931951d86665e1feed7af4be01ceba9972ac7f8
MD5 4e34e09dd62ae6b3f19c8b7228be2dd0
SHA1 4c355c11aab19fd8ee313bcbc636d2ecb3523eb1
SHA512 26067aa8de62d8255c9d07ea0f73ae9f38571f11e974134f5249c5a8b822b4eb412a5c6a93d09678e0e038beb38c0b76508b43c452a38db40ff142ba8e5f810e
SSDEEP 384:RqraRHwa629DFEzE39UU+InTN+W7KmMwUaym/BU9tP:ocHwa5EQ3QITN+WuRwLyKE
TLSH
T1F0A2B65217F9106DF5F38FBCB9F49966AE36FE621D18E01E4154406E0A92FA0CDB133A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\de\FileWatcher.resources.dll
Size 9KB
SHA256 309b8a45c9fe6b616918cc0999183d6224389b4d8cd4bbef317fb0e9728e4bd2
MD5 6882f63ff403d04ebfb2193ce94ac7b8
SHA1 6f24cbc8413b6e35e171da119d3af7c68aad1317
SHA512 61aa7384076afd9388036bc4eba42ab7dfc185ef604c0e8102faea44bba31bdde96911582337162d65b5a0c397230c667997c79163422e6bd58c0c57bfa1c1d6
SSDEEP 192:KRWE9qGw+qxoNG4oInfrN+BqKmMwUani64m/BM9sL:KUE9bUU+InTN+wKmMwUaym/BM9sL
TLSH
T1D9123BE38F7C0052FEA34F30F4F15653BE33BAC41A6DA56E914490127C85B905EA263C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\de\PDFLauncher.resources.dll
Size 18KB
SHA256 df62030f0fc3922c9537f4bfc191ff69ebb2a3748466dad9c215fed3b9126123
MD5 4e073597319e984c122d6b7588455e08
SHA1 7b5f3ecf5e42bfbae4d2826a88f518950f2cb250
SHA512 2b0fe031a4afd089ade9c43129e44512ded6c77f1d92cf0848afae074d419a90b109e559edcb9ec54ef294bc8cfef7258c64d4e32ba5dc8679fe6c63b17d3176
SSDEEP 384:+RjZHgZ3osybC75y3G0WA9rIhUU+InTN+qZmKmMwUaym/F99e:cAZ3osybQU3aABIUITN+6RwLyKQ
TLSH
T1E582A2611EFE100DE2F3AFBC76F851659E37FCA10E14E41E0528504E9952F90EDA2B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\de\pdfconverter.resources.dll
Size 30KB
SHA256 d3bf2f67c6299880ee346f44255d9f878cc3550c8428031a00022d88b3d0bf0d
MD5 0444031cb1f058d9bc46d50a1b4cba2e
SHA1 6cb69a773a5170caec88d7d21616a76507ea3762
SHA512 9f7a2dc2d5903dd07c9a45098449f276affe3eb82ca964c6b3c8c7f75a1f17c03b136133b737fa2675b8389858d245460e829254e18c22773b28bdaba8c6fcaa
SSDEEP 768:n7fywXcrd6oUpdfn3LTdbcxDcLvutpzQNsK7eITN+CRwLyKX:7fxXcB6oUpdfn3LTdbcNcLvwpzQNsOeZ
TLSH
T196E24D523AFD140DF3F3EFB87AB84558AA3BFCA41E21E49E4015504D2972FA08966337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\de\pdfeditor.resources.dll
Size 128KB
SHA256 ab3f86f7d9f81668f7bc2010f30075006f1194d877caf54c2516a0ce8468b036
MD5 583bda624d453d2a807e4c2e973d1328
SHA1 03e7c4fd8e7565c954e624719ddcbfd8c45383b5
SHA512 9419c953302dde7d19d45218880c1411e0e8a5e03d090c943d39f3a2cc850bf77bcbcbea26e2de344d4e0689631509c1bb395e3063debe72c154f9928a452105
SSDEEP 3072:IGDyJAUB62wpjfyHTovHkfjxsWAluEigd2b0K5kfxc24b79YYuVOHSci3ocxccwr:MvZrx6BRhJosy
TLSH
T165D340126BFE110CF2F76FA83BB89658AA36FE765D16D45E0425908E0632F90CD64733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\es\CommonLib.resources.dll
Size 21KB
SHA256 183f8a1db114f198e9404a32f24257b4656af15ae53f7582a51cae48da66d1bd
MD5 4df4b64a1dc5da3cd48c8d85546ed698
SHA1 5f6a202cf6b7c31fc48bdbc560f8927b94ffeeee
SHA512 426236d4a043b4ddea8d88adc7722dbd0e220e4fcc0075219a11274ebc55f08cceb806916fa91f6b130f349791b8239bce0ab7dccee11e164927078c8e09be0f
SSDEEP 384:JvpVICNZVMqqjGDhmjd3EnoUU+InTN+IKmMwUaym/N319i:3VICNL7DSd0n/ITN+BRwLyKZ+
TLSH
T12BA2D5925BF80559FAF38FB9BEF59515DD32BD622C18E0AE8154405E08A1FC4CE3273A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\es\FileWatcher.resources.dll
Size 9KB
SHA256 e581193233f4f4cb6e2d06dda496451157f312fd6f835b1ca67ea479c7db7023
MD5 a9a9dd2e32d90803ff2de94c078e199c
SHA1 33468a77f7408be657fc63fed8ed24ca910db3ab
SHA512 87e89dd15206b7a17bb52f887d9cec09a331f7731cebf246970eec08577a449d40bb4355f87250f2f947310b9d1af05c67a584c714d64491f7769e9caf74e5fd
SSDEEP 192:luOnEtew+qxoNG4oInfrN+BnQSKmMwUani64m/Bp9X:luiEt4UU+InTN+ySKmMwUaym/Bp9X
TLSH
T143123CE38F7C0062FEA34F30E4E25613BF37B9C45A6D656E914490157CC6B906EA293C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\es\PDFLauncher.resources.dll
Size 18KB
SHA256 a990e08223d541347eff0194a5d79bef0b736094f247eb886c627b67f9727a5a
MD5 d003bd7f10628a205cb19d645b2423cd
SHA1 6af632bbeaf00af7602babfc899ec1afa912a524
SHA512 6abedfb02cd814e459ae21cf8f51a0299a096dc643d713609e3ee006caf61f8f3bbe3906a074c444414bd88555b8b2287fb7edcdc9c822d3cd0be3c5aa960048
SSDEEP 384:w9jch8l4pBDa5KJeBgr4eUU+InTN+4KmMwUaym/BB9Tn:h2l4pBDOKJeBa4FITN+xRwLyK9
TLSH
T1F982A2212FF91119E2F3AFBC73F95212DD36FCB11D14E46E4164404EA956F80E9A2B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\es\pdfconverter.resources.dll
Size 30KB
SHA256 329238ce6407f0bc61c287c14509566998009abf6950d1a05f7cdbb8a5d9ce7d
MD5 a4b5a36a0a4680d1ab288d7260ebf98c
SHA1 186887a65c93744d1720c182eb410a92fdad5765
SHA512 f15f01197058fa04a19d49fbff619ac41f54ec372c4c3a8f94685a646a3c46ed08c511d64f65ebbeb80a6df891c63a017b9a357200d70afb415e507ee7c494c4
SSDEEP 768:zVbok3bXCGx75iLUdBHXUUE7mITN+zRwLyKU:5bzbXCGx75iLUdBHXUUMmITMRRKU
TLSH
T102D23D123BFD191CF3F3AFB87AB69505993AFCB12D15E49E8021544D2872FA0895273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\es\pdfeditor.resources.dll
Size 125KB
SHA256 eca007632e30d3fb61b621f5269aba1b583686e3bc10afd0163b351204da49bb
MD5 f565d3f8e0e95b9a70f050cbdb09d880
SHA1 2d45b685298492831701eb0d32765ec4adabfcc7
SHA512 bf3abe7089c267754c962846e0688b110d971414c3ead4f693c7952586a8dc777f7ed1bf7919dd06b9cdbfa5fa3ab990aaceef4cf4267871dadbd40c3c4b2600
SSDEEP 3072:KGDyn8rQfUdjdybRqrwEgqzQJrOARupKgqIbDOMfGicALHhW4GHtO2WcPzHoR4zJ:WuBEJCwEgYVg
TLSH
T1EDC32A227BFD161CF2F36BA87BBA9219A976FDB62D05D49F0025408E0576F80C961733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\fr\CommonLib.resources.dll
Size 21KB
SHA256 2049e2b29334d0c29671fbc4a680830d6265addff9fd46048ff7c001f8b451e5
MD5 99cf11ba443c0c65e770c92fed6c2df1
SHA1 fcc48473e5a71edb63f16d244eefe2b1c534ff50
SHA512 613c7d688cac6db233e95e41dd68c3e88f059d9ac69e4669ea02ac89552a1a3163887ea5209dcc1733f9e9945204489ca305e1c3190421686fda0fc71650592b
SSDEEP 384:6tYGMdw/JE9AQF2xnnaic5UlhEHxDUU+InTN+DKmMwUaym/FN9B:Vdw/J0Dz5UlSHxuITN+GRwLyKf
TLSH
T1C8A2D68657F9115CF8F38FB9BAF09926DC32BD616C08D46E0054015E09A2FE4CEB237A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\fr\FileWatcher.resources.dll
Size 9KB
SHA256 586c8773b92cf86d5b3a4f209eda63bf3fa74f8b31297c72fd7b0106cb2d24b2
MD5 ad51bbff0bad3700c02404e3b4f7408a
SHA1 46c9795161505327abe7763224bc52a6d75c9c73
SHA512 463b6fe185aff69b4e09f0939b3edfd723cf1d664d234020161e29bb085be6b29cb9f4b55801fe7f8750264d3b1e8b25e5ff05d8ad8525d6639884d2a6e9b1c8
SSDEEP 192:sLlEtOw+qxoNG4oInfrN+pfYKmMwUani64m/F8092:sBEtoUU+InTN+iKmMwUaym/FT92
TLSH
T1CE122BE38F7C0052FEE34F34E4E25613BF37BAC41A6D656F905490226C85B906EA263D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\fr\PDFLauncher.resources.dll
Size 18KB
SHA256 fc9bdc543c5aa616ae6cdacea2fbab8d113aadb6b54acbe514c832ca060a4015
MD5 16d000ea1d45996f2383788a50e8287e
SHA1 955eaa3ca213dfeb0bc1f69778dcb6580ff2a413
SHA512 5632a9ffc0c336164e6a6a9222bae9851184cf30762e3925bd2f3328082b79b3057a97045a6712d350e75565d970df892999d8beb7106371da43bb578e2b5fec
SSDEEP 384:J1ju2QlpwcfqZXVvc9cycr+wUUIxmr4rUU+InTN+PKmMwUaym/Bz9H:e2QlpwcfqFV4cH6/UIxI4GITN+CRwLyG
TLSH
T1FE82B3616FF91019E6F3AFBC72F591128D36FCB11E05E52E0558004EA952FD0E9A2B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\fr\pdfconverter.resources.dll
Size 30KB
SHA256 8de341631a1fea9234db96f23411c91183decdead7474b2b61de75cf6230b866
MD5 a9185c78cc43544ec283c54a74270679
SHA1 66874d044f666ae446ffc1773520aa73c4c6433d
SHA512 b2f1c489f057277485dd30f02cbe036822d5385db57fe2abf5eea6497d7388c72d48a4aaaef7b47d6659d02eedee39356eba7741f5705cff80fe3371deca3ed2
SSDEEP 768:kyXyzlnKM6USS3LEdz9T9VrcCqWwUhVd73ITN+LRwLyKwa:HX8lKM6USS3LEdz9T973ITiRRKwa
TLSH
T1ADE25F123BF9140DF3F3AFB97AB59106C93AFDB45D14E45E4006604D2972FA489A273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\fr\pdfeditor.resources.dll
Size 128KB
SHA256 4cf96b19bc5c2858bd0e0961d4c9c81f4e5c62d26b90d95005e8a334354f13b3
MD5 face2db8541dc595efd36ee48efc51bb
SHA1 d7004af12071c1810495cfe2f68b9118138b9e32
SHA512 32b329c0d2eda8f5d15ed3c6cfae685da2ecbaf92ae34a560c68ddd6536b202526bc07aa37283a7e6496da31a5f8f53156e538b9e9bafa99137fd62c9c29eb5a
SSDEEP 3072:WGDy1u4dJUsB+Mjcyi2xgseUeVpAOuTvgfrbIuFO5T8wg97zvaSvLA1kCQs7t5Eh:CUGLengirOteZd
TLSH
T18AD34E16BBF8210CF6F36FA87BB59219D936FE7A5D01D55E0429408E0672F94CAA0337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-IPG296VDGC.tmp

Path C:\Program Files\PDFgear\is-IPG296VDGC.tmp
Size 19KB
SHA256 34b32542bff5b97386f0044748425a31797bb634d22dc1bc7253dd01aa350345
MD5 c80f25ab27aa5339e13dca21169c17f3
SHA1 459c53201181d672308a26771ee56ad50241d90e
SHA512 8772f0d2c7c4af18959f6a75bae570c6a3703b61f6d71933a3b9a33c6fff6fb948bfb91149b3ee6fdc6022b7a92544e4c451dee1950f8be1481d609aaa06680f
SSDEEP 96:hrd4hjo0Gli606Uwfx0GReGWeGFuGgeKCUDuTeHOTu0U5e3eTOaUmS0SXStuKhuG:hrk8z5PUDRTHffIz
TLSH
T1D492192091C4AB998FB255E23E7B7428CB6D0377288C419D70ED6E4B8F26DD66607077
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\it\CommonLib.resources.dll
Size 21KB
SHA256 240a3ad8a9dd1a023059a81dfe32265c6c998fd123d22608d5f4a93c535deb6c
MD5 5e5572736ec530eb7a85712d42c1d855
SHA1 be833feb56524c08d96573ceba935052899cf5a8
SHA512 c2a2ef68dc0b2d2954ab12c8c92c5797be89d899d99c1193a211f8c21b8dcaa8c1a1340ae8f53c03d1784592e4a0552fd149ddeb307db74873a59fa8248e7820
SSDEEP 384:yyebco+/hllnv6eGMEXwUU+InTN+RYKmMwUaym/Nl96:LeIDDN6eGVXXITN+nRwLyKQ
TLSH
T19CA2A7965BF91028F5F38FBCAAF59945EE77BCA12D18E02E4154005E0A92FD0DD7233A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\it\FileWatcher.resources.dll
Size 9KB
SHA256 0a708d5bb1e80a91cb69de376022b9055be48c4cbc93a5b7973e81f5b5ba406b
MD5 5149a6e83a5d7c513e3c25c2d88f08a9
SHA1 89d05902728e800ed9e1c12495d2675200ba9640
SHA512 28391f32d9906069e575b672f1ac819fd3be4bc51d78efb9f6d8e31b418dce5f49e33f34b6cd4bf20d7d3addf95f5160736e06078a1e8f37c479369d4796eab0
SSDEEP 192:g1b/EN4w+qxoNG4oInfrN+BU/KmMwUani64m/BK9Ll:g9/ENCUU+InTN+W/KmMwUaym/BK9Ll
TLSH
T12C122BA38F7C0062EEA34F31E4F15613BF37BAC41A6DA56F915490267C86B906E9253C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\it\PDFLauncher.resources.dll
Size 17KB
SHA256 14fe76c5f3535553440c4860de673f3c03049287d9b2261e66b6744dd4323963
MD5 1366287484455d497d7cbd7d3697775e
SHA1 b6668fc9e46cedc7124cbf44c17e012a4729a7a8
SHA512 d430978129630d5f7ddad28a69e6e8cdf132bc46735ebf651626b296f751f11b4304d96fc1e71e53ae691f1400a109ad6c0987acdd329de356ade56e27991589
SSDEEP 384:KhjUp9WuxB5cTVO+EjPr4dUU+InTN+P+KmMwUaym/Bx9v:fp9triTQ+EjT4wITN+PLRwLyKJ
TLSH
T1A982A1316FF91119E2F3AFBCB2F951159E33FCA51D14E42E8554004DA952F80EAA2B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\it\pdfconverter.resources.dll
Size 29KB
SHA256 a872522333f0fc9adfe4358e478e5b738724bf7b1c3fafe9b75c2fb200133bb6
MD5 772218ceefee537474e97719375625e8
SHA1 878bb404a9adf3bba2dd7d2369619e5e6a592bec
SHA512 cbdb75fa41627554a96177f89a0308739620687f51fd35b7568c23c4b757e0dcb4c1a72ccfeb406ac7b58021e8300987a970be9ac815917f37e740055cb2d489
SSDEEP 768:1MNkJ8IxANxNizXLrd5bY15t9XL6M1g9IWWpYio07dITN+/RwLyKl:GNlIxUxNizXLrd5bY15t9XL6M1g9IWW0
TLSH
T1C7D2FD223BFD140CF7F3AFB93AB961049A3AFCB51D21E45E4005144D2972FA099A273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\it\pdfeditor.resources.dll
Size 124KB
SHA256 f6aeaa8485a1ac9641ad8b9b25e6906d6e15d3c9801afe8ac63bb9c22959f6af
MD5 113094f90a3883fd4d343e67c0b8aefe
SHA1 76ccdfa0dcb0a789fe48e8acce548c3f826d3723
SHA512 54f614857ca2bc55000b753e34213dd9ea6d44ba02510eb62269896e29e30d6c3c344cf2b27ad343bdc430593f203caee665cc67b6fcb767883c0857a718b1f5
SSDEEP 3072:MGDyY0RbRXkn272o/8yKDk7cZwJ1AouZhgNEbsJQ99FJlVyQ2xorbCAg3ZIPrrfV:QSwoZ8YLLGiofv1HohA/7qzIAIevO9VA
TLSH
T167C31E217BF9211CF6F76FA87BB9A208A936FDBA6D11D41E0425418E1577F80C9A0733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\ja\CommonLib.resources.dll
Size 22KB
SHA256 c68bb647628166ba6e629fffe0576cadb7135f60808d6f602ce42748f0ab6385
MD5 89cac03c62eb01e1eaf6e8b5e27b86fa
SHA1 a043fbaf642009aaa6d1a9949f4fb82d35d4a1cb
SHA512 31655637f201041dc30312efdbd4e6e518ebee6bb5d67d9bb154ca45871c076cf00c85ed0e427cc355f639c4b39fddf35e3e15e88ee831390f45565aa3e96de8
SSDEEP 384:YjAt4anM6j4HNzeaqEX1UU+InTN+JKmMwUaym/FZ9I:QC4mWzeaPX4ITN+YRwLyKm
TLSH
T1DAA2A56D43F91029F8B38FB5A8FD2981DC32BC52ED15E03E002C806E6961F9DE960776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\ja\FileWatcher.resources.dll
Size 9KB
SHA256 4a5d4c031944c59d25ad0b64454c514482d1830b5ecaeb15c6983c2d6d677672
MD5 2e98aa823d97965c520b132f939bc08d
SHA1 2b3f50828215cee60e6f0741f92325cd77a43105
SHA512 800c12f03130f5af933d9c07b1fbf75f0b6e766e8c27c377e30576a5621064fefdf5da251b262721ecd5476a14f01fe45e2304fc0de205f36231a7aae7907387
SSDEEP 192:OAazIEthw+qxoNG4oInfrN+RWKmMwUani64m/BU99:1aUEt1UU+InTN+4KmMwUaym/BU99
TLSH
T18A124CE34F7C00A3EEE34F30E4E15653BF37B9C45A6D656E905590227C81B906EA193C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\ja\PDFLauncher.resources.dll
Size 18KB
SHA256 dc0a9c9d3a475259193515161a5da9b8947c8eedd191ba7972b4f48877d4f4dd
MD5 d16629edc86b8df64110874c80a9121e
SHA1 386e0d75338f9bd542cc5b0e1969853685d4fef0
SHA512 8c22dd4fda2ecdb5d50f9ac67166993f40b254d3a707c3b717914b09467ec60ee34202c0a908170786d5dc1dda72c9a6a2865dc7c713f1d05719ae247b564e7e
SSDEEP 384:rxjejLb8G3m3aANrq1lznfSrYVFUU+InTN+wKmMwUaym/F19c:ELb8GfQralznfEYVoITN+5RwLyK2
TLSH
T1B482B4185FF91018EAF3BF7866F911919937FCA1AD10E52E455C804EA852FC0FE52B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\ja\pdfconverter.resources.dll
Size 31KB
SHA256 3ad0b2c480943a66a99ac4f2a2727ea94bec0b6545d125f6d29dccec028654ee
MD5 3329ec02cb257a8b4a19bcafc538cc6f
SHA1 c20e97d98c11675e809ee5c00e45b23e1f45aa39
SHA512 de5e00128d9d528bfa9239f809112133a4c36cf99b74d1db2066ef0027a0e69bb29643d110ef1a095f0a2fbad85ff8644e1e4649e2be338f92afdfd5d08d77a9
SSDEEP 768:FZUtLo2IDRSBZ3LSdsI5TT9Ev0Yn70ITN+5JRwLyK8:/URo2IDRSBZ3LSdsI5T5EV0ITmRRK8
TLSH
T1D8E20D193BF9140CF7F3AFB979B861848836FC65AD11E86E001E945D2872FA8D911B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\ja\pdfeditor.resources.dll
Size 133KB
SHA256 4ed47b19518936bc71228e60d6993e9ce30f837e94ed4b0b494bee860ecb2506
MD5 db53882666b844d2f087ba4ef3171c87
SHA1 12c978ebbfa1dbfc46cb85a0d75019e097698c4f
SHA512 dd98a345bc030e656da7ee0ae9548d3e27e1dda1bcdccf8db00efbf0e639ebf3f8d327719e400c666f45b788ccdf1d6e5c884d1bdde19ba61cd7fd220c1f106c
SSDEEP 3072:hGDyknU60fumYNnDDZFAGaxKNA1vQAKuZogiSb2BteIu9zvrhiJm9QWK7/w3vbf4:Nh2qn1aHJEDYn
TLSH
T190D32E1D6BF9141CF9F36BA53AB962849536FC7AED11E52E003D905E1972F88C920733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\ko\CommonLib.resources.dll
Size 21KB
SHA256 9de9bbbdfb2574ab0b1c5149e4bc9ba232b288834e9d8ac2d0721d633abd5428
MD5 2ca7c0612a7f55d42160d114d2790755
SHA1 00b736714ebec30abdf61c70eeba6908e72d576a
SHA512 fe4ed49e5a0edcc39ecc926b5b925ba1ab86a6f04d4dbe80c9123526997ade85510c0d2f3b3ba8b18a0af7db266dd284146a4f185ba726ccd240f9ea92f04205
SSDEEP 384:10mxXVzXG3pQmuqcIFM3WEndhBUU+InTN+qKmMwUaym/Bv9a:y0XVzXG3pQm/XC37nwITN+XRwLyK6
TLSH
T169A2B49217FA1188F4B38FB8BEF8A9128E32FE626F16D05D4454444E4861FD2CD7277A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\ko\FileWatcher.resources.dll
Size 9KB
SHA256 d5ed72acd91534e195354959a5ecbdf6289c35f0a5fb422e232deb27cc04fbc1
MD5 c04070639f98f3d55ac2c9bc78daae57
SHA1 eb6647f79857138d009d16611d235d9da5de9097
SHA512 49c4999fd9fe687a00db7709265bbef6ca298d783c357ee76c05b5ec37a312702a044c60c475ce3072d30fd104787fbdb9b6386b8852992ec871e3e38de1736f
SSDEEP 192:nswEN8w+qxoNG4oInfrN+RzKKmMwUani64m/Nm91:nHENeUU+InTN+sKmMwUaym/Nm91
TLSH
T184121BA34F7C0052EEE34F30F4F15613BF37BAC55A6DA56E905490266CC5BA06E9253C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\ko\PDFLauncher.resources.dll
Size 18KB
SHA256 eb7405794bec96adb6873c7f5caa82c9ba090d61f81c3ab6c37975f5f47ed263
MD5 d80a5bad3e51c96a1baa8d1f8ce28f60
SHA1 9c9fe16f2403e47333a3f889c96ae0913b794db7
SHA512 0fb54ed6ae658502b8a0f43a241ef34b0852a9d342b32099bf133df2a3e11ac0601df2800bcbb5577613c3dbcabb1822b8ba47f7f45bb581630e96f6acb0c438
SSDEEP 384:KRjNuUz5/6+sn3t8gPjjR/roPUU+InTN+YeKmMwUaym/Bj9L:+uUz5/6+O3ygfRjo6ITN+4RwLyKr
TLSH
T12882A2A01EF91019F6F3AFB876F96255CD36FCB11E15D42E4550044DA882FD0EA62B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\ko\pdfconverter.resources.dll
Size 30KB
SHA256 7d222b6c42cca3bfa547bc72ab03944094cb23d313a95243128bafdafcb898da
MD5 08c631349cbf46c99aae541ffe687882
SHA1 30d0492e67d840ed0ada0f48bf98e19a91b443df
SHA512 0f23faff3baa886740f7c05451d5bea0d8d4f24666c34fea92ae1d8966ef9b81b592c878c1147969ec11437320c95b11281dd75da673d102be6e271631057b1f
SSDEEP 768:3+1bx7286QD4kvLad7tuk7T/i8P7kITN+dXRwLyKN:O197286QD4kvLad7tuk7+8DkITMXRRKN
TLSH
T14FD22C923AFA150CF3F3EFB87AB85204887AFCB21E26D45E4441584C5C72FA0895273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\ko\pdfeditor.resources.dll
Size 127KB
SHA256 9c9b5d4b44282bc2a3ef009b4df490bc469b42501e3199a3704a865b2fceb69e
MD5 038275f59866010afb0d814d143a3054
SHA1 cab1e2fb0b528504fe80db4f4edad768d0e07193
SHA512 765d4ad20cde01d0991f1ec41deea57d60f2e62ab51f30255fb97e8812d35a316a7f41dc56a8ac0ba567901836744877b089122d3a5603d7980e5ceb540511e2
SSDEEP 3072:mGDyqJanjVwMlSY8jrXgbZPSTiAMuXeg7IbnGRwZs4r/N3+dJzsjtVT9GeDxTHZS:yM8VSsT/0Kw
TLSH
T16ED30D923BFA114CF1F39FA87BB8A6589576FE761F02C45E0820488E4972F818D61777
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\nl\CommonLib.resources.dll
Size 21KB
SHA256 7ce9152211df9ce9d3f3ae8ec633e3a0e78f35860f8b564dae003892796b2367
MD5 415a90ae43ddede13fd8081f9da38ee6
SHA1 c0720ee4a6c23feb505e43edd59372b3a4ba6268
SHA512 7c74a39755f3250efa5202bb80c95038eef4bfb97090e559945c7d879c96cd09c9d4cffe95d388361c10fd76e8855176593b5e9cea0f40d0f155ee07b247226b
SSDEEP 384:idMxEYvwsn+v6RvkMiZfIEHbUU+InTN+pKmMwUaym/Fx9F:ZEKd48EfBHWITN+4RwLyKP
TLSH
T1E1A2A3421BF8116CF4F38FB9FAF45916DE32BE625E18E06E4055805E0862F90DDB233A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\nl\FileWatcher.resources.dll
Size 9KB
SHA256 3a79b4ff2716ae6bb6da5ce8b9b001ae1e5c171922bde6e605d88125f05b447e
MD5 a1d53054f8f1ae126bc0a03217376b16
SHA1 cad6b3635cefc155320e0e7e2d21f3de79358737
SHA512 810530d1f2ca6aa89158a14341a61ba5ea8a9aecb21390444c6b11b7ef644c92190f9bb798d5ee3e0ff1fda0da77409119a3f31f9a1a0e302f462e99e92fba51
SSDEEP 192:uxZzE9kw+qxoNG4oInfrN+x95KmMwUani64m/N99Oq:uxtE9WUU+InTN+9KmMwUaym/N99Oq
TLSH
T12D123DA38F7C0052EEE34F30E4E25613BE37F9D45A5D656F914490267C86BA06E9293C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\nl\PDFLauncher.resources.dll
Size 18KB
SHA256 c52ecd7973dc78092fbc5ac5e23c8fb8619f7c4e770a051172db3ce549f386f3
MD5 bcb8b6bcadc9525a0a00048e72d7a535
SHA1 90128c7a6b3a1536fae3d926911ef7d81679f0cf
SHA512 bc503a561af1b0a6238c679bc8866c4616e23a59f81d870a1e7e3effbea5d06df15db15017099e5591504192f415f05b4617fd2b9cc081d01a27c04d33c50114
SSDEEP 384:hNj9waMd92hS52vfgrY9cUU+InTN+tKmMwUaym/F29a:SaMdE7faYRITN+8RwLyKZ
TLSH
T15482A2115FF94019E2F3AFBCA2F85212CE37FCB01E14E82E0558545D9852FD0E9A2B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\nl\pdfconverter.resources.dll
Size 30KB
SHA256 27281ad2138a8cb80fbb8eff1ce4e28d30a1ce9af71459793f52872aba38196a
MD5 173f3ef6515fba4e4c2d1c1f98f0ed89
SHA1 297bf8a0104f5cb688caf9bb673293e98c98c9ce
SHA512 e488d355570f4035c8a46249263265cbfdbda2817d520e2bf463847e6a9bcc2e38fe53af45b70122b0193ec7f1aff76a9e6810f1e5dcb10e99edc97ee6f2756d
SSDEEP 768:P8H96tUlWMrzhwLddLGpnAzKVZXxxlte7oITN+URwLyKq:m9uUlWMrzhwLddLGpnFx4oITDRRKq
TLSH
T11DD20B023BF9140CF3F3EFB9BAB855569A3BFCA45E24D85E4009545D1872FA0896273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\nl\pdfeditor.resources.dll
Size 125KB
SHA256 bc439c2848ce2064d97d0f8a1f7049afc4a45d87d313251ddbfdf0c3601782b6
MD5 7c82fe598f9ef30c69f6711d1bd497b6
SHA1 ccb3b11e84e5693bac93ad7affa6d6c13d85bd3f
SHA512 ee02eccc61719c2cfa0d9de8e07e45ecc7169dd98ac09d242fb67c72df447c668e01a5eecee94803634f175208a1e7ac8fef646a187e887bbe10fe4aae0fe6b4
SSDEEP 3072:5GDyC67/hQClNkZnRVmS4M/8oGu/AvuGzgcobyLhtjRc2mwylzNAueqOOGgeGz5T:VUbEoJycYu
TLSH
T190C33F026BFD101CF2F36FA87BB896599936FE7A4E15D46E0069849E0933F90C964733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.exe

Path C:\Program Files\PDFgear\pdfconverter.exe
Size 1.6MB
SHA256 09319b314f223e3ab8a65883eede6d290074f54b6a810b726ec45a9623e6f9af
MD5 9ef33ec35c9e92654c0625b386ecab8b
SHA1 86aa56c0da142822d7f90ae2047e8515c1b7cfa2
SHA512 4020cb0164f7810571e8101e597f8faa0f756e62ce154683d37ef7f260e966df64dcc3af637f1ab5bfdaf9705293d8e5228dee5869c60909b682196337e67b3c
SSDEEP 49152:fk4L/mwcV7JyavGiuLgs3T1Q8XLdTHFVzdvGDuLgsBT148XLdw:fyvGiuLgs3T1Q8XLdTHFVhvGDuLgsBTg
TLSH
T1DB85E8082E204D55D5FAC934A17459089A79FCA3E2F9C39108BB3CA4CFFF3B259529D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.exe

Path C:\Program Files\PDFgear\pdfeditor.exe
Size 8.0MB
SHA256 0f2f83233c1627f39a7eb1dd9ba6c29ac85fbc7057a440c94903ad0b3bb84993
MD5 5a0cc256892dcbe1bc0ac26f4db36675
SHA1 bc6d0639dd6f2a7c46d8e74d678ffccaa7d3112e
SHA512 c134d9315c1f6fc3155a06fd04a7151d500cd526301040026de271139118d38aa470977940f35e950e6e6483df8274b05847e9d375972805c6fe890bd23520a8
SSDEEP 196608:U7/+60phfvGiuLgs3T1Q8XLdRDsN4FeRPzd2SZPvGouLgs4T1X8XLdp:1qDQ/RPsmu
TLSH
T155867C935BA48C24E0BF863564B10508D675BF579BE5E20F38FE38D89FFA3515A102A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\pt\CommonLib.resources.dll
Size 20KB
SHA256 089c743dd936ba8f17989e0deb46ca7b7358d0213922a68990a321dbbede5136
MD5 faa942dcc420a5934bf74f6ed88010d9
SHA1 40a6032a89078c6b221944e138152e78ef7143ae
SHA512 4f9161fc6eec9ae94a13fd4eb5ded1d0918737540f284cb7aa0e0a2f1393b9b08f510a0e19b6aba184cdc8a160a6fce421f15068ae3bc41e12b2c82f69e4673c
SSDEEP 384:/pCaHyogaNsBL+1nEntUU+InTN+dKmMwUaym/N19Z:Fyoj8L+1EngITN+sRwLyKf
TLSH
T15E92B5521BF9011CF8B38FB8BEF55A16DD72BD622D18E45E4294014E49A1FD0CE7273A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\pt\FileWatcher.resources.dll
Size 9KB
SHA256 6a9fbd31412a4788c16e2b99033b73f850ef4ecaa22c49e4fcf46e72c0899d67
MD5 df8d6497f3494f458a456f00ab576a2b
SHA1 5fd199217aa1679987ac4e8df5e9b62d4e8e2446
SHA512 cbeb79e2057b853ab4bd700d3245a9d549cb9558c062fa861635a3b85b4051c81366ec1b29fc57d5a2769432844ea2ae26ef83082c1778be6d577c599c4eb30b
SSDEEP 192:thwSE9q3w+qxoNG4oInfrN+BWKmMwUani64m/Nd9bC:th5E9sUU+InTN+oKmMwUaym/Nd9bC
TLSH
T1DC122CA34F7C0092EEA34F30F4E21613BF37FAC44A6DA56E915590267CC5B906E9293C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\pt\PDFLauncher.resources.dll
Size 18KB
SHA256 234012a99c5acf6abe8593864bc8dbb120f1b7649d82d105776266492079ed1e
MD5 09a55d58076cf458a325285688a249f1
SHA1 3278e2513ff9aaa3f0c54f6ba2f9e9ec3a7a9e2b
SHA512 0415b4867b0dc80fb740060ac4e1b00ba98e42fc48c2f64af209545a2c11988682a39ec37d38be5c011d26b9cb0b653bddd672040ff1be946912453d5e774be2
SSDEEP 384:QljBbwwhONkgOJUqWWYorYOUU+InTN+vKmMwUaym/BK9Usd:gcwhONkaq1YCYVITN+iRwLyKq
TLSH
T1A882A2612FF90119E2F3AFBC73F95116DD36FCA01E15E42F4254014EA956F80E9A2B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\pt\pdfconverter.resources.dll
Size 30KB
SHA256 8edd070dc27963aed01cdff29a45ec4206a164cece650f33969eeb4a7818870a
MD5 28ed1b9356acfe44e427ea47e3365dea
SHA1 e6f8f5e194ee5be5a0533c97f0b323536492006c
SHA512 d2afee2b6a2827a26a0c7ea4601ab580ebf5d803c388ce00c536db367632a3946c17aa3e496f5020a013ddfc3ea9de4d5762efc8c309ffb63aebd922d5dd5f3f
SSDEEP 768:n2fNAudLB8Dp95LedAglR9MvDDj57Ig7qITN+TeRwLyKG:2fiuxB8Dp95LedAglR9M9qITlRRKG
TLSH
T1D7D23C523BFD140CF3F3AFB87AB5A515993AFCB42D21E45E4006144D2972FA089A273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\pt\pdfeditor.resources.dll
Size 125KB
SHA256 ad0e776426f373670e5aabdcd099468f99b0dfb39febecc20c5f133500e13dca
MD5 612419edce61efb570700b0a10a962ca
SHA1 4073d2a932fb38731ca1c193cd345908e11c6b25
SHA512 3cf81e798a342122a743c07fecb64d6f4719fc5a3bd5814d901d4de39fb2b88de4113ab15e007a545142e734cd4893174728595a3bbffae19dff8a02b4507b7c
SSDEEP 3072:6GDyfTcVAY33+XD8OC1YePhVWTeArupVgVSbqrpWCQ/ZPirN6yLZMOt6jzS1L6i2:m3WtTWD/DMa6XlFSmp
TLSH
T198C34C123BF9110CF6F76FA87BB99619A93AFDB62D06D45F0426418E0576F80CA60733
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\ru\CommonLib.resources.dll
Size 24KB
SHA256 612f0e633ae1c23b4ff7ef07295b477d8c9035bcba8c7aa22493a4f77b5c1b95
MD5 05cd9b5a466f6f73906c49ffec6865b2
SHA1 845a977573ffb533025b27185dbb3f5258d14290
SHA512 124e46bec99a037ff202a57bbb32c4be6b91ffb8923fa14de3a5cb77c3c68da3d54a07a869ff00a90ae84f991e8ad62d3c14d89af78c2328ed56288da1ec1ec9
SSDEEP 384:gy618WqJLSL+U04EpPs9WzkEHHUU+InTN+3KmMwUaym/FD9lc:odqVSSptMWzdHiITN+aRwLyKNc
TLSH
T127B2445117F9209DE173AB7AE9B06D09AC777DBE3F59D21E00601C6E24F2B60C93523A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\ru\FileWatcher.resources.dll
Size 9KB
SHA256 f1d41e1c4fdf04574b6fdd4f67ab4e9a5628a60924a390276ebdf6e45c7f66a2
MD5 896f68295e82a14ef9191c87f7348ad3
SHA1 26082c6f76fcaf6c218ca9c93082ebc8dd6f10b7
SHA512 49c5fc81b26c8c54489542801882b259d95d224db2cad22b58c69f93c3baf0a7b79babd6d5de093bd83c6680bc032bac300a6349966d56d77e1c489ddc2f66da
SSDEEP 192:irnCNbCEtqdw+qxoNG4oInfrN+BkTa1KmMwUani64m/B49/U:irnpEt2UU+InTN+a0KmMwUaym/B498
TLSH
T1ED124DE38F7C0062EEA38F30F4E15613BF37B9D41A5D656E914490267CC1BA06EA253C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\ru\PDFLauncher.resources.dll
Size 19KB
SHA256 921126f9155c185606079932a67ffa1155fd60cf228cea9c5f634c1c10464791
MD5 af054b7be34ef684793236f0b3e54bca
SHA1 ebbe4dc77b6ed982c1ef6e7c4c951e7441fa6a1e
SHA512 a422a3a7406db09bfeaca43692146a8cdf90ab5fe956cfafe8d8ec1feab67cf0b02416701bf985758dde718c1f6b7de200b4bfb023e96610851d2cc0467cca70
SSDEEP 384:C5jB2fwHYpUduS0RjmHrodUU+InTN+/TKmMwUaym/FMz98:SeSYC/ejSowITN+ORwLyKz
TLSH
T18892B6201BFA204DF1B3BF7DA5F819059C36FCBD2F19D11E0554182E68A2F90DA6673A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\ru\pdfconverter.resources.dll
Size 34KB
SHA256 70a62e0e6d7b40e40b690c79900e6a3c388d375033531a8a8d7d47b557dcab2a
MD5 ebdee6392dd0c1e0567c2a04f2ed64ea
SHA1 0540a4867189efb78a183273605712118c40a059
SHA512 12f5e0596f5007d043c54ea3882483970916231f7ddad4a6c3bb1b8f7cc0fdd3bad399cc77bfe67c57c9977b083e5abff559aacdb16773775160ae3b6868cea9
SSDEEP 768:XUsCeb4iEQ9y4mr8Lsdph7/8e7Z4ROBbyITN+HRwLyK9:ksDb4fQ04mr8Lsdph7/8e7aExyITIRRM
TLSH
T1DFF2001126FA244DF3B3EBBAB97469095C77FCBD2E66D25D0010186D29B3FA0852533B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\ru\pdfeditor.resources.dll
Size 153KB
SHA256 fb97afd2c3b37ef73d8467a2832d875326c9d731302040452601a9583fc84f71
MD5 6ede56f0b51fc32f7ac081b774f92f79
SHA1 5efae13a8db06c05fc54de142f76cf9060978988
SHA512 68cc53119f28a0d561c91173d7247750d5575b1c37382b50ffcdfdb5e19b8d369827598eddbea64da73d4a7503719ce3bc460ee0b75d09e46e50ef6b9aac72a4
SSDEEP 3072:CGDyjzysu4x60uRE7SMshSF/NzAduOIgJXbUpBmRDQ+Wj87bSNOTTVloSaEnAcQI:+VQa/If6en5CLQNh4UR5Ht2y
TLSH
T14AE3DF1127F9205DF1B36B5AEE7869086C76BDBE2E16D25E04201C6E25F3E50CA39337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e_sqlite3.dll

Path C:\Program Files\PDFgear\runtimes\win-x64\native\e_sqlite3.dll
Size 1.6MB
SHA256 957066af365f43e7b35b04dc9bcfcf4984c2dd7ed0640e7425f9c0ca014d836a
MD5 6a67f4751ef45ae84549a109c0128efe
SHA1 e5a264bb80be05c60095a74b3f9eea89cd2ca41d
SHA512 219983369ea2023db4ba6530adfbf54f901d119191da31c25ff5f89ce76ecff21296921618cce171d7a3a4625a2bcf56788dc8bbd7b1c8a803977175057cb4d3
SSDEEP 24576:H8vNkN4aHKDqpny6GU+NTpmn2icMI/R5gl9iYfZnt1Ko9ppdyi4+Nf:HyiqD6TcTpm2ijk+ZdKEJ
TLSH
T1A8757D47B3B9009CD46783788913971BD7F274052B64ABDB55A08A992F23FF61E7A330
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CommonLib.resources.dll

Path C:\Program Files\PDFgear\zh-CN\CommonLib.resources.dll
Size 19KB
SHA256 5e55daedab0d12f06ee0e5a549a738fc233f1addbaf2be657da61b89778fcd52
MD5 50d2608540be123df4fa7ece6814be62
SHA1 75caec1e1c46442a082bcb9017709da296f336a4
SHA512 70d0a9341a09ae2bf874e776232987f1a79b1105ae9cfd4e4be2c6e6bde5891589fa05e7df111e0b9c4e36df5037c0f4d80c0eb1dbd6f3a618572a7bcfd27322
SSDEEP 384:ldEsZ/NArSdMLmYE3CUU+InTN+ZKmMwUaym/Nii9j:rbBZMLS3pITN+oRwLyK4q
TLSH
T10492D5A20BF9255CF4B38FB8BAF5551ADD33BD622D19E46E0150004E5AA1FA0CD7273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FileWatcher.resources.dll

Path C:\Program Files\PDFgear\zh-CN\FileWatcher.resources.dll
Size 9KB
SHA256 3f48ef66c818c28993632cac62ca56fc4a0583c687b970dbaf3deaa36e829af0
MD5 88fcc059e737601920a451c07247f52d
SHA1 4b9a3ff5add7e2369ceae40c01561fdcdabd9a60
SHA512 4beb710d28d7409aaf848820132c50053838ee40a901e4a3a309686df71208ddcd69676607573c9d3590447bf92fea591980c3d41bb5ae6c8a5c23ccf0fa9bde
SSDEEP 192:QJvWKitEd1w+qxoNG4oInfrN+RnKmMwUani64m/NL9r:QB8EdRUU+InTN+hKmMwUaym/NL9r
TLSH
T111123DE38F7C0062EEE34F30E4F15613BF37BAC45A6D656E905490267C85B906DA2A3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDFLauncher.resources.dll

Path C:\Program Files\PDFgear\zh-CN\PDFLauncher.resources.dll
Size 17KB
SHA256 31bba11653541d5182cec07bfd55ae77f3e99dc9844e7a88c7029b8acb20154e
MD5 6c48af97c412eb3098f0ad1a688a32be
SHA1 56ea3bf764256b7ea5c9de34cf8e9d3daeca03a4
SHA512 0604664c6f28291d3b5da5b845b6eff4d32b6dcf661424dc1e76d0c8fcda9fea28c538fae95376867095410eaf551226204016bd1030581c29556dc901a5e8a3
SSDEEP 384:jji0AyTvMLGvVfrYzUU+InTN+cKmMwUaym/N19N:q0AyT0MDY+ITN+lRwLyKX
TLSH
T1AA82B4611FF9511CE2F3AF7C76F91126DE36FCB01E14E41E4560004DA996F80EAA2B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfconverter.resources.dll

Path C:\Program Files\PDFgear\zh-CN\pdfconverter.resources.dll
Size 28KB
SHA256 485ec17c83fbe30c2ce1a611428f547cb570289d33950401e9fe66bc725d3479
MD5 394a5580f2578d498ddb967773d7cd3c
SHA1 b62c34f29fb37d6f3f5339e1f1442088e9331223
SHA512 c6a094f5db262b1cd0ac4dfa5b6858594187f10d3659fea03fbff1aeb1df446646f28f622e42a35fcc6c7a418847ab4a3072a3415c72e20c32b2cdd6b7c433e9
SSDEEP 768:SJuebFs7zXgiYLLdyaisxo97kEPfYfF7EdITN+TRwLyK3:WukFs7zXgiYLLdyaisC79QFEdITGRRK3
TLSH
T128D21C523BFD140CF3F3AFB87AB95114983BFCA51E21E85E4441245D1972FA089A273B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pdfeditor.resources.dll

Path C:\Program Files\PDFgear\zh-CN\pdfeditor.resources.dll
Size 116KB
SHA256 368a94e7ee2b6b2e099117c8565876a55423edb1dd9d897cd1cb63570840aafb
MD5 7d3c009f2249bfc7b1d42a718a75142b
SHA1 42ce417c0244b0075e961d743c51fd4c84900f2d
SHA512 da4856e342c679f7c52880fdbbf0587b7b86b18ad2edec8bf9b0b28b7dcc288501a2c28f5e34ea44cbb8fec5430cc24b0f591eea55d3f6310d3fde4bc88ac2f5
SSDEEP 3072:fGDy1FxQgWwyhBIglB4oZCMoHoAcuMtg/QbJU1Cm1oVA/yMB4zhU0p3YQfnyjC8o:7gB7oyIDve
TLSH
T148C32C017BF9251CF6F76FA83BB99218E936FEB65E11D85E0421548E0A32F80C961737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 f7397b6c530d2d6274d58ba5308eb6237df422bbd780f9cad3e45417cd60c42a
MD5 11bf890fa80fbe6608cf3ff662db0f64
SHA1 89b77d987fbb167e6a0d8f3555d6d62b9d0d3579
SHA512 6d98b1ed4098a0859da15154e7aca4d177cd4b3ce42727a373ccdb6e45bb09f6abde9e7fa88e9438b795cf9526c3e21737a0fa63894888f11121138985d76ce1
TLSH
T15251A4A48B2109CFD7AA457902F044B936F57C7F830BAEDD2240ACFD4492FA321E205B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6be78c29d326e465148499678a023f9b24db3b5c8c65311332848ef35d3d8f26
MD5 3ea79781b7052b6dd605579c9f23badc
SHA1 3c8c922c2d018356d67ff3ce66c58001e1c79fad
SHA512 2ab88876b0b8d631d77f96851ab81e5a73a58aa237df634ac893ef4dfb85e0c8c1f4aeaab43090bd787ce5a9b3b89916c6501bc41ebb9f8d6514d5111a29f533
SSDEEP 96:DzOuEGIuEGueuEGsVa+STzBuEGHuEGzuEGqduEGquEGfuEGLxuEGauEG1KMiwQ:DK/GI/Gue/GsVa+ST1/GH/Gz/Gqd/GqR
TLSH
T12E91A0F7C3E4867DC81191F4AA147E1BCE6D0A24432C3C56C9D9AE5BA7E24B2E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2a65105bc4c18daafde2cefc6bb043bb7b6e59bfc1eff290d0595a8b192b7607
MD5 72a784276ad36b95736d9eb3d8d2752c
SHA1 6204a3f09473dcac007e2393e05b75d06a974fdd
SHA512 b1b0897abf22f30bc389d23d98f11ac0817e900a21dfae11823e138e93fafb7112f9f45e8cbbf6284bf36302f26fe7522a9e1d97272cafeb47d540af6f61ffc1
SSDEEP 192:sxRxRoCX/f7sVX23Zxg2zoA8pQN/g6+WNlA//rId43EVkoVJdYhGzIgDlP7bJ:sxRxlX/f7sVX2JxKo/5C/rKXD
TLSH
T1BC52E806A9686D3B4CD7E21DFA15BB63E2F95022A0D01E48F7FC961C14E7ADD6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 af58ae34541db2e4854f79eb7d7ee7c8ab313a6737e0b9806fdf9bec2e1a3d9b
MD5 c705441083a53b2258e62d92aa803231
SHA1 f649265e813f93c1d8153f92853313b6f0c839e6
SHA512 3be640a6ffa8cd15d8c85e8b46ba2bb19d010208c3366f0ad8a5e89f3fb9f33f0162daf15b9cd407eb75f0d8920440008d59266575554405f3f71edb1fd8a489
SSDEEP 192:sxRmRoCX/f7st523Zxg2zoA8pQN/g6+WNlA//rId43EVkoP9dYhGzIgVP7bJ:sxRmlX/f7st52JxKo/5C/ryXH
TLSH
T1FE42D9066D68A93B4CD7E21DFA15BB63E2F95022A0D01E58F7FC961C14E7ADD6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8162600ebbbcee19158bdd6ba28a01fd2d830f97aa9a3bcdae7a2d25253354e1
MD5 8e44af6b19d0f369ac13bc52a4743165
SHA1 f67676b858d6043bee472d9817060282394d472a
SHA512 6b77c48b2d24c6cc8be15a9c50919fb216aa235c4bc1623f0ac5c38b3a2ee9e51d16c105b51c572019c88bbac526ac65e37555584d52fb8954d385fad5820266
SSDEEP 192:sxRxRoCX/f7sV523Zxg2zoA8pQN/g6+WNlA//rId43EVkoP9dYhGzIgDnP7bJ:sxRxlX/f7sV52JxKo/5C/ryXN
TLSH
T17742E8066D64A93B4CD7E21DFA15BB63E2F95022A0D01E58F7FC961C14EB6DD6207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 1b9b2e79a13f1322346f8e0db4d08f57387ea340429e652936af3907e41dc360
MD5 2f8ebf8d08117eb72dacc714476cc1d7
SHA1 2dae392edccaff986aca1e21ea34a04615188e59
SHA512 681de995df3c55622204366a1b3bb8ac180d1fe50397d858918486dc3adcb032d02ecb874776a27d3972ec29945c17f106fb96af59b16405821afee14dadabe8
SSDEEP 768:j26HKc7pLuLf6RWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV8bBVuwDro9xIec:j26HKAEf6RWgs2f02u1ja3bB4wwFK
TLSH
T1BED2DA7B740DCABF4F800ADDEC197E9F6D6802CB9698CD8447FA941C02C6BEA51164DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d11a1a9136c0a5faac71eba1d1b8416d0e377f6e9d22dc472242edbfe4178840
MD5 b2902a8a1ae164510d84fc0d57d7018c
SHA1 e130f3c16bd3034507849d9be1138720fd11e762
SHA512 20a4a670dfa86f8b9536e7de1771d9dbe1a4da7db728894e3a73457f0a06c91f9c12fe46b0519fd75599a4d10f66273b866528cd3a8c54938a811deee807dfc6
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHRu/bpLP7W/cKgD7K4CgN7cRZUnej+K4sj:CVCbvlfj2LQ/3dGgJ8NVIbTMHRu/bpLE
TLSH
T19091F001B5BA12807CBEA64D80F8891B828174B67615A52B7FF819A74F67F134DFCCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25ea727d-2daf-417c-ae65-6d87be636dbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\25ea727d-2daf-417c-ae65-6d87be636dbb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 892f63cf01d9b5fc3ef38d8596d8b460ae83bb00433cdb8c0181ef0fd4778bf3
MD5 5eb09c8cfe28e89e52c8d223525b5de1
SHA1 997cff668e55477354f617a63b6edc7724ce45fc
SHA512 d883cc534eab642700ba7741415b771e96267e040c99de7fbf2b5366c577c022374081eb383fb990dd05978a74b5e06fd1b6032157c569a37b2345ec34dcdb46
SSDEEP 768:hM3zF/TBOWMUtm0StaONXyer1IRCzni9VPi9PutN:hM3hxSIqnSPJtN
TLSH
T1AFF2BF70A5959E238CF6F396B54267D3BEF82073D1C44694EAEAAB0D098361E130FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 63903888069088a19eca136cc106d979e2b5431ed8ce9ae1c92bd09f08156b4f
MD5 ff82a7e2bf7badc297be0f95f1bc2889
SHA1 a8f386cddce8fb2e5077a55f4db8d383dea72d36
SHA512 f3e1b65c78019f26e6c22fd4df9eb41aad399d042b8063d551dabfee194d53b96b9c9e3bae2f3f32af21d868c6285b182bcd6e54de9b8bec9b85c84fbd104e2d
SSDEEP 768:hrv+4UNbdz3Rc/TBOWMUtm2ONXyer1IRCzniB7eVH1SK7:hbsbV3e5SIqnkEH1l
TLSH
T15E03CF32A4949E338DE2A3D6B047B6437FF86057C6840790E9DE2F4E069B59D230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 0fdaae907beb86c4ee0e08d36145c548cb271df9689575be78444a7b74bfe847
MD5 b6abdf423f6b2fb1d5ebb9b54d75ccbf
SHA1 584a5e6e13ea976ee5e2e8b2d72f68fcfe496656
SHA512 11dbeac7a19a37b3da4bd22b24395a146ef11e0f4d74dbf58d11a0f2ece56d57cb8fa48805e8aad87e3d91d4286d137f27a80f91691a4b74ccbf362d269b4dbe
SSDEEP 768:2FQO3NwgUacsOWMUtm0StCONXyer1IRCzni9VPi9PutN:9O3FVSIqnSPJtN
TLSH
T18F1317F594D38A37D8AE9783A73D6E86ADBCD063B1889594B7D55E0CCC8217FC30A805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4cc72e7a436a2694eba6769b311eb06170f2c2fd2cfb14b4fd59ba08ef9f5150
MD5 424ce13e330a3cd23a78b31afe344d2e
SHA1 83f3379fedd1845a8a647df81c2b0958fdb3af01
SHA512 9ec5f2ab5ea094662852a7be3b55d3f00709f081ab28b341d18fab5da6aff532d1cd712ff6fa66565eed426cf0d0a7d27e1c3196bae08becfb77b0e1d480dc1c
SSDEEP 768:7rv+4UNbdz3cb/TBOWMUtm0StQONXyer1IRCzniwVeVH1SK7:7bsbV3cFSIqnhEH1l
TLSH
T1A303B031A594DE334DE2A396B443B3877FB8206785C40B90E9DA1F4D099759E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bb226eafe54efc2b461b3ff50c9d90da1ddec2b54ab7aa227d4d38c8a557f371
MD5 160ee823494aa32c78667456a0f63a03
SHA1 5e871850d6c356e13832f074689d7972c0052891
SHA512 e12912d9b76b2bd8a746888fd74bba90102616a3d38557e944c0174739cf05f15200a6a08b1ec3c1f33376716de430c03065db69d16335d8998e105ba05404b7
SSDEEP 768:9M3gF/TBOWMUtm0StaONXyer1IRCzni9VPi9PutN:9M32xSIqnSPJtN
TLSH
T1FAF2BF70A5959E239CF6F396B54267C3BEF82073D1C44694EAEAAB0D09C365E130FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 afa82f078265dd27a2258097ac582291b13f061c3fa0249ebe76ff49d3fad0b5
MD5 7e372d2258477c7b633c87f7c6aa93f7
SHA1 8ec453de3cf54ccbd2d30ed0da976cf5319d0bad
SHA512 5ee607e4ed14e4e9e543806dbfc733580fdc90f1da386cf3e81238406828816038b265fed6814e14dd2f2310720555cf69f7d98d6522eb71a844f7a9728a5500
SSDEEP 768:nrv+4UNbdz3oF/TBOWMUtm0StaONXyer1IRCzni9VR3T:nbsbV3uxSIqnSJ
TLSH
T1D703BF31A5599E338DF6A395B047B7837FF820A784C44694E9DA2F4D099759E230FC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf1635f6-d7fb-4f5b-b281-689d6b6801f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bf1635f6-d7fb-4f5b-b281-689d6b6801f1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

metadata.json~RFe5a904b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json~RFe5a904b.TMP
Size 132B
SHA256 ea13d57b11af249f90704dbcafd354c5e80b10358db7edb9eaf8f6fd597eb1d4
MD5 ae3a19c226264ff6cb64877f1e7e7243
SHA1 f993431dbd09200fd92b7a04ee6711a54ad95cc9
SHA512 97e5dbf0663585afbb5e0f2b5a36192624eb2c898462abef65225987df632d30f74f05ac5a71175c4c59f75d9ae6d2e640d168e479cb26b9a6857c71efda029a
TLSH
T1C1C02B85CB1E0C854E78153D48420B2727819F0030508534445A490C41741CE00888CF
MD5 SHA1 SHA512 TLSH

Submit Download

pdfdata.db

Path C:\Users\Admin\AppData\Local\PDFgear\AppData\pdfdata.db
Size 12KB
SHA256 0b21032603caaec688694da39739b6517429c3c34ab1a7824a76164c61e4f793
MD5 026b80d2dc357b48b2d8d36c875057a8
SHA1 ecf4a87be28aae6e8481748a09779d70f72edb0b
SHA512 61a297356dce94a3062f8c25fa1f3e7f6210686c87ab736e9424cfabe193e5cf58e53459fbf39092bf0d979268a0c30aee49e8c0cce920383284c14a2dace9d3
SSDEEP 12:TLmkHVtUUa7YeerSY3C+o4DW6TCWKfElli3vt//fH0QoE7svi:TLmiXZmOCedC7fAl0F//fH05r6
TLSH
T16E42DC775ECB5917CCE18F36EE4214E50F0B827F9340DF82187120D64A2080E0E2E601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ffa63b23-f5d1-4786-8fd9-025dcbaae843.tmp

Path C:\Users\Admin\AppData\Local\Temp\ffa63b23-f5d1-4786-8fd9-025dcbaae843.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

pdfgear_setup_v2.1.19.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3F4FQ9TU1F.tmp\pdfgear_setup_v2.1.19.tmp
Size 4.5MB
SHA256 6bc0322c55b3cec8c9a6fd909bcd71bde378951515afb402dc5125e5fa53b881
MD5 8ef55689c055c815d838affdc4687133
SHA1 3c680dee3dc04f421192ed7a59d199fc23cf8311
SHA512 d2a9e29655195e80bbb4a1f775281547eb1e479ae284e62b47590d2e33630be5b3b6dd616ed3793ef63b8b9446209d247fe5c0b63d8d5b81b483b3ff1a4f3c68
SSDEEP 98304:s9SZUvl30aj90ZFcvdQ0hdgvminQLMj+Jo333lvGiuLgs3T1Q8XLdw:bItJj90Z6RgKwLvGiuLgs3T1Q8XLdw
TLSH
T1CC267E03B748653AD4F70A39983BA614583FBE613626CD476BF43C5C8F3A6416D26B83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

isxdl.dll

Path C:\Users\Admin\AppData\Local\Temp\is-8ROJEWI8RD.tmp\isxdl.dll
Size 121KB
SHA256 b0cc4697b2fd1b4163fddca2050fc62a9e7d221864f1bd11e739144c90b685b3
MD5 48ad1a1c893ce7bf456277a0a085ed01
SHA1 803997ef17eedf50969115c529a2bf8de585dc91
SHA512 7c9e7fe9f00c62cccb5921cb55ba0dd96a0077ad52962473c1e79cda1fd9aa101129637043955703121443e1f8b6b2860cd4dfdb71052b20a322e05deed101a4
SSDEEP 1536:dohlISko4eZHOMazWpdYoEWSekaDnXUq5o5dInL:dkIM4ehDaqEpMXUq5o5dIL
TLSH
T18FC36B317350D433C06B193A191A87BA637FBA3195B5984B7B840FBE6F30691DA3631B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3820_740177925\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-948-0x0000028239360000-0x0000028239376000-memory.dmp

Download

memory/1288-968-0x0000028251EF0000-0x0000028251F7A000-memory.dmp

Download

memory/1288-934-0x0000028237580000-0x0000028237644000-memory.dmp

Download

memory/1288-981-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/1288-935-0x00007FFCF55BF000-0x00007FFCF55C0000-memory.dmp

Download

memory/1288-939-0x0000028251CF0000-0x0000028251DCE000-memory.dmp

Download

memory/1288-941-0x00000282392D0000-0x00000282392FE000-memory.dmp

Download

memory/1288-978-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/1288-942-0x00000282392A0000-0x00000282392BA000-memory.dmp

Download

memory/1288-946-0x0000028239270000-0x000002823927A000-memory.dmp

Download

memory/1288-954-0x00000282393B0000-0x00000282393C6000-memory.dmp

Download

memory/1288-952-0x00000282392C0000-0x00000282392CA000-memory.dmp

Download

memory/1288-950-0x0000028239380000-0x00000282393A8000-memory.dmp

Download

memory/1288-982-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/1288-976-0x0000028251CB0000-0x0000028251CD2000-memory.dmp

Download

memory/1288-958-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/1288-944-0x0000028239300000-0x0000028239312000-memory.dmp

Download

memory/1288-956-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/1288-975-0x0000028252190000-0x0000028252242000-memory.dmp

Download

memory/1288-960-0x0000028239330000-0x000002823933A000-memory.dmp

Download

memory/1288-961-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/1288-962-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/1288-965-0x0000028239400000-0x0000028239408000-memory.dmp

Download

memory/1288-974-0x00007FFCF5430000-0x00007FFCF5DD4000-memory.dmp

Download

memory/1288-963-0x0000028239340000-0x0000028239348000-memory.dmp

Download

memory/1288-970-0x0000028251C30000-0x0000028251C50000-memory.dmp

Download

memory/2736-1014-0x000001848F120000-0x000001848F13C000-memory.dmp

Download

memory/2736-1010-0x000001848F0A0000-0x000001848F0B4000-memory.dmp

Download

memory/2736-1018-0x000001848F0E0000-0x000001848F0EA000-memory.dmp

Download

memory/2736-1047-0x00000184ACED0000-0x00000184ACEDE000-memory.dmp

Download

memory/2736-1016-0x000001848F090000-0x000001848F09A000-memory.dmp

Download

memory/2736-1045-0x00000184ACEF0000-0x00000184ACF0C000-memory.dmp

Download

memory/2736-1025-0x00000184A9510000-0x00000184A9542000-memory.dmp

Download

memory/2736-1044-0x00000184ACF90000-0x00000184AD04A000-memory.dmp

Download

memory/2736-1012-0x000001848F0C0000-0x000001848F0E0000-memory.dmp

Download

memory/2736-1046-0x00000184ACF50000-0x00000184ACF8E000-memory.dmp

Download

memory/2736-1006-0x000001848EAB0000-0x000001848EC04000-memory.dmp

Download

memory/2736-1032-0x00000184AC850000-0x00000184AC858000-memory.dmp

Download

memory/3244-986-0x000002737BC40000-0x000002737BD0E000-memory.dmp

Download

memory/3244-1001-0x000002737DAA0000-0x000002737DAA8000-memory.dmp

Download

memory/3244-997-0x000002737DA40000-0x000002737DA48000-memory.dmp

Download

memory/4872-0-0x0000000000BB0000-0x0000000000CE8000-memory.dmp

Download

memory/4872-1036-0x0000000000BB0000-0x0000000000CE8000-memory.dmp

Download

memory/4872-12-0x0000000000BB0000-0x0000000000CE8000-memory.dmp

Download

memory/5036-20-0x0000000000AF0000-0x0000000000F84000-memory.dmp

Download

memory/5036-18-0x0000000000AF0000-0x0000000000F84000-memory.dmp

Download

memory/5036-14-0x0000000003160000-0x0000000003161000-memory.dmp

Download

memory/5036-16-0x0000000000AF0000-0x0000000000F84000-memory.dmp

Download

memory/5036-13-0x0000000000AF0000-0x0000000000F84000-memory.dmp

Download

memory/5036-1003-0x0000000000AF0000-0x0000000000F84000-memory.dmp

Download

memory/5036-1035-0x0000000000AF0000-0x0000000000F84000-memory.dmp

Download

memory/5036-237-0x0000000000AF0000-0x0000000000F84000-memory.dmp

Download

memory/5036-6-0x0000000003160000-0x0000000003161000-memory.dmp

Download

memory/5036-717-0x0000000000AF0000-0x0000000000F84000-memory.dmp

Download