e93309ba206e529234084221a03f5dbd91719ce66ab06f8ad3474f5727f8dfd1

Analysis

max time kernel
149s
max time network
165s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stirling-PDF-windows-x86_64.msi
Size 258.3MB
Sample260818-ay2z7sshkc
SHA256 e93309ba206e529234084221a03f5dbd91719ce66ab06f8ad3474f5727f8dfd1
MD5 e49714398b798b2f1a8f09cc86c24af3
SHA1 79abac141fefa41da09e4504c634d9a66635f686
SHA512 1a37bf6b49b4ab18b058921c6e31e52fd5b6c826ca8e341dbd32743da61d1cd7a7343221242951e36ad301b0ea0239d4e10fe8d2c52dfd562db978e71e2a9516
SSDEEP 6291456:6vtz/5/8zXbktzvIC/WJMK+weRCao/TZ1F9SAph9L+auuvGvpcsSK:6vtD5OAltefBAw99SAL9CaxeRcv
TLSH
T160D833A2A8BD5F2EE04876368181732C8956BDC15112DC76F708F7A63B731D22AF6CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	java.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
2252	Stirling-PDF.exe
952	java.exe

Loads dropped DLL 13 IoCs

pid	Process
2132	MsiExec.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe
952	java.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3572	msiexec.exe
7	3572	msiexec.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Stirling-PDF.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-crt-math-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.cryptoki\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\README.txt	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\lib\tzdb.dat	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\lib\security\cacerts	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\verify.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\rmi.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.management\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\sspi_bridge.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\w2k_lsa_auth.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\bcel.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\lib\security\blocked.certs	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\j2gss.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.base\aes.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.security.jgss\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\jimage.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\stirling-provision.exe	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_6042029\crl-set	msedgewebview2.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.rmi\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\security\java.security	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.unsupported\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.instrument\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\jawt.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.mscapi\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.desktop\mesa3d.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.dynalink\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\lib\psfont.properties.ja	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.naming\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\fontmanager.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\server\jvm.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.sql\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-profile-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\prefs.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-interlocked-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_6042029\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4084_6042029\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-file-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml.crypto\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-crt-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.compiler\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.desktop\freetype.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\lib\classlist	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml.crypto\santuario.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.cryptoki\pkcs11wrapper.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\jaxp-strict.properties.template	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.ec\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-localization-l1-2-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.security.jgss\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.scripting\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\limited\default_US_export.policy	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\freetype.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\ucrtbase.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\kinit.exe	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\management.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\stirling_thumbnail_handler.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-crt-private-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\xhtml10.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\xmlspec.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\Uninstall Stirling PDF.lnk	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-processenvironment-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 10 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{EF165B43-F51E-4B09-9E11-230441296E37}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8207.tmp	msiexec.exe
File created	C:\Windows\Installer\{EF165B43-F51E-4B09-9E11-230441296E37}\ProductIcon	msiexec.exe
File created	C:\Windows\Installer\e59743e.msi	msiexec.exe
File created	C:\Windows\Installer\e59743c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59743c.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{EF165B43-F51E-4B09-9E11-230441296E37}\ProductIcon	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3572	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000524fef632b0bf5150000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000524fef630000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900524fef63000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a524fef63000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d524fef63000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314873132746042"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\shell\open\command\ = "\"C:\\PROGRA~1\\STIRLI~1\\STIRLI~1.EXE\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf\shell\open\command\ = "\"C:\\Program Files\\Stirling PDF\\Stirling-PDF.exe\" \"%1\""	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673\ShortcutsFeature = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\ProductIcon = "C:\\Windows\\Installer\\{EF165B43-F51E-4B09-9E11-230441296E37}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\PackageName = "Stirling-PDF-windows-x86_64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stirlingpdf\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\Language = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf	Stirling-PDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf\DefaultIcon\ = "C:\\Program Files\\Stirling PDF\\Stirling-PDF.exe,0"	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9ABF5033E5E790C5CB17CE0A6AF5F4EE	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf\DefaultIcon	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stirlingpdf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}\ = "Stirling-PDF Thumbnail Handler"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open\command\command = 78002d005b007000750037003f007d002c004000540054002400440024003400290041006e003500530068006f0072007400630075007400730046006500610074007500720065003e002900360039004400500045006b0043004b004600640037007e0034007500640047006200560074002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stirlingpdf\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\PackageCode = "7126793BBFBC1C2488AD0319E02645F0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf\shell\open	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\Stirling PDF.pdf\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\Stirling PDF.pdf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\shellex\{E357FCCD-A995-4576-B01F-234630154E96}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\Version = "34471939"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf\ = "URL:stirling.pdf.dev protocol"	Stirling-PDF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673\Environment = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open\command\ = "\"C:\\Program Files\\Stirling PDF\\Stirling-PDF.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open\ = "Open with Stirling PDF"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}\InprocServer32\ = "C:\\Program Files\\Stirling PDF\\stirling_thumbnail_handler.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "Stirling PDF.pdf"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673\External	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\ProductName = "Stirling PDF"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf\shell\open\command	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9ABF5033E5E790C5CB17CE0A6AF5F4EE\34B561FEE15F90B4E91132401492E673	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf\shell	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\DefaultIcon\ = "\"C:\\PROGRA~1\\STIRLI~1\\STIRLI~1.EXE\",0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\stirlingpdf\URL Protocol	Stirling-PDF.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	msiexec.exe
4292	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4084	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3572	msiexec.exe
Token: SeSecurityPrivilege	4292	msiexec.exe
Token: SeCreateTokenPrivilege	3572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3572	msiexec.exe
Token: SeLockMemoryPrivilege	3572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3572	msiexec.exe
Token: SeMachineAccountPrivilege	3572	msiexec.exe
Token: SeTcbPrivilege	3572	msiexec.exe
Token: SeSecurityPrivilege	3572	msiexec.exe
Token: SeTakeOwnershipPrivilege	3572	msiexec.exe
Token: SeLoadDriverPrivilege	3572	msiexec.exe
Token: SeSystemProfilePrivilege	3572	msiexec.exe
Token: SeSystemtimePrivilege	3572	msiexec.exe
Token: SeProfSingleProcessPrivilege	3572	msiexec.exe
Token: SeIncBasePriorityPrivilege	3572	msiexec.exe
Token: SeCreatePagefilePrivilege	3572	msiexec.exe
Token: SeCreatePermanentPrivilege	3572	msiexec.exe
Token: SeBackupPrivilege	3572	msiexec.exe
Token: SeRestorePrivilege	3572	msiexec.exe
Token: SeShutdownPrivilege	3572	msiexec.exe
Token: SeDebugPrivilege	3572	msiexec.exe
Token: SeAuditPrivilege	3572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3572	msiexec.exe
Token: SeChangeNotifyPrivilege	3572	msiexec.exe
Token: SeRemoteShutdownPrivilege	3572	msiexec.exe
Token: SeUndockPrivilege	3572	msiexec.exe
Token: SeSyncAgentPrivilege	3572	msiexec.exe
Token: SeEnableDelegationPrivilege	3572	msiexec.exe
Token: SeManageVolumePrivilege	3572	msiexec.exe
Token: SeImpersonatePrivilege	3572	msiexec.exe
Token: SeCreateGlobalPrivilege	3572	msiexec.exe
Token: SeCreateTokenPrivilege	3572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3572	msiexec.exe
Token: SeLockMemoryPrivilege	3572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3572	msiexec.exe
Token: SeMachineAccountPrivilege	3572	msiexec.exe
Token: SeTcbPrivilege	3572	msiexec.exe
Token: SeSecurityPrivilege	3572	msiexec.exe
Token: SeTakeOwnershipPrivilege	3572	msiexec.exe
Token: SeLoadDriverPrivilege	3572	msiexec.exe
Token: SeSystemProfilePrivilege	3572	msiexec.exe
Token: SeSystemtimePrivilege	3572	msiexec.exe
Token: SeProfSingleProcessPrivilege	3572	msiexec.exe
Token: SeIncBasePriorityPrivilege	3572	msiexec.exe
Token: SeCreatePagefilePrivilege	3572	msiexec.exe
Token: SeCreatePermanentPrivilege	3572	msiexec.exe
Token: SeBackupPrivilege	3572	msiexec.exe
Token: SeRestorePrivilege	3572	msiexec.exe
Token: SeShutdownPrivilege	3572	msiexec.exe
Token: SeDebugPrivilege	3572	msiexec.exe
Token: SeAuditPrivilege	3572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3572	msiexec.exe
Token: SeChangeNotifyPrivilege	3572	msiexec.exe
Token: SeRemoteShutdownPrivilege	3572	msiexec.exe
Token: SeUndockPrivilege	3572	msiexec.exe
Token: SeSyncAgentPrivilege	3572	msiexec.exe
Token: SeEnableDelegationPrivilege	3572	msiexec.exe
Token: SeManageVolumePrivilege	3572	msiexec.exe
Token: SeImpersonatePrivilege	3572	msiexec.exe
Token: SeCreateGlobalPrivilege	3572	msiexec.exe
Token: SeCreateTokenPrivilege	3572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3572	msiexec.exe
Token: SeLockMemoryPrivilege	3572	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3572	msiexec.exe
3572	msiexec.exe
2252	Stirling-PDF.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 2132	4292	msiexec.exe	98
PID 4292 wrote to memory of 5064	4292	msiexec.exe	106
PID 3572 wrote to memory of 2252	3572	msiexec.exe	109
PID 2252 wrote to memory of 4084	2252	Stirling-PDF.exe	110
PID 4084 wrote to memory of 1056	4084	msedgewebview2.exe	111
PID 4084 wrote to memory of 1480	4084	msedgewebview2.exe	112
PID 4084 wrote to memory of 1480	4084	msedgewebview2.exe	112
PID 4084 wrote to memory of 1480	4084	msedgewebview2.exe	112
PID 4084 wrote to memory of 4456	4084	msedgewebview2.exe	113
PID 4084 wrote to memory of 3240	4084	msedgewebview2.exe	114
PID 4084 wrote to memory of 3240	4084	msedgewebview2.exe	114
PID 4084 wrote to memory of 2052	4084	msedgewebview2.exe	115
PID 4084 wrote to memory of 2052	4084	msedgewebview2.exe	115
PID 4084 wrote to memory of 2052	4084	msedgewebview2.exe	115
PID 2252 wrote to memory of 952	2252	Stirling-PDF.exe	117
PID 952 wrote to memory of 5868	952	java.exe	122
PID 952 wrote to memory of 5896	952	java.exe	124
PID 952 wrote to memory of 5932	952	java.exe	126
PID 952 wrote to memory of 5992	952	java.exe	128
PID 952 wrote to memory of 6040	952	java.exe	130
PID 952 wrote to memory of 6048	952	java.exe	132
PID 952 wrote to memory of 6084	952	java.exe	134
PID 952 wrote to memory of 1624	952	java.exe	136
PID 952 wrote to memory of 5148	952	java.exe	138
PID 952 wrote to memory of 5152	952	java.exe	140
PID 952 wrote to memory of 2956	952	java.exe	141
PID 952 wrote to memory of 5476	952	java.exe	144
PID 952 wrote to memory of 1956	952	java.exe	146
PID 952 wrote to memory of 5816	952	java.exe	148
PID 952 wrote to memory of 5944	952	java.exe	150
PID 4084 wrote to memory of 3816	4084	msedgewebview2.exe	157
PID 4084 wrote to memory of 3816	4084	msedgewebview2.exe	157
PID 4084 wrote to memory of 1620	4084	msedgewebview2.exe	159
PID 4084 wrote to memory of 1620	4084	msedgewebview2.exe	159

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Stirling-PDF-windows-x86_64.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files\Stirling PDF\Stirling-PDF.exe
  "C:\Program Files\Stirling PDF\Stirling-PDF.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --enable-features=CertVerifierBuiltinFeature --lang=en-US --mojo-named-platform-channel-pipe=2252.3836.5829571723165891840
    3⤵
    - Drops file in Program Files directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x104,0x16c,0x7ffdf343b078,0x7ffdf343b084,0x7ffdf343b090
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1716,i,18212872185363407288,16706760588629417081,262144 --enable-features=CertVerifierBuiltinFeature --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
      4⤵
      PID:1480
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2044,i,18212872185363407288,16706760588629417081,262144 --enable-features=CertVerifierBuiltinFeature --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:3
      4⤵
      PID:4456
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1740,i,18212872185363407288,16706760588629417081,262144 --enable-features=CertVerifierBuiltinFeature --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:8
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3656,i,18212872185363407288,16706760588629417081,262144 --enable-features=CertVerifierBuiltinFeature --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
      4⤵
      PID:2052
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4844,i,18212872185363407288,16706760588629417081,262144 --enable-features=CertVerifierBuiltinFeature --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:8
      4⤵
      PID:3816
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4888,i,18212872185363407288,16706760588629417081,262144 --enable-features=CertVerifierBuiltinFeature --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
      4⤵
      PID:1620
- - C:\Program Files\Stirling PDF\runtime\jre\bin\java.exe
    "C:\Program Files\Stirling PDF\runtime\jre\bin\java.exe" -Xmx2g -DBROWSER_OPEN=false -DSTIRLING_PDF_TAURI_MODE=true -Dlogging.file.path=C:\Users\Admin\AppData\Roaming\Stirling-PDF\logs -Dlogging.file.name=stirling-pdf.log -Dserver.port=0 -Dserver.forward-headers-strategy=none -Dsecurity.enableLogin=false -Dsecurity.csrfDisabled=true -jar "C:\Program Files\Stirling PDF\libs\stirling-pdf-2.14.3.jar"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:952
  - - C:\Windows\SYSTEM32\where.exe
      where rar
      4⤵
      PID:5868
  - - C:\Windows\SYSTEM32\where.exe
      where magick
      4⤵
      PID:5896
  - - C:\Windows\SYSTEM32\where.exe
      where gs
      4⤵
      PID:5932
  - - C:\Windows\SYSTEM32\where.exe
      where soffice
      4⤵
      PID:5992
  - - C:\Windows\SYSTEM32\where.exe
      where unoconvert
      4⤵
      PID:6040
  - - C:\Windows\SYSTEM32\where.exe
      where tesseract
      4⤵
      PID:6048
  - - C:\Windows\SYSTEM32\where.exe
      where ocrmypdf
      4⤵
      PID:6084
  - - C:\Windows\SYSTEM32\where.exe
      where qpdf
      4⤵
      PID:1624
  - - C:\Windows\SYSTEM32\where.exe
      where weasyprint
      4⤵
      PID:5148
  - - C:\Windows\SYSTEM32\where.exe
      where pdftohtml
      4⤵
      PID:5152
  - - C:\Windows\SYSTEM32\where.exe
      where ebook-convert
      4⤵
      PID:2956
  - - C:\Windows\SYSTEM32\where.exe
      where python3
      4⤵
      PID:5476
  - - C:\Windows\SYSTEM32\where.exe
      where python
      4⤵
      PID:1956
  - - C:\Windows\SYSTEM32\where.exe
      where /opt/venv/bin/python3
      4⤵
      PID:5816
  - - C:\Windows\SYSTEM32\where.exe
      where fontforge
      4⤵
      PID:5944

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7B7F560A74021D462BC55BAE8682F088 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2132
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59743d.rbs

Path C:\Config.Msi\e59743d.rbs
Size 145KB
SHA256 996fecafb2983a5fd56c492dd3616d8f45346ab4aa224679a02a2edd88634915
MD5 22a56754b415be73aef2cf8f58842e5d
SHA1 22f51cb785eede6e0484bc173087c55972b034f9
SHA512 cebb9e11e216ae6061ee9ad88dedc4f0d2f2c241c5fb77d5abce8b7c5844a7bf02471054870dcf43e924c195bbb13ada7d48311fa1b7d95ad1b004a582ca4731
SSDEEP 1536:n0wYSqmUv6BnuGO7j6f+i9WQpa1u+XNLek0EX2y6SU0qd4p3hazmUe7Z6nZkg0H0:lC2x
TLSH
T181E38B466A20C782E18F177DFE6757413335C4ED63EE910B66AC9274D8863A03BB8D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\java.dll
Size 114KB
SHA256 e5b9d03078656bc530f03857fa89c435db4fd7b246a6f34edea4f1c59f5b31e6
MD5 6136718281baf216a552dbbaddddc1f6
SHA1 48f03f875583690f2ad9addda742aae7cabc4bad
SHA512 41789c514fd76e04d015e8a0810fa5a17ee9ee2339b6c3bc65530565f4edc4adbe2d23fcf6a9192a513327848f99add41c7af6e3c9ab8c432037657829bbf5bd
SSDEEP 3072:xhkdkKVjreezgMyHtEQP3i+ayNGEZYYrZU69s/2gFMOuxFRVOvwl:3UkKVjaezgfjiwmwl
TLSH
T11AB34B1BB7298085F45AAABC80669D0BD372B4700341E74F13E6CA9E9F8F7713D09795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Stirling PDF\runtime\jre\bin\java.exe
Size 49KB
SHA256 1dfe0b08636bc74b56db5e246f038cfe67c18f567053373fa601d310f29ed9da
MD5 f0be736a482b66d05f9a285c544645e5
SHA1 a49476ff972848b543972406349296786ff8ef0f
SHA512 2cc540f808b9b03db31de4f1fde327bde158b00cbd8eb2d845e438ab3a8d9e8cec66c6739c6f171972e4314186a2f03a50bc3c55c2007d46a8c1cfcf8888a317
SSDEEP 768:jTZJFZM5R2TyJ5R3s8D/bkt5Ruz3Vb3NU5TYiDLk5uIvnlb:R5M5RdJ5R3sozkt5RA3NU5T7lIvlb
TLSH
T134337C47AA182C81F42F84B158A7752751B4BD032BC173EBBDCAB21E0D71391A9176EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\jimage.dll
Size 33KB
SHA256 2375c81a92a89dfbcdd613790748b702e81f762d964e10b41c294264735be325
MD5 ed56339ae3a4cf33905441f88593b79d
SHA1 13512db899807405357e7f7f9e28e155ac9d6894
SHA512 01553e87d62810fcb71ce7500dd4a50aa2bc66177b14cbe9420e66160db9c86063133ae4e0be6de62eabe693ed4030f62220585ccfeddb2691dba0d54ffd8127
SSDEEP 384:H55kBR2x3tCn9LD+YuNIpQKyvh7GB4JNyEIYi2mL4/y8RbIIvZgFchQj:HFHCnFDCIpQJvh7J2YiDLk5uIvLQj
TLSH
T16FF27D5AE6841C89E92BE538C8AB9A1FD7F5F9524F51C3CB1720825E0F333813B59792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\jli.dll
Size 82KB
SHA256 da2693437d06125ba8392bc2b8200adb094dd0c294f9771b68e2d089cc3f655a
MD5 4c950d7b1fc6e140f97632b05115d78e
SHA1 79f685fbd7a65be7949465d4a16b284713be5680
SHA512 428c8c21b95319b492c988298bed3370f8c6ad6e6c42c3a3b517ef50a43c9b17c8379995847bf57d9c278f69426a7e6fe62a54d9c7ed76301c0887783fe716cd
SSDEEP 1536:nkoxO38mh+pYZochEJgsQBIOFeXOUKFA7lIvh:ko038S+KZoKEMFe+UKFAOvh
TLSH
T11E839E9A539011E4DEB79578D9B4960FC3F2B0653721838F13AC81EA0FB36613E19BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\management.dll
Size 29KB
SHA256 3cc759174fa5cf6f270fbcb6d0415e4312605d2b87f5a3a5bd8c080e7b18f882
MD5 591311a02adba14661b78df5e4a95a8b
SHA1 e9a5a129065b83613373f4a5a4990a590949956f
SHA512 ad6f58ed2b68e5d88875bba29e2736b1fc517347d774206ecd808f2f1ab8eff7f3c66f6b1450f12201cdc18eea79e48ae5e26cb7a9f7020d161026294919d479
SSDEEP 384:/10/3Hri4b9ao0KHs2Vs0G3cPDYNyEIYi2mL4/y8RbIIvZghyG:/10PLi6gSXPDdYiDLk5uIvu
TLSH
T11ED24A56A66C6445E1DFB53570900636AAB3B5C61FC193C70270C53C5BBBFE23A382BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\net.dll
Size 59KB
SHA256 87955e43ccd8af43645cb5f23e435d80ca1afbfa3e47969fb002b57e65231d4e
MD5 f7a1fa1678b83cc5fbd20cccf19bb550
SHA1 b5a5ef92f4b24811edd9c6d1319037e754f9aae5
SHA512 646d5883c84d056414f95554903d4e744238849350b2f50144ba2f90a0c20a47ab5d3097835d21bb1abc32b1ed5c5aad431ee73c82a472645b130639bf3f18d5
SSDEEP 1536:pC1z7R0OBwv3XteSDJkt4ZLWiyb+dnh+G7qm7lIvU:iz7G/1kt2/dnhn7qmOvU
TLSH
T132537D0697D414C5E827CA78C6AB4A1BCB72F4A0625083DF03B5C5AE6FE73B27719781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\nio.dll
Size 79KB
SHA256 953b491b5981356d04288884bf3f178d94b892d11445e864b67420eddd56094d
MD5 7717fcd85c8e1bb8c6c04ac26c7eb30e
SHA1 e1abd155b1ea55dff6812bfb212c78c47c8fd737
SHA512 8c6c3a6bc13b28402cea63b352f2091b1d34a751c0da781b06f25644741bc888a20f6ac011a6ea459adb931e44c7e8f2d229a8381fb3f355ebc8ca3a797bd923
SSDEEP 1536:y72Yp5yt/WuKq/b94c8LIH047RwYEpdqDRuO7lIvgZB:21WMyb9Vb7RJEpdGAOOviB
TLSH
T1F78319A25760889BE87A7238429A574BF373FC115510A35F5228CB559F1F2B33E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\server\jvm.dll
Size 14.7MB
SHA256 50f653c1d30db1342f5d476946ef63f25b663f72e89445c0d70a33d1b86a4ee2
MD5 20a0ca0a2d25b3431c808a36355338df
SHA1 49ca3932510e262298c80d7e80908c6ab7be7e12
SHA512 06f4191d6dddcbc01a1a4f1d2c8f5cd900f3af3fe4e6f888d91dce4f96df27f593c02e208f7ab762e452208f1b89af447624729cd46a9eca7653bc2b1b47ef65
SSDEEP 393216:idy82untfmaQkNWHRpnlf7zwMw4K5vTaqkHPskF2IBjQ3wKIyYjXiuntdsfU2fLG:AvdC
TLSH
T1B8F65C17B3B400A8E067C178CB279A17D7F2B8944370E7CF55A4566E2F13BE6693A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\sunmscapi.dll
Size 48KB
SHA256 5ffa0a0bfa49e460c4c819d133975f6fd75ff2e3e91adce77eec35de1d65490d
MD5 1030311384a885012baec07ee08450c1
SHA1 b9efdbec9cefbd406a13846f89539ed011b32d3e
SHA512 d785a6f34f3d97e2a4d7f073dece9d2470f762d0c75496b92e53fef2694231182c90623a0d659f6dcc7335de1df963f32ceb771d5ae456399b0509ccc9fc4ca3
SSDEEP 768:FLuffbPCN0LH0Ed43coMEFZTbsUksUmZAMVzp/eYdfrYiDLk5uIvWA:xuf2w0THbsUksUm+MVz1eYpr7lIvWA
TLSH
T1FD236B0BC7A104D5FC63C8BCC42A961BE6B1B9465122C7CF1361CA199FA6BB2B73C741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\vcruntime140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\zip.dll
Size 80KB
SHA256 d18e94754ad3b1f894b06b61eddb8b8a33c3a2bf073ef1ceb5a7fc313b06b111
MD5 8856d4a3668d6907b290bf979430c73c
SHA1 b02cb9254fc50959bedb65cd1fc9b91fe89dea24
SHA512 4027d14d68a169e6cdff5c29fa41008db0d0bcf90b96fe29fd7fa397278ed80c4d3ee2ebe4dee3b946140bc30382ee4fd59fbdfb0c14a38ea34fc430dbb2074b
SSDEEP 1536:ZO6rmxTSQDn3R8fW5QmahAKoZkIOmo4sR7lIv9:ZO6rmxW0n3Of9AVKmo3ROv9
TLSH
T1AD839C958AA04061DAFB9570C9F64B2FD3BAB0145791478F63A8835A2F533613F4C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaxp.properties

Path C:\Program Files\Stirling PDF\runtime\jre\conf\jaxp.properties
Size 8KB
SHA256 d4f45052a100e5aef02b6638a3b9c69b2bdd46155ceb58a52671e5d594c30100
MD5 80f4a5f43c22b97be120e0716974a029
SHA1 ed8df3f663c669bbe7d9dffd03d4800fae364ba9
SHA512 875a099a87f8427057661f1b2463c3ba4f2f1070247ca7c1064b3d4e3f45a878057c374eb80f6d760537fa0c11d30add9bd34e3ee9f70c2259f274e719dc5bd5
SSDEEP 192:vmeomZOmsWKjL53t72QxQOjLLc12/yAyRc:ueomZOmsWKP53t7HxQOLcs6c
TLSH
T1B0024123B64DB774038602D1910E13DEEBA8696CBD3764A475DC263C321AED423F75CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Program Files\Stirling PDF\runtime\jre\conf\logging.properties
Size 2KB
SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
MD5 c4b74648f229c4b7e62a1061ee1dc3f0
SHA1 5795edcb624326bbefdedcdb6a11d9c18071d8ce
SHA512 76ea95402f64947c2784f1f8d0857f0d7c963285ae9ebcd9f5cb407d83a14e4da6d14aeb8641c9d9b1c92af4493a4b10e52ad6efda7ae47f265d43df6b4002d0
TLSH
T13251FE5E9B4E2D35430E00AA5A7FF6527E1898BD1C23A5F6B35E6304321D43485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Program Files\Stirling PDF\runtime\jre\conf\net.properties
Size 7KB
SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
MD5 1f251a36eb37913b696b5be5595e1cd0
SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
TLSH
T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Program Files\Stirling PDF\runtime\jre\conf\security\java.security
Size 74KB
SHA256 8f42977f80b73ed19f941a1e2886de91d61e2c799b22f3e8e370d54c1ce99365
MD5 223e640f9591adc5dc8598b86e766b5e
SHA1 6e8e354fc49276874acfe13df7663d6ee62c08c0
SHA512 9166d3e9b378c8ffb1261673dfe89bf55c537252d43400f00f0f9c46d1c78c9af5060ab0e8818448664de544ba003cd8927606507601a4c5addc56d924a767a0
SSDEEP 1536:rQMy8R78MRjJPFp5/LTNHu1UoQ2k/gl0ug6YilNndOcA2ZIYy64A:J8MfPFD/LTNO1UoQDHiDndOcKq
TLSH
T14D73D522BB896B720AF211A3639EF1D9F76DA12A32325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\Stirling PDF\runtime\jre\legal\java.instrument\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Program Files\Stirling PDF\runtime\jre\legal\java.management\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.cryptoki\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Program Files\Stirling PDF\runtime\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Program Files\Stirling PDF\runtime\jre\lib\modules
Size 26.7MB
SHA256 1e3c3d4d96bb62387e34047614183e9d959b26523f6c95e6dc1bccd63dfae55d
MD5 6e80c9c4ac969eddc91662c66b5e2844
SHA1 fbd06bb5be4964e505b7917c38dfbaefbd961a53
SHA512 835dc6cb29b6070e4fc7219e7494b72095476b7a50bab850da63a543ddae7ee0285550c1cf0990917656cf5c33713a328c4fc96a9b74ebd8fa1c8c64acf8bfc5
SSDEEP 393216:x6E3j7n6ezk1hIgXB8KOikIJlXeVyiJh59nLutNecxgUIkoxVPT0qoeZzq1:1WHlR8KOiHwyiJhXnSbeggUdCCqJZC
TLSH
T10057220EF8C19B51C8A691F78562AAD52631A4D0FE81438F2185322D7C7B963CBBF57C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacerts

Path C:\Program Files\Stirling PDF\runtime\jre\lib\security\cacerts
Size 149KB
SHA256 98d34a90fca2688ef5674862d2a484e09e5ca25d2f07c5d654aa28f1581f3419
MD5 14ba18eba1ec1f514421a21b644d9fb1
SHA1 d16a7c7186e57094ff9bad426c048f94c6f0d0e6
SHA512 ab7355fa51a0d0c9488199dec5fbba2b365087b0427dc08be0e9ee6e7dd0254d309bd108512e0afb4167ce5ad6381abcda88ae173849ff07af26b40e37cb11a0
SSDEEP 3072:7CW6brdYD+xDlAwjhShvDZKSCgsQyAQpNYFVp/JKtwnGlaIVG6lmXPBTiM93uN/5:2W6uD+liTmqgrQ5TDur7VVJ25pG
TLSH
T118E34A4A9F7D2408BFF29F0495D8DA27AD72BBE22D59D92B101080DD1961F90BC9833F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Program Files\Stirling PDF\runtime\jre\lib\tzdb.dat
Size 100KB
SHA256 5906b44e25a8a730131d7ba1beb5d15af27043f6536f1a169ca8a5d8b8bed8f8
MD5 1c666dde9e9c6fe77715e29d61960af2
SHA1 b6df03d1b9231bdce9ee6f5a3eeac881994f5f1a
SHA512 2a015071df1b3eaf6f5ce1c15989c874c48ca1f4818e3a24b650151292945e70b07b43baf0dad72828621a5748b8276b3ac7c17dbf0768b1881a30dd140daf2c
SSDEEP 1536:y0ExeF88hPdr92L674jAGubqn0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:yPeq8hPdrcWzbqn0hJzdxuT/5ToU
TLSH
T16AA3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Program Files\Stirling PDF\runtime\jre\lib\tzmappings
Size 15KB
SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
MD5 f2c6e7d7e1856acd650426427dc72cbd
SHA1 42fcb6d986381170cdef3aeaaf9f8ddc124fdec0
SHA512 3fff765acea8b4b2f1d01ee080920db815212ef05a75832a4a01e174886544b1320f85229d43d5077e050bf8309a2d467d784e828b82cfd095fa1caca7780b35
SSDEEP 192:LQW46R4S2t0ZvH4LacPZ5E1DBMpLcnyhAXnEo2nh+E4:LQW46R4jtavQSRqwSL4
TLSH
T15F622585B06622E4C073EC0D3F227AD3F886F3C49AC69A4D2953C366BD059B766D5837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Program Files\Stirling PDF\runtime\jre\release
Size 368B
SHA256 1e5d5a2c295aec5e0c848622fe9f88b9a3129a6028c1d1a4522117bf7f6780a9
MD5 a37bad4cc8d575e5026621af9e93f2e7
SHA1 04297b6064f99c096c10ca36561c51c3301112a7
SHA512 262c572041d57b28aec8d2b368d951da16b99cdac3308479490a4ed61413adccf45513a959e42e8cc3763f0007328a5dc61bfe6d9df2c5ead31b952295d22ad0
TLSH
T15AE0D82F581FA4E06BE440C224B4C81FF4D8EC3456846AC4BAC75580B471F8056B0125
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4084_589581140\manifest.fingerprint
Size 66B
SHA256 e84df839eb3dee2a10ba66de65c372c6e2bba0cbab46a39af041f4eeaab1ffe8
MD5 06d2b48de0edcb3e022ed639f0fb0085
SHA1 32f93d5a76998c407087269794026d1ea028828f
SHA512 3c883d4c342f95f28e4a76c73ce7151e8a76d6f5b2c86f90a9ee7f9976ae7e1be94c963489b326d2ff5f7c6423b29552d9aa09b65c17396c2f66ce271fe19506
TLSH
T1F3A022E32CE8880EACEC0AAB020A0AFA0ECC8000020280C80008080220028F0008CA8C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4084_589581140\manifest.json
Size 135B
SHA256 bf066a2cf10074e847bef7c066a9c84deada6586412e181cb417c6426a5d60a4
MD5 616eb6b585f16811dc5db5063e088cd7
SHA1 fc50aa7b747f9367d2b177eab7ab12cdafdeea85
SHA512 cdaf55640f0279c1cee06338912a07bc8bc8cb3780f70202363e25b327eb94a524c0acdd25cc2b22fbb1895d32af888857b17b3f0d7a2064f51ccdf1bab57f79
TLSH
T1BFC04C668D41DEAB00A647A56B295315E23B4B4B5044400A7AB5429C1A285964271844
MD5 SHA1 SHA512 TLSH

Submit Download

Stirling PDF.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stirling PDF\Stirling PDF.lnk
Size 2KB
SHA256 1c208c4dd1c17b11e5426d4253d2d032d0825ac328e0f620bfca0c791e2e04b5
MD5 07b7911b5eb9aba56f138d79bdf37f08
SHA1 e07800941fa8e19b7776b84d1c0e1b73b23ff565
SHA512 80f52978ea87468f2e6ba301548cc76a46b67cdd81022efcb93a836edc0acae9e2d2af92df54b6455d3cd4496b002e562afa4778542e2cf0389c59bc6b305288
TLSH
T17341D00417AD2B7AF3E197753D5656239A62FC06BA64CF2A5185018D0C745006DA6F3F
MD5 SHA1 SHA512 TLSH

Submit Download

Stirling PDF.lnk~RFe59981f.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stirling PDF\Stirling PDF.lnk~RFe59981f.TMP
Size 1KB
SHA256 f349ec32b98be106f50dadf84c40f7297c82354098bbe1eaad75fccd90b2694f
MD5 affc8331517fa2dae79a7785ed8326e1
SHA1 284989b8d8d00b20c000089dd849a09dd28b6019
SHA512 01267cf4b7e364e25ba86c2d957cf31150988a6325845427c4e240a8947d23a1680b01d23ecacd94360a0ba27ad242a58387954758576398da29f21f6991c088
TLSH
T1B941DF041BAD2B7BF3E197753D965722DA72FC06AA65CF3B5185018D08705006DA6F3F
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 317ca52ac589f8e9ea6d8ef80828baba91d2e7e9407884b302c5169915d67cf0
MD5 0cff95327af49874dc35d5c5efa46138
SHA1 d2d7ec0f2ee7118f93a0d5c9b9fa49d222731ac7
SHA512 71c25f2c38d676a7363fa7f117d4ba5f4f03e327a4f515d0bf1e26702942a6ee8afe29018c7aa260d13ab017f8e8a9d55bc9b0304ce35960fa786f08685607dd
TLSH
T1A7F0237739E772511412DC3C2BF91C3339A0ADEB04CA85EAF03418E54BA7BA6D24B04A
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_4FC308ADEA166F4258CCB77F69C42403

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_4FC308ADEA166F4258CCB77F69C42403
Size 727B
SHA256 be05cfc6634f0bfacf2d4f07e259ad07d958b96e3532bea1301674bcc0b5121a
MD5 5a0bef870c47d09ff356d350e6489435
SHA1 2c262a824284eec2e869b4758124dc496d43f1ce
SHA512 59b2b713c47d8b0293ed62d2f63603a747969d90fed31aa7b467e52d9fed8aab652d5fa53f9b8fbbafdc2074bb39df62dc4735f5a2caf1a1888c158511cad997
TLSH
T12001942766B9FF4052DE8C84CFE9DBCE32A84C122CCE020F31394514E0C1F210D01311
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 0206281a958665fb40c4e54614c5ee1bea23d3c8046ced2ecb4fa7b28fc03294
MD5 977c761e9dc78cdf834e48080f5a52f2
SHA1 1d943256438dc47157f3707ff6c05b0865d25a19
SHA512 e95a6c431e6a1e476345a74ab3e0957c7ae609349c411f758a9d714eab10c83831b4a568bf88d72141784e7142410395b9b32bdaa74813cec747aa84f3903aa3
TLSH
T19701941229F72B21B801843DCF9C64B43586C1942D4A23E43B3F28AD324EFB4851B512
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 34284cb5dbadc87e98afdd2b667fb8dbc19d2cc6923e4b1910dee6398ce7c07c
MD5 1798b9dbbcc66a845eb22d517a143a46
SHA1 44ec248f3b36583fe71367eb570229edf89ed180
SHA512 6f89df31be384abf4650be749f7ad914a9264da72169a0f84b74e1b62d7303628d3e216958b6c7fdaded62d84f48fdfb54fec9698797f5b7352b2bb23b2e399b
TLSH
T101E0203067FE502EF1A0577803D591D55F25F10B2C45527E1D91147D5909D005D96D31
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_4FC308ADEA166F4258CCB77F69C42403

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_4FC308ADEA166F4258CCB77F69C42403
Size 404B
SHA256 068dee19cec55b4c64921675591b7c694c8e7cb8c8dd712d1a55379da75ac3ad
MD5 6836334fde7e01556ad7c6fb5a251488
SHA1 8a4ac9702722805de6280d364a635dd7c6b95a3e
SHA512 a142b1b4d144c770febd72c304cacd4be6fd7e74dcfe503f585cb023c9413eaa5ff288bf4d0a95622071ce99712db98add1fd5ba30af840060fec82dd7a17eae
TLSH
T1EDE0203432F7455EF4F1A43843FB69225D9DF10F1505D25B2550575AEA14A40CDA3664
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 ce176682f4bfbc36ad4961942ab3418c16660a16a22a4a84984d56a269130ddb
MD5 6b46eec0d8340fa1d86dd5015da616f9
SHA1 bf41e0ca5500c3d33428c1ed8329811c1b743aee
SHA512 9d7c96bc2a3b31e1fbb086b314700dd7bc2906701909692b01b13601f891e40a893631462cd2a5e46b850a0f3fa1754d352bd4b5d1340c0e7c2c25db45dce895
TLSH
T190E0682862EB610EF190893482FAE1751D89E2092000A27826D15308B70AF009D119F4
MD5 SHA1 SHA512 TLSH

Submit Download

MSI2030.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI2030.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\AutoLaunchProtocolsComponent\1.0.0.12\protocols.json
Size 3KB
SHA256 2edf732da5fd827859e7a1a5b69a4a622cfc416f60a6ae04154d5aad3a1bccec
MD5 5e2067a92dcfcb05537479c384a89725
SHA1 eeed29b07d865ac4d46629fddadad629d0ad4e2b
SHA512 c96c5f9cb7a169ad91b070b567cf9fa8f35951ccc5aa930e97dbeccbeac27f7e9dde1379138c9ba6b0d10339f9cb053ef21f19f06d7560f97d5d23a27c8ed4f6
TLSH
T17D7184B7862088194E360AB4AA0DF10DF93702DF2AF598D3B27D455F1F712BB3946249
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 df429d449c9db64f52cd94ccf95aef52ffdcc5af0f2bd94f068673039fa078ba
MD5 d09ca1ee3b71b872e981f3d84210af01
SHA1 d88e2e50af70f2a4eb01682a8ab9d77544bbff40
SHA512 d0031b9fcde82e75688e206351b30b2940af4a3283a6a3c456e4c2d88b52bc4628ff42fdceea31194296a20da0ca68ecaad32fd976856b58f5a03e556628740f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 399d2285431d7febb7274e58e949e43507a48822a2bffe10f83007445437b6b4
MD5 b505a28136fee87c7339b7a02c6b59ab
SHA1 a4fb8bab92e8bc2beaa53720f4cfd6e119ba768e
SHA512 d1fc23991a1d84af1e42c1086a622fc7f95779f9dbc44a45bf409805d71d25cf466428764bfa606edc5dde52b71f0cbf417e0a74f492be0d498e3d74ea78be0e
TLSH
T1A0D0123333224678C01028331013710D1400C21F80164004643DA66F1A041500916491
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 c8b715e9315f997f82688de5087bdaa04325f2f031c56451684b5f9f45ead0f4
MD5 b064a048d48a4a1fa3a44e9b400fb14e
SHA1 d3ae642e567eba43a5a76184c11161bcc912f316
SHA512 5197a7e8dd9a97abd59b6fa57faffe9b16d426882212cce2f784da699b1d0e62d7a548e265e7abc78df96b4c856eb3b2261296d7878488c33d5194d757ccd417
TLSH
T1FBB0125011180109CFF077340BC3344E7835040122230F130FD4ECF060113C14574201
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 76d08a56d610e3e24d9093d6f62c6b4c29cd0a7b713408ebdef441d9ce0424f2
MD5 fcd3a3c590875de192d106e2c8300ef9
SHA1 225f4f5fdd2733aa95985c513a3f8fc69dbcf076
SHA512 859d6d231e85dd582a362caa42d8c0a93a230b450627c5cc33aad7d312ea2e1684a2dd20eeb97642c98690ec53a7c88123cf35b0defdb677a2059bb7e01f3f93
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\Network Persistent State
Size 836B
SHA256 f0d9fc060ee27663401867987f3f87c6bae22facd973fd440a04da371a75dd7e
MD5 8ce592ad9feb62da293c11542f649700
SHA1 45f2ebc0d9bc00949850f6d46a7f65fb68c357c8
SHA512 f74ba0715c3cf420126f7d322e738b246aee745d4c639fe7a6039e00acabb4f410c8fdfd1d031fc5e1a9ca5114a5c7462d3739cf640ec074f6552083791746fb
TLSH
T1B30180A282F0C56D874127E01A313C17CD2E0405972CAD36CDEAABA55BD1071E11154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5ad553.TMP

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\Network Persistent State~RFe5ad553.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 e03090e24ec98149ef25ddd9fa97f2b198519404bc5e1c801d55fddb222cf18a
MD5 88cd8dacc1db1312acc659fe055ee0f6
SHA1 2a2543c0565e0658dee46a9812174ec7be4f010c
SHA512 8cd2ab46ae458074bad0495e2b67717a0e18aefee850f7bbe39d6c9d2d8536d4c41f5aa0d8f29ab5c43bd5e6a809c9052451edbe49c28f999b586d26747776af
TLSH
T1F4E0D8B384BEB46B2078297A1885BD091E7EF534509154E48A52466CA0600BA5613522
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a1e95.TMP

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\TransportSecurity~RFe5a1e95.TMP
Size 188B
SHA256 9cce648ee9a78f2a56691c758b0b2eb07a28ec8a6e9b8294cb602166ddbb0d40
MD5 b309dae18c67ccbf098f0c1b64e7a906
SHA1 2630be4e0feb6c64e632ad324739d295285ee6e6
SHA512 14a77047f2c413a9cd20e7cdc87a28d9e1e16082cabbbdd63ae5ed2daf40ca9f828bf317cbdfa4335694dac069f25a89a88d0d52e03bbaee791ebbe836debf1d
TLSH
T1E4C0C0A3807DE037107C063118C1BD045F3BF0365051F4E88EA355BCA0200BA5127113
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Preferences
Size 6KB
SHA256 f13cc2ae6d65337127e25952ec0b9fa754960c31288f8a2ed4e13ab16cca7aa3
MD5 1f5dbfad0ec25ed04aca26280087bd3c
SHA1 a8e8c1c500f61a9d857ee45640b6713530ad3d8c
SHA512 6bfe2b95447845af2942b8cab4fefcebb21c3b07a9ed3298758de42dc03bddf7a371502a2b9d9888ffb986301361a579186364ad779b1039d0189402364f3249
SSDEEP 96:st805lyHcb9Hff5Z8i0vhEwtkt9m/7qx+WVHMSm+uecJAP1idQjf+gzoMOB:st807RfBZ8pawMA/S+WiTAPwduhoMC
TLSH
T1D7D1A9025E2879774CC7F6197A36BB12E3F6516262D50E58EFFC861C08E66DC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a4b33.TMP

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Preferences~RFe5a4b33.TMP
Size 6KB
SHA256 7cdacb2cd75e7f686f02df65d304a147a5bea32adf69ec8bf5698b45775f474e
MD5 682172c2a9787c9f0e96c3d0972b0e9a
SHA1 82e692bdb55d7593deafdfebaf02b4cf473da8df
SHA512 f4a00fc8978e3b2b955241b1a6a9c830426d6a37e37becaf297cb81f136afc30de7e639c62263ead6f70a8951016f1d1baa7d0142ae32bb7c75f64367a07355b
SSDEEP 96:st805lyHcb9wff5Z8i0vhEwtkt9m/7qx+WVHMSm+uecJAP1idQjf+g+oMEB:st807ifBZ8pawMA/S+WiTAPwduIoM8
TLSH
T1DDD197025E28B9774CC7F6197A36BB12D2F6216262D50E98EFFD851C08D66DC630B90B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State
Size 1KB
SHA256 42aef992be1739067944f65834ae6d16e59c1c090b5490865ac8ac2f04eb4f20
MD5 329d0aca58bd3b263015d447e2eddbc8
SHA1 a6ad2de167469046ac559b33f2d1f4fd269c81db
SHA512 008b0e90ff928bbcb3f18f5300992322af9715add9050ae938a546d5e6d990115a3c212e5f76648e7d1070b1ad9c94ae9e45573cf27f0c771a49bec724888530
TLSH
T14B3192B2A880BB72AD81B184B313AF976E21213AC1508E88A5DD470C02DB7AC502EC37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State
Size 2KB
SHA256 bfa8ed8ed2ffdbe49f49394ae0998deddb7b20c2df4ed6f7283a86062f9b6168
MD5 77b6556a55847eafe8d119be3774d04b
SHA1 483936ae43fbdcdda757e530cb3ced0ba4c56da3
SHA512 0aa2478a92b6d5e42ca026f9ee10a84c2fbf5b75cae287736a1442ff16a4fdee6d4edbdf90b52e7157c479396ef417604ff024051374f869d0448574fbef0831
TLSH
T1565196727844FB7389E2E584B65A6F13DA36627586511F90AADD0B0C01DB66C2306C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State
Size 16KB
SHA256 26e5e682962a6500d261d1949abd4da6e2d49f475467df270b9cb43bd6eb8beb
MD5 c18b0b24cb287f1dd76e33ff1445db7c
SHA1 754949d8db4b02ed9de73135a0e97f85c80fc537
SHA512 a6b01247cf4bf949ee88f8537a1a62bbc1c789866040e687717d3f0f083ea494c8b0938a19d6d7f258536df4449e38ecd4cc224c2025c1cedc94e657699b760c
SSDEEP 384:z1+aQikB+z/xvxjg/qhEwNbgJ8skRpK8zA+uEW:8/UxvxjgC+16PRfs
TLSH
T1AC729E2A58A97E23A6F2F5847A5D1B8FD7B544B280C16EB84EED5F0D02CB7D81302D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State
Size 3KB
SHA256 3d5603138474d6508ed1ef6115f1c9e408441df6058e139621229ad578c26674
MD5 b67bfea077c8176f1fe9cc875a5251b8
SHA1 3ea8aa1863723fc842802d43415d1ebaf8fec0d2
SHA512 062eb5733b2d9167ea64e6c4c96b1457c320d103cd7a2de5bc09fad8ef2635630ba2aeeeebed6696a60ef525271096ad7382ee6a9bd04b4989bce9df538df463
TLSH
T17371B6766864FA378EE2E944B6862F16B7651237D1913F94DAEC0F0C01DB7982342C17
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe59ac82.TMP

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State~RFe59ac82.TMP
Size 1KB
SHA256 93cc436127a179b8533bd415795c969cf9941daf4e2107e4215259f92c190501
MD5 4adad728f5bfd82e9cfc856b34d880cc
SHA1 87554c987ee8531c620ff15fcde020fb8a43a521
SHA512 facfd761dfcdb672d83190d823284a3911abcc7023d73c06764ca968e5308323e55ea002a67d1a1a15bed554ee94c8ec7d8a7937b454576b73199f340d16cebb
TLSH
T1282165B39884FF72E941A494B313AF8B2E60617981508F48A5CD531C02DB6AC552BC37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.yml

Path C:\Users\Admin\AppData\Roaming\Stirling-PDF\configs\settings.yml
Size 35KB
SHA256 3c5906179405463e93de156b5c26c092a3b63c28b7543f11f7dda44444fe70fa
MD5 1339f1071b8dc6a2b1564cd1664d636d
SHA1 2b3a9ada265524c5de87e9a65aa24549dc6b614e
SHA512 33085b17d587082072dccb93f96399f18a4cb11b320fa9dd7f38e47759e8cf53b043c1678ef32cdebca1352c1e44c496c9e2f652c5e8d5db6249c18776e3d598
SSDEEP 768:2GPwjUQ8NPkYCCTUVhbvFydvhaxuD6eiwxvFwOAohxt:2GP8CUVgvhWeFAi
TLSH
T164F2F953660431394792C1B6B526D632AB3AE10E1A937039B49EC26C3F4AF1C537BFE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tauri-backend.log

Path C:\Users\Admin\AppData\Roaming\Stirling-PDF\logs\tauri-backend.log
Size 1KB
SHA256 a13dc566556a1b24492abc77389dafb4606176d69426827272ec4b094e5e6a3b
MD5 0aa889a2317cf5159264e04db220ffad
SHA1 e5501ee6f2e7729651b4d6cedad31406a626dd26
SHA512 9c3daa82f2e137b04fa61ec9046ece4767ba1316615ec841ae786775cea3fa558900e7bf0e01ce66ff2519299038ae35cb9dbac7d1ad27aee802e25a13a65c09
TLSH
T1C541BB0A69D4E60EFD2ECE835374AA8C4020C83B37793859D724F31A16B846A427DE32
MD5 SHA1 SHA512 TLSH

Submit Download

tauri-backend.log

Path C:\Users\Admin\AppData\Roaming\Stirling-PDF\logs\tauri-backend.log
Size 3KB
SHA256 9bc8d9b4deab6281e208532e15ce883f2b17122caa0291642b51de5aa7237424
MD5 d9ad1f27b0db760c1f1a609312648f00
SHA1 5dfd5bd02fc0180534d0e6338383dcd934edad55
SHA512 376d69c2b1131c9aeb00410b4b04aaba4f86242312235e8cd95e6fa04e8b3651315be8fabe8e6294a58850af6c806124ea267b796698dd44add08982a7ccb64a
TLSH
T1BA71108BA181944BEE3DDDA76231EB4D5540843F67742075AB28F31903BE4EE0479F70
MD5 SHA1 SHA512 TLSH

Submit Download

tauri-backend.log

Path C:\Users\Admin\AppData\Roaming\Stirling-PDF\logs\tauri-backend.log
Size 4KB
SHA256 f448f1f895f433b8720f9c14c5b0fb57cc2dd79ac1d43d57c45e5351d1278ba2
MD5 b67889d02310f88ac66ec161640704b3
SHA1 590cf95f92b445a111bb287ee9a0446f7bff3053
SHA512 0d3762a2a58a4ba9c1ec02b08b7f9d4b557730e16161481dae837d4f90a43562b90024431daa2feee3784a374acac5352848e10d1f362f2a68aae44b0d4820c7
SSDEEP 96:AK8JvNOvNXnTTTFTBTxTHhyvbTsO5TckmzByvEPnTp8lDh53a4JvsO1TCHTItAK8:EJvNOvNXTnRl1HEvf15Fmzkv+p2D3pvu
TLSH
T1F3A15E4AA2C19597EE7DDCAB62309A8D2650883FA7742068AA3CF315027D4DA0979F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 97cce0a988bfa3176e2534046c30843eb168bdfb4259e5d2187647f6b9230d35
MD5 5d32642ae09bd1ced40cb0bea8ac3969
SHA1 38e5b3817533bb23e7e564a4cb9ae3bec316ff1f
SHA512 519bc8a1edc1d57d51039fc9073e469440b9fb45b448ec112958e7e0c65fe68d0bf64bd1dedd5480cec10648af6caa17a4b4b6b689b9b122b48c62d0c7d76dae
SSDEEP 24576:Ru8m+1zBdoO/vvTLrW2ez2qCHvkTel2y6AGt0JXVuUKX+R/r4vFvuw9Bz:z
TLSH
T1AB47A42436F92140E7F79F3C68F06A23493A7D6B9C19DE8D45811B4E0921FB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{79029278-4b84-4b82-a2fb-e521e8b53199}_OnDiskSnapshotProp

Path \??\Volume{63ef4f52-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{79029278-4b84-4b82-a2fb-e521e8b53199}_OnDiskSnapshotProp
Size 6KB
SHA256 97a25bfdedc79ed1244caebb365797c9b0f1978eae80b54e5e49dd1e478dd93c
MD5 90c4a89821b5bb4ba32c5650f8ca0278
SHA1 f79935548d8eeb9994fc101be6329f1e90fa03b4
SHA512 605a22412215106f110bc101d5339d9937934471896ff3e64a19a3aac3207d90a569b56400c8ba07d6467749b960cd96497e344354eb2715eeec8e4f6548c3bf
SSDEEP 96:FGmEMAvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:QmYb++ZVmN
TLSH
T1BED188085AF54711E2F3AB3129F14557A877B911EF33CB8E0298638E2670910F936F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1480-653-0x000001F584220000-0x000001F5842ED000-memory.dmp

Download

memory/1480-305-0x00007FFE13800000-0x00007FFE13801000-memory.dmp

Download

memory/2052-671-0x000001B714700000-0x000001B7147CD000-memory.dmp

Download

memory/2052-406-0x00007FFE13800000-0x00007FFE13801000-memory.dmp

Download

memory/3240-326-0x00007FFE12F70000-0x00007FFE12F71000-memory.dmp

Download

memory/3240-327-0x00007FFE13630000-0x00007FFE13631000-memory.dmp

Download