e93309ba206e529234084221a03f5dbd91719ce66ab06f8ad3474f5727f8dfd1

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Stirling-PDF-windows-x86_64.msi
Size 258.3MB
Sample260818-ay2z7sshkc
SHA256 e93309ba206e529234084221a03f5dbd91719ce66ab06f8ad3474f5727f8dfd1
MD5 e49714398b798b2f1a8f09cc86c24af3
SHA1 79abac141fefa41da09e4504c634d9a66635f686
SHA512 1a37bf6b49b4ab18b058921c6e31e52fd5b6c826ca8e341dbd32743da61d1cd7a7343221242951e36ad301b0ea0239d4e10fe8d2c52dfd562db978e71e2a9516
SSDEEP 6291456:6vtz/5/8zXbktzvIC/WJMK+weRCao/TZ1F9SAph9L+auuvGvpcsSK:6vtD5OAltefBAw99SAL9CaxeRcv
TLSH
T160D833A2A8BD5F2EE04876368181732C8956BDC15112DC76F708F7A63B731D22AF6CD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
1776	Stirling-PDF.exe
4112	java.exe

Loads dropped DLL 14 IoCs

pid	Process
4716	MsiExec.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe
4112	java.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Stirling-PDF.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\README.txt	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.base\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.transaction.xa\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\javaw.exe	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\splashscreen.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.base\aes.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\jaxp-strict.properties.template	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\xhtml10.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\lib\security\public_suffix_list.dat	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\schema10part1.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\lib\tzmappings	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-string-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.rmi\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-heap-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\Uninstall Stirling PDF.lnk	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\rmiregistry.exe	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.prefs\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\jaxp.properties	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-fibers-l1-1-1.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.cryptoki\pkcs11wrapper.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-kernel32-legacy-l1-1-1.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\jcup.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.security.jgss\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\sound.properties	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.ec\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.sql\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\jrunscript.exe	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.ec\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.mscapi\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.cryptoki\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\ucrtbase.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.unsupported\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-crt-environment-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\limited\exempt_local.policy	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.xml\dom.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.base\icu.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-namedpipe-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.management\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.desktop\lcms.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.datatransfer\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-util-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-crt-stdio-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.naming\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.security.sasl\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.desktop\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\limited\default_US_export.policy	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\fontmanager.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\conf\security\java.security	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.dynalink\dynalink.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.sql\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-memory-l1-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.security.sasl\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.compiler\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\instrument.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.compiler\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\lib\fontconfig.bfc	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.net.http\LICENSE	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-file-l2-1-0.dll	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.net.http\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.base\public_suffix.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.base\c-libutl.md	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\legal\java.prefs\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\Stirling PDF\runtime\jre\bin\api-ms-win-core-console-l1-1-0.dll	msiexec.exe

Drops file in Windows directory 19 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBC4C85285DD08131.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A30.tmp	msiexec.exe
File created	C:\Windows\Installer\{EF165B43-F51E-4B09-9E11-230441296E37}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4500_2038477313\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4500_2038477313\_metadata\verified_contents.json	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e5a7011.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBC359E1440061481.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{EF165B43-F51E-4B09-9E11-230441296E37}\ProductIcon	msiexec.exe
File created	C:\Windows\SystemTemp\~DFEAC5B474F7C5B59F.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4500_2038477313\LICENSE	msedgewebview2.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5a7013.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF21780C3F96C553E8.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4500_2038477313\keys.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4500_2038477313\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e5a7011.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{EF165B43-F51E-4B09-9E11-230441296E37}	msiexec.exe

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5344	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000f2192634d2a4d980000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010f2192630000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010f219263000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30f21926300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60f21926300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf\DefaultIcon\ = "C:\\Program Files\\Stirling PDF\\Stirling-PDF.exe,0"	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ShellEx\{E357FCCD-A995-4576-B01F-234630154E96}\ = "{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf\ = "URL:stirling.pdf.dev protocol"	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stirlingpdf\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\ = "Stirling PDF.pdf"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673\MainProgram	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673\Environment = "MainProgram"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\ProductIcon = "C:\\Windows\\Installer\\{EF165B43-F51E-4B09-9E11-230441296E37}\\ProductIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9ABF5033E5E790C5CB17CE0A6AF5F4EE\34B561FEE15F90B4E91132401492E673	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf\DefaultIcon	Stirling-PDF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\DefaultIcon\ = "\"C:\\PROGRA~1\\STIRLI~1\\STIRLI~1.EXE\",0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\Stirling PDF.pdf\ShellNew	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\ProductName = "Stirling PDF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\Version = "34471939"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\9ABF5033E5E790C5CB17CE0A6AF5F4EE	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf\shell\open	Stirling-PDF.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open\command\command = 78002d005b007000750037003f007d002c004000540054002400440024003400290041006e003500530068006f0072007400630075007400730046006500610074007500720065003e002900360039004400500045006b0043004b004600640037007e0034007500640047006200560074002000220025003100220000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\ = "URL: protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}\ = "Stirling-PDF Thumbnail Handler"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}\InprocServer32\ = "C:\\Program Files\\Stirling PDF\\stirling_thumbnail_handler.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\PackageName = "Stirling-PDF-windows-x86_64.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stirlingpdf\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673\External	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf\shell\open\command	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open\command\ = "\"C:\\Program Files\\Stirling PDF\\Stirling-PDF.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\stirlingpdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2D2FBE3A-9A88-4308-A52E-7EF63CA7CF48}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\shellex\{E357FCCD-A995-4576-B01F-234630154E96}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf\URL Protocol	Stirling-PDF.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf\shell\open\command\ = "\"C:\\Program Files\\Stirling PDF\\Stirling-PDF.exe\" \"%1\""	Stirling-PDF.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673\ShortcutsFeature = "MainProgram"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf\shell\open\ = "Open with Stirling PDF"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\34B561FEE15F90B4E91132401492E673	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\Language = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\stirlingpdf\shell\open\command\ = "\"C:\\PROGRA~1\\STIRLI~1\\STIRLI~1.EXE\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\stirlingpdf\shell	Stirling-PDF.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stirling PDF.pdf	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdf\Stirling PDF.pdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\34B561FEE15F90B4E91132401492E673\PackageCode = "7126793BBFBC1C2488AD0319E02645F0"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5656	msiexec.exe
5656	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs

pid	Process
4500	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5344	msiexec.exe
Token: SeSecurityPrivilege	5656	msiexec.exe
Token: SeCreateTokenPrivilege	5344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5344	msiexec.exe
Token: SeLockMemoryPrivilege	5344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5344	msiexec.exe
Token: SeMachineAccountPrivilege	5344	msiexec.exe
Token: SeTcbPrivilege	5344	msiexec.exe
Token: SeSecurityPrivilege	5344	msiexec.exe
Token: SeTakeOwnershipPrivilege	5344	msiexec.exe
Token: SeLoadDriverPrivilege	5344	msiexec.exe
Token: SeSystemProfilePrivilege	5344	msiexec.exe
Token: SeSystemtimePrivilege	5344	msiexec.exe
Token: SeProfSingleProcessPrivilege	5344	msiexec.exe
Token: SeIncBasePriorityPrivilege	5344	msiexec.exe
Token: SeCreatePagefilePrivilege	5344	msiexec.exe
Token: SeCreatePermanentPrivilege	5344	msiexec.exe
Token: SeBackupPrivilege	5344	msiexec.exe
Token: SeRestorePrivilege	5344	msiexec.exe
Token: SeShutdownPrivilege	5344	msiexec.exe
Token: SeDebugPrivilege	5344	msiexec.exe
Token: SeAuditPrivilege	5344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5344	msiexec.exe
Token: SeChangeNotifyPrivilege	5344	msiexec.exe
Token: SeRemoteShutdownPrivilege	5344	msiexec.exe
Token: SeUndockPrivilege	5344	msiexec.exe
Token: SeSyncAgentPrivilege	5344	msiexec.exe
Token: SeEnableDelegationPrivilege	5344	msiexec.exe
Token: SeManageVolumePrivilege	5344	msiexec.exe
Token: SeImpersonatePrivilege	5344	msiexec.exe
Token: SeCreateGlobalPrivilege	5344	msiexec.exe
Token: SeCreateTokenPrivilege	5344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5344	msiexec.exe
Token: SeLockMemoryPrivilege	5344	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5344	msiexec.exe
Token: SeMachineAccountPrivilege	5344	msiexec.exe
Token: SeTcbPrivilege	5344	msiexec.exe
Token: SeSecurityPrivilege	5344	msiexec.exe
Token: SeTakeOwnershipPrivilege	5344	msiexec.exe
Token: SeLoadDriverPrivilege	5344	msiexec.exe
Token: SeSystemProfilePrivilege	5344	msiexec.exe
Token: SeSystemtimePrivilege	5344	msiexec.exe
Token: SeProfSingleProcessPrivilege	5344	msiexec.exe
Token: SeIncBasePriorityPrivilege	5344	msiexec.exe
Token: SeCreatePagefilePrivilege	5344	msiexec.exe
Token: SeCreatePermanentPrivilege	5344	msiexec.exe
Token: SeBackupPrivilege	5344	msiexec.exe
Token: SeRestorePrivilege	5344	msiexec.exe
Token: SeShutdownPrivilege	5344	msiexec.exe
Token: SeDebugPrivilege	5344	msiexec.exe
Token: SeAuditPrivilege	5344	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5344	msiexec.exe
Token: SeChangeNotifyPrivilege	5344	msiexec.exe
Token: SeRemoteShutdownPrivilege	5344	msiexec.exe
Token: SeUndockPrivilege	5344	msiexec.exe
Token: SeSyncAgentPrivilege	5344	msiexec.exe
Token: SeEnableDelegationPrivilege	5344	msiexec.exe
Token: SeManageVolumePrivilege	5344	msiexec.exe
Token: SeImpersonatePrivilege	5344	msiexec.exe
Token: SeCreateGlobalPrivilege	5344	msiexec.exe
Token: SeCreateTokenPrivilege	5344	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5344	msiexec.exe
Token: SeLockMemoryPrivilege	5344	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
5344	msiexec.exe
5344	msiexec.exe
1776	Stirling-PDF.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5344	msiexec.exe
5656	msiexec.exe
4716	MsiExec.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5656 wrote to memory of 4716	5656	msiexec.exe	90
PID 5656 wrote to memory of 1752	5656	msiexec.exe	96
PID 5344 wrote to memory of 1776	5344	msiexec.exe	99
PID 1776 wrote to memory of 4500	1776	Stirling-PDF.exe	100
PID 4500 wrote to memory of 5980	4500	msedgewebview2.exe	101
PID 4500 wrote to memory of 5016	4500	msedgewebview2.exe	102
PID 4500 wrote to memory of 5016	4500	msedgewebview2.exe	102
PID 4500 wrote to memory of 5016	4500	msedgewebview2.exe	102
PID 4500 wrote to memory of 5016	4500	msedgewebview2.exe	102
PID 4500 wrote to memory of 5072	4500	msedgewebview2.exe	103
PID 4500 wrote to memory of 2016	4500	msedgewebview2.exe	104
PID 4500 wrote to memory of 2016	4500	msedgewebview2.exe	104
PID 4500 wrote to memory of 2016	4500	msedgewebview2.exe	104
PID 4500 wrote to memory of 1136	4500	msedgewebview2.exe	105
PID 4500 wrote to memory of 1136	4500	msedgewebview2.exe	105
PID 4500 wrote to memory of 1136	4500	msedgewebview2.exe	105
PID 4500 wrote to memory of 1136	4500	msedgewebview2.exe	105
PID 4500 wrote to memory of 1136	4500	msedgewebview2.exe	105
PID 1776 wrote to memory of 4112	1776	Stirling-PDF.exe	106
PID 4112 wrote to memory of 5180	4112	java.exe	108
PID 4112 wrote to memory of 5268	4112	java.exe	109
PID 4112 wrote to memory of 5808	4112	java.exe	112
PID 4112 wrote to memory of 1292	4112	java.exe	114
PID 4112 wrote to memory of 4728	4112	java.exe	116
PID 4112 wrote to memory of 3148	4112	java.exe	117
PID 4112 wrote to memory of 2676	4112	java.exe	119
PID 4112 wrote to memory of 1976	4112	java.exe	122
PID 4112 wrote to memory of 5976	4112	java.exe	124
PID 4112 wrote to memory of 3572	4112	java.exe	126
PID 4112 wrote to memory of 6104	4112	java.exe	127
PID 4112 wrote to memory of 3316	4112	java.exe	130
PID 4112 wrote to memory of 2492	4112	java.exe	132
PID 4112 wrote to memory of 400	4112	java.exe	134
PID 4112 wrote to memory of 1332	4112	java.exe	136
PID 4500 wrote to memory of 2732	4500	msedgewebview2.exe	140
PID 4500 wrote to memory of 2732	4500	msedgewebview2.exe	140
PID 4500 wrote to memory of 2732	4500	msedgewebview2.exe	140

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Stirling-PDF-windows-x86_64.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5344
- C:\Program Files\Stirling PDF\Stirling-PDF.exe
  "C:\Program Files\Stirling PDF\Stirling-PDF.exe"
  2⤵
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --enable-features=MojoIpcz,CertVerifierBuiltinFeature --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=1776.5400.3557156447802341235 /pfhostedapp:d3ccce2b2975520b5c216a43ad6550d93d3c5598
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4500
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView /prefetch:4 /pfhostedapp:d3ccce2b2975520b5c216a43ad6550d93d3c5598 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x160,0x194,0x7ffa034d5fd8,0x7ffa034d5fe4,0x7ffa034d5ff0
      4⤵
      PID:5980
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1712 --field-trial-handle=1716,i,7112592252534555213,12130185384896270476,262144 --enable-features=CertVerifierBuiltinFeature,MojoIpcz --variations-seed-version /prefetch:2 /pfhostedapp:d3ccce2b2975520b5c216a43ad6550d93d3c5598
      4⤵
      PID:5016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2152 --field-trial-handle=1716,i,7112592252534555213,12130185384896270476,262144 --enable-features=CertVerifierBuiltinFeature,MojoIpcz --variations-seed-version /prefetch:3 /pfhostedapp:d3ccce2b2975520b5c216a43ad6550d93d3c5598
      4⤵
      PID:5072
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2256 --field-trial-handle=1716,i,7112592252534555213,12130185384896270476,262144 --enable-features=CertVerifierBuiltinFeature,MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d3ccce2b2975520b5c216a43ad6550d93d3c5598
      4⤵
      PID:2016
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=2996 --field-trial-handle=1716,i,7112592252534555213,12130185384896270476,262144 --enable-features=CertVerifierBuiltinFeature,MojoIpcz --variations-seed-version /pfhostedapp:d3ccce2b2975520b5c216a43ad6550d93d3c5598 /prefetch:1
      4⤵
      PID:1136
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView" --webview-exe-name=Stirling-PDF.exe --webview-exe-version=2.14.3 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4784 --field-trial-handle=1716,i,7112592252534555213,12130185384896270476,262144 --enable-features=CertVerifierBuiltinFeature,MojoIpcz --variations-seed-version /prefetch:8 /pfhostedapp:d3ccce2b2975520b5c216a43ad6550d93d3c5598
      4⤵
      PID:2732
- - C:\Program Files\Stirling PDF\runtime\jre\bin\java.exe
    "C:\Program Files\Stirling PDF\runtime\jre\bin\java.exe" -Xmx2g -DBROWSER_OPEN=false -DSTIRLING_PDF_TAURI_MODE=true -Dlogging.file.path=C:\Users\Admin\AppData\Roaming\Stirling-PDF\logs -Dlogging.file.name=stirling-pdf.log -Dserver.port=0 -Dserver.forward-headers-strategy=none -Dsecurity.enableLogin=false -Dsecurity.csrfDisabled=true -jar "C:\Program Files\Stirling PDF\libs\stirling-pdf-2.14.3.jar"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4112
  - - C:\Windows\SYSTEM32\where.exe
      where rar
      4⤵
      PID:5180
  - - C:\Windows\SYSTEM32\where.exe
      where tesseract
      4⤵
      PID:5268
  - - C:\Windows\SYSTEM32\where.exe
      where ocrmypdf
      4⤵
      PID:5808
  - - C:\Windows\SYSTEM32\where.exe
      where qpdf
      4⤵
      PID:1292
  - - C:\Windows\SYSTEM32\where.exe
      where weasyprint
      4⤵
      PID:4728
  - - C:\Windows\SYSTEM32\where.exe
      where pdftohtml
      4⤵
      PID:3148
  - - C:\Windows\SYSTEM32\where.exe
      where magick
      4⤵
      PID:2676
  - - C:\Windows\SYSTEM32\where.exe
      where gs
      4⤵
      PID:1976
  - - C:\Windows\SYSTEM32\where.exe
      where soffice
      4⤵
      PID:5976
  - - C:\Windows\SYSTEM32\where.exe
      where unoconvert
      4⤵
      PID:3572
  - - C:\Windows\SYSTEM32\where.exe
      where ebook-convert
      4⤵
      PID:6104
  - - C:\Windows\SYSTEM32\where.exe
      where python3
      4⤵
      PID:3316
  - - C:\Windows\SYSTEM32\where.exe
      where python
      4⤵
      PID:2492
  - - C:\Windows\SYSTEM32\where.exe
      where /opt/venv/bin/python3
      4⤵
      PID:400
  - - C:\Windows\SYSTEM32\where.exe
      where fontforge
      4⤵
      PID:1332

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5656
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B03D683F0D9B021DA91EAE37109E8DAC C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4716
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1752

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5a7012.rbs

Path C:\Config.Msi\e5a7012.rbs
Size 145KB
SHA256 b738e7d163c3d65585a4f0b30d17490c68a52b401b14bc2d1d0bc565bfe7d8fc
MD5 d3326912a9bc6245e6e6d829b9c82e4e
SHA1 2e170836d5979234659195facf47d9138317812e
SHA512 282c5e9ac1d02138061151e006b1fe691d8563acb2d1c637cdf21d0356e935c47c0c1194771b28b0f677a9921b4e1fad0d16d506370818da6e1a71efb962fd53
SSDEEP 1536:20wYSqmUv6BnuGO7j6f+i9WQpa1u+XNLek0EX2y6SU0qd4p3hazmUe7Z6nZkg0Hc:oK2V
TLSH
T175E38B466A20C782E18F177DFE6757413335C4ED63EE910B66AC9274D8863A03BB8D1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\VCRUNTIME140.dll
Size 117KB
SHA256 02c6aa0e6e624411a9f19b0360a7865ab15908e26024510e5c38a9c08362c35a
MD5 caf9edded91c1f6c0022b278c16679aa
SHA1 4812da5eb86a93fb0adc5bb60a4980ee8b0ad33a
SHA512 32ac84642a9656609c45a6b649b222829be572b5fdeb6d5d93acea203e02816cf6c06063334470e8106871bdc9f2f3c7f0d1d3e554da1832ba1490f644e18362
SSDEEP 1536:dI2v39UXigCBs29DdxfggO6vMMKZsY2ofRjoecbdhUwdJTzmZhTzC:diwskD8B6vMMEs5oGecbd2wHT0Te
TLSH
T1FBC38C4672A042FBD16AC274C1E35E17FB75B84487A0A7CF03A58A690F53BE09E3D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\java.dll
Size 114KB
SHA256 e5b9d03078656bc530f03857fa89c435db4fd7b246a6f34edea4f1c59f5b31e6
MD5 6136718281baf216a552dbbaddddc1f6
SHA1 48f03f875583690f2ad9addda742aae7cabc4bad
SHA512 41789c514fd76e04d015e8a0810fa5a17ee9ee2339b6c3bc65530565f4edc4adbe2d23fcf6a9192a513327848f99add41c7af6e3c9ab8c432037657829bbf5bd
SSDEEP 3072:xhkdkKVjreezgMyHtEQP3i+ayNGEZYYrZU69s/2gFMOuxFRVOvwl:3UkKVjaezgfjiwmwl
TLSH
T11AB34B1BB7298085F45AAABC80669D0BD372B4700341E74F13E6CA9E9F8F7713D09795
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.exe

Path C:\Program Files\Stirling PDF\runtime\jre\bin\java.exe
Size 49KB
SHA256 1dfe0b08636bc74b56db5e246f038cfe67c18f567053373fa601d310f29ed9da
MD5 f0be736a482b66d05f9a285c544645e5
SHA1 a49476ff972848b543972406349296786ff8ef0f
SHA512 2cc540f808b9b03db31de4f1fde327bde158b00cbd8eb2d845e438ab3a8d9e8cec66c6739c6f171972e4314186a2f03a50bc3c55c2007d46a8c1cfcf8888a317
SSDEEP 768:jTZJFZM5R2TyJ5R3s8D/bkt5Ruz3Vb3NU5TYiDLk5uIvnlb:R5M5RdJ5R3sozkt5RA3NU5T7lIvlb
TLSH
T134337C47AA182C81F42F84B158A7752751B4BD032BC173EBBDCAB21E0D71391A9176EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jimage.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\jimage.dll
Size 33KB
SHA256 2375c81a92a89dfbcdd613790748b702e81f762d964e10b41c294264735be325
MD5 ed56339ae3a4cf33905441f88593b79d
SHA1 13512db899807405357e7f7f9e28e155ac9d6894
SHA512 01553e87d62810fcb71ce7500dd4a50aa2bc66177b14cbe9420e66160db9c86063133ae4e0be6de62eabe693ed4030f62220585ccfeddb2691dba0d54ffd8127
SSDEEP 384:H55kBR2x3tCn9LD+YuNIpQKyvh7GB4JNyEIYi2mL4/y8RbIIvZgFchQj:HFHCnFDCIpQJvh7J2YiDLk5uIvLQj
TLSH
T16FF27D5AE6841C89E92BE538C8AB9A1FD7F5F9524F51C3CB1720825E0F333813B59792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jli.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\jli.dll
Size 82KB
SHA256 da2693437d06125ba8392bc2b8200adb094dd0c294f9771b68e2d089cc3f655a
MD5 4c950d7b1fc6e140f97632b05115d78e
SHA1 79f685fbd7a65be7949465d4a16b284713be5680
SHA512 428c8c21b95319b492c988298bed3370f8c6ad6e6c42c3a3b517ef50a43c9b17c8379995847bf57d9c278f69426a7e6fe62a54d9c7ed76301c0887783fe716cd
SSDEEP 1536:nkoxO38mh+pYZochEJgsQBIOFeXOUKFA7lIvh:ko038S+KZoKEMFe+UKFAOvh
TLSH
T11E839E9A539011E4DEB79578D9B4960FC3F2B0653721838F13AC81EA0FB36613E19BD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

management.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\management.dll
Size 29KB
SHA256 3cc759174fa5cf6f270fbcb6d0415e4312605d2b87f5a3a5bd8c080e7b18f882
MD5 591311a02adba14661b78df5e4a95a8b
SHA1 e9a5a129065b83613373f4a5a4990a590949956f
SHA512 ad6f58ed2b68e5d88875bba29e2736b1fc517347d774206ecd808f2f1ab8eff7f3c66f6b1450f12201cdc18eea79e48ae5e26cb7a9f7020d161026294919d479
SSDEEP 384:/10/3Hri4b9ao0KHs2Vs0G3cPDYNyEIYi2mL4/y8RbIIvZghyG:/10PLi6gSXPDdYiDLk5uIvu
TLSH
T11ED24A56A66C6445E1DFB53570900636AAB3B5C61FC193C70270C53C5BBBFE23A382BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\msvcp140.dll
Size 561KB
SHA256 a4c2229bdc2a2a630acdc095b4d86008e5c3e3bc7773174354f3da4f5beb9cde
MD5 72f3d84384e888bf0d38852eb863026b
SHA1 8e6a0257591eb913ae7d0e975c56306b3f680b3f
SHA512 6d53634bc51bd383358e0d55988d70aee6ed3897bc6ae5e0d2413bed27ecff4c8092020682cd089859023b02d9a1858ac42e64d59c38ba90fbaf89b656c539a6
SSDEEP 12288:rSTTigI46Bb3SUPvRgrKtzL4oaQEKZm+jWodEEVPLwtQB:rUStZaQEKZm+jWodEE9CQB
TLSH
T1B9C41A23B74905A0E195E3B8A1878316D7F1BC4A8312A3C792FBD66D2F673D1673B250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

net.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\net.dll
Size 59KB
SHA256 87955e43ccd8af43645cb5f23e435d80ca1afbfa3e47969fb002b57e65231d4e
MD5 f7a1fa1678b83cc5fbd20cccf19bb550
SHA1 b5a5ef92f4b24811edd9c6d1319037e754f9aae5
SHA512 646d5883c84d056414f95554903d4e744238849350b2f50144ba2f90a0c20a47ab5d3097835d21bb1abc32b1ed5c5aad431ee73c82a472645b130639bf3f18d5
SSDEEP 1536:pC1z7R0OBwv3XteSDJkt4ZLWiyb+dnh+G7qm7lIvU:iz7G/1kt2/dnhn7qmOvU
TLSH
T132537D0697D414C5E827CA78C6AB4A1BCB72F4A0625083DF03B5C5AE6FE73B27719781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nio.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\nio.dll
Size 79KB
SHA256 953b491b5981356d04288884bf3f178d94b892d11445e864b67420eddd56094d
MD5 7717fcd85c8e1bb8c6c04ac26c7eb30e
SHA1 e1abd155b1ea55dff6812bfb212c78c47c8fd737
SHA512 8c6c3a6bc13b28402cea63b352f2091b1d34a751c0da781b06f25644741bc888a20f6ac011a6ea459adb931e44c7e8f2d229a8381fb3f355ebc8ca3a797bd923
SSDEEP 1536:y72Yp5yt/WuKq/b94c8LIH047RwYEpdqDRuO7lIvgZB:21WMyb9Vb7RJEpdGAOOviB
TLSH
T1F78319A25760889BE87A7238429A574BF373FC115510A35F5228CB559F1F2B33E3E782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jvm.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\server\jvm.dll
Size 14.7MB
SHA256 50f653c1d30db1342f5d476946ef63f25b663f72e89445c0d70a33d1b86a4ee2
MD5 20a0ca0a2d25b3431c808a36355338df
SHA1 49ca3932510e262298c80d7e80908c6ab7be7e12
SHA512 06f4191d6dddcbc01a1a4f1d2c8f5cd900f3af3fe4e6f888d91dce4f96df27f593c02e208f7ab762e452208f1b89af447624729cd46a9eca7653bc2b1b47ef65
SSDEEP 393216:idy82untfmaQkNWHRpnlf7zwMw4K5vTaqkHPskF2IBjQ3wKIyYjXiuntdsfU2fLG:AvdC
TLSH
T1B8F65C17B3B400A8E067C178CB279A17D7F2B8944370E7CF55A4566E2F13BE6693A321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sunmscapi.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\sunmscapi.dll
Size 48KB
SHA256 5ffa0a0bfa49e460c4c819d133975f6fd75ff2e3e91adce77eec35de1d65490d
MD5 1030311384a885012baec07ee08450c1
SHA1 b9efdbec9cefbd406a13846f89539ed011b32d3e
SHA512 d785a6f34f3d97e2a4d7f073dece9d2470f762d0c75496b92e53fef2694231182c90623a0d659f6dcc7335de1df963f32ceb771d5ae456399b0509ccc9fc4ca3
SSDEEP 768:FLuffbPCN0LH0Ed43coMEFZTbsUksUmZAMVzp/eYdfrYiDLk5uIvWA:xuf2w0THbsUksUm+MVz1eYpr7lIvWA
TLSH
T1FD236B0BC7A104D5FC63C8BCC42A961BE6B1B9465122C7CF1361CA199FA6BB2B73C741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140_1.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\vcruntime140_1.dll
Size 48KB
SHA256 7dd9aa02e271c68ca6d5f18d651d23a15d7259715af43326578f7dde27f37637
MD5 2bd576cbc5cb712935eb1b10e4d312f5
SHA1 dfa7a46012483837f47d8c870973a2dea786d9ff
SHA512 abbd3eb628d5b7809f49ae08e2436af3d1b69f8a38de71ede3d0cb6e771c7758e35986a0dc0743b763ad91fd8190084ee5a5fbe1ac6159eb03690ccc14c64542
SSDEEP 768:IzzO6ujT3MbR3vXCz6S5Mq83yJ9d3+DuO9zUgElq9z6m:Fq/XuA3o9dgzUZWz5
TLSH
T17C235C9457784086D59F95B0C1D6EE537E7CFA964B00928F0BA1E1882F637D0EB3D22B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zip.dll

Path C:\Program Files\Stirling PDF\runtime\jre\bin\zip.dll
Size 80KB
SHA256 d18e94754ad3b1f894b06b61eddb8b8a33c3a2bf073ef1ceb5a7fc313b06b111
MD5 8856d4a3668d6907b290bf979430c73c
SHA1 b02cb9254fc50959bedb65cd1fc9b91fe89dea24
SHA512 4027d14d68a169e6cdff5c29fa41008db0d0bcf90b96fe29fd7fa397278ed80c4d3ee2ebe4dee3b946140bc30382ee4fd59fbdfb0c14a38ea34fc430dbb2074b
SSDEEP 1536:ZO6rmxTSQDn3R8fW5QmahAKoZkIOmo4sR7lIv9:ZO6rmxW0n3Of9AVKmo3ROv9
TLSH
T1AD839C958AA04061DAFB9570C9F64B2FD3BAB0145791478F63A8835A2F533613F4C3FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jaxp.properties

Path C:\Program Files\Stirling PDF\runtime\jre\conf\jaxp.properties
Size 8KB
SHA256 d4f45052a100e5aef02b6638a3b9c69b2bdd46155ceb58a52671e5d594c30100
MD5 80f4a5f43c22b97be120e0716974a029
SHA1 ed8df3f663c669bbe7d9dffd03d4800fae364ba9
SHA512 875a099a87f8427057661f1b2463c3ba4f2f1070247ca7c1064b3d4e3f45a878057c374eb80f6d760537fa0c11d30add9bd34e3ee9f70c2259f274e719dc5bd5
SSDEEP 192:vmeomZOmsWKjL53t72QxQOjLLc12/yAyRc:ueomZOmsWKP53t7HxQOLcs6c
TLSH
T1B0024123B64DB774038602D1910E13DEEBA8696CBD3764A475DC263C321AED423F75CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logging.properties

Path C:\Program Files\Stirling PDF\runtime\jre\conf\logging.properties
Size 2KB
SHA256 8590633e1e8a7d88ffe74cc04189c5c61b1ed4703180cbc851dcd5575efcce74
MD5 c4b74648f229c4b7e62a1061ee1dc3f0
SHA1 5795edcb624326bbefdedcdb6a11d9c18071d8ce
SHA512 76ea95402f64947c2784f1f8d0857f0d7c963285ae9ebcd9f5cb407d83a14e4da6d14aeb8641c9d9b1c92af4493a4b10e52ad6efda7ae47f265d43df6b4002d0
TLSH
T13251FE5E9B4E2D35430E00AA5A7FF6527E1898BD1C23A5F6B35E6304321D43485DBBC2
MD5 SHA1 SHA512 TLSH

Submit Download

net.properties

Path C:\Program Files\Stirling PDF\runtime\jre\conf\net.properties
Size 7KB
SHA256 594bc40230a0bd7c441fe069989d66e534a6bae2ee5910f9f4bf64e59b583256
MD5 1f251a36eb37913b696b5be5595e1cd0
SHA1 412fed5d460c414583b16f41e1ebe4262c239af1
SHA512 7a24d898e68c2a7f229220074c510910e7257dd11be33cece3ed4f630552934f6968aa310bcf956a30baf610528cd251f233bad32fd0921ece2c171a7154e2a5
SSDEEP 192:/LVGG4f4z346et5m27Sn1gTe93hf7k9SrnF:ZGxYCU1gY3hzk9+F
TLSH
T142E17283BF46B7354399C291E21EA7EEE32C913D4C33B5B831AC850D2619C76427F4A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

java.security

Path C:\Program Files\Stirling PDF\runtime\jre\conf\security\java.security
Size 74KB
SHA256 8f42977f80b73ed19f941a1e2886de91d61e2c799b22f3e8e370d54c1ce99365
MD5 223e640f9591adc5dc8598b86e766b5e
SHA1 6e8e354fc49276874acfe13df7663d6ee62c08c0
SHA512 9166d3e9b378c8ffb1261673dfe89bf55c537252d43400f00f0f9c46d1c78c9af5060ab0e8818448664de544ba003cd8927606507601a4c5addc56d924a767a0
SSDEEP 1536:rQMy8R78MRjJPFp5/LTNHu1UoQ2k/gl0ug6YilNndOcA2ZIYy64A:J8MfPFD/LTNO1UoQDHiDndOcKq
TLSH
T14D73D522BB896B720AF211A3639EF1D9F76DA12A32325154748D420C7326F71C3776E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default_US_export.policy

Path C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\unlimited\default_US_export.policy
Size 146B
SHA256 758b930a526fc670ab7537f8c26321527050a31f5f42149a2dda623c56a0a1a9
MD5 1a08ffdf0bc871296c8d698fb22f542a
SHA1 f3f974d3f6245c50804dcc47173aa29d4d7f0e2c
SHA512 4cfca5b10cd7addcff887c8f3621d2fbec1b5632436326377b0ce5af1ae3e8b68ac5a743ca6082fc79991b8eec703a6e1dfd5b896153407ad72327753222fdb3
TLSH
T178C02B07BB17D0F800D0EF4617B57916B1701E89B0A1121CFA00C2A41EDC6108330394
MD5 SHA1 SHA512 TLSH

Submit Download

default_local.policy

Path C:\Program Files\Stirling PDF\runtime\jre\conf\security\policy\unlimited\default_local.policy
Size 193B
SHA256 8d8a318e6d90dfd7e26612d2b6385aa704f686ca6134c551f8928418d92b851a
MD5 2a0f330c51aff13a96af8bd5082c84a8
SHA1 ad2509631ed743c882999ac1200fd5fb8a593639
SHA512 2b0385417a3fc2af58b1cbb186dd3e0b0875e42923884153deee0efcb390ca00b326ed5b266b3892d31bf7d40e10969a0b51daa6d0b4ca3183770786925d3cde
TLSH
T14EC0C02DFF9BE2BD44F0AF4623B15485703912473092031CF24583C43EDC580C2306A8
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Program Files\Stirling PDF\runtime\jre\legal\java.instrument\LICENSE
Size 33B
SHA256 86e0516b888276a492b19f9a84f5a866ed36925fae1510b3a94a0b6213e69192
MD5 16989bab922811e28b64ac30449a5d05
SHA1 51ab20e8c19ee570bf6c496ec7346b7cf17bd04a
SHA512 86571f127a6755a7339a9ed06e458c8dc5898e528de89e369a13c183711831af0646474986bae6573bc5155058d5f38348d6bfdeb3fd9318e98e0bf7916e6608
MD5 SHA1 SHA512

Submit Download

ASSEMBLY_EXCEPTION

Path C:\Program Files\Stirling PDF\runtime\jre\legal\java.management\ASSEMBLY_EXCEPTION
Size 44B
SHA256 b998cda101e5a1ebcfb5ff9cddd76ed43a2f2169676592d428b7c0d780665f2a
MD5 7caf4cdbb99569deb047c20f1aad47c4
SHA1 24e7497426d27fe3c17774242883ccbed8f54b4d
SHA512 a1435e6f1e4e9285476a0e7bc3b4f645bbafb01b41798a2450390e16b18b242531f346373e01d568f6cc052932a3256e491a65e8b94b118069853f2b0c8cd619
MD5 SHA1 SHA512

Submit Download

ADDITIONAL_LICENSE_INFO

Path C:\Program Files\Stirling PDF\runtime\jre\legal\jdk.crypto.cryptoki\ADDITIONAL_LICENSE_INFO
Size 49B
SHA256 ebf9777bd307ed789ceabf282a9aca168c391c7f48e15a60939352efb3ea33f9
MD5 19c9d1d2aad61ce9cb8fb7f20ef1ca98
SHA1 2db86ab706d9b73feeb51a904be03b63bee92baf
SHA512 7ec63b59d8f87a42689f544c2e8e7700da5d8720b37b41216cbd1372c47b1bc3b892020f0dd3a44a05f2a7c07471ff484e4165427f1a9cad0d2393840cd94e5b
MD5 SHA1 SHA512

Submit Download

jvm.cfg

Path C:\Program Files\Stirling PDF\runtime\jre\lib\jvm.cfg
Size 29B
SHA256 aa9efb969444c1484e29adecab55a122458090616e766b2f1230ef05bc3867e0
MD5 7ce21bdcfa333c231d74a77394206302
SHA1 c5a940d2dee8e7bfc01a87d585ddca420d37e226
SHA512 8b37a1a5600e0a4e5832021c4db50569e33f1ddc8ac4fc2f38d5439272b955b0e3028ea10dec0743b197aa0def32d9e185066d2bac451f81b99539d34006074b
MD5 SHA1 SHA512

Submit Download

modules

Path C:\Program Files\Stirling PDF\runtime\jre\lib\modules
Size 26.7MB
SHA256 1e3c3d4d96bb62387e34047614183e9d959b26523f6c95e6dc1bccd63dfae55d
MD5 6e80c9c4ac969eddc91662c66b5e2844
SHA1 fbd06bb5be4964e505b7917c38dfbaefbd961a53
SHA512 835dc6cb29b6070e4fc7219e7494b72095476b7a50bab850da63a543ddae7ee0285550c1cf0990917656cf5c33713a328c4fc96a9b74ebd8fa1c8c64acf8bfc5
SSDEEP 393216:x6E3j7n6ezk1hIgXB8KOikIJlXeVyiJh59nLutNecxgUIkoxVPT0qoeZzq1:1WHlR8KOiHwyiJhXnSbeggUdCCqJZC
TLSH
T10057220EF8C19B51C8A691F78562AAD52631A4D0FE81438F2185322D7C7B963CBBF57C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacerts

Path C:\Program Files\Stirling PDF\runtime\jre\lib\security\cacerts
Size 149KB
SHA256 98d34a90fca2688ef5674862d2a484e09e5ca25d2f07c5d654aa28f1581f3419
MD5 14ba18eba1ec1f514421a21b644d9fb1
SHA1 d16a7c7186e57094ff9bad426c048f94c6f0d0e6
SHA512 ab7355fa51a0d0c9488199dec5fbba2b365087b0427dc08be0e9ee6e7dd0254d309bd108512e0afb4167ce5ad6381abcda88ae173849ff07af26b40e37cb11a0
SSDEEP 3072:7CW6brdYD+xDlAwjhShvDZKSCgsQyAQpNYFVp/JKtwnGlaIVG6lmXPBTiM93uN/5:2W6uD+liTmqgrQ5TDur7VVJ25pG
TLSH
T118E34A4A9F7D2408BFF29F0495D8DA27AD72BBE22D59D92B101080DD1961F90BC9833F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzdb.dat

Path C:\Program Files\Stirling PDF\runtime\jre\lib\tzdb.dat
Size 100KB
SHA256 5906b44e25a8a730131d7ba1beb5d15af27043f6536f1a169ca8a5d8b8bed8f8
MD5 1c666dde9e9c6fe77715e29d61960af2
SHA1 b6df03d1b9231bdce9ee6f5a3eeac881994f5f1a
SHA512 2a015071df1b3eaf6f5ce1c15989c874c48ca1f4818e3a24b650151292945e70b07b43baf0dad72828621a5748b8276b3ac7c17dbf0768b1881a30dd140daf2c
SSDEEP 1536:y0ExeF88hPdr92L674jAGubqn0Lg/////UzJbPdJPNL0mIT/M4Z3jyxU:yPeq8hPdrcWzbqn0hJzdxuT/5ToU
TLSH
T16AA3C4B57F7150B7B2CB8122262B5B93097DAC816FC3084675B4BD4E8A76AD7203335E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tzmappings

Path C:\Program Files\Stirling PDF\runtime\jre\lib\tzmappings
Size 15KB
SHA256 3929ab1380771d0d542d91cfbae02ce519a76678f5f63813739a6c6b98dc6d72
MD5 f2c6e7d7e1856acd650426427dc72cbd
SHA1 42fcb6d986381170cdef3aeaaf9f8ddc124fdec0
SHA512 3fff765acea8b4b2f1d01ee080920db815212ef05a75832a4a01e174886544b1320f85229d43d5077e050bf8309a2d467d784e828b82cfd095fa1caca7780b35
SSDEEP 192:LQW46R4S2t0ZvH4LacPZ5E1DBMpLcnyhAXnEo2nh+E4:LQW46R4jtavQSRqwSL4
TLSH
T15F622585B06622E4C073EC0D3F227AD3F886F3C49AC69A4D2953C366BD059B766D5837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

release

Path C:\Program Files\Stirling PDF\runtime\jre\release
Size 368B
SHA256 1e5d5a2c295aec5e0c848622fe9f88b9a3129a6028c1d1a4522117bf7f6780a9
MD5 a37bad4cc8d575e5026621af9e93f2e7
SHA1 04297b6064f99c096c10ca36561c51c3301112a7
SHA512 262c572041d57b28aec8d2b368d951da16b99cdac3308479490a4ed61413adccf45513a959e42e8cc3763f0007328a5dc61bfe6d9df2c5ead31b952295d22ad0
TLSH
T15AE0D82F581FA4E06BE440C224B4C81FF4D8EC3456846AC4BAC75580B471F8056B0125
MD5 SHA1 SHA512 TLSH

Submit Download

Stirling PDF.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stirling PDF\Stirling PDF.lnk
Size 2KB
SHA256 85d33c07edb56660d078d370901e42cd95ca44b1553b34a005e2899ca09478c9
MD5 905e3e5049a9442e951d3e4da902078f
SHA1 54b1f07d1b5f3e927defc2d3afbeb36834651632
SHA512 754f5b029221df23c5eb021c06cbdf05b87244fa39648b2e81d18ac557107f476635490b6d219521a3fdb2256adc041f84f1d968d7dda5687c303259149f6220
TLSH
T1E141BE0457AD177BF3E197752D9656238A31FC16EA348F2A51C6018918B41009EAAF7F
MD5 SHA1 SHA512 TLSH

Submit Download

Stirling PDF.lnk~RFe5a9af9.TMP

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Stirling PDF\Stirling PDF.lnk~RFe5a9af9.TMP
Size 1KB
SHA256 4e3b9f18912042509823c423ffcd7c987f1b63ab7a97a9cd658fa443789a9a66
MD5 4fd0c2166716f66b6ad6c7c8d0a2624c
SHA1 2923fa0d2dc81f469f328d8f100942a79bdfa0bc
SHA512 c9cc14c399507008d0ccf40f6f64c0c12dda7d3a617c403e64b981c524c51cb8af7415cbb81480d2a2e9c3ab1e5cce6acb4de773fd3406c5247b7459fb868b9b
TLSH
T18941CD0447AD1B7BF3E197752D9657228A32FC16AB349F2A51CA018918B0500AEA6F7F
MD5 SHA1 SHA512 TLSH

Submit Download

MSIF15.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSIF15.tmp
Size 132KB
SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
MD5 cfbb8568bd3711a97e6124c56fcfa8d9
SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
TLSH
T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 6cb450d1f5411186c4b3ebc16150f9c8f73245c3ed164395c4a1fe1d797661f7
MD5 a8e8c6194d70f05f903723fb4dd46a3f
SHA1 2c26b53435a4ebbc4f47cac50accfcb01bb54b92
SHA512 0fe6f9b41ae4a621c97e6d25548b7edeb9dc3e4aece87d6213c86f216e7dc5faf2e1b2391525b3df9e55c98eb118af9a72e10a20d9caef8ee40f5432a65a0682
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 7359f7a18a3c09a14e5b1b6bde1ec085ed9ba98d5be829082420e6bb8fd84865
MD5 f1a9175064c475d5cf84691c879d67ae
SHA1 8962ee47b9f6884021078fc23ca357eaf30084e8
SHA512 08ccc982cf0240fa604c47f231986ce58609d430e794db54d29457dd3407b853213beec0743ce01fa1d00263e4efc23d8ee340a2afa0d7df309d68ac182b93a3
TLSH
T1F0D012367303017CD01030731046A20C0900D50B404981455438951E2E045640D16565
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 b74a7e569b762bbcd31ef824a6b9595e50cef1b8988cf007764534046dc44c04
MD5 53fc0fe94adcdfa9acefe561944f534f
SHA1 c55a982fda4e904702a4fee866b9211964d5872c
SHA512 acb3278427bd08c95965f0d049036a28bb50a3bf206251bd57e1fa928931bc73a0434e0b6e325fd5ccb0b07c77bd8d2e260d4948ad2f51ad2ef2cc79dbbd1aac
TLSH
T17EB0126307040132C601323401D334463C301F2341030E05DFD06CF5E2727C40237002
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b09b1.TMP

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Code Cache\js\index-dir\the-real-index~RFe5b09b1.TMP
Size 48B
SHA256 41e31b6462d4e19f6b5351ce67199273425428a88d1268b4ac56ed7f1b0a4c7d
MD5 9976b687f3dc23d1257d31e11e78ec99
SHA1 5a81715a56f482e2af438a430b50ef4231051190
SHA512 4089cc0c60a3fa1c24b863a97d0b0df4683172889206b24eea07badb8422233a24ff4eb5cb180b6429937c299765579be8af47c1f6683283ea35d2f6af84dcc4
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\Network Persistent State
Size 377B
SHA256 6861cdbbb157f10402386011080c11ce001688ec9ef8cf0c880854660f777186
MD5 073ce830c725312dd987b67c2e83cc7e
SHA1 3204772c248655ee59a4114a3d0c9b87246365d4
SHA512 e09cf1e4c9470c0304438b41df9cec595efee65e581e01a4da619b49d8f48946e834ab2687df533ee0a8657edfc87aa29a102af0c5e640530b63bfb61452854a
TLSH
T169E061B24370D9BE4701939016246C07CD7D0016572CDE7BCEE67B715762075E010547
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5bdc33.TMP

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\Network Persistent State~RFe5bdc33.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 9706c484dd327d98eb4d861bd475020087cf9f94bbe0886f5e90907ffd261bac
MD5 00e26904345b8bb256d5fc2234004340
SHA1 2872cc2dd9f794c2a50a853634addc1f63f1896a
SHA512 3d9fd1c0e720649ab0787e5df10bad0e151016bbe13ca569575d6b8bec4061a0def21ff4328bcff385c3c33c93a9da071b2da079982da59f9f7077452d21c3ba
TLSH
T19CE026A3857DF4A3107C4ABA1885BD0E2FBFB535528154E8CF5A867CB0A007B6323232
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\TransportSecurity
Size 355B
SHA256 40e23bf24f8d1f8f4dd1afd392fe46cfd8e184ddfdc7e4abbab28356201427a3
MD5 7cc30fe8178a91177f95ef2bba3c3e24
SHA1 717b7a40a4fa4642c72196f04a418e83cb7b3b02
SHA512 476cae363c513a5bc92a2198ed333bf3471eb2df427e2006b30271670951c070001f2de1894c26db8ea8c51f46dfe0702253fe07b07426471b2ec7df774c5987
TLSH
T16AE02063C47EE463107C5A7A1845BD491F7FB531425154E5CF5A433CB0600BA6317532
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5b1fc9.TMP

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Network\TransportSecurity~RFe5b1fc9.TMP
Size 188B
SHA256 6e33d5db2f9c448e8f0e20d395499b66ad5b4183e541defec8242d2ca38b3409
MD5 364f388fbc62dcc8587185b469c07f4b
SHA1 947bfa5aba95d32c8093cfdb4d09ed942886c66d
SHA512 9e2fd50fd6361ae99ee697f8fe750edf188eae80c0a3bc7bdc9df465424ee33a660d9cde9602ffeeb0760d9fe4cad3f1953b7694d95eb4f86456588f00aaf3d3
TLSH
T1B4C02262013AE0F2207806212C80AD2C5F3FA0311141A4E88B624939E02026A6513216
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

ab03b63c-ced4-4e1e-af1a-42b41cb2a113.tmp

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Default\ab03b63c-ced4-4e1e-af1a-42b41cb2a113.tmp
Size 6KB
SHA256 563787d709ca38983321fb16db523dd5d10e3623d8dfccb1da9e8f1f81908e9e
MD5 efb7711fe55b1562c9fd99271682662f
SHA1 33b322199ca5ddc6255f8c87067eedf21792cfc0
SHA512 a8275f78f818c55cab3f09d53059c62ecdc4e8fa308739548b8dc99bf84cb38c92f84ac1afa34a59f294c0d4d8cb44e5d3219286f5e91b1366b64ce031215ff5
SSDEEP 96:sta/dzfhFb9wkao5h16Z0Ds7/x+6MhmuecJKg1ejeWK+gMZJ28XM1C7K:stCpSlonDsV+FdKgQje6nG6K
TLSH
T15CD195025E24B9BB4CC7F209BB397A17E2F9517265D11E58EBF8462C04DB6DC230B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State
Size 15KB
SHA256 555517e4e09484a765e4d53100a5107e64136d600c16784ba1147a342a9cc5bc
MD5 9ff53338424ad6c91bfdf92c38f58a3e
SHA1 f17fb1fbe7b04ba87d7b03e73601ad634bcf71dd
SHA512 114c6c38037cf2d8e3412a3cacb688283b35bd9922c320639aad25bc0051c0fdcd788bd84743dbb3acc02bc611a7cb80714b1884f1028ce0a878d86277f2ef74
SSDEEP 384:MCkGCMZkoU5//bZ2lw/M85Z3WNBSOtw2/gcEV6:s8koU5HbMGqocb
TLSH
T1A272B07668315E335BB7CE1DF59A3B026F9C926185896A60CFCE9F1901DB2C4030CD39
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State
Size 2KB
SHA256 6aa21aad0bc2441faee80aab63f98bc6f00ca0cee6a16200788e415cb79cefe4
MD5 cc9fd2114ca7c19db671bdd932ec1c56
SHA1 59b1e4068e023168c530470d2b8ee07d9a29bdd9
SHA512 8d1cca68f409db6ef94c717698ddbe04ddb0bd2526c66deb909f2884250eb21bed1c67c232df5deb383fe8b734d048ba4b6b42bc3c696481225c07c43a6d1c83
TLSH
T1E7516573A5146B77C9F39A44BA5B6F23AF395162EB521F609BDC0B0800D756C2306C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State
Size 3KB
SHA256 3b1ca4059182f693cc41b50b71023d11d2c812d2e3ed2b2cf8e484c3a82d3bc2
MD5 a57581ed53834459ed146bdd100885e3
SHA1 5065b04b2a7ba4d83aff8bd61a0ef64a590846b6
SHA512 a63329c316217bf27227896eefd53e3be905e2d4981b612b8ed80aaeb68bd317a629308bf603b40f5ecaa9af0606a33c09a8324fed00ec56f604d51c48791e4f
TLSH
T106618677A964AA778DF3DA04B9872B12BB655133E5953F64CAEC0F0C01D729C1346C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5ab49c.TMP

Path C:\Users\Admin\AppData\Local\stirling.pdf.dev\EBWebView\Local State~RFe5ab49c.TMP
Size 1KB
SHA256 c9f2a0fd7c633fec6bef789feb5c81cdf9466af7e67fe5faaffaeb40f77f64b6
MD5 64f76841d06298d47096afc72a13a533
SHA1 10a410d625e5d0714cb277b8c0f6ec213bf6f179
SHA512 ee657f4f5d0dc09f4623b44a05f2747d36e7e108fd80fb355317b26fdca773a9385a8ee514f690a5bdb391e418e088684f86b517da78a2c3313bd574802e54ae
TLSH
T1042142B3E1501F73DC925A19B317AA636F340167D2514F1096DD4A1805D21ACE71ED33
MD5 SHA1 SHA512 TLSH

Submit Download

settings.yml

Path C:\Users\Admin\AppData\Roaming\Stirling-PDF\configs\settings.yml
Size 35KB
SHA256 99f1f851ac9c69a48586b0ea88f1a70afa9a4bcca0f3b9238a783eb56dbcf45a
MD5 6c72262ec20b2fae010ebf02eff1cd6c
SHA1 45e81b88cfa0174cd0ed8ac782428060f496bf44
SHA512 43de8382ae22735a2fef875d3709a5261d05423ab6249a5f39bab887cba4d94c073540cc21ba6a9002a7f6672f88066a278a6083bf64901b0ab4c2045f31544a
SSDEEP 768:2GPwjUQ8NPkYCCTUVhbvFydvhaxuD6eiwgvFwOAohxt:2GP8CUVgvhWPFAi
TLSH
T148F20953660431394792C1B6B526D632AB3AE10E1A937039B49EC26C3F4AF1C537BFE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tauri-backend.log

Path C:\Users\Admin\AppData\Roaming\Stirling-PDF\logs\tauri-backend.log
Size 1KB
SHA256 279b797ca2ae9023f5c73569c8ecc2d1c3b90d01f979cf9d7bfd05a9d2726085
MD5 0db204e354e2d80eb54a3ae4e193f768
SHA1 96b2385040939d37df62245eb424c56fe706e8f8
SHA512 4f7204e15489cb625312317c4a0447ddd17b680db85d6e3810ad240cc010389e5823e8a09adc2745c89946cc452c581647255b207c76a0a5dabd8daa06b9d5f4
TLSH
T17031DF0769C4AE0EB92ACFC35778E688C000D83B377D386ED764E35A166D4690275E32
MD5 SHA1 SHA512 TLSH

Submit Download

tauri-backend.log

Path C:\Users\Admin\AppData\Roaming\Stirling-PDF\logs\tauri-backend.log
Size 3KB
SHA256 11df37353ab8192d95248e76ffc3da12d4ad8c223bf3bd55f17594a94c8b60bf
MD5 9710bf95725f69d031821feebf036a8a
SHA1 49acb2575ff6c47d22f7de0d2263fb5752321e7a
SHA512 a9b9619e307624aa7ac98cd5e8ead32eb599fc2c7b65c9c1ed7d4de3d6159efba42c801747574afa64704bd17ec3825fc30728f135c81ab123c914b5684b427e
TLSH
T191713E4FA180584B9E35DCFB7231A74E8540843F777820B9AA68F325023A0EE0879F74
MD5 SHA1 SHA512 TLSH

Submit Download

tauri-backend.log

Path C:\Users\Admin\AppData\Roaming\Stirling-PDF\logs\tauri-backend.log
Size 4KB
SHA256 75baef707c61875975dbadae355459e67b8e954b8eb5ff3a3529694a53d13412
MD5 dd374c9b50bce8354fa47e75d6b82f20
SHA1 c799f37cc9235265c4fba83726e7d0c609028d9b
SHA512 712d9e6d7c432f6084e9616611a0ed2cfcf758532f952bc3e38db9cb36a6400e773e514569269592a90a6e59ca533869515891070f7a1a3a7dfa27cb34f40f42
SSDEEP 96:qKesIvscOvsctnTdTbTrTNTHhyvdT4QHlca84TBtGTFiEUhoqjyvEPnTNIAK37JY:4sIvscOvsctTZfPpHEvZBAsrOv+WAK3a
TLSH
T103A1410A61C015879E79DDFB7230A74E5540943FB37820689E78F315023E4EA097AF75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 5b3668c6f63e661aa8e586b237be591c4bddb2ddfba4ef3f3e429a26bbbea97c
MD5 75fb18e9a140ed56b98511b14dfbde65
SHA1 2860c6701d372c031366303e15fc008533daa6ec
SHA512 be67cde042235fca1d5c2ea8fac8b6b3163670a4fdf647771114a0cdbef8e1e4a7f52acb9d12a58bfe995439048f63521a496c01457be9136a4853e22fe6ea47
SSDEEP 24576:VFo3DMPSdoO/vvTL/SwJpilgfrejy7uKkkP7tknB/MnqZeIZ8YhWJwz4NuR:CHQ
TLSH
T19157F71836F92110F7F79E3CA8F0AA2749397D5B9C15DE8D45811B8E0821F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{60772708-5830-420f-83af-c6de025a5d31}_OnDiskSnapshotProp

Path \??\Volume{6392210f-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{60772708-5830-420f-83af-c6de025a5d31}_OnDiskSnapshotProp
Size 6KB
SHA256 906889dd9d616dccc6e746d8ca0331a53dd42a6c0ddc05201b9a7e1d7982f6e4
MD5 a04c44570470c024c3ab26b87d91827a
SHA1 fa3832cfa80841f71e369a8c1f10a583a0528577
SHA512 dcbcea6f9186db91e55920c40a869aace19f85b24030f499af8d2050102e65e5877a0299ac8e522aaf3ad08279f749c71f20b3c22d18e90af5fb1f1831e23644
SSDEEP 96:FaPb+vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:82b++uVmN
TLSH
T175D166085AF54711E2B3AB3128F18557A877B911EF33CB8E0298238E6661910F975F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1136-307-0x00007FFA26F70000-0x00007FFA26F71000-memory.dmp

Download

memory/2732-928-0x00007FFA26E60000-0x00007FFA26E61000-memory.dmp

Download

memory/2732-927-0x00007FFA27260000-0x00007FFA27261000-memory.dmp

Download

memory/2732-945-0x0000021CCDFA0000-0x0000021CCDFCF000-memory.dmp

Download

memory/5016-292-0x00007FFA26F70000-0x00007FFA26F71000-memory.dmp

Download

memory/5016-895-0x0000021E0B580000-0x0000021E0B743000-memory.dmp

Download

memory/5016-595-0x0000021E0B580000-0x0000021E0B743000-memory.dmp

Download