Windows Analysis Report
sample.zip

Compliance

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SumatraPDFUninstall

Source: unknown

HTTPS traffic detected: 172.67.147.142:443 -> 192.168.2.18:49704 version: TLS 1.2

Networking

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: unknown

DNS traffic detected: queries for: pixel.pdfixers.com

Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704

Source: unknown

HTTPS traffic detected: 172.67.147.142:443 -> 192.168.2.18:49704 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe

Window created: window name: CLIPBRDWNDCLASS

System Summary

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\OUTLOOK.EXE

Source: classification engine

Classification label: clean5.winZIP@4/8@1/13

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\HAYXG4SY\LMPPM1MU.htm

Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe

Mutant created: NULL

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

File read: C:\Users\desktop.ini

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe "C:\Users\user\Desktop\sampleC:\Users\aiciaboyd\Downloads\PDFixers.exe"
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process created: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe "C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe"
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process created: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe "C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe"

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: mscoree.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: profapi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: ieframe.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: iertutil.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: netapi32.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: winhttp.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: wkscli.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: netutils.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: sxs.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: dwrite.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: d3d11.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: dcomp.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: dxgi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: msiso.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: urlmon.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: srvcli.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: mshtml.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: sspicli.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: powrprof.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: umpdc.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: srpapi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: wintypes.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: msimtf.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: msls31.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: d2d1.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: d3d10warp.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: dxcore.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: secur32.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: mlang.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: wininet.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: jscript9.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: winmm.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: mswsock.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: winnsi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: schannel.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: msasn1.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: dpapi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: gpapi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: t2embed.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: uianimation.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: mpr.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: scrrun.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: cscapi.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: edputil.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: appresolver.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: slc.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: sppc.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: thumbcache.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: dataexchange.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: d3d11.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: dcomp.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: twinapi.appcore.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windows.ui.fileexplorer.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: assignedaccessruntime.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: structuredquery.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windows.storage.search.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: twinapi.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: cscapi.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: actxprxy.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: networkexplorer.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: ehstorshell.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: cscui.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: mrmcorer.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windows.staterepositorycore.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: policymanager.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: msvcp110_win.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: bcp47mrm.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windows.ui.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: windowmanagementapi.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: inputhost.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: wkscli.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: provsvc.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: photometadatahandler.dll
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}\InProcServer32

Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe

Window found: window name: SysTabControl32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

Registry value created: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SumatraPDFUninstall

Source: sample.zip

Static file information: File size 8281127 > 1048576

Persistence and Installation Behavior

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

File created: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 203AD480000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 203C6E20000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 203C93A0000 memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD300000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD340000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD360000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD390000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD430000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD470000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD4B0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD4F0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD530000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD570000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD590000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD5B0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD5D0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD5F0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD610000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD630000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD650000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD670000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD690000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD6D0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD6F0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD710000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD730000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD750000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD770000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD7B0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD7D0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCD9F0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCDA10000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCDA30000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCDA70000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE240000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE260000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE280000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE2A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE2C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE300000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE320000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE340000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE360000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE380000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE3A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE3E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE400000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE420000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE440000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE460000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE480000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE4C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE4E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE500000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE520000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE540000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE560000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE5A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE5C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE5E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE600000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE620000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE640000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE680000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE6A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE6C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE6E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE700000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE720000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE760000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE780000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE7A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE7C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE800000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE820000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE840000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE860000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE8A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE8C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE8E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE900000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE920000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE940000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE960000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE9A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE9C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCE9E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEA00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEA20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEA40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEA60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEA80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEAC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEAE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEB00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEB20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEB40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEB60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEB80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEBA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEBE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEC00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEC20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEC40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEC60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEC80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCECA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCECC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCED00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCED20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCED40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCED60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCED80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEDA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEDC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEDE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEE20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEE40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEE60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEE80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEEA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEEC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEEE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEF20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEF40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEF60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEF80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEFA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEFC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCEFE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF000000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF040000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF060000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF080000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF0A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF0C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF0E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF100000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF120000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF160000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF180000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF1A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF1C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF1E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF200000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF220000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF240000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF280000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF2A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF2C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF2E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF300000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF320000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF340000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF360000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF3A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF3C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF3E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF400000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF420000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF440000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF460000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF480000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF4C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF4E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF500000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF520000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF540000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF560000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF580000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF5A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF5E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF600000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF620000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF640000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF660000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF680000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF6A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF6E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF700000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF720000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF740000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF760000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF780000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF7A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF7C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF800000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF820000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF840000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF860000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF880000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF8A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF8C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF8E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF920000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF940000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF960000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF980000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF9A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF9C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCF9E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFA00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFA40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFA60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFA80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFAA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFAC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFAE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFB00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFB20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFB60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFB80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFBA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFBC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFBE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFC00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFC20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFC40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFC80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFCA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFCC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFCE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFD00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFD20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFD40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFD80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFDA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFDC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFDE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFE00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFE20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFE40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFE60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFEA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFEC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFEE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFF00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFF20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFF40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFF60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFF80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFFC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BCFFE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0000000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0020000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0040000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0060000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0080000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD04A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD04E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0500000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0520000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0540000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0560000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0580000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD05A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD05C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0600000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0620000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0640000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0660000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0680000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD06A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD06C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0700000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0720000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0740000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0760000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0780000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD07A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD07C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD07E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0820000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0840000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0860000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0880000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD08A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD08C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD08E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0900000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0940000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0960000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0980000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD09A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD09C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD09E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0A00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0A20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0A60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0A80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0AA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0AC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0AE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0B00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0B20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0B40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0B80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0BA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0BC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0BE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0C00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0C20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0C40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0C60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0CA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0CC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0CE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0D00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0D20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0D40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0D60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0D80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0DC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0DE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0E00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0E20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0E40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0E60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0E80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0EC0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0EE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0F00000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0F20000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0F40000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0F60000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0F80000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0FA0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD0FE0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1000000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1020000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1040000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1060000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1080000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD10A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD10C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1100000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1120000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1140000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1160000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1180000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD11A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD11C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD11E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1220000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1240000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1260000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1280000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD12A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD12C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD12E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1300000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1340000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1360000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1380000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD13A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD13C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD13E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1400000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1440000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1460000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1480000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD14A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD14C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD14E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1500000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1520000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1560000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1580000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD15A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD15C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD15E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1600000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1620000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1640000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1680000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD16A0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD16C0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD16E0000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1700000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1720000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1740000 memory commit | memory reserve | memory write watch
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Memory allocated: 20BD1760000 memory commit | memory reserve | memory write watch

Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe

Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc

Anti Debugging

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

Process created: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe "C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe"

Language, Device and Operating System Detection

Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\Candarali.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\corbell.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\corbelli.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\times.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\sample\Device\HarddiskVolume3\Users\aiciaboyd\Downloads\PDFixers.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Directory queried: C:\Users\user\Documents\QCFWYSKMHA
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Roaming\SumatraPDF\SumatraPDF-3.5.2-64.exe	Directory queried: C:\Users\user\Documents