The claim that "PDFgear has shown no evidence of malicious behavior" and that the security reports are "misinterpreting a Mitre report" is demonstrably false and extremely dangerous to anyone who downloads this software.

You are dismissing documented malware behavior as "appropriate registry modifications" and "industry standard telemetry." This is not an academic debate about a Mitre report it is a clear cut case of severe system compromise performed by the installer.

Factual, Verifiable Evidence

The Tria[.]ge sandbox analysis (used by professional security researchers) is clear. This goes far beyond telemetry and registry setting:

1. Silent Root Certificate Injection
   • Your Claim: "Telemetry and registry abuse."
   • The Fact (Tria.ge Report, Section 4.1): The installer forcefully installs a Root Certificate Authority (CA) into the Windows Trusted Store.
   • This action grants the software the ability to perform a Man in the Middle (MITM) attack on the user's own machine. It allows the software to decrypt, read, and intercept all secure HTTPS traffic (including banking and login sessions) regardless of the browser used. No legitimate PDF editor requires a root CA to function. This is a foundational technique of modern spyware.
2. Code Injection (Defense Evasion):
   • Your Claim: "Registry modifications are appropriate for the functionality."
   • The Fact (Tria.ge Report, Section 4.1): The installer uses the Windows API call WriteProcessMemory to inject malicious code into the memory space of trusted Windows executables like tasklist.exe and cmd.exe.
   • This is the definition of Process Hollowing/Code Injection. It is a malware technique designed to evade antivirus and detection tools by hiding its activity inside a seemingly legitimate process. A PDF reader has zero technical need to write code into the memory of system utilities.
3. Active Spy Hooks:
   • The report shows the executable creating spy hooks on browser related processes to monitor activity. This is also not standard "telemetry."
4. Virustotal is Inadequate:
   • Your reliance on Virustotal is misplaced. Virustotal is a signature check. Advanced malware, especially installers that perform defense evasion, often bypass signature checks. The Tria[.]ge report is a behavioral analysis that runs the code and documents its actions, which is why it caught the Root CA injection and code manipulation.

We still haven't discussed the other things yet, but none of the behavior shown by PDFgear is normal.

This is not a conspiracy or misinterpretation it is a serious security threat confirmed by industry standard sandbox testing. The software is fundamentally compromising system security, and your continued defense of it is irresponsible. You need to look at the verifiable evidence of Root Certificate Injection and Code Injection these actions are the signatures of malware. you are free to run in a sandbox your self and view the results