Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
8test/91B5D...9D.msi
windows7_x64
8test/91B5D...9D.msi
windows10-2004_x64
1test/ed01e...aa.exe
windows7_x64
10test/ed01e...aa.exe
windows10-2004_x64
10test/fe9d7...8f.exe
windows7_x64
10test/fe9d7...8f.exe
windows10-2004_x64
10test/main.exe
windows7_x64
1test/main.exe
windows10-2004_x64
10test/main_temp.exe
windows7_x64
1test/main_temp.exe
windows10-2004_x64
1Analysis
-
max time kernel
165s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-ja-20220112 -
submitted
19/01/2022, 15:40 UTC
Static task
static1
Behavioral task
behavioral1
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win7-ja-20211208
Behavioral task
behavioral2
Sample
test/91B5DB3C0CCBD68BD04C24571E27F99D.msi
Resource
win10v2004-ja-20220113
Behavioral task
behavioral3
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7-ja-20211208
Behavioral task
behavioral4
Sample
test/ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v2004-ja-20220112
Behavioral task
behavioral5
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win7-ja-20211208
Behavioral task
behavioral6
Sample
test/fe9d72dd4b046bafdd144902ab570297629f83d06afb5a9ba7703382a29d588f.exe
Resource
win10v2004-ja-20220112
Behavioral task
behavioral7
Sample
test/main.exe
Resource
win7-ja-20211208
Behavioral task
behavioral8
Sample
test/main.exe
Resource
win10v2004-ja-20220112
Behavioral task
behavioral9
Sample
test/main_temp.exe
Resource
win7-ja-20211208
Behavioral task
behavioral10
Sample
test/main_temp.exe
Resource
win10v2004-ja-20220112
General
-
Target
test/main.exe
-
Size
2.2MB
-
MD5
5ffb3bfb8e0b0002d940ad4707d1c504
-
SHA1
ed6402ebc9050fd7c85384ec88343c556df3a71e
-
SHA256
aa80d3eaee384c8a0ba25b3d501dc0c83f7405190ae47877595fc63cf3161dcf
-
SHA512
3f05b5c0c80223ecff25f7c8c6a1d6b6462e80ca918f526b6fe0e229f0c1631ea25bf0f856338551e32f8cf9a2a0c838941136cd788ae89b1826aaeeb2a2ccf0
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs
-
Executes dropped EXE 3 IoCs
pid Process 444 armsvc.exe 3256 AdobeARM.exe 3356 MSIF661.tmp -
Loads dropped DLL 24 IoCs
pid Process 1536 MsiExec.exe 2428 MsiExec.exe 2428 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 2500 MsiExec.exe 3644 MsiExec.exe 3644 MsiExec.exe 3644 MsiExec.exe 3644 MsiExec.exe 3644 MsiExec.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Elevation.tmp MsiExec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\AppCenter_R.aapp msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_extensions.pak msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Compare_R_RHP.aapp msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\rt3d.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prcr.x3d msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\drvSOFT.x3d msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\RDCNotificationClient.appx msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\MakeAccessible.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\ROMAN.TXT msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1258.TXT msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\ msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\PPKLite.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1252.TXT msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Search.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\cef_200_percent.pak msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Welcome.pdf msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt40.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\logsession.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Res.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2.dll msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\plugin.X.manifest msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroPDFImpl.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icucnv58.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libcef.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\DigSig.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\cryptocme.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeXMP.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Javascripts\ msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\eBook.api msiexec.exe File created C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_RHP.aapp msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\CoolType.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Menu.aapp msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\BIBUtils.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\JP2KLib.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Accessibility.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\nppdf32.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\tesselate.x3d msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Multimedia.api msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\StorageConnectors.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\ msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Checkers.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\widevinecdmadapter.dll msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AIR\ msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\snapshot_blob.bin msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroLayoutRecognizer\AcroLayoutRecognizer.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\OptimizePDF_R_RHP.aapp msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\EScript.api msiexec.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annots.api msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPlugin.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudt.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Edit_R_Exp_RHP.aapp msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Installer\1cf6933.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6943.HDR msiexec.exe File created C:\Windows\Installer\1cf695d.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6984.HDR msiexec.exe File created C:\Windows\Installer\1cf698c.HDR msiexec.exe File created C:\Windows\Installer\1cf6993.HDR msiexec.exe File created C:\Windows\Installer\1cf69a2.HDR msiexec.exe File created C:\Windows\Installer\1cf69a5.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSIF4AA.tmp msiexec.exe File created C:\Windows\Installer\1cf692a.HDR msiexec.exe File created C:\Windows\Installer\1cf6952.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6962.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6977.HDR msiexec.exe File created C:\Windows\Installer\1cf6991.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6999.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf699a.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI6C4A.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\1cf6987.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6990.HDR msiexec.exe File created C:\Windows\Installer\1cf692b.HDR msiexec.exe File created C:\Windows\Installer\1cf6954.HDR msiexec.exe File created C:\Windows\Installer\1cf6958.HDR msiexec.exe File created C:\Windows\Installer\1cf6966.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf698a.HDR msiexec.exe File created C:\Windows\Installer\1cf6990.HDR msiexec.exe File created C:\Windows\Installer\1cf6997.HDR msiexec.exe File created C:\Windows\Installer\1cf69a7.HDR msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SecStoreFile.ico msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI92F5.tmp msiexec.exe File created C:\Windows\Installer\1cf6939.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6946.HDR msiexec.exe File created C:\Windows\Installer\1cf6976.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf698d.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6995.HDR msiexec.exe File created C:\Windows\Installer\1cf699a.HDR msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\APIFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\MSIB0E5.tmp msiexec.exe File opened for modification C:\Windows\Installer\1cf6933.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6941.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf696e.HDR msiexec.exe File created C:\Windows\Installer\1cf6972.HDR msiexec.exe File created C:\Windows\Installer\1cf698b.HDR msiexec.exe File created C:\Windows\Installer\1cf6996.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6997.HDR msiexec.exe File opened for modification C:\Windows\Installer\MSI9285.tmp msiexec.exe File opened for modification C:\Windows\Installer\1cf692e.HDR msiexec.exe File created C:\Windows\Installer\1cf6936.HDR msiexec.exe File created C:\Windows\Installer\1cf6945.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf694d.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf694f.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6956.HDR msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\XFDFFile_8.ico msiexec.exe File created C:\Windows\Installer\1cf6953.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6960.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6972.HDR msiexec.exe File opened for modification C:\Windows\Installer\1cf6986.HDR msiexec.exe File created C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\FDFFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\1cf6953.HDR msiexec.exe File created C:\Windows\Installer\1cf695b.HDR msiexec.exe File created C:\Windows\Installer\1cf6965.HDR msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\SC_Reader.ico msiexec.exe File created C:\Windows\Installer\1cf6943.HDR msiexec.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SDXHelper.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SDXHelper.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SDXHelper.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" msiexec.exe -
Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f msiexec.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\NumMethods\ = "6" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}\1.0 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA408033019195008142136144\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XFDFDoc\shell\Read\command msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\SOFTWARE\Adobe\Acrobat\Exe msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81F9B44F-BA3A-4F5D-9B51-090C74A9B3A4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E790E1D1-9DE8-4853-8AC6-933D4FD9C927}\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroExch.Document\CurVer msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\1 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F9F2FE81-F764-4BD0-AFA5-5DE841DDB625}\TypeLib\ = "{C523F390-9C83-11D3-9094-00104BD0D535}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2018\shell\open\ddeexec\ = "[HandleAcroURL(\"%1\")]" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00FFD6C4-1A94-44BC-AD3E-8AC18552E3E6}\TypeLib\ = "{C523F390-9C83-11D3-9094-00104BD0D535}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{E790E1D1-9DE8-4853-8AC6-933D4FD9C927}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\Programmable\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\InprocServer32\ThreadingModel = "Apartment" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\DocObject\ msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.pdx msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Adobe.AcrobatSearch\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xdp\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\2\ = "8,1,1,1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA408033019195008142136144\SourceList\LastUsedSource = "n;1;C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\Cache\\" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\Verb\0 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0\FLAGS msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\NumMethods msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{F1E6C7A4-6B15-4C06-B1EF-88A4F2A886CB}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24DA047B-40C0-4018-841B-6B7409F730FC}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PDFPrevHndlr.DLL\AppID = "{6236FF8C-E747-4173-86D3-99F511B61DF3}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{00FFD6C4-1A94-44BC-AD3E-8AC18552E3E6}\{B4848E37-7C66-40A6-9F66-D3A9BC8F4636}\TypeLib msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\DocObject\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Adobe.Reader.HTMLPreview.1\CLSID\ = "{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroPDF.PDF.1\DocObject msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5007373A-20D7-458F-9FFB-ABC900E3A831}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ShellFolder FileSyncConfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfd+xml\CLSID = "{CA8A9780-280D-11CF-A24D-444553540000}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/vnd.adobe.pdfxml msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\NumMethods\ = "6" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDXFileType\shell\Read\command msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\AppID = "{F2383816-917A-46CC-AD2A-5013BED3800F}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Adobe.AcrobatSearch\ = "Acrobat Search" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA408033019195008142136144\ProductIcon = "C:\\Windows\\Installer\\{AC76BA86-0804-1033-1959-001824311644}\\ARPPRODUCTICON.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\shell\Read\command\ = "\"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\" \"%1\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\ = "Broker Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFPrevHndlr.PDFPreviewHandler.1\ = "Adobe PDF Preview Handler for Vista" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\MiscStatus msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\ = "PDXFileType" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3EC-4981-101B-9CA8-9240CE2738AE}\TypeLib\Version = "1.1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Adobe.Reader.HTMLPreview.1\ = "Adobe Reader HTML Preview Class" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C}\TypeLib\ = "{41738EEA-442F-477F-92CF-2889BD6CD7E7}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BE79C475-D632-4A57-91B3-DA044FA27CDA}\1.0\0\win32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\adoberfp.dll" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{4A894040-247E-4AFF-BB08-3489E9905235}\ProxyStubClsid32 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\Insertable\ msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF} msiexec.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32 FileSyncConfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\ = "PSFactoryBuffer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Plugin\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\\APIFile_8.ico,0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\VersionIndependentProgID\ = "PDFPrevHndlr.PDFPreviewHandler" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A894040-247E-4AFF-BB08-3489E9905235}\TypeLib\ = "{C523F390-9C83-11D3-9094-00104BD0D535}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46B89F5A-769D-4792-AD9A-E3755915CBC3}\ProxyStubClsid\ = "{00020420-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PdfFile.OpenDocuments\CurVer\ = "AdobeAcrobat.OpenDocuments.3" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4036 AdobeARMHelper.exe 4036 AdobeARMHelper.exe 4036 AdobeARMHelper.exe 4036 AdobeARMHelper.exe 4036 AdobeARMHelper.exe 4036 AdobeARMHelper.exe 4036 AdobeARMHelper.exe 4036 AdobeARMHelper.exe 3644 MsiExec.exe 3644 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4036 AdobeARMHelper.exe Token: SeIncreaseQuotaPrivilege 4036 AdobeARMHelper.exe Token: SeSecurityPrivilege 3336 msiexec.exe Token: SeCreateTokenPrivilege 4036 AdobeARMHelper.exe Token: SeAssignPrimaryTokenPrivilege 4036 AdobeARMHelper.exe Token: SeLockMemoryPrivilege 4036 AdobeARMHelper.exe Token: SeIncreaseQuotaPrivilege 4036 AdobeARMHelper.exe Token: SeMachineAccountPrivilege 4036 AdobeARMHelper.exe Token: SeTcbPrivilege 4036 AdobeARMHelper.exe Token: SeSecurityPrivilege 4036 AdobeARMHelper.exe Token: SeTakeOwnershipPrivilege 4036 AdobeARMHelper.exe Token: SeLoadDriverPrivilege 4036 AdobeARMHelper.exe Token: SeSystemProfilePrivilege 4036 AdobeARMHelper.exe Token: SeSystemtimePrivilege 4036 AdobeARMHelper.exe Token: SeProfSingleProcessPrivilege 4036 AdobeARMHelper.exe Token: SeIncBasePriorityPrivilege 4036 AdobeARMHelper.exe Token: SeCreatePagefilePrivilege 4036 AdobeARMHelper.exe Token: SeCreatePermanentPrivilege 4036 AdobeARMHelper.exe Token: SeBackupPrivilege 4036 AdobeARMHelper.exe Token: SeRestorePrivilege 4036 AdobeARMHelper.exe Token: SeShutdownPrivilege 4036 AdobeARMHelper.exe Token: SeDebugPrivilege 4036 AdobeARMHelper.exe Token: SeAuditPrivilege 4036 AdobeARMHelper.exe Token: SeSystemEnvironmentPrivilege 4036 AdobeARMHelper.exe Token: SeChangeNotifyPrivilege 4036 AdobeARMHelper.exe Token: SeRemoteShutdownPrivilege 4036 AdobeARMHelper.exe Token: SeUndockPrivilege 4036 AdobeARMHelper.exe Token: SeSyncAgentPrivilege 4036 AdobeARMHelper.exe Token: SeEnableDelegationPrivilege 4036 AdobeARMHelper.exe Token: SeManageVolumePrivilege 4036 AdobeARMHelper.exe Token: SeImpersonatePrivilege 4036 AdobeARMHelper.exe Token: SeCreateGlobalPrivilege 4036 AdobeARMHelper.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeSecurityPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe Token: SeTakeOwnershipPrivilege 3336 msiexec.exe Token: SeRestorePrivilege 3336 msiexec.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3256 AdobeARM.exe 3256 AdobeARM.exe 3256 AdobeARM.exe 3256 AdobeARM.exe -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 3256 AdobeARM.exe 3256 AdobeARM.exe 3256 AdobeARM.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3204 SDXHelper.exe 3256 AdobeARM.exe 3256 AdobeARM.exe 3256 AdobeARM.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3336 wrote to memory of 1536 3336 msiexec.exe 81 PID 3336 wrote to memory of 1536 3336 msiexec.exe 81 PID 3336 wrote to memory of 1536 3336 msiexec.exe 81 PID 3336 wrote to memory of 2428 3336 msiexec.exe 82 PID 3336 wrote to memory of 2428 3336 msiexec.exe 82 PID 3336 wrote to memory of 2428 3336 msiexec.exe 82 PID 4036 wrote to memory of 3256 4036 AdobeARMHelper.exe 84 PID 4036 wrote to memory of 3256 4036 AdobeARMHelper.exe 84 PID 4036 wrote to memory of 3256 4036 AdobeARMHelper.exe 84 PID 3336 wrote to memory of 2500 3336 msiexec.exe 85 PID 3336 wrote to memory of 2500 3336 msiexec.exe 85 PID 3336 wrote to memory of 2500 3336 msiexec.exe 85 PID 3336 wrote to memory of 3644 3336 msiexec.exe 86 PID 3336 wrote to memory of 3644 3336 msiexec.exe 86 PID 3336 wrote to memory of 3644 3336 msiexec.exe 86 PID 3336 wrote to memory of 3356 3336 msiexec.exe 87 PID 3336 wrote to memory of 3356 3336 msiexec.exe 87 PID 3336 wrote to memory of 3356 3336 msiexec.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\test\main.exe"C:\Users\Admin\AppData\Local\Temp\test\main.exe"1⤵PID:3876
-
C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe"C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:3204
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.245.1128.0002\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.245.1128.0002\FileSyncConfig.exe"1⤵
- Modifies registry class
PID:2628
-
C:\ProgramData\Adobe\ARM\S\18764\AdobeARMHelper.exe"C:\ProgramData\Adobe\ARM\S\18764\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\18764" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\18764" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3256
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 80DA645BC9A75B6D7CB0D505B8C94BE02⤵
- Loads dropped DLL
PID:1536
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 868053A3ADE2ED343303C5CBE7A4A2A6 E Global\MSI00002⤵
- Loads dropped DLL
PID:2428
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 11538AED35466BF5A152ED269158E7ED2⤵
- Loads dropped DLL
- Drops file in System32 directory
PID:2500
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 543335D6DBF1D367D73C146399B1A1A7 E Global\MSI00002⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3644
-
-
C:\Windows\Installer\MSIF661.tmp"C:\Windows\Installer\MSIF661.tmp" /b 2 120 02⤵
- Executes dropped EXE
PID:3356
-
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"1⤵
- Executes dropped EXE
PID:444
Network
-
Remote address:8.8.8.8:53Requestardownload.adobe.comIN AResponseardownload.adobe.comIN CNAMEardownload.adobe.com.edgesuite.netardownload.adobe.com.edgesuite.netIN CNAMEa1953.dscd.akamai.neta1953.dscd.akamai.netIN A104.109.143.9a1953.dscd.akamai.netIN A104.109.143.25
-
HEADhttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestHEAD /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 200 OK
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Length: 228925440
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:15 GMT
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=0-1119
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:15 GMT
Content-Range: bytes 0-1119/228925440
Content-Length: 1120
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=1120-3005
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:17 GMT
Content-Range: bytes 1120-3005/228925440
Content-Length: 1886
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=3006-7709
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:18 GMT
Content-Range: bytes 3006-7709/228925440
Content-Length: 4704
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=7710-18166
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:19 GMT
Content-Range: bytes 7710-18166/228925440
Content-Length: 10457
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=18167-40174
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:20 GMT
Content-Range: bytes 18167-40174/228925440
Content-Length: 22008
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=40175-83007
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:21 GMT
Content-Range: bytes 40175-83007/228925440
Content-Length: 42833
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=83008-174421
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:22 GMT
Content-Range: bytes 83008-174421/228925440
Content-Length: 91414
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=174422-296441
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:23 GMT
Content-Range: bytes 174422-296441/228925440
Content-Length: 122020
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=296442-539703
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:24 GMT
Content-Range: bytes 296442-539703/228925440
Content-Length: 243262
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=539704-1028069
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:25 GMT
Content-Range: bytes 539704-1028069/228925440
Content-Length: 488366
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=1028070-1932119
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:26 GMT
Content-Range: bytes 1028070-1932119/228925440
Content-Length: 904050
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=1932120-3850787
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:27 GMT
Content-Range: bytes 1932120-3850787/228925440
Content-Length: 1918668
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=3850788-7650491
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:28 GMT
Content-Range: bytes 3850788-7650491/228925440
Content-Length: 3799704
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=7650492-15040295
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:29 GMT
Content-Range: bytes 7650492-15040295/228925440
Content-Length: 7389804
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=15040296-23728157
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:30 GMT
Content-Range: bytes 15040296-23728157/228925440
Content-Length: 8687862
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=23728158-32928980
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:31 GMT
Content-Range: bytes 23728158-32928980/228925440
Content-Length: 9200823
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=32928981-42361911
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:32 GMT
Content-Range: bytes 32928981-42361911/228925440
Content-Length: 9432931
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=42361912-51994427
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:33 GMT
Content-Range: bytes 42361912-51994427/228925440
Content-Length: 9632516
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=51994428-61770145
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:34 GMT
Content-Range: bytes 51994428-61770145/228925440
Content-Length: 9775718
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=61770146-71594257
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:35 GMT
Content-Range: bytes 61770146-71594257/228925440
Content-Length: 9824112
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=71594258-81158823
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:36 GMT
Content-Range: bytes 71594258-81158823/228925440
Content-Length: 9564566
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=81158824-90826151
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:37 GMT
Content-Range: bytes 81158824-90826151/228925440
Content-Length: 9667328
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=90826152-100154125
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:38 GMT
Content-Range: bytes 90826152-100154125/228925440
Content-Length: 9327974
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=100154126-109687076
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:39 GMT
Content-Range: bytes 100154126-109687076/228925440
Content-Length: 9532951
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=109687077-119669558
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:40 GMT
Content-Range: bytes 109687077-119669558/228925440
Content-Length: 9982482
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=119669559-129774303
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:41 GMT
Content-Range: bytes 119669559-129774303/228925440
Content-Length: 10104745
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=129774304-139915151
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:42 GMT
Content-Range: bytes 129774304-139915151/228925440
Content-Length: 10140848
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=139915152-150077360
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:43 GMT
Content-Range: bytes 139915152-150077360/228925440
Content-Length: 10162209
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=150077361-160128263
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:44 GMT
Content-Range: bytes 150077361-160128263/228925440
Content-Length: 10050903
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=160128264-169924321
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:45 GMT
Content-Range: bytes 160128264-169924321/228925440
Content-Length: 9796058
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=169924322-179403494
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:46 GMT
Content-Range: bytes 169924322-179403494/228925440
Content-Length: 9479173
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=179403495-189142330
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:47 GMT
Content-Range: bytes 179403495-189142330/228925440
Content-Length: 9738836
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=189142331-204147140
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:48 GMT
Content-Range: bytes 189142331-204147140/228925440
Content-Length: 15004810
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=204147141-218108139
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:49 GMT
Content-Range: bytes 204147141-218108139/228925440
Content-Length: 13960999
Connection: keep-alive
-
GEThttp://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspRemote address:104.109.143.9:80RequestGET /pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msp HTTP/1.1
Connection: Keep-Alive
Accept: */*
Accept-Encoding: identity
If-Unmodified-Since: Wed, 20 Feb 2019 12:28:35 GMT
Range: bytes=218108140-228925439
User-Agent: Microsoft BITS/7.8
Host: ardownload.adobe.com
ResponseHTTP/1.1 206 Partial Content
Last-Modified: Wed, 20 Feb 2019 12:28:35 GMT
ETag: "da52000-582527f262aa0"
Accept-Ranges: bytes
Content-Type: application/microsoftpatch
Date: Wed, 19 Jan 2022 15:42:50 GMT
Content-Range: bytes 218108140-228925439/228925440
Content-Length: 10817300
Connection: keep-alive
-
322 B 7
-
322 B 7
-
965 B 7.4kB 10 8
-
104.109.143.9:80http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.msphttp3.7MB 235.3MB 79517 158241
HTTP Request
HEAD http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
200HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206HTTP Request
GET http://ardownload.adobe.com/pub/adobe/reader/win/AcrobatDC/1901020098/AcroRdrDCUpd1901020098.mspHTTP Response
206