raccoon | 8bc36f61610304148652cc7748ac1a215290f720d9e5e8df53d1d3b2c3c0e5fd

Analysis

max time kernel
524s
max time network
527s
platform
windows10-1703_x64
resource
win10-20220812-en
resource tags

arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
submitted
16-01-2023 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

readerdc64_es_xa_cra_mdr_install.exe
Size

1.2MB
MD5

a2e37f954986af9f88342b20b2965646
SHA1

b298ce01bc93e8391acca3a07c0d06021df30dd6
SHA256

8bc36f61610304148652cc7748ac1a215290f720d9e5e8df53d1d3b2c3c0e5fd
SHA512

a492235f0e6de5f93200e0886bf4d3d77629777f28a5d517e87c3bb45e4266f339ab6a66d889434e617a3e4cec7248b488fb1e5aa0a73b6498ed7ec2d4073e7a
SSDEEP

24576:YDDuX33Kl7LoDozrFH1edTVyJFeMxbsRIHZ9lWzirNj:pHKFcD4FHnU+bhgo

Score

10^/10

raccoon persistence stealer

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon

Blocklisted process makes network request 1 IoCs

flow	pid	Process
45	4848	msiexec.exe

Executes dropped EXE 10 IoCs

pid	Process
4160	606DDA3D-6A55-41A4-B506-F825B135FEA0
4944	setup.exe
2756	MSICED0.tmp
4584	FullTrustNotifier.exe
2396	ADelRCP.exe
1124	SingleClientServicesUpdater.exe
96	armsvc.exe
1864	SingleClientServicesUpdater.exe
3864	MSI1AAD.tmp
208	armsvc.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\ACTIVE SETUP\INSTALLED COMPONENTS\{A6EADE66-0000-0000-484E-7E8A45000000}	MsiExec.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDF64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FF76CB60-2EC8-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{123FCDEB-862C-41BE-A256-19CFF2CA2F44}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InprocServer32	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\ViewerPS.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroBroker.exe\""	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{85DE1C45-2C66-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FF76CB60-2E68-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7241-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{13C3C803-0CEF-4AE1-AF81-B73DD04BCAB5}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\AcrobatInfo.exe\" /PDFShell"	ADelRCP.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32\ThreadingModel = "Both"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1BFA8EF7-4C47-4FA8-94AA-3F9DFDBE58C5}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32	ADelRCP.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\InProcServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{72498821-3203-101B-B02E-04021C009402}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InProcServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\pdfprevhndlr.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{FD2C8897-2BE8-459c-B8E4-0D2FCFD341F0}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C523F39F-9C83-11D3-9094-00104BD0D535}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\plug_ins\\Accessibility.api"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{335E7240-6B49-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{1BFA8EF7-4C47-4FA8-94AA-3F9DFDBE58C5}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C400-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{72498821-3203-101B-B02E-04021C009402}\LocalServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17F2E344-8227-4AA7-A25A-E89424566BBA}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2EAF0840-690A-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{6D12C402-4E34-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\LocalServer32\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{335E7241-6B49-101B-9CA8-9240CE2738AE}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\InprocServer32\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\adobeafp.dll"	msiexec.exe

Sets file execution options in registry 2 TTPs 31 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrServicesUpdater.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RdrCEF.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe\MitigationOptions = "256"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroServicesUpdater.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\MitigationOptions = "256"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcrobatInfo.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Acrobat.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroCEF.exe\MitigationOptions = "256"	MsiExec.exe

Loads dropped DLL 64 IoCs

pid	Process
216	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\atl110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe
File opened for modification	C:\Windows\SysWOW64\msvcr110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\msvcp110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\vccorlib110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfc110u.dll	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\mfcm110u.dll	msiexec.exe
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\S_IlluCCFilesEmpty_180x180.svg	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fr-fr\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_replace_signer_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\hr-hr\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\themes\dark\core_icons.png	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\en-gb\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\mip\images\Smock_Help_18_N.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\plugin.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\snapshot_blob.bin	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_export_18.svg	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\check.cur	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\app\dev\nls\ja-jp\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themes\dark\WelcomeCardPro.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\whats_new\de-de\Q3_2022_payments.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_education_arrow_30.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_share_get_link_18.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\s_share_get_signatures_18.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\README.txt	msiexec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_filter_18.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\spectrum_spinner_process.svg	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\digsig\css\main.css	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_review_upsell.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\images\themes\dark\new_icons_retina.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\css\main-selector.css	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\images\core_icons.png	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\tool-selector.css	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\reviews\js\nls\ro-ro\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\sample-files\js\nls\nl-nl\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\main-cef-ui-theme.css	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\progress_spinner_dark.gif	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\css\main.css	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\js\nls\de-de\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libEGL.dll	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\en-gb\ui-strings.js	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\hr-hr\ui-strings.js	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sl-sl\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\new_icons_retina.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\on-boarding\images\themes\dark\cross_error.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\search-summary\js\nls\fr-ma\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\unified-share\images\themes\dark\AddressBook.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\plugins\rhp\createpdfupsell-app-tool-view.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ro_get.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\AlertMedium.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images\chevron-down.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\themes\dark\s_filterselected-dark-disabled_32.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\root\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\home\images\icons_retina.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\tracked-send\images\logo_retina.png	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.de_DE_PREEURO.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\fr-fr\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\ui-strings.js	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\walk-through\images\dc_share_upsell_2x.png	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\MoreTools.aapp	msiexec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\images\s_sign_empty_no_signed_in_state.svg	SingleClientServicesUpdater.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js	SingleClientServicesUpdater.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\themes\dark\icons.png	MsiExec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ESP\Action02.sequ	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\icons_ie8.gif	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\tr-tr\ui-strings.js	MsiExec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIBC6.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI828C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4FC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI511F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\acropdf64.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\msvcp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI91DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\appcenter_r.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\symbol.txt2	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\AGM.dll_Exch	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\Exch_cooltype.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8A36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\zdingbat.txt	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\chrome_elf.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\concrt140.dll.CC943011_A332_3C6E_AE5A_D28E3EC152B8	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\CRWindowsClientService.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\msvcp140_2.dll.CC943011_A332_3C6E_AE5A_D28E3EC152B8	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ahclient.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rdrservicesupdater.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\msvcp140_1.dll.CC943011_A332_3C6E_AE5A_D28E3EC152B8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\adobearm.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\F_CENTRAL_msvcr120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\F_CENTRAL_msvcp120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\nppdf32.dll_Apollo	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\nppdf32.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\dummy.dic	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\adobearmhelper.exe.BDCA7721_F290_4124_BBED_7A15FE7694EB	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\concrt140.dll.CC943011_A332_3C6E_AE5A_D28E3EC152B8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\wcchromenativemessaginghost.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\ExLang32.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8FA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\TrackedSend.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9DD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICA20.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\msvcp140_codecvt_ids.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\TURKISH.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\viewer.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI40C5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACC2.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\comdll.x.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\AXSLE.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\Onix32.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\ANCUtility.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D15.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\F_CENTRAL_mfc120u_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\vcomp140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-1034-1033-7760-BC15014EA700}\_729C1918_D5B6_4B24_97EC_8B387AE953A9	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B66.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\ahclient.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\F_CENTRAL_vccorlib120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\comdll.x.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\logsession.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\rt3d.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDCE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI56D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC666.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\nppdf32.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\UKRAINE.TXT	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8B4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\AGM.dll_Exch	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\dummy.aff	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA430133017706CB5110E47A00\21.1.20135\F_CENTRAL_mfc120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 59 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroLicApp.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AASIapp.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B723F941-52A2-4392-B500-60F3889659B4}	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B7278BD0-7970-47D6-8954-99B2343EED88}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppName = "AcroCEF.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AASIapp.exe = "11000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppName = "Acrobat.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\AppName = "AcroRd32.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrobat.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{191DA03B-FBE7-4579-B64D-273DC8358F1B}\AppName = "Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Acrodist.exe = "11000"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroLicApp.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppName = "AcroBroker.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7AC06A6F-4C88-4707-8DEC-61017CB50E1E}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\AcroDist.exe = "11000"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{BE0A2BA1-1E09-4A59-BE36-AA32DC25931B}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{EF27C7F4-B47A-4011-8177-6408DC5DDB1A}\AppName = "AcroCEF.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{89322207-5E2E-40CE-90ED-5957180E3B2C}\AppPath = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\"	msiexec.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{289AF617-1CC3-42A6-926C-E6A863F0E3BA} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000a21d011de329d901	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000050458f1ee329d901	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{DF9A1DA0-23C0-101B-B02E-FDFDFDFDFDFD}\TreatAs	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Key\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{18AED83F-B7B1-4992-B9E1-D291B1E5E0B4}\ = "CVisioDocumentsProxy"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf\OpenWithProgids	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1ACFD784-DE28-47E2-B5F7-8602EC765AF3}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0FCBE75-3867-41D9-BE5F-DC0287F4CB92}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat2019\shell\open\ddeexec	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ = "IAcroAXDocShim"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\acrobat\DefaultIcon\ = "C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\OpenWithProgids	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfd+xml	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.secstore\Acrobat.SecStore	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.XDPDoc\BrowseInPlace = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.Sequence\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-1034-1033-7760-BC15014EA700}\\_SequenceFile.ico,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA430133017706CB5110E47A00\SourceList\Media\1 = "ACROBAT9;[1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\shell\Print	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3F77C747-A942-45B2-A812-097A1F5CFE6F}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3E9-4981-101B-9CA8-9240CE2738AE}\TypeLib\Version = "1.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\{BBAA0E44-3862-490C-8E63-AC2D2D6EF733}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E790E1D1-9DE8-4853-8AC6-933D4FD9C927}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.pdfxml\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BD7F7648-67FE-4262-9218-41B0CF89D20B}\TypeLib\ = "{E64169B3-3592-47D2-816E-602C5C13F328}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document\ = "Adobe Acrobat Document"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}\ProgID\ = "AcroExch.Time.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Point.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D86D3661-4F11-4a9a-AD85-772A52AE6D69}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4C64AF6-D1CD-4D49-AE49-83D87B97CD7C}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EE490A9F-1F32-4EF4-9EA5-430AFAB362FA}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C4B777E9-F040-4084-BE29-3A8F84782D32}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{895A0964-AE59-41CE-98DD-E880F78B0F2A}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker.1\CLSID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\AcrobatPDXFileType	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\MiscStatus\ = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6D12C401-4E34-101B-9CA8-9240CE2738AE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AFormAut.App.1\ = "AFormApp Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\7	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B4848E37-7C66-40A6-9F66-D3A9BC8F4636}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\Shellex\PropertySheetHandlers	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AdobeAcrobat.OpenDocuments.2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\DocObject	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Acrobat.SecStore\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BD7F7648-67FE-4262-9218-41B0CF89D20B}\TypeLib\Version = "1.1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.App.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.FDFDoc\shell\Printto	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA430133017706CB5110E47A00\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\MiscStatus\1	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B4CD3F0-4981-101B-9CA8-9240CE2738AE}\ = "CAcroHiliteList"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Acrobat.XDPDoc\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document\Shell\print\command\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\" /p /h \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document\CurVer\ = "Acrobat.Document.DC"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B4CD3F0-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{7CD06992-50AA-11D1-B8F0-00A0C9259304}\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C18642A5-F0CB-4013-A164-F35FEDE7129F}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA430133017706CB5110E47A00\Patches\68AB67CA044AFFFF4A24CB6130F46500 = ":TGT_6ToUPG_6;:#TGT_6ToUPG_6"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.xfdf\OpenWithProgids	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_es_xa_cra_mdr_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	readerdc64_es_xa_cra_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_es_xa_cra_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_es_xa_cra_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_es_xa_cra_mdr_install.exe

Suspicious behavior: EnumeratesProcesses 36 IoCs

pid	Process
2204	readerdc64_es_xa_cra_mdr_install.exe
2204	readerdc64_es_xa_cra_mdr_install.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
2096	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
4380	MsiExec.exe
1648	MsiExec.exe
1648	MsiExec.exe
1648	MsiExec.exe
1648	MsiExec.exe
2396	ADelRCP.exe
2396	ADelRCP.exe
1124	SingleClientServicesUpdater.exe
1124	SingleClientServicesUpdater.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
4860	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe
2632	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4944	setup.exe
Token: SeIncreaseQuotaPrivilege	4944	setup.exe
Token: SeSecurityPrivilege	4848	msiexec.exe
Token: SeCreateTokenPrivilege	4944	setup.exe
Token: SeAssignPrimaryTokenPrivilege	4944	setup.exe
Token: SeLockMemoryPrivilege	4944	setup.exe
Token: SeIncreaseQuotaPrivilege	4944	setup.exe
Token: SeMachineAccountPrivilege	4944	setup.exe
Token: SeTcbPrivilege	4944	setup.exe
Token: SeSecurityPrivilege	4944	setup.exe
Token: SeTakeOwnershipPrivilege	4944	setup.exe
Token: SeLoadDriverPrivilege	4944	setup.exe
Token: SeSystemProfilePrivilege	4944	setup.exe
Token: SeSystemtimePrivilege	4944	setup.exe
Token: SeProfSingleProcessPrivilege	4944	setup.exe
Token: SeIncBasePriorityPrivilege	4944	setup.exe
Token: SeCreatePagefilePrivilege	4944	setup.exe
Token: SeCreatePermanentPrivilege	4944	setup.exe
Token: SeBackupPrivilege	4944	setup.exe
Token: SeRestorePrivilege	4944	setup.exe
Token: SeShutdownPrivilege	4944	setup.exe
Token: SeDebugPrivilege	4944	setup.exe
Token: SeAuditPrivilege	4944	setup.exe
Token: SeSystemEnvironmentPrivilege	4944	setup.exe
Token: SeChangeNotifyPrivilege	4944	setup.exe
Token: SeRemoteShutdownPrivilege	4944	setup.exe
Token: SeUndockPrivilege	4944	setup.exe
Token: SeSyncAgentPrivilege	4944	setup.exe
Token: SeEnableDelegationPrivilege	4944	setup.exe
Token: SeManageVolumePrivilege	4944	setup.exe
Token: SeImpersonatePrivilege	4944	setup.exe
Token: SeCreateGlobalPrivilege	4944	setup.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe
Token: SeRestorePrivilege	4848	msiexec.exe
Token: SeTakeOwnershipPrivilege	4848	msiexec.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
2204	readerdc64_es_xa_cra_mdr_install.exe
2204	readerdc64_es_xa_cra_mdr_install.exe
2204	readerdc64_es_xa_cra_mdr_install.exe
2204	readerdc64_es_xa_cra_mdr_install.exe
4160	606DDA3D-6A55-41A4-B506-F825B135FEA0
4944	setup.exe
4944	setup.exe
4944	setup.exe
2396	ADelRCP.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 4160	2204	readerdc64_es_xa_cra_mdr_install.exe	67
PID 2204 wrote to memory of 4160	2204	readerdc64_es_xa_cra_mdr_install.exe	67
PID 2204 wrote to memory of 4160	2204	readerdc64_es_xa_cra_mdr_install.exe	67
PID 4160 wrote to memory of 4944	4160	606DDA3D-6A55-41A4-B506-F825B135FEA0	68
PID 4160 wrote to memory of 4944	4160	606DDA3D-6A55-41A4-B506-F825B135FEA0	68
PID 4848 wrote to memory of 216	4848	msiexec.exe	71
PID 4848 wrote to memory of 216	4848	msiexec.exe	71
PID 4848 wrote to memory of 216	4848	msiexec.exe	71
PID 4848 wrote to memory of 2096	4848	msiexec.exe	72
PID 4848 wrote to memory of 2096	4848	msiexec.exe	72
PID 4848 wrote to memory of 4380	4848	msiexec.exe	73
PID 4848 wrote to memory of 4380	4848	msiexec.exe	73
PID 4848 wrote to memory of 1648	4848	msiexec.exe	76
PID 4848 wrote to memory of 1648	4848	msiexec.exe	76
PID 4848 wrote to memory of 1648	4848	msiexec.exe	76
PID 4848 wrote to memory of 2756	4848	msiexec.exe	77
PID 4848 wrote to memory of 2756	4848	msiexec.exe	77
PID 4848 wrote to memory of 2756	4848	msiexec.exe	77
PID 4848 wrote to memory of 4584	4848	msiexec.exe	81
PID 4848 wrote to memory of 4584	4848	msiexec.exe	81
PID 4848 wrote to memory of 4584	4848	msiexec.exe	81
PID 1648 wrote to memory of 2396	1648	MsiExec.exe	82
PID 1648 wrote to memory of 2396	1648	MsiExec.exe	82
PID 4848 wrote to memory of 1124	4848	msiexec.exe	84
PID 4848 wrote to memory of 1124	4848	msiexec.exe	84
PID 4848 wrote to memory of 3864	4848	msiexec.exe	88
PID 4848 wrote to memory of 3864	4848	msiexec.exe	88
PID 3864 wrote to memory of 992	3864	MSI1AAD.tmp	90
PID 3864 wrote to memory of 992	3864	MSI1AAD.tmp	90
PID 4848 wrote to memory of 4860	4848	msiexec.exe	91
PID 4848 wrote to memory of 4860	4848	msiexec.exe	91
PID 3864 wrote to memory of 2300	3864	MSI1AAD.tmp	92
PID 3864 wrote to memory of 2300	3864	MSI1AAD.tmp	92
PID 4848 wrote to memory of 2632	4848	msiexec.exe	94
PID 4848 wrote to memory of 2632	4848	msiexec.exe	94
PID 4848 wrote to memory of 4216	4848	msiexec.exe	97
PID 4848 wrote to memory of 4216	4848	msiexec.exe	97
PID 4848 wrote to memory of 4216	4848	msiexec.exe	97

C:\Users\Admin\AppData\Local\Temp\readerdc64_es_xa_cra_mdr_install.exe
"C:\Users\Admin\AppData\Local\Temp\readerdc64_es_xa_cra_mdr_install.exe"
1⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Adobe\A9254D13-A91C-42DE-A77B-A9D1937D3B41\ACE94AEA-70A3-410C-8A50-6B7B98CDFD99\606DDA3D-6A55-41A4-B506-F825B135FEA0
  "C:\Users\Admin\AppData\Local\Adobe\A9254D13-A91C-42DE-A77B-A9D1937D3B41\ACE94AEA-70A3-410C-8A50-6B7B98CDFD99\606DDA3D-6A55-41A4-B506-F825B135FEA0" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES ENABLE_CHROMEEXT=1
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\setup.exe
    "C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\setup.exe" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES ENABLE_CHROMEEXT=1 DISABLE_CACHE=1
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4944

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Registers COM server for autorun
- Sets file execution options in registry
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 1A99275A6BFE0427282A4B1375DAC513
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:216
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 0BCDBBBE2BCB5B6FF319885E303A0A9D
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B3339365F91AAC034D7E568545B2D983 E Global\MSI0000
  2⤵
  - Sets file execution options in registry
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 03505956C1B9C4FE0E386A4093AC141E E Global\MSI0000
  2⤵
  - Modifies Installed Components in the registry
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe
    "C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe"
    3⤵
    - Executes dropped EXE
    - Registers COM server for autorun
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2396
- C:\Windows\Installer\MSICED0.tmp
  "C:\Windows\Installer\MSICED0.tmp" /b 2 120 0
  2⤵
  - Executes dropped EXE
  PID:2756
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" ClearToasts
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe
  "C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe" 22.003.20310 --SingleClientApp
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1124
- - C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\SingleClientServicesUpdater.exe
    --postMsg
    3⤵
    - Executes dropped EXE
    PID:1864
- C:\Windows\Installer\MSI1AAD.tmp
  "C:\Windows\Installer\MSI1AAD.tmp" {AC76BA86-1034-1033-7760-BC15014EA700} 1
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3864
- - C:\Windows\system32\msiexec.exe
    msiexec.exe /i {AC76BA86-1034-1033-7760-BC15014EA700} REINSTALLMODE=omus REINSTALL=ALL IS_SEC_INSTALL=1 /qn
    3⤵
    PID:992
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c del "C:\Windows\Installer\MSI1AAD.tmp"
    3⤵
    PID:2300
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding ACA44892624FEBF5A16D41E6B3D28BAA
  2⤵
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:4860
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding BF7B5D5C5557009B591E420A19A2AE48 E Global\MSI0000
  2⤵
  - Registers COM server for autorun
  - Sets file execution options in registry
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  PID:2632
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 104C407C3D659999EC219ED285694482 E Global\MSI0000
  2⤵
  PID:4216

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
1⤵
- Executes dropped EXE
PID:96

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
1⤵
- Executes dropped EXE
PID:208

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\PROGRAM FILES\COMMON FILES\ADOBE\ACROBAT\SETUP\{AC76BA86-1034-1033-7760-BC15014EA700}\Abcpy.ini

Filesize
644B

MD5
1965ef76a143599308aa14aa0175b0e1

SHA1
93535ce70dc2598572b59a31401ae7f3bebed9f3

SHA256
d70276e38ea1d8a4a8efeb5686deec4085d0f76b437c679bc80f92d6375231a2

SHA512
df498931cd52a26e850dc007571266c5cd81cc5ac21991df329d6f0569c64a47bf066c140b7ab993166da58c51171cc94380b61cf4a1ec9be2bc5814ddd4767d

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\AcroPro.msi

Filesize
11.1MB

MD5
fb9fff4b2a7537ccde35411e5bd6655a

SHA1
2ba2d86f5fb35a39f506263496ac6a22044f14a4

SHA256
71a2c3adf0b0202d5b4d9a7f1b143d2cdc3393aa960619976350003c67749af4

SHA512
9b7e0efdfa11744e039afd9eb67d2843f2a57602be9c59c638358900aa6e810d44cb826140a19e7e1b866ba7e6326f9a586f4e82f4b6349c762a0398b0da334c

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\AcroRdrDCx64Upd2200320310.msp

Filesize
381.1MB

MD5
2ce94a17465c3b9dcfc2698091cb79e0

SHA1
f98544d0c5d253fa3420c01c0abc61e45e421863

SHA256
b81358a531a034a232a81f8efc95b9b12c6a952fab7b2cf1c88aef41dee36df8

SHA512
d3355f7bc2c708d79a0bbf677f1aec798a4ae8f75b34fc75e5ed6ca89ed0b8208a03975390363823848c113a4c31cee6c09e809148d8b41ca1d88a4a225245ef

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\Core.cab

Filesize
490.5MB

MD5
b80e8040e63617f75bc0e0720832d904

SHA1
851d2cd29f636637d4a96161904ddf83bd40fcc1

SHA256
f9355903a07c4e4174846e62c4d2419a61f4224c6396c76782af784920c0fa49

SHA512
f16c4de487ddaa7b9b66da789391046bd31092ec4c15bd95a807e5f22abe499a95a5d999c859769e4a9b6e342953119e69021888af95ab52b547560a4a4930b3

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\Languages.cab

Filesize
11.1MB

MD5
02d589bc2e5ec2e4dadabbfc298bc232

SHA1
39f819b8eeb8043d815453647caa1868b1508473

SHA256
db4177f872763e90cd2367547f7f6476468a28fe36c2ac79f5c74911df63fccd

SHA512
058aeac6679be57ef13bd9f6b28b9e6dd799be866ca93c6090abf2086cc2be4c46ea0644a2fa96a14c734826d6dd751ba5af69cdf6c229f74e2dc1c25f8e980d

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\setup.exe

Filesize
627KB

MD5
004684451f1b953f3c66c867dfcd4681

SHA1
8bc279497bbe7618d0c55a08bfd72ca93122b530

SHA256
587c9954bd0a59043adf54003982bab173a601a66f69d3681cb016cee4823a9a

SHA512
2ffc6957eb6cbc07cc997d023dd5e9d45ebeb84d3a781cb7484f9679bd2b3104ca6d450524c92b28ddfefe92bac70fcdf2782283f7b6dac3ba97007559897910

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\setup.exe

Filesize
627KB

MD5
004684451f1b953f3c66c867dfcd4681

SHA1
8bc279497bbe7618d0c55a08bfd72ca93122b530

SHA256
587c9954bd0a59043adf54003982bab173a601a66f69d3681cb016cee4823a9a

SHA512
2ffc6957eb6cbc07cc997d023dd5e9d45ebeb84d3a781cb7484f9679bd2b3104ca6d450524c92b28ddfefe92bac70fcdf2782283f7b6dac3ba97007559897910

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1034-1033-7760-BC15014EA700}\setup.ini

Filesize
369B

MD5
012c25d9899eb3483e1d16203a1b5280

SHA1
5b4471fd5e2c2d3cbe8e1ba1cf2701183d1ce540

SHA256
806d7486e8b3595ea256b597a5313fbe597ecb01191cdc68b9491516bbd95487

SHA512
10617a9731a66ae0770cc614313b379651e4ed62727d1afa8b30c44824a3879f8a421990013678dfae24e53e756f3f458bc6a90acac7ba3c416675fce3a08f9c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
471B

MD5
9b513b04a228de36a051bbb0a42dc4ed

SHA1
a44ddee59aeaef6deae252e74ee927946fc22861

SHA256
f5c72f4e7581ce69cf39ebbeb7c775ff2810dbcc31aaabced1f6ac50af33f264

SHA512
f9f788ee169d1044a8c77e3e12aecf7472c4c0aa5202521c2f256b06ecadbb24be16e2f3634ad92863c11a633086225ec25d15c9897efe3bbbef58bbc89e012c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_EB45B4DDD2CA201E87E40B2FB5245AEF

Filesize
727B

MD5
e0b6669bed29418226796ab610d4d258

SHA1
65c3f195526936bed75031e8039cdee3c86ead1c

SHA256
397717e7ab033c5f318fb2599d8c98fd30ecbc39981d1504d0facc7fc2aca65e

SHA512
e2bd8c7dd429f238083e22dadd650ff8983584ea0d0a06b07c1b824c248b53a3e22e4f4d2c2daa3da5f3a2edd6a7ad37c14937c00819d3a7213afb726838dc84

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
727B

MD5
a7778dee1c20deb0de8faf5e1a5a77fd

SHA1
625361db1b3983898a99d50765bea05a361ae8ee

SHA256
8337923244bde0c4fd3ab7b5205de4f26a0c9b80fe9c2ed6f7dd2ed4eb631656

SHA512
be680e4085f414111f0998a4c4ad1ec943261859f9f2354f8c14e798b88f494cad92dfab47a89d4d1edf3af69f755656c721c455b080b6af43f413a7bc95446b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Filesize
400B

MD5
ba17b064e8e17944227102ec79538a13

SHA1
0961a8a2e2727b3f18fc0129a904e006c9f9a862

SHA256
04e7debcb74c9c7ac17c8d960ce743c8e8e4250f2af3cce0694c21432ce0bf83

SHA512
5db75ca347132675a2e5326bde3c525cdb0a82befa5c3330e1077f9e71d870f36cd27afa5b89cf4d469095b753e20977050593439d387b3584817b1e814efdfd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_EB45B4DDD2CA201E87E40B2FB5245AEF

Filesize
434B

MD5
79fd11ba54661007ce18c90ffa957790

SHA1
aaf3c9086e41355e40d5b47ac10faeffa425153c

SHA256
1e15e7a2f725223f07fa99e75ac97e9fa575b0518e3bc40095d53533b05df5c9

SHA512
a7c1aef02eae9156d85068828a10437a04908ec128d41e630f8240ea734884ec48b196d4cae9225d32c20dea9df491e875bf87581a26215b7fb0f711d460088e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Filesize
412B

MD5
176c81f3d285642dddfe339fe568017d

SHA1
7c343f6e81181bd60b8a97a66937fbca199160a2

SHA256
e40d6d3159728858c7d67132a1bb18620e6f450e1cdee33b6b3e640153c9a9b5

SHA512
dc2b54c044fda88fea3f4cb0268e16fe542b787ff8d06cb4568a59ec7b7e9506d18eb4c8119ce5b21ed63e3247d338e9d8dc5dbd1c4805409e62942690afa9df

Download Submit
C:\Users\Admin\AppData\Local\Adobe\A9254D13-A91C-42DE-A77B-A9D1937D3B41\ACE94AEA-70A3-410C-8A50-6B7B98CDFD99\606DDA3D-6A55-41A4-B506-F825B135FEA0

Filesize
407.7MB

MD5
9e3a8d5f7a530ba6a111fd682aa3fb53

SHA1
94f8ef8e4341b100550da4b3914c05c95e4ffc09

SHA256
2c00f3b622654866baa6342cb5abc78a50ae5bacfc858edd94c3f4e97a4f9dad

SHA512
d44693411980470c16ee6941b1acfe61e8cb8cf6d0fe0fa9a4215625a37c570f925e0b01df49e70f5b7c7da095b9e24e1deef3f9cd1543ce9beb0c31d0f903ae

Download Submit
C:\Users\Admin\AppData\Local\Adobe\A9254D13-A91C-42DE-A77B-A9D1937D3B41\ACE94AEA-70A3-410C-8A50-6B7B98CDFD99\606DDA3D-6A55-41A4-B506-F825B135FEA0

Filesize
407.7MB

MD5
9e3a8d5f7a530ba6a111fd682aa3fb53

SHA1
94f8ef8e4341b100550da4b3914c05c95e4ffc09

SHA256
2c00f3b622654866baa6342cb5abc78a50ae5bacfc858edd94c3f4e97a4f9dad

SHA512
d44693411980470c16ee6941b1acfe61e8cb8cf6d0fe0fa9a4215625a37c570f925e0b01df49e70f5b7c7da095b9e24e1deef3f9cd1543ce9beb0c31d0f903ae

Download Submit
C:\Windows\Installer\MSI3823.tmp

Filesize
141KB

MD5
edb88affffd67bca3523b41d3e2e4810

SHA1
0055b93907665fed56d22a7614a581a87d060ead

SHA256
4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15

SHA512
2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf

Download Submit
C:\Windows\Installer\MSI4A07.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSI4D15.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSI4E1F.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSI4FC6.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSI511F.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSI52F5.tmp

Filesize
516KB

MD5
51a8dec0247b569e10042f1543fbdb32

SHA1
d27d410739a64b6df18c460e094fcec31810892c

SHA256
8eba0b040fb6dbb0f5dacbdfa9e2929cbaaab12865012ed7dda9ccdc09124a48

SHA512
0c414cf9dfee03732dd284e17446ce0203c0f0c96221a851ad3c9dabbb2db8da9f0c5c02b8a17c029d3446b551018e8fd0565febbb3fb3d2e28af0dea67ad539

Download Submit
C:\Windows\Installer\MSI53F0.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSIAAEA.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSIAB78.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSIAC54.tmp

Filesize
484KB

MD5
82d689ebdb24eb3c7788a46c0b5f2628

SHA1
0421603165e20ecb9d0421ed350e4ee47b5f411b

SHA256
2f7e2e93d493141ff65149db8aac0c149549f19b4f3ef66111bcda7c7c2feb5b

SHA512
cf89dc63eb3cdc623f3dabb50db6c3cbb3cf8065edd6aeebc0a0c2dd12d0135641e7777300ce93c18ab1b48cf52d5e6c7c552a9729ba00b4826d2fd8728011c1

Download Submit
C:\Windows\Installer\MSIACC2.tmp

Filesize
206KB

MD5
0fb71a79c1269e2ba50fb92eb92866d6

SHA1
7292a917707d174f7f98bbcd7e248000ebcfe9e0

SHA256
e9e4adfa160ce9bbeda6a083c42562fdb33a8c9261f85edc682528333813b7b6

SHA512
0c2e80768302fb009298b288b06bb9e62db91fbd04163f0fad707f9cc84445985cf811839a6c6cf022817f4405276b63b7ba46c5c67e24fd5a90cf976ffd4144

Download Submit
C:\Windows\Installer\MSIC666.tmp

Filesize
141KB

MD5
30ac3d04294763687de62b4ca63fab8b

SHA1
8596aa3ed684d6569e3768a1308bba797b9bb735

SHA256
d530dee06d1034921924dd52839009833dbe2b8be4920fdfd4f8cb4c2bc38c6d

SHA512
86adffdda46230f13362b6aa427072221ad285a79187900a1c6321ff2f9f35fcdfb74af640e44b330ed6361452b2470ab4022045faae3e68db3d170f37514cd1

Download Submit
C:\Windows\Installer\MSICA20.tmp

Filesize
157KB

MD5
61dd20ce235e5dd15c99f20d52b1e7fc

SHA1
3608756a912f2936071aea63efaf6bb62e4bdb8b

SHA256
16d175bb058d95c8f622fb5eb46a1525d07251202c2521846c55be41cf3602c1

SHA512
6c08cf0b49e30c3a41163aaccd1bd16e05608938ec1c8dfd76fc6322ee6dec0d2e5108f983e47fa549faeeea51c22fe91e83603fd73308822f76cd5593274462

Download Submit
C:\Windows\Installer\MSICB1B.tmp

Filesize
157KB

MD5
61dd20ce235e5dd15c99f20d52b1e7fc

SHA1
3608756a912f2936071aea63efaf6bb62e4bdb8b

SHA256
16d175bb058d95c8f622fb5eb46a1525d07251202c2521846c55be41cf3602c1

SHA512
6c08cf0b49e30c3a41163aaccd1bd16e05608938ec1c8dfd76fc6322ee6dec0d2e5108f983e47fa549faeeea51c22fe91e83603fd73308822f76cd5593274462

Download Submit
C:\Windows\Installer\MSICBC8.tmp

Filesize
486KB

MD5
1566e699ee42eaa571700f3ad30b2dba

SHA1
d2b11f53310ad7118b6893c46ea815f9c7bf9ce2

SHA256
4bc5fc5cd0ae661b4ffe6ad9e12e55b233f471ba84f40cba7beb0cea8822e831

SHA512
52f8b86486bc22198cde10f91d4588a7a939580327e8ba03b254d5a2c915b039775afe696fe2014aaecf83ef514d3123c6ec68244b40603aa5d980f7e4c1ba1b

Download Submit
C:\Windows\Installer\MSICCF2.tmp

Filesize
486KB

MD5
1566e699ee42eaa571700f3ad30b2dba

SHA1
d2b11f53310ad7118b6893c46ea815f9c7bf9ce2

SHA256
4bc5fc5cd0ae661b4ffe6ad9e12e55b233f471ba84f40cba7beb0cea8822e831

SHA512
52f8b86486bc22198cde10f91d4588a7a939580327e8ba03b254d5a2c915b039775afe696fe2014aaecf83ef514d3123c6ec68244b40603aa5d980f7e4c1ba1b

Download Submit
C:\Windows\Installer\MSICD9E.tmp

Filesize
516KB

MD5
51a8dec0247b569e10042f1543fbdb32

SHA1
d27d410739a64b6df18c460e094fcec31810892c

SHA256
8eba0b040fb6dbb0f5dacbdfa9e2929cbaaab12865012ed7dda9ccdc09124a48

SHA512
0c414cf9dfee03732dd284e17446ce0203c0f0c96221a851ad3c9dabbb2db8da9f0c5c02b8a17c029d3446b551018e8fd0565febbb3fb3d2e28af0dea67ad539

Download Submit
C:\Windows\Installer\MSICEB9.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSID031.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSID13B.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSID294.tmp

Filesize
142KB

MD5
857de6c3d57dbf9af4087e9f7fe45aae

SHA1
610a3bfb986904342654a567e285c6bef18d543b

SHA256
106771a66d9538e63adc5fa8ac704e2e79232874433cdb5ec6d4c9353a58c470

SHA512
700aec5ab66817e0dfb97c9f3d4f113f6e8b6f9257f142e33f014bf03a2c916d2f65b0800e8e6568f578269935daea6c877352681078855afff2489b404be702

Download Submit
C:\Windows\Installer\MSIDE5D.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
C:\Windows\Installer\MSIDF38.tmp

Filesize
516KB

MD5
51a8dec0247b569e10042f1543fbdb32

SHA1
d27d410739a64b6df18c460e094fcec31810892c

SHA256
8eba0b040fb6dbb0f5dacbdfa9e2929cbaaab12865012ed7dda9ccdc09124a48

SHA512
0c414cf9dfee03732dd284e17446ce0203c0f0c96221a851ad3c9dabbb2db8da9f0c5c02b8a17c029d3446b551018e8fd0565febbb3fb3d2e28af0dea67ad539

Download Submit
\Windows\Installer\MSI3823.tmp

Filesize
141KB

MD5
edb88affffd67bca3523b41d3e2e4810

SHA1
0055b93907665fed56d22a7614a581a87d060ead

SHA256
4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15

SHA512
2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf

Download Submit
\Windows\Installer\MSI4A07.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSI4D15.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSI4E1F.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSI4FC6.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSI511F.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSI52F5.tmp

Filesize
516KB

MD5
51a8dec0247b569e10042f1543fbdb32

SHA1
d27d410739a64b6df18c460e094fcec31810892c

SHA256
8eba0b040fb6dbb0f5dacbdfa9e2929cbaaab12865012ed7dda9ccdc09124a48

SHA512
0c414cf9dfee03732dd284e17446ce0203c0f0c96221a851ad3c9dabbb2db8da9f0c5c02b8a17c029d3446b551018e8fd0565febbb3fb3d2e28af0dea67ad539

Download Submit
\Windows\Installer\MSI53F0.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSIAAEA.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSIAB78.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSIAC54.tmp

Filesize
484KB

MD5
82d689ebdb24eb3c7788a46c0b5f2628

SHA1
0421603165e20ecb9d0421ed350e4ee47b5f411b

SHA256
2f7e2e93d493141ff65149db8aac0c149549f19b4f3ef66111bcda7c7c2feb5b

SHA512
cf89dc63eb3cdc623f3dabb50db6c3cbb3cf8065edd6aeebc0a0c2dd12d0135641e7777300ce93c18ab1b48cf52d5e6c7c552a9729ba00b4826d2fd8728011c1

Download Submit
\Windows\Installer\MSIACC2.tmp

Filesize
206KB

MD5
0fb71a79c1269e2ba50fb92eb92866d6

SHA1
7292a917707d174f7f98bbcd7e248000ebcfe9e0

SHA256
e9e4adfa160ce9bbeda6a083c42562fdb33a8c9261f85edc682528333813b7b6

SHA512
0c2e80768302fb009298b288b06bb9e62db91fbd04163f0fad707f9cc84445985cf811839a6c6cf022817f4405276b63b7ba46c5c67e24fd5a90cf976ffd4144

Download Submit
\Windows\Installer\MSIC666.tmp

Filesize
141KB

MD5
30ac3d04294763687de62b4ca63fab8b

SHA1
8596aa3ed684d6569e3768a1308bba797b9bb735

SHA256
d530dee06d1034921924dd52839009833dbe2b8be4920fdfd4f8cb4c2bc38c6d

SHA512
86adffdda46230f13362b6aa427072221ad285a79187900a1c6321ff2f9f35fcdfb74af640e44b330ed6361452b2470ab4022045faae3e68db3d170f37514cd1

Download Submit
\Windows\Installer\MSICA20.tmp

Filesize
157KB

MD5
61dd20ce235e5dd15c99f20d52b1e7fc

SHA1
3608756a912f2936071aea63efaf6bb62e4bdb8b

SHA256
16d175bb058d95c8f622fb5eb46a1525d07251202c2521846c55be41cf3602c1

SHA512
6c08cf0b49e30c3a41163aaccd1bd16e05608938ec1c8dfd76fc6322ee6dec0d2e5108f983e47fa549faeeea51c22fe91e83603fd73308822f76cd5593274462

Download Submit
\Windows\Installer\MSICB1B.tmp

Filesize
157KB

MD5
61dd20ce235e5dd15c99f20d52b1e7fc

SHA1
3608756a912f2936071aea63efaf6bb62e4bdb8b

SHA256
16d175bb058d95c8f622fb5eb46a1525d07251202c2521846c55be41cf3602c1

SHA512
6c08cf0b49e30c3a41163aaccd1bd16e05608938ec1c8dfd76fc6322ee6dec0d2e5108f983e47fa549faeeea51c22fe91e83603fd73308822f76cd5593274462

Download Submit
\Windows\Installer\MSICBC8.tmp

Filesize
486KB

MD5
1566e699ee42eaa571700f3ad30b2dba

SHA1
d2b11f53310ad7118b6893c46ea815f9c7bf9ce2

SHA256
4bc5fc5cd0ae661b4ffe6ad9e12e55b233f471ba84f40cba7beb0cea8822e831

SHA512
52f8b86486bc22198cde10f91d4588a7a939580327e8ba03b254d5a2c915b039775afe696fe2014aaecf83ef514d3123c6ec68244b40603aa5d980f7e4c1ba1b

Download Submit
\Windows\Installer\MSICCF2.tmp

Filesize
486KB

MD5
1566e699ee42eaa571700f3ad30b2dba

SHA1
d2b11f53310ad7118b6893c46ea815f9c7bf9ce2

SHA256
4bc5fc5cd0ae661b4ffe6ad9e12e55b233f471ba84f40cba7beb0cea8822e831

SHA512
52f8b86486bc22198cde10f91d4588a7a939580327e8ba03b254d5a2c915b039775afe696fe2014aaecf83ef514d3123c6ec68244b40603aa5d980f7e4c1ba1b

Download Submit
\Windows\Installer\MSICD9E.tmp

Filesize
516KB

MD5
51a8dec0247b569e10042f1543fbdb32

SHA1
d27d410739a64b6df18c460e094fcec31810892c

SHA256
8eba0b040fb6dbb0f5dacbdfa9e2929cbaaab12865012ed7dda9ccdc09124a48

SHA512
0c414cf9dfee03732dd284e17446ce0203c0f0c96221a851ad3c9dabbb2db8da9f0c5c02b8a17c029d3446b551018e8fd0565febbb3fb3d2e28af0dea67ad539

Download Submit
\Windows\Installer\MSICEB9.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSID031.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSID13B.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
\Windows\Installer\MSID294.tmp

Filesize
142KB

MD5
857de6c3d57dbf9af4087e9f7fe45aae

SHA1
610a3bfb986904342654a567e285c6bef18d543b

SHA256
106771a66d9538e63adc5fa8ac704e2e79232874433cdb5ec6d4c9353a58c470

SHA512
700aec5ab66817e0dfb97c9f3d4f113f6e8b6f9257f142e33f014bf03a2c916d2f65b0800e8e6568f578269935daea6c877352681078855afff2489b404be702

Download Submit
\Windows\Installer\MSIDE5D.tmp

Filesize
811KB

MD5
cd3fb3fa45cb024072dda7b8c755b02a

SHA1
a8a63206a69f440ed5aed5801ec376e3a4b22446

SHA256
901939ba40a4ca39fa2d5f87cf5cc9e45ce40140ebd6bdc412a572a2b514e417

SHA512
ed1a0224fd4fe50d09211acb77b4d9cea75f64c3fd2d04ecce20bf1d0cda478c694c9cb094f92f5396f46c057fec5c695df254a54d001f6103de848e60a7ca20

Download Submit
memory/2204-161-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-154-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-128-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-127-0x00000000002E0000-0x0000000000717000-memory.dmp

Filesize
4.2MB

Download
memory/2204-120-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-256-0x00000000002E0000-0x0000000000717000-memory.dmp

Filesize
4.2MB

Download
memory/2204-184-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-135-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-185-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-183-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-182-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-181-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-180-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-179-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-178-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-177-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-176-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-175-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-174-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-173-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-172-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-171-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-170-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-169-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-168-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-167-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-166-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-125-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-165-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-164-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-163-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-162-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-126-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-160-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-159-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-158-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-157-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-156-0x00000000010E0000-0x00000000010E3000-memory.dmp

Filesize
12KB

Download
memory/2204-155-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-129-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-123-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-122-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-153-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-121-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-152-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-151-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-150-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-149-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-148-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-147-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-146-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-145-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-144-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-143-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-142-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-141-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-140-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-139-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-138-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-137-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-136-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-124-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-134-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-133-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-132-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-131-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download
memory/2204-130-0x0000000077540000-0x00000000776CE000-memory.dmp

Filesize
1.6MB

Download