Analysis
-
max time kernel
151s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
16-02-2023 00:34
Static task
static1
Behavioral task
behavioral1
Sample
Adobe Acrobat DC OCR Fix.exe
Resource
win7-20220812-en
windows7-x64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
Adobe Acrobat DC OCR Fix.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
Adobe Acrobat DC OCR Fix.exe
-
Size
109.7MB
-
MD5
36e21b27644c07b5e815c9eb2a819e6e
-
SHA1
e51a64704ca5862af9fb1c61f73bf9cb55dfaee4
-
SHA256
d79fa6a863bb63a7df878d66fcdbd17a31bd69f6d05190f9ffa7b0fb38b2799d
-
SHA512
cbc043aebf7ac712eb4f5da908d2e00eb67df4759f313329bea4276a5b092e5a40ce01989ded11427f7318883e0f9d34de371d9b206b21e5c3ed36ef5b89066d
-
SSDEEP
3145728:G4HZnnw/hW6RbeNV9Y1tncbdm+fxd57f/W:dZnw/MKu/Y1BcJ9xdZHW
Malware Config
Extracted
Family
redline
Botnet
TPB
C2
amrican-sport-live-stream.cc:4581
Attributes
-
auth_value
9af3f668d2aa93965a3f83753e8ccb3f
Signatures
-
Detect PureCrypter injector 1 IoCs
resource yara_rule behavioral1/memory/1224-109-0x0000000004D00000-0x0000000004F70000-memory.dmp family_purecrypter -
PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
pid Process 1700 PatchFix.exe 1624 MSI1D39.tmp 1752 Adobe Acrobat DC OCR Fix.exe 1224 WindowsServices.exe -
Loads dropped DLL 6 IoCs
pid Process 1764 MsiExec.exe 1884 MsiExec.exe 1884 MsiExec.exe 1884 MsiExec.exe 1884 MsiExec.exe 1968 RegAsm.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\S: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\K: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\M: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\W: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\Q: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\A: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\G: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\V: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\Y: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\N: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\O: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\T: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\U: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\B: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\H: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\J: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\X: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\Z: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\F: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\R: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: Adobe Acrobat DC OCR Fix.exe File opened (read-only) \??\Y: msiexec.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1700 set thread context of 1968 1700 PatchFix.exe 36 PID 1224 set thread context of 580 1224 WindowsServices.exe 44 -
Drops file in Program Files directory 36 IoCs
description ioc Process File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_font_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_same_proba.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_similar_characters_differentiation.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_same_proba.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_similar_characters_differentiation.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_features_fast.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_font_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_features_one_candidate.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_font_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_similar_characters_differentiation.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_similar_characters_differentiation.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_bigrams.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_features_one_candidate.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_same_proba.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_words.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_bigrams.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_features_one_candidate.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files (x86)\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix.exe msiexec.exe File created C:\Program Files (x86)\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix\Crack Fix.zip msiexec.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_bigrams.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_features_fast.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_font_features.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_features_fast.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_same_proba.bin Adobe Acrobat DC OCR Fix.exe File opened for modification C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\ Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\chinese_traditional_features_fast.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\japanese_bigrams.bin Adobe Acrobat DC OCR Fix.exe File created C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\PaperCapture\iDRS15\OCRResources\korean_features_one_candidate.bin Adobe Acrobat DC OCR Fix.exe -
Drops file in Windows directory 17 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\Installer\MSIF4FB.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1D39.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\6cf190.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIF393.tmp msiexec.exe File opened for modification C:\Windows\Installer\{FE78F420-B2B7-48E8-8554-166BB86484D5}\AdobeAcrobatDCOCRFix.exe msiexec.exe File created C:\Windows\Installer\6cf194.msi msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\6cf190.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIFF88.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\6cf192.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSIF894.tmp msiexec.exe File created C:\Windows\Installer\6cf192.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI37F.tmp msiexec.exe File created C:\Windows\Installer\{FE78F420-B2B7-48E8-8554-166BB86484D5}\AdobeAcrobatDCOCRFix.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies data under HKEY_USERS 46 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2D\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe -
Modifies registry class 24 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\ProductName = "Adobe Acrobat DC OCR Fix" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\ProductIcon = "C:\\Windows\\Installer\\{FE78F420-B2B7-48E8-8554-166BB86484D5}\\AdobeAcrobatDCOCRFix.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\SourceList\Media\1 = "Disk1;Disk1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\SourceList\Net msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\Adobe Acrobat DC OCR Fix\\Adobe Acrobat DC OCR Fix 1.0.0\\install\\" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\Assignment = "1" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\SourceList\PackageName = "Adobe Acrobat DC OCR Fix.msi" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\InstanceType = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CB7F35AD6166DBB4485DC755A3507584 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\024F87EF7B2B8E84584561B68B46485D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\024F87EF7B2B8E84584561B68B46485D\MainFeature msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\DeploymentFlags = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\CB7F35AD6166DBB4485DC755A3507584\024F87EF7B2B8E84584561B68B46485D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe Acrobat DC OCR Fix\\Adobe Acrobat DC OCR Fix 1.0.0\\install\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\SourceList\Media msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\PackageCode = "AC07C28362AF2B04ABA190BFD20B1093" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\024F87EF7B2B8E84584561B68B46485D\SourceList\Media\DiskPrompt = "[1]" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 888 msiexec.exe 888 msiexec.exe 1700 PatchFix.exe 1700 PatchFix.exe 1624 MSI1D39.tmp 580 InstallUtil.exe 580 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 888 msiexec.exe Token: SeTakeOwnershipPrivilege 888 msiexec.exe Token: SeSecurityPrivilege 888 msiexec.exe Token: SeCreateTokenPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeAssignPrimaryTokenPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeLockMemoryPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeIncreaseQuotaPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeMachineAccountPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeTcbPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSecurityPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeTakeOwnershipPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeLoadDriverPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSystemProfilePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSystemtimePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeProfSingleProcessPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeIncBasePriorityPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeCreatePagefilePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeCreatePermanentPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeBackupPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeRestorePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeShutdownPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeDebugPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeAuditPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSystemEnvironmentPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeChangeNotifyPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeRemoteShutdownPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeUndockPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSyncAgentPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeEnableDelegationPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeManageVolumePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeImpersonatePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeCreateGlobalPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeCreateTokenPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeAssignPrimaryTokenPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeLockMemoryPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeIncreaseQuotaPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeMachineAccountPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeTcbPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSecurityPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeTakeOwnershipPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeLoadDriverPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSystemProfilePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSystemtimePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeProfSingleProcessPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeIncBasePriorityPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeCreatePagefilePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeCreatePermanentPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeBackupPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeRestorePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeShutdownPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeDebugPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeAuditPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSystemEnvironmentPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeChangeNotifyPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeRemoteShutdownPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeUndockPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeSyncAgentPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeEnableDelegationPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeManageVolumePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeImpersonatePrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeCreateGlobalPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeCreateTokenPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeAssignPrimaryTokenPrivilege 1460 Adobe Acrobat DC OCR Fix.exe Token: SeLockMemoryPrivilege 1460 Adobe Acrobat DC OCR Fix.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1460 Adobe Acrobat DC OCR Fix.exe 1816 msiexec.exe 1816 msiexec.exe 1752 Adobe Acrobat DC OCR Fix.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 888 wrote to memory of 1764 888 msiexec.exe 27 PID 888 wrote to memory of 1764 888 msiexec.exe 27 PID 888 wrote to memory of 1764 888 msiexec.exe 27 PID 888 wrote to memory of 1764 888 msiexec.exe 27 PID 888 wrote to memory of 1764 888 msiexec.exe 27 PID 888 wrote to memory of 1764 888 msiexec.exe 27 PID 888 wrote to memory of 1764 888 msiexec.exe 27 PID 1460 wrote to memory of 1816 1460 Adobe Acrobat DC OCR Fix.exe 28 PID 1460 wrote to memory of 1816 1460 Adobe Acrobat DC OCR Fix.exe 28 PID 1460 wrote to memory of 1816 1460 Adobe Acrobat DC OCR Fix.exe 28 PID 1460 wrote to memory of 1816 1460 Adobe Acrobat DC OCR Fix.exe 28 PID 1460 wrote to memory of 1816 1460 Adobe Acrobat DC OCR Fix.exe 28 PID 1460 wrote to memory of 1816 1460 Adobe Acrobat DC OCR Fix.exe 28 PID 1460 wrote to memory of 1816 1460 Adobe Acrobat DC OCR Fix.exe 28 PID 888 wrote to memory of 1884 888 msiexec.exe 32 PID 888 wrote to memory of 1884 888 msiexec.exe 32 PID 888 wrote to memory of 1884 888 msiexec.exe 32 PID 888 wrote to memory of 1884 888 msiexec.exe 32 PID 888 wrote to memory of 1884 888 msiexec.exe 32 PID 888 wrote to memory of 1884 888 msiexec.exe 32 PID 888 wrote to memory of 1884 888 msiexec.exe 32 PID 888 wrote to memory of 1700 888 msiexec.exe 33 PID 888 wrote to memory of 1700 888 msiexec.exe 33 PID 888 wrote to memory of 1700 888 msiexec.exe 33 PID 888 wrote to memory of 1700 888 msiexec.exe 33 PID 888 wrote to memory of 1700 888 msiexec.exe 33 PID 888 wrote to memory of 1700 888 msiexec.exe 33 PID 888 wrote to memory of 1700 888 msiexec.exe 33 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 1700 wrote to memory of 1968 1700 PatchFix.exe 36 PID 888 wrote to memory of 1624 888 msiexec.exe 38 PID 888 wrote to memory of 1624 888 msiexec.exe 38 PID 888 wrote to memory of 1624 888 msiexec.exe 38 PID 888 wrote to memory of 1624 888 msiexec.exe 38 PID 888 wrote to memory of 1624 888 msiexec.exe 38 PID 888 wrote to memory of 1624 888 msiexec.exe 38 PID 888 wrote to memory of 1624 888 msiexec.exe 38 PID 1968 wrote to memory of 1224 1968 RegAsm.exe 43 PID 1968 wrote to memory of 1224 1968 RegAsm.exe 43 PID 1968 wrote to memory of 1224 1968 RegAsm.exe 43 PID 1968 wrote to memory of 1224 1968 RegAsm.exe 43 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44 PID 1224 wrote to memory of 580 1224 WindowsServices.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\Adobe Acrobat DC OCR Fix.exe"C:\Users\Admin\AppData\Local\Temp\Adobe Acrobat DC OCR Fix.exe"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix 1.0.0\install\Adobe Acrobat DC OCR Fix.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Adobe Acrobat DC OCR Fix.exe" SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1676504215 "2⤵
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:1816
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E9D09FAD8C0EDBDC1C008524F56F6D5E C2⤵
- Loads dropped DLL
PID:1764
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5129D93CF157156EB227C1F4B676B1712⤵
- Loads dropped DLL
PID:1884
-
-
C:\Users\Admin\AppData\Roaming\WindowsActiveServices\PatchFix.exe"C:\Users\Admin\AppData\Roaming\WindowsActiveServices\PatchFix.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe"C:\Users\Admin\AppData\Roaming\WindowsServices\WindowsServices.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe5⤵
- Suspicious behavior: EnumeratesProcesses
PID:580
-
-
-
-
-
C:\Windows\Installer\MSI1D39.tmp"C:\Windows\Installer\MSI1D39.tmp" "C:\Program Files (x86)\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1624
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:380
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000004A4" "000000000000049C"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:576
-
C:\Program Files (x86)\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix.exe"C:\Program Files (x86)\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:1752
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:672
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1ac1⤵PID:1100
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix.exe
Filesize78.9MB
MD5c79bd426892455c5940558ed35d1c31d
SHA1c20cc903f5448ed529fdc432f76f292bb129da3f
SHA25680b49468a65d7d697a82dfd8c1666c030b98b86d9b1ffe6e686dd44e2cb526ef
SHA512281adf9b580a75be96d01da9944d8984154ab5a3ce270173ce2ba4daec427374787f80e333a745d942c5eb8a0ae9d7682e36ab83558ac996bc178b82ee68321d
-
C:\Program Files (x86)\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix.exe
Filesize78.9MB
MD5c79bd426892455c5940558ed35d1c31d
SHA1c20cc903f5448ed529fdc432f76f292bb129da3f
SHA25680b49468a65d7d697a82dfd8c1666c030b98b86d9b1ffe6e686dd44e2cb526ef
SHA512281adf9b580a75be96d01da9944d8984154ab5a3ce270173ce2ba4daec427374787f80e333a745d942c5eb8a0ae9d7682e36ab83558ac996bc178b82ee68321d
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
C:\Users\Admin\AppData\Roaming\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix 1.0.0\install\Adobe Acrobat DC OCR Fix.msi
Filesize1.5MB
MD5ad90c85e5ffeb58971681af0b8f957e7
SHA15da0606d3bfee71dd6b715bdb5bb6f01390309f2
SHA25661230bdd7f8e5b5bb1238a4769c313195034e62041b39a35efec046a4911002e
SHA512efbc9e56424740297f80a2ffa285736bf37c65b1d8397afa8b6c294558a313e3a706de4448067e67bac12ebb30e19b2b0fbc60ea22868cdd278b43bdade915f4
-
C:\Users\Admin\AppData\Roaming\Adobe Acrobat DC OCR Fix\Adobe Acrobat DC OCR Fix 1.0.0\install\Adobe Acrobat DC OCR Fix1.cab
Filesize106.1MB
MD537e49cb56995f022efb42b4257c06226
SHA1db8c5e5cddea5d176f6d3449c3efb9682f7929ec
SHA2564393dd38e12e603822f948f3372e33231657170459470ab5a1eccd74b6ff8e0d
SHA5124f3847ad181597408e07c71b194a53a47911565e2ba50867ca4157ff00b74ec0dcc90b2b4a01956ed18420fc4513b310925ca601a7bd4906b4c023ee74198f49
-
Filesize
410KB
MD549fe4d0ff69682f4ed74f16cf6257cc6
SHA19b9780a98637bfd2938fde3a4e22c3d20602acb4
SHA2560a7dfe1887ddf815a120858594159c63ae7b218690c94ce30c32752c74398bb8
SHA512840b33b5e1d1277892b6b5cfb31aa6972a0d4518c3fa61ebd74678f5593d7a9de7c99fe3ac9d6df259bf532bd354620bd889290c826d058376824063b76b0bc1
-
Filesize
410KB
MD549fe4d0ff69682f4ed74f16cf6257cc6
SHA19b9780a98637bfd2938fde3a4e22c3d20602acb4
SHA2560a7dfe1887ddf815a120858594159c63ae7b218690c94ce30c32752c74398bb8
SHA512840b33b5e1d1277892b6b5cfb31aa6972a0d4518c3fa61ebd74678f5593d7a9de7c99fe3ac9d6df259bf532bd354620bd889290c826d058376824063b76b0bc1
-
Filesize
1.2MB
MD5b27e75867100b7f34b35cf147b7ce92e
SHA1e1b51e321d8a5595cc0382198a6ab34c98924194
SHA2567304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e
SHA512b71ba509772548d94d7a31685527f454ffc12380fa1537ef133140ece9f67d9070d21497b5694adbe405c528bb83266409053f754a437cde9caf361797318773
-
Filesize
1.2MB
MD5b27e75867100b7f34b35cf147b7ce92e
SHA1e1b51e321d8a5595cc0382198a6ab34c98924194
SHA2567304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e
SHA512b71ba509772548d94d7a31685527f454ffc12380fa1537ef133140ece9f67d9070d21497b5694adbe405c528bb83266409053f754a437cde9caf361797318773
-
Filesize
381KB
MD588a4962643af83785b80ea15fe74e860
SHA1d061c3d6cc1286626f76443591594580bac7c0c6
SHA256c8e5d349d9f6f3b5f20e5d5a0c5315c882d2afcedb21abe66cff00c1a57fd91e
SHA512015de66204dfff71f284ec0df58107e6a6ec20326cd75183a8aa49d7095184b85f78503a3a16e86d999b4720e0c2380d661395416b4be2e6346fc8488065a9c8
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
Filesize
567KB
MD55f1b243813a203c66ba735139d8ce0c7
SHA1c60a57668d348a61e4e2f12115afb9f9024162ba
SHA25652d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2
SHA512083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
Filesize
1.2MB
MD5b27e75867100b7f34b35cf147b7ce92e
SHA1e1b51e321d8a5595cc0382198a6ab34c98924194
SHA2567304e4710381b20058acc561ff7a36df7e2ce614e8d8e045452bbfaec9f1ab6e
SHA512b71ba509772548d94d7a31685527f454ffc12380fa1537ef133140ece9f67d9070d21497b5694adbe405c528bb83266409053f754a437cde9caf361797318773
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
Filesize
378KB
MD50981d5c068a9c33f4e8110f81ffbb92e
SHA1badb871adf6f24aba6923b9b21b211cea2aeca77
SHA256b3f5e10fb1b7352a6dbbcbb10ed605a8fda24f3f9c31f954835bd5a41eb6ea68
SHA51259cccdcde1964e61fa63078fde776eee91c462d7d3db308ada02e27e6ce584c41ad1f7970642e02ce331d805215a2cc868fb0512c01accfa70cda52e9329e1d8
-
Filesize
567KB
MD55f1b243813a203c66ba735139d8ce0c7
SHA1c60a57668d348a61e4e2f12115afb9f9024162ba
SHA25652d5b228221cd5276e4ee2a038e0ce0cf494d5af9c23ac45dcbfadc3115c8cb2
SHA512083c6d1af44847db4b6fb90349234128141a838d1d438d5c24f5063539a8087f0814d06cfa162aeace20e162292f64c7635b4a0e81b2ca972706cfbc484adfb5