lumma | hxxp://get[.]adobe[.]com/uk/reader/

Analysis

max time kernel
584s
max time network
603s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
11-05-2023 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://get.adobe.com/uk/reader/

Score

10^/10

lumma raccoon stealer upx

Malware Config

Extracted

Family

raccoon

rc4.plain

Signatures

Lumma Stealer
An infostealer written in C++ first seen in August 2022.
stealer lumma
Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
stealer raccoon
Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

271 180 msiexec.exe
Executes dropped EXE 3 IoCs

Processes:

readerdc64_uk_hi_cra_mdr_install.exeE9FA3F4F-FE44-4571-8409-A06879CFB783setup.exe

pid process

4896 readerdc64_uk_hi_cra_mdr_install.exe
1716 E9FA3F4F-FE44-4571-8409-A06879CFB783
2796 setup.exe

flow	pid	process
271	180	msiexec.exe

Loads dropped DLL 46 IoCs

Processes:

MsiExec.exeMsiExec.exeMsiExec.exe

pid	process
3240	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe

UPX packed file 12 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\readerdc64_uk_hi_cra_mdr_install.exe	upx
C:\Users\Admin\Downloads\readerdc64_uk_hi_cra_mdr_install.exe	upx
C:\Users\Admin\Downloads\readerdc64_uk_hi_cra_mdr_install.exe	upx
behavioral1/memory/4896-421-0x00000000004A0000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4896-504-0x00000000004A0000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4896-524-0x00000000004A0000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4896-534-0x00000000004A0000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4896-535-0x00000000004A0000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4896-551-0x00000000004A0000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4896-570-0x00000000004A0000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4896-585-0x00000000004A0000-0x000000000089C000-memory.dmp	upx
behavioral1/memory/4896-1164-0x00000000004A0000-0x000000000089C000-memory.dmp	upx

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe

Drops file in System32 directory 1 IoCs

Processes:

MsiExec.exe

description ioc process

File created C:\Windows\SysWOW64\Elevation.tmp MsiExec.exe

description	ioc	process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exeMsiExec.exeE9FA3F4F-FE44-4571-8409-A06879CFB783

description	ioc	process
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.ar_YE.txt	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.uk.txt	msiexec.exe
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_200_percent.pak	MsiExec.exe
File opened for modification	C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\abcpy.ini	E9FA3F4F-FE44-4571-8409-A06879CFB783
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\cryptocme.sig	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\form_responses.gif	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Resource\CMap\Identity-V	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.pt_PT_PREEURO.txt	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.de_CH.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\Comments.aapp	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\reviewers.gif	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\CPDF_Full.aapp	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\libcef.dll	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.es_BO.txt	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.es_VE.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Click on 'Change' to select default PDF handler.pdf	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\reflow.api	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.ar_AE.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libGLESv2.dll	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\DocSettings\Redaction\FRA\SearchRedactPatterns.xml	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\pi_brokers\32BitMAPIBroker.exe	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\adobepdf.xdc	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Sequences\ENU\Action06.sequ	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\review_email.gif	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.es_ES.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\Pages_R_RHP.aapp	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.ar_LY.txt	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_CA.txt	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.es_HN.txt	msiexec.exe
File opened for modification	C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\AcroPro.msi	E9FA3F4F-FE44-4571-8409-A06879CFB783
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Tracker\reviews_sent.gif	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Resource\Font\Pfm\SY______.PFM	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\Mappings\win\CP1251.TXT	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\icudt69.dll	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\rt3d.dll	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.pl_PL.txt	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.uk_UA.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\ENU\eula.ini	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RTC.der	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Resource\Font\ZX______.PFB	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\Edit_R_Full.aapp	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\ReadOutLoud.api	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.es_MX.txt	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.ko.txt	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\Core.cab	E9FA3F4F-FE44-4571-8409-A06879CFB783
File opened for modification	C:\Program Files\Adobe\Acrobat DC\Acrobat\Air\	msiexec.exe
File created	C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\AdobeHunspellPlugin.dll	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia\MPP\MCIMPP.mpp	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\v8_context_snapshot.bin	MsiExec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Resource\TypeSupport\Unicode\Mappings\Adobe\zdingbat.txt	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\JP2KLib.dll	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\Javascripts\JSByteCodeWin.bin	msiexec.exe
File created	C:\Program Files\Adobe\Acrobat DC\Acrobat\RdrApp\ENU\Combine_R_RHP.aapp	msiexec.exe

Drops file in Windows directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ar_jo.t	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ca_es_p	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.sv.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\adobeafp.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\collectsignatures.aapp123	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\aide.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\bib.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_FormsDocument.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.hu_hu.t	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.pt_pt.t	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\adobexmp.dll1	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\msvcp140_2.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\ConvertPDF_RHP.aapp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\CRWindowsClientService.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Edit_R_Menu.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\nppdf32.dll_Apollo	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\_32bitmapibroker.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Developer_R_RHP.aapp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.es_do.t	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ru.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\concrt140.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\manifest.json	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\RichMedia_R_RHP.aapp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.hu.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\collectsignatures.aapp123	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\cooltype.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\F_CENTRAL_mfcm120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\vcruntime140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Edit_R_RHP.aapp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\ReadOutLoud.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\ReadOutLoud.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.es__tra	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.sk_sk.t	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI40BA.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\F_CENTRAL_msvcr120_x64.05F0B5F5_44A8_3793_976B_A4F17AECF92C	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\acrotextextractor.exe	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\F_CENTRAL_msvcp120_x86.194841A2_D0F2_3B96_9F71_05BA91BEA0FA	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\msvcp140_1.dll.DFEFC2FE_EEE6_424C_841B_D4E66F0C84A3	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\msvcp140_2.dll.F1670FCA_6780_3657_9C04_AF8005AC8143	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\LICENSE.txt5	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.nn_no.t	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI69D9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID75D.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.hu_hu.t	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_XMLFormsDocument.ico	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ar_ma.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.es_pr.t	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\CoreTechScCore.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ca.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.es_es_p	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_FormsDocument.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE52.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\_4bitmapibroker.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\msvcp140.dll.CC943011_A332_3C6E_AE5A_D28E3EC152B8	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\_32bitmapibroker.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Protect_R_RHP.aapp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Annots.api	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\Checkers.api	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ar_iq.t	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI40EA.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\AXE8SharedExpat.dll	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_SC_Acrobat_Standard.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ar_jo.t	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133282946012414387"	chrome.exe

Modifies registry class 64 IoCs

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.secstore\Acrobat.SecStore	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Version	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroPDF.PDF.1\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.secstore	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\ = "Adobe PDF Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.aaui\ = "Acrobat.aaui"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\Content Type = "application/vnd.adobe.pdx"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.RMFFile\shell\Open\ = "Open with Adobe Acrobat"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.XDPDoc\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Control	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74A13FDD-9BCF-4229-9CAB-0079A5E17A25}\Programmable\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroPDF.PDF\CLSID\ = "{CA8A9780-280D-11CF-A24D-444553540000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\InprocServer32\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\AcroPDFImpl.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.XDPDoc\shell\Open\command\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.XDPDoc\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-1033-1033-7760-BC15014EA700}\\_XDPFileType.ico,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.acrobat.aaui+xml\Extension = ".aaui"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E790E1D1-9DE8-4853-8AC6-933D4FD9C927}\ = "_IAcroAXDocShimEvents"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcrobatBPDXFileType\shell\Open\ = "Open with Adobe Acrobat"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.fcdt\Content Type = "application/vnd.adobe.formscentral.fcdt"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.aaui\ = "Acrobat User Interface"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ProxyStubClsid32\ = "{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.aaui\Content Type = "application/vnd.adobe.acrobat.aaui+xml"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.XFDFDoc\ = "Adobe Acrobat Forms Document"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\Interface	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroPDF.PDF.1\ = "Adobe PDF Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0\HELPDIR\ = "C:\\Program Files\\Common Files\\Adobe\\Acrobat\\ActiveX\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.aaui\shell\Open\command\ = "\"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\Acrobat.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.FDFDoc\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcrobatPDXFileType\ = "Adobe Acrobat Catalog Index"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroPDF.PDF	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\1.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Control\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.fdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{05BFD3F1-6319-4F30-B752-C7A22889BCC4}\	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E790E1D1-9DE8-4853-8AC6-933D4FD9C927}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xfdf\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.FDFDoc\shell\Open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcrobatPDXFileType\shell\Open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Acrobat.RMFFile\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-1033-1033-7760-BC15014EA700}\\_RightsManagementFile.ico,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AcroPDF.DLL\AppID = "{BBAA0E44-3862-490C-8E63-AC2D2D6EF733}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcrobatPDXFileType\shell\Open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\Version\ = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.secstore\ = "Acrobat.SecStore"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.sequ\ = "Acrobat.Sequence"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AppID\AcroPDF.DLL	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0B4F6AD-5E09-4CB1-B763-EC390CBDE51D}\Programmable\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aaui	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcrobatBPDXFileType\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcrobatBPDXFileType\shell\Open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xdp\ = "Acrobat.XDPDoc"	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

readerdc64_uk_hi_cra_mdr_install.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_uk_hi_cra_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_uk_hi_cra_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_uk_hi_cra_mdr_install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	readerdc64_uk_hi_cra_mdr_install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	readerdc64_uk_hi_cra_mdr_install.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

chrome.exechrome.exereaderdc64_uk_hi_cra_mdr_install.exeMsiExec.exeMsiExec.exe

pid	process
3476	chrome.exe
3476	chrome.exe
400	chrome.exe
400	chrome.exe
4896	readerdc64_uk_hi_cra_mdr_install.exe
4896	readerdc64_uk_hi_cra_mdr_install.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
764	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe
232	MsiExec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

Processes:

chrome.exe

pid process

3476 chrome.exe
3476 chrome.exe
3476 chrome.exe
3476 chrome.exe
3476 chrome.exe
3476 chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe
Token: SeShutdownPrivilege	3476	chrome.exe
Token: SeCreatePagefilePrivilege	3476	chrome.exe

Suspicious use of FindShellTrayWindow 50 IoCs

Processes:

chrome.exe

pid	process
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

Processes:

chrome.exe

pid	process
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe
3476	chrome.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

readerdc64_uk_hi_cra_mdr_install.exeE9FA3F4F-FE44-4571-8409-A06879CFB783setup.exe

pid	process
4896	readerdc64_uk_hi_cra_mdr_install.exe
4896	readerdc64_uk_hi_cra_mdr_install.exe
4896	readerdc64_uk_hi_cra_mdr_install.exe
4896	readerdc64_uk_hi_cra_mdr_install.exe
1716	E9FA3F4F-FE44-4571-8409-A06879CFB783
2796	setup.exe
2796	setup.exe
2796	setup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3476 wrote to memory of 1520	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 1520	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 2416	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 3580	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 3580	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe
PID 3476 wrote to memory of 748	3476	chrome.exe	chrome.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://get.adobe.com/uk/reader/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89b539758,0x7ff89b539768,0x7ff89b539778
2⤵
PID:1520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:2
2⤵
PID:2416

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:3580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:748

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:1
2⤵
PID:5012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:1
2⤵
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4460 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:1
2⤵
PID:1908

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4960 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:1
2⤵
PID:1168

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4896 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:1
2⤵
PID:572

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5256 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:1
2⤵
PID:4120

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:2464

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:3268

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:2920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5248 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:4580

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5476 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:3044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:2056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=908 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:3184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5592 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:1604

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:2124

C:\Users\Admin\Downloads\readerdc64_uk_hi_cra_mdr_install.exe
"C:\Users\Admin\Downloads\readerdc64_uk_hi_cra_mdr_install.exe"
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4896

C:\Users\Admin\AppData\Local\Adobe\EBF4965C-1281-4A00-BD58-764524C1A6DC\B41A2E0C-6A88-48AD-B03A-373B81CF09FB\E9FA3F4F-FE44-4571-8409-A06879CFB783
"C:\Users\Admin\AppData\Local\Adobe\EBF4965C-1281-4A00-BD58-764524C1A6DC\B41A2E0C-6A88-48AD-B03A-373B81CF09FB\E9FA3F4F-FE44-4571-8409-A06879CFB783" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES ENABLE_CHROMEEXT=1
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe
"C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe" /sAll /re /msi PRODUCT_SOURCE=ACDC OWNERSHIP_STATE=1 UPDATE_MODE=3 EULA_ACCEPT=YES ENABLE_CHROMEEXT=1 DISABLE_CACHE=1
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5136 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4932 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:2148

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5596 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:4684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5832 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:2264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5812 --field-trial-handle=1832,i,15135218782127537577,16539861157410569820,131072 /prefetch:8
2⤵
PID:2212

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3308

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:180

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding 24CBCE7324C68BFA9453BB8BB0D88F28
2⤵
- Loads dropped DLL
PID:3240

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 09307DD77F0A56DF5B4F7E2674B57600
2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:764

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 994340D314E9A38959F0E1D007445FF3 E Global\MSI0000
2⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:232

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\PF6B52.tmp
Filesize
943B

MD5
2c240ac80c9154b2e5da000f315655c0

SHA1
3feebc66d8da0f893742c4827f1cd28da186cf07

SHA256
c396d5624ef40e46c41f177d3428349b99677233c7a22effd66bf4f9b578da86

SHA512
8633ccdf81b2a35b5f60bd5b81e8b802dbf1fa96f0043b7c4d4974eb7c195f5a508d9eb4a73ca057ca45465915e5b9dc28c649f6816805b04d4814e9eaf5ba6f

Download Submit
C:\Config.Msi\PF7399.tmp
Filesize
929B

MD5
2b13dcc28d4914730afa1cf8671fb4e6

SHA1
f388e83082b8efdd0453beedec27f40e9b15548a

SHA256
a72f480ae16340f81c962db19434cdb94cd65d83f9df5942c86599ee857ad960

SHA512
700f24aadacc9fc6a530a5a0b80dcdd62b8867404c2f7e1130e179003391fe0bb1fed9e63e1af71f20b2f7b3ff4bc2cc83dd83f1925649bb24cb1a922d1cf95d

Download Submit
C:\Config.Msi\PF791F.tmp
Filesize
947B

MD5
0d05ba4b7894cc4d8c9de43c99a48c2f

SHA1
0a421cf4ddd54f8fb50171d5ade42fc4208eb9a2

SHA256
b105974347955b85cb586d043cc1e30cb17cfec2f55e974b721164e247f32854

SHA512
2147afbca28100ca8249f4f6c48ba61221dd0e15845533ca16d4fb2c34e136b83b9169b29eed6714935e8e4f05cd8663b2ccc9878de19333fd4ba6c9427bbb5e

Download Submit
C:\Config.Msi\PF7CED.tmp
Filesize
951B

MD5
c8e5c1394732fe5525e45d9b35be6f0a

SHA1
741690a318583947fc8f517dcc9df1f160c3dc6f

SHA256
5d52573c1545f007b2aeef6941bff41f3683dd1c2130381cc2c04cfc9992c2ab

SHA512
f8cef3263137744b4df6abc977cf2b69f52ed709a4d7090878afb1f9f4b5cbc66aeb86bd7e7ed8c1190bb9b51d3a354373fa82f393d88029f79bcbbb60ce61fd

Download Submit
C:\Config.Msi\PF898F.tmp
Filesize
947B

MD5
d530a78af2deab9340d6fbfb0543fdb9

SHA1
f53b642eed8a7c1f00c72338e152caa2fd0e71f1

SHA256
1604170d05fa20ce0e2ce10daa51970ef45b3a9e70f9ac4a83e80cd5dea0a80d

SHA512
777d526250eb4cd6abebbdd891fe8ed131b676559838c21563502d4e8a6bb7aa39a2024fa3a7cd9d22bbc2a6b25b9f0ebc4ca0afea293e9828684ddfa691eb74

Download Submit
C:\Config.Msi\PTE1FF.tmp
Filesize
869B

MD5
7b31ba0ade0541129f9be22f49ad6dde

SHA1
9aaadf930511053cb9f27db845af580faebe2cbf

SHA256
84500d1fcf6be83e0a54290522871c6338b5699e5883b11d257746abae339f8d

SHA512
ad8bc00e9f8ae4bd3c6a8d23771d9e1194d02477828c40c314f2b5245a6e15f33954d5059af3d5804937b5ccdd0c2af6c15258bf328eb485077af3dc3f3f1603

Download Submit
C:\Config.Msi\PTE3A9.tmp
Filesize
64KB

MD5
15dc5d61a2dd6c5df9fd8fefeaa0f609

SHA1
fe54e7a1bfcb6d2bc583cc22cb9207738643aad4

SHA256
715cc6ce7a91faf7148f18bc946c035a27f7b668598370cbe8dd3e355bcd8bf9

SHA512
adb9d2e723587dd8e4b5154620ff9455b39ae9fcba4a378fd4e6a26b206c3568d6583dde52194969a64eb1fb9802fa74f157c0f016637871b1ff9ca1df3a3279

Download Submit
C:\Config.Msi\PTE3BA.tmp
Filesize
197KB

MD5
1870a1dbdb41a376e369cea64133c1a0

SHA1
016f0609e87cc398d1650065329c924198d882e9

SHA256
3adc615291ca60780875f0374a56ae5023f1ba7483d1cc9e2730e1f40a394587

SHA512
4e8da56cb7909b67ae670f90f3757fb0417cd607a4831a7bf88de0979f105a25938b8eb76fbc9eb119ade25e3489481511c8c22b0326c9f53e68d352d4301488

Download Submit
C:\Config.Msi\PTE43A.tmp
Filesize
328KB

MD5
08625d4ef605cb8b5ac0a3aae59c613f

SHA1
5b32c30662dbd9df397675c2b0c4a8a6293fcb94

SHA256
f072aab8101de0b8668f0d33368d232be2e13044b17dc3fe4d5936782b01b805

SHA512
990faa900ba1c084a0d0bd4694ef1e17a56d9cfd124311ffdbf92e2b5a5541ad1dd8db3539348dd633ce58d322b262cecb4c4ea786a02b1b76fb6abb4fd39ba2

Download Submit
C:\Config.Msi\PTE46B.tmp
Filesize
17.0MB

MD5
2b1ab5e6d57a2c6734f33b03206c5a34

SHA1
e0bfd570418c6ffaa8aca7f34a692ece04183ba3

SHA256
6d3a35e6c21678da13d88a49a03c337f254558804ce96d6282e86fb0509019f8

SHA512
d79d056f31f722913c7b7edd88875ba5ace7e61784da60476517e2e4049497c28fbebbcd0c153b11c81e089d23242a38c77c757fa0bbfe406c706735449d4fe2

Download Submit
C:\Config.Msi\PTE50D.tmp
Filesize
630B

MD5
e88416d37a63a283f9f23b1eae771391

SHA1
75c44d876e25ed5c37f9603b948da7a843f19222

SHA256
d8e44375c9bec310ad35f6ecf93ddb6b9fcf8678d2ca2a330812b6930c3e3483

SHA512
39383f3642fa1b56c768a91a2bdc8897993401198d2b4717aab2d350992366cc7255db7c532c9797bf1b0f28d73b665f9fc06fbf0a6b8bad639669a96c3be61a

Download Submit
C:\Config.Msi\PTE54D.tmp
Filesize
368KB

MD5
e7fc3a1789f644c8450eef87e249b74f

SHA1
236a44c9b193c3398baa3a0c2fa8c492cf63d5f2

SHA256
97c6a4574904d985b307918c8b3e05bfa038d46db3f561252ab9b996b7058f9d

SHA512
52a2a5199bda25f58889fd95152ddba63f42f78fc17c7277ce5f170fd43adad3c697947329481ede361342630053df8f63997933e377098877999196c0111a82

Download Submit
C:\Config.Msi\PTE5BE.tmp
Filesize
6.7MB

MD5
c28707d7edc03e61cc820bd30d54f7f1

SHA1
25d40b4698bef9b6793863514396ca10db68d581

SHA256
e2efa622cb8d9d87ab39df8d6d148ab8391474aaca48903548d3a8f3e985d843

SHA512
6b506aebefdf03a00b9e55a9a3ce269e32195282e6d85da8e96f205cf052d84bdead195eaa0ca9d1c169737ec0fc1a20c38f775e55dbbca842cf8bc040181983

Download Submit
C:\Config.Msi\PTE60E.tmp
Filesize
568KB

MD5
870334bfd6dbcc609c662338c06d0660

SHA1
6ac0043efd31d45f31497fb56556c66ca5005b1b

SHA256
5eb082a7dd262fea063a669c4f8fa1c8ff6dc6edaaf8b73b4b18c7b31d0ec64e

SHA512
982b652ec9308187e864325de9b8f6182a5fa1a921b726a84d9fde51baae02b43b9aaa3b4680791e8d70d16e81aaca61dd5d6fd5d69ef8c8fdec060b2fcb5e07

Download Submit
C:\Config.Msi\PTE61F.tmp
Filesize
45KB

MD5
25f10a4c71271cade87f71a816145c43

SHA1
b2f18e287b76700b833a534863fb88736be7e96b

SHA256
591262c3404a26013bc158e5f5d5ff5a8d91cb53c12b6e2db4bdcf53b24a0001

SHA512
84775216f2050c7a1e289e06a8b2d99894f3dbc0a9d87a4d65a2fcd585b501eb42869dd67e8deff2c57428127c38eb47032df944ffa373b2310032b90c2742f1

Download Submit
C:\Config.Msi\PTE62F.tmp
Filesize
99KB

MD5
98e7ae2426d8969c67c60c0a90879ae1

SHA1
407875bfd8cea44c75e523900771fca312feb9b3

SHA256
7c56350232821a53203d21ef26a1882b636fb48938b09855767f04709dbe9168

SHA512
64f372165b479e2e25b0129f1b04f8ddd1eb2bc54fe35981a0af84263e1cde8b14975323f539b51d36a8c926b30956bebe9b9a0081b39d3676ef5627fe34fa76

Download Submit
C:\Config.Msi\PTE713.tmp
Filesize
118KB

MD5
085e03a7f6d8d8e1dd2bf960a5a83813

SHA1
92ea87508bafdac423cc5b8535d880ba306cf604

SHA256
877aad74f9a154b6118c5595a561eb58cda8eb900b6b2152c60a8ee6e725ecca

SHA512
5d294a607f089cad692370551042c28f1d7dbbb15e310f5790c13b08ddbc3796b74a9f8b8b5c248842ca584b5656d45e60420b65411f1acd7bb0a36f8207dd25

Download Submit
C:\Config.Msi\PTE724.tmp
Filesize
8.5MB

MD5
f4456f9a03cded42798d5d3e637cbf1d

SHA1
f5431c6eb3a9a0055ad3aee1a52a2be071416cf7

SHA256
51bfa4c950eef13eaf5fd8b05a67cb1a5bb90a6c2fb0dcdc892bc7dc22e0dc81

SHA512
d0078c188fbbd453af88893ce75461540e8751655610d3ae2270de2d02a2b415a72e5b935ed4932559736b5ce9bada2048eda4a0317e6063ae9a16ffbde1e273

Download Submit
C:\Config.Msi\PTE792.tmp
Filesize
315B

MD5
8a459a331fdfee70b76f0f7a8c1549f1

SHA1
e4985ffc52a99ef7003af3719962cf62c0b57c42

SHA256
a26773a23c32bbd14be54104f836798a150cf0df852bd006d4ea9746ca8df364

SHA512
56013ca6c3610e5acf082e008fd185bd6974be30df1f380a56c98a842c64a364ed2fbbe6f21089f9d55ab545859764d10b88be23c11714bac306d34c55cfc94b

Download Submit
C:\Config.Msi\PTE894.tmp
Filesize
689B

MD5
473562347aadb28d9cf5157ad2f5d92d

SHA1
d758383dedc5b243b28bc9d70d488990e5df3d7f

SHA256
b6b18d96150c917905f63259c493bbc8234e8c0fb1b5c938696e9ff42aa20ddf

SHA512
241dc9064b490b69505e398209a1ce6814ba5e504923b03d1495e055c7c67f377102c89131c97b1f2bd6a606e715bfd10d0ded0bccc7c3b1b9e939791f66db6b

Download Submit
C:\Config.Msi\PTE8B4.tmp
Filesize
1.0MB

MD5
e85d337ad95308c9b40adcb5ae971d15

SHA1
adadf48e23e7d44b02f89ac19c7fa3f5bc9f5baa

SHA256
da1303e92be4ded59007c0f1ca60d76ed8d8cde45abf2cc7d5604945d8e3074e

SHA512
007254a37fcf15bb547e8cd363f631ee3652c462bbaa67d227680801c829906550b34fb70cf8232c28910c061a58cac28950f3c3680ef80cc1e324ec72bd5fb3

Download Submit
C:\Config.Msi\PTE8F5.tmp
Filesize
517B

MD5
6321d4c5b651769af6f3f0799f3e7eb0

SHA1
7444212656558ce3159c112c9a37d1ce2a7157f9

SHA256
4f427c72f61af824fb5032a5af8e635db069b4be9c5b7292320b2d594c74c1ce

SHA512
55df9ff7946809808b44d89a4a3738aed30d9d79cc63e2b2d82a22bf28a1a26182acf962703acfcdad108211153e8ee40e5a3e5ab0b86a7d1d81fcaa36a4a952

Download Submit
C:\Config.Msi\PTE905.tmp
Filesize
465B

MD5
7f5efabe8cd81c9412e91568cce7e1a4

SHA1
4b808d0a7b2b5ef154228eaa46b79397db080312

SHA256
59af66bb74bf0a21917ea0267e83ec6072555fafae41a60df06795567026e906

SHA512
4b1886d20d980d9d0e211f61afb3d28d7d493c4a5f37f8b3d45b3808dc44746813f28a04a2926581812b83d2b2eac63e354185dc2f41c65b30f9fd51a43aaeb3

Download Submit
C:\Config.Msi\PTE917.tmp
Filesize
19KB

MD5
09e1544daf46150a8ce9d0adb8de35a3

SHA1
0de466af903e82acb9ac278a926097b27f044bd5

SHA256
5bcbbeea1bea963145e5713bc12ccfe15c7371c242c2117377c5120b3dec0d6b

SHA512
0a5bf79d582c6171937ab76d0503774db636e84a18c72fbcf5182a8919681cf2d0a486c8a604f716765112a10ea972f2e52ff6691eb556ea5820aa4d30a17794

Download Submit
C:\Config.Msi\PTE937.tmp
Filesize
489B

MD5
6c9395ac33fc713992141ef9b19b24fc

SHA1
934260171f3657ea945fae2af19fc8ed241bf494

SHA256
e3b268381bc8a9b845892de0273794dda8fd661696a72e81d2dbf8e54019dbf8

SHA512
d9fefa92215befa964e3455d737c3996af0b1b2bf756e17bf395703d81f833ecb9ef3530539d4747f50c6b5cfc491f892b94904e52b1e2d6bd093ff5853e961f

Download Submit
C:\Config.Msi\PTE957.tmp
Filesize
3KB

MD5
52c6ad3c6e16e4655e2950faa0852d71

SHA1
0ee716c233cc980e46ad2da9701634f8b5f01aeb

SHA256
5bea6d27d714b2b6c8732d312372778eacd7720aa978eaeaa60da63615c88fa2

SHA512
f1d6db9a125c0f5aab06bd868760cf73d6553a476f5883fb7b9504062e8ddb8ac2349bd54b2d9545edaa71fb93e0deefc8b04132ed215de9b70f6e53ee8872e9

Download Submit
C:\Config.Msi\PTE968.tmp
Filesize
443B

MD5
e5cd267e2b4e75b5c36aad94a2f74b98

SHA1
61d0844c75c9a285a21178c56ade4385c9ee48f8

SHA256
93233ec25a0ff05b0fdba51570e9ceb54fbb1c0ec35ce2cc66028a4eb366efd1

SHA512
836f852afe0e77f4277bf730effadbcb1ed8d8a8ba5d071738d6c11d041e884b51cf0e3a1dea2355077afb7bd6e6898dfe1fa54446a11f38e01a0dca721969d7

Download Submit
C:\Config.Msi\PTE9A9.tmp
Filesize
662KB

MD5
9bfe241cca23aa979d3f6c1ab1692ccd

SHA1
8d224a056952c1d3700f031a86c68ac6926263f2

SHA256
c2f2f6c49ef1124cbbebe040b189294620df9f2a247cb7e4f517c4661be32dd5

SHA512
ff43c8d79dddbbb66161b44a8200204eaf955f3b8465ece269946d5b24e18e3a0fc3c7b8631b000fb073722874c580a65e7c36572cf18e32cfa429adb86ffd64

Download Submit
C:\Config.Msi\PTEA17.tmp
Filesize
647KB

MD5
dfa021dfe7db92a4c2fb4f49628bbbae

SHA1
0a84af2630af7cbef7b50ed4616d511d8a5f2200

SHA256
efd9905a24dc67ee186bbe8f336314d31c23d6474bcaa6b395ffdae4b56e12d4

SHA512
ca0387888784a84fb25363db51bd414b66aab48e0f80f25906ebff9d3c700f3decdd6d7e3004fc209d7968cfdb6caa3b16b29e53459bd71a6a414230b84d6bff

Download Submit
C:\Config.Msi\PTEA66.tmp
Filesize
369B

MD5
ddbe640bbf49a96fb52ad91d518497bc

SHA1
a05f63a1869b190f5f8e0592b4c5f0426ba4b5bf

SHA256
89ba2e28024f8db5f74e0fbece1ef10a67e704bff853d82617bd99d4b3a4479c

SHA512
d4b1ce1e94f3927d55e4c993d3caafed0713ceb5d143ce5c793e3ef4fe5b574e8efc4e696e65fa13cf5dde2b4c1cc52be7cd249154c8fb65fe728ad87200d298

Download Submit
C:\Config.Msi\PTEA96.tmp
Filesize
382B

MD5
f8b4bb2e73e8206663b55d6c856802eb

SHA1
d430425305af9709ed3756c95a4a83e79fc65da3

SHA256
993e01576ffe40d51760a8cefab11e98c3601dc5c11c4549d5210056486ff811

SHA512
aff531a74414997ed4df65a977f3e009cf1e3a93e396ee6e3d2a83297c21a2cf81b2bfbbcdb060abaed99876d5103eff110a0777aa2e5f3e307bf2af5fa1061d

Download Submit
C:\Config.Msi\PTEAB7.tmp
Filesize
325B

MD5
3dc284ce0749e99f6c82664743cc4e57

SHA1
e4872895e2cf013069f9a062851aabf7be7e0ed4

SHA256
921e6913075091ed201442c26407e5336cb481d9b856ec9b244ecd1ca6a9f261

SHA512
1b11e1a636accb9a0354b7d5ab4574dc0fb23f71a1b49acaa33304e354e7d3328805c43715d44ac746f0d9439371898dafd716bcb90aaa4e1f66ce441bdce4c9

Download Submit
C:\Config.Msi\PTEB08.tmp
Filesize
501KB

MD5
8d7a16054d5cce7de6e4a7535299bc10

SHA1
7bec4480f1b251ba917f91fd113b2ff6fe92c6d6

SHA256
ab27abfb7ff2ee6eeda0608f6adbed2740c746a5e8af8fb9c46b96d2c1565870

SHA512
044c0c54ba64d7f4f84398efc7890d37a1e01ffe42aee2bf4546b65892ec337f8db0ec1daf75496ec93b20f21ea37a12d00b93df386c5e2b86e02b4215686ac8

Download Submit
C:\Config.Msi\PTEB19.tmp
Filesize
634B

MD5
2fa62bef71420bda7a6c26da813175d1

SHA1
c342100e18d88715ef30489300a6b5193819c87c

SHA256
eee74addef22ec774abe998c08330c90948e94e88136f49089bb03e9724a56a9

SHA512
c140c808dc17dbdc056b12b6cba053792d606354e0b6d6ab1e997ed6c08b1eb6e0b7dfe713a6414af3d9bbffbad28a8f6327f937fb324dc7b8da60c9772fb8c5

Download Submit
C:\Config.Msi\PTEB1A.tmp
Filesize
1.5MB

MD5
60bdaa5fa4d6dd69879bdfc7e7b319bd

SHA1
0c3b83425d53f3c072dc6a02839d02349609bad9

SHA256
f7c85bbc88c56cc2caccac6fe231e2ff8c8a7dececc8f1d70646214bf12b93a2

SHA512
a8f0051401abf724a07103c22b2e6ccb3dc53da0e33d21aa741df2e0f51c9bb3e52e46382e3eebb878053509af977485ef25f5f29305c9cc864b7fa40545f058

Download Submit
C:\Config.Msi\PTEB6E.tmp
Filesize
31KB

MD5
cdfdf21442b77e6e9e44687f0fedbb87

SHA1
038bead480a597f4d2cfa9a2d579302df7b9ba2d

SHA256
21d404cbc37d05f93909983a5406839bfc7203796880aff555313bfe55c05808

SHA512
3762bcf600cfd6d2d3e6b74509feccb5fbc4e5fc39334bab07e25421e7af27fc7989537aa1b47120e83f4d56d5da5815fa901967f9c5d026aab41118c9b96e18

Download Submit
C:\Config.Msi\PTED26.tmp
Filesize
32KB

MD5
e8db77056b069f83f4b7043d4858e1d1

SHA1
50960d34571b7bc3cde0aa1742412d0b14fb7b06

SHA256
d9ac5891a2c6edf3671823062dcfd7dffe02820832818de775385074cb901991

SHA512
8ca8f889bf62a9ec93dc9e936fda40e11b67620dc8827ecf88e297b362924f9bea0349cb7a298dda854a39908a32163653a5aee84587e1b8f2aa2056e28559ce

Download Submit
C:\Config.Msi\PTED6A.tmp
Filesize
32KB

MD5
d1ec8e2b6dfd588955ffe0ea56cda752

SHA1
03c9012b5b615e786f2b7af16fa8f58e024bf507

SHA256
9388509b0214d6e9ffeac311137f1e5b69ba5b259e79207cb1d70f2453dc9f57

SHA512
57c0e8668bb94302b17de95d190739be4eb244a50e9666ee96cdc37e880c33253c0613d2db6fabd17b98a608786b34a3fc987abb098c770f550a2b97fb9a47f0

Download Submit
C:\Config.Msi\PTEF02.tmp
Filesize
32KB

MD5
43a853ce7954adfa3692301f52ea65b9

SHA1
afd15b43c1a3b5afd59470cd588e9fd1c5dcee8d

SHA256
8a3df7c4a8eb4fc97a9df0c66db2802c853c9505f6704814375a534e2efde7d8

SHA512
dbacbbb4335d52f7e531e0dfd6c91e5b44f04807f30d57f2e989b640f8186f04f557795f50fa5ba8133e7bfaa04c1ea8e82e33be3b44af47e718bf850a141ca4

Download Submit
C:\Config.Msi\PTF00F.tmp
Filesize
32KB

MD5
424fd63c7f124c19cf306422dab905d6

SHA1
16c8c4b6c36ce3f502c58205c48c947c2d60e743

SHA256
e7a3207d33f5c5bfc7541da1513a6fb03a0d133268607879494483b36505046a

SHA512
178373c79389b0653c6ece89d450a968dfce4ca59d8af8fdd65a016d19b5f9baf77f86ec8f2eadf2580887f15ab3a455d63c24d4557f9256c6bf42ee1038b05b

Download Submit
C:\Config.Msi\PTF051.tmp
Filesize
32KB

MD5
7899dd563d3e7a2907c0a2e3df529dd7

SHA1
88e17a6780522dafb0289ff990a8f0cc7dea0198

SHA256
0421520e004d623a35afb103c50a26f12de452ff456ca971ba5c5915888b977a

SHA512
f3ab84aabeeab61c271605ed1356e0fc188ca6960a3ce71e9a92efb84d7024867c6689f24e107fa55603dcda2e32a8975288e908252fb72968003d6ba64e5870

Download Submit
C:\Config.Msi\PTF12F.tmp
Filesize
28KB

MD5
e7136f15c30a0e4e25a79a1a550bb6f7

SHA1
a036e267f59d312c969f709fca1a13f00151d303

SHA256
ce2b07dab68f9284e554b7e9ce3f0ee240764ebd29b23a89097c1b2ea9f8dd8f

SHA512
2e01ad8603c89cd40819e209677e6c93e00a957e31aea13dd36bede26366a872fc80249fc45b527332f196b44c1071e87702ee596b5e323a1970b35f1b0fdba2

Download Submit
C:\Config.Msi\PTF162.tmp
Filesize
175KB

MD5
60feb51b897571afae62e64d8f469102

SHA1
bee0492e554acc8b57c366fd98779a21051104c1

SHA256
d3ec51b03196531c973f681b1c6b8a57990f0fd9bfd3013cac68acc4dba1d86e

SHA512
d1fca7a59803a45260b2e2bf4f45d205b44b01179cd8a19a888eb3fc759035708967ad1df49c56ed606feb5ffb648b6cffe23f2b6e87257fd9d0e54ee4e3522e

Download Submit
C:\Config.Msi\PTF183.tmp
Filesize
158KB

MD5
86c853cd5741c32f72189cb46b130e26

SHA1
b6249344cc1d6a528bf11e5dac3ceefce2064ebe

SHA256
9a03dec75c41b7718f9c08992e9abe964ea3cd2e8f7fb5e95f2f94517879dfd0

SHA512
90211e031344af2051d95ab91c4d0be2cf56d0de27d5cb689352824e470ce7fb2c1c718448eb7c75a9eac44211b040967da6d7015d38ff1494849a8cc0bcb5d2

Download Submit
C:\Config.Msi\PTF193.tmp
Filesize
60KB

MD5
48069273f48f6727943ffdfaac70dfff

SHA1
4983dae8918cc83b69a0ac0e95ed7cfcdf45f9db

SHA256
7df93004f26962fea12c7831d1381b7444da4b82e5fd9ce44e00d47ca15b721a

SHA512
5a44d3e82412c2a308d0c6cbefca47c2af7419267c18fd6e025d4caf64795d860432117e3a3d7b2fd9de9cbc0418057a52b8c73bac5bdf863be6bdce8b444927

Download Submit
C:\Config.Msi\PTF194.tmp
Filesize
408B

MD5
ea6b2803109b0db3c00e4b58606b9506

SHA1
35db652da1829652c730d01c1f6de0d2c67e8ca5

SHA256
9878a920ad22c52f96dd23e8ac3b37435e4c2816aedd4029336a2eb69dd5a15e

SHA512
bc1ff7fe94776f2b439adab514dbfb7bb415257432d476df42a35a4e380eed19476c4fbeb614cc67b8fd7538c921c7bacf323422bdfdebe46356b10e4e6d384e

Download Submit
C:\Config.Msi\PTF195.tmp
Filesize
403B

MD5
110c9fb975bee283520bc06191e74490

SHA1
7b05562fd49b8b66e38fb2f9921f5bc9b43daf2c

SHA256
d3fe1cd6955582b166ae0a2b8100caaf0f14195d52071b52240d7916b1cdc906

SHA512
0c1b9297261ceb411ddf133727f2ffb97bf65728eb99fc030b1223dcd71372658b8c3f89de56171e852ae4e8de9d4cb04777ba3f281058c82df6962e5046752f

Download Submit
C:\Config.Msi\PTF1A6.tmp
Filesize
413B

MD5
3c896105f07917c90b6c54d323fdfed0

SHA1
63eb8a146be1882674116d7c256c4eccddad9cc5

SHA256
5e40be688475d65d95455f6b561cb2e5ae4cefbf1eef1b5073b5cd6245ad449a

SHA512
738a454139cc4beced944a00e4022ba7460bd48016cc137a52b76949ee850be29c0b35bace2c92f00976cc0176f09208fab886676b0bf28bd82040aa3e75161b

Download Submit
C:\Config.Msi\PTF1C6.tmp
Filesize
979B

MD5
1299475143a6f298aa2e2293b9c6a19b

SHA1
e798b8a53925c70128822a6ec5a9874bc0a4d117

SHA256
ce15595833200699de341dd940b305b55976ec5e26c5c1ff399a21b282773d3b

SHA512
babf8dcd3efbd772c76d70f41a97a877b60b0bf454d3b33f1193cafeba28e284662ec68adb805382cea9896553825ab9fdbbfec88796810dad8c44ef84ac732a

Download Submit
C:\Config.Msi\PTF273.tmp
Filesize
516B

MD5
d375eba00593465ef1f3c635afde1b8a

SHA1
1cd8d8eec281a30a8aa90d9b8da006f83fcbe550

SHA256
ddc3b1f85705674eaa67cdf86aabf92e036036550bab23991085dcf570cf2f09

SHA512
44013e237517a1c0122d0a7b1498fd090acefb642a8bdfff06a314548c5f347f0068c68f525049edc5997aba65317253b338fea53b1d80f3439feab6d4d0d39c

Download Submit
C:\Config.Msi\PTF293.tmp
Filesize
414B

MD5
d1ea3b58591e2c120b4f7d8589258855

SHA1
1623ccf18a0c5130ed98ea2a635a0d4342ea64de

SHA256
2962841981e190cc5192b47f7f670acb60e1c06b033339e4a24f22163add5a27

SHA512
e1e8fd5423c22bb35e562dbd20c8b9a3092a5fedf6d5277f38712b42217d40e65dbde8b25d17dcfabd235a7e6f64b566bb1612b00e7b2beb0e49a414f9903a85

Download Submit
C:\Config.Msi\PTF2B3.tmp
Filesize
3.3MB

MD5
70a5164a8551dfe27313c20b759582e7

SHA1
79286cf70ecfb715ccd478ccaaba950db52cb4a8

SHA256
b23ecf6bf61144b658c3b70f8a437ced14f41dcde93922168239f29dfa1255d1

SHA512
f59ee7ec7124c7b2092f4fa0647a8ab3b0eec13f93262d3d2b71a3f7da8810322c1d36df4458dcb6cc4efeb8a724eaf50ee2416f62268fa03d8f5bbb095b75ac

Download Submit
C:\Config.Msi\PTF356.tmp
Filesize
10KB

MD5
7a1d097cdc037f88c723796afdd7d6e3

SHA1
f1260edd6b4b7a163ff639088a340f5894eb843f

SHA256
ab162cecba35ca08dbbfc2dd02826b8ff0e4758b5171498c2dc4a09814bd8324

SHA512
c33ffd27eb92b9c111f0500bf31de05c5287ef842feac5b00de69db531a9385ab76e3a88fac32ac87ecbe6e3ab2dbf2856ab0332f547be195f3a8eac04cef843

Download Submit
C:\Config.Msi\PTF366.tmp
Filesize
150KB

MD5
655f65fea9b969d342d3b7f3c13853f8

SHA1
5f451d58abe811b8427ca6ee54e5a97e25a55024

SHA256
dd26586d0022b9b7adc63604f026a9f77c2668c42c13cd9f6ba22052627771ae

SHA512
f75262b5dd6d9c8197993c060ef9333408d364702e53501f33289fa60c467aff81947ca688980faee5b2f87a26f0b0adf2682e22f366c002cb20e4d568084bfd

Download Submit
C:\Config.Msi\PTF377.tmp
Filesize
938B

MD5
0396f5af999fefee59b6c593d195a4a2

SHA1
12148c7b616b1578fff37b4a6b167b37b043e488

SHA256
ed42b838650b587101f5f1c6d64424ffae94c57912428fcef92a7bb719cc2db7

SHA512
60b5741022689df123ae3e0eb2a3c2e330be3e899c6a950c089efc91fc2d2c359b470b4b10e6bb6268473829f8293d1783a0a7246aceb9112fc6aff51f70396b

Download Submit
C:\Config.Msi\PTF3D6.tmp
Filesize
850B

MD5
b814b34b591af96570f3113237fdb0dc

SHA1
abe62690f5c232939b8f27f71cea370a92dd3886

SHA256
8d7d0fbda51b7f68572ff1998771574881adfe8bc8df2920c0c81f57453d501b

SHA512
551d501248840ffa26988368bea67ca6b6c99281a83c792e2eb2bb1befb8df4a1d44e74072c3d27b63d02c2fb8bbe7c951a3c230b6fbe46695c903a75782196b

Download Submit
C:\Config.Msi\PTF3F6.tmp
Filesize
181KB

MD5
2c2f548d29f72337cc24de10c7efb73d

SHA1
8f19cf3ac669ae57980a776d2df5fff5b788e115

SHA256
d03cf8804fd37557ee0327cca90d4dd3151a11b93d46397a3b78fbb79a9656b4

SHA512
43961b16f16f8239a1d9e5d72356b62e174ea1598407dd318ba5d7a7de8f007a109e825d03058e99f8ee5d0b6c1dfbcf176f12545ca9663083b7c17ee418831e

Download Submit
C:\Config.Msi\PTF407.tmp
Filesize
11KB

MD5
a50381742250958147e754638c25d9db

SHA1
45282c50d748ca0c0e49c7111be7150eaa8cacc7

SHA256
a64cae7d17855ffd2657a16db6b8b179576d43f1d8f7ddb2d9a699ec804bf828

SHA512
1a7fc4f7c53cf9febed293d604762dd03530db51cd18b8daa6471da8671449cca11c2495fed15f985a100d2143c0106d09a0bb000749e4063ef4b2b1ff972116

Download Submit
C:\Config.Msi\PTF417.tmp
Filesize
1.9MB

MD5
11045bbd05a060eb473b6466ad0cde0e

SHA1
1c00d62f91d0599ed72883e3989cd6bc7c2234c5

SHA256
0640ff283809b1fde943e24952221342c1247e5403116d4db8ff8d427ef6537d

SHA512
2e3a5fd2e0f2b478bfe1458f2209e4a1cbe541feab5c2482b517acb45af427af98660aa9246aa86b9a907466bfa4dab6f671c636719242661fd1926f33e9f5b3

Download Submit
C:\Config.Msi\PTF466.tmp
Filesize
11KB

MD5
83899818f03b2d2dfdf0d7df2ab72152

SHA1
b7016e3f80a1ca83f9ec9c424e996a311d8cc458

SHA256
f0e344f9e8800cc3c0292d7264d62cc0c48a2a5dd65ec8a83588053111cbb4c3

SHA512
b9287ee284d73893873ca2ddc957ef621fe1409afa3705e1d9c2b885197e64235cb6d44b8d86b6a6561895ddae7cd4ca6ed5727c2b93023209feb5b4c2d8035e

Download Submit
C:\Config.Msi\PTF477.tmp
Filesize
27.3MB

MD5
c495e6a1dc083b1486126e860f9b6f81

SHA1
b23f9b9dab3b262cb88a212e82cff808be13b012

SHA256
7c23bd0043a15846a9d639b9798f77614f144b169ea6e0b3eb692effa0e49593

SHA512
9dd6bb695e1f374aeef3ca7c219db23c5ae1c99693612db5e5ebad20932441a3b85c5245ebaebcc74950b527fca783f2c2258f9956f7689375c6ec0d0046b4f9

Download Submit
C:\Config.Msi\PTF4F5.tmp
Filesize
11KB

MD5
ffae43d6fbfae04bcbf1466c6dfe4464

SHA1
4b85ddb6c7bb842e70a011e84db4692894a6be2f

SHA256
8e7b5cbd050cbfc0623d831a4eac33cd66a0e077bbe09905f504b5f1add753e6

SHA512
354078f50f300734b6efc863b6cc2d6f6f8fe82becb4e8fdb83d0cdb3f813c7aad796c2dc7fd7ebde49989da1a5167b69491add81afe36b2acaf90108268e310

Download Submit
C:\Config.Msi\PTF4F6.tmp
Filesize
2.4MB

MD5
da4f1f4cc68e86a6023058b8420b79e7

SHA1
701aab2c6788833f931941853f3268ee400ee14e

SHA256
d98aee9b575c331c779342adb76629f19099637fc782693e6e233f70306b3ec5

SHA512
ae3061921eb91cc0ce0f5505d419cc8eac115a6547bdbcc489422e790eecf10fb29e6d69346e16a8a895a640cb83aaf1eceed8b081cd964e6ac3fa662bb2bff4

Download Submit
C:\Config.Msi\PTF516.tmp
Filesize
358B

MD5
e67425eee33e80f84ed4726e62b1bb3a

SHA1
9dfc21fd99463141958518605231daf111d02684

SHA256
0efca0e8dbb261ea62fe85819777d2e12b9e8581e46f7dbcd4fbf41ac4c147a2

SHA512
e94d4d497e7cdbe07671c099616c17f8d4aa28a0ad6215633fd0e49630dbd7ac2a885d73b3368b89f28b6733a212768b253914843048761dfb0c403ae456487f

Download Submit
C:\Config.Msi\PTF527.tmp
Filesize
2.9MB

MD5
3e1630cc393dd5e75626e07385aec54b

SHA1
c0bf8a01e7ef5e4aaa65ab990245cad9e402bfe3

SHA256
7b48ac981034675a9e084c8a6b44b46c64e235b428899bcc93e786cc504c292e

SHA512
1c79b92f2c4ae30f6f2fb7b16b959d2cb61c3615749f11819055ea48cb59f9cc39f53878978d3e6b98e57310fd1ed5a1c45781388c5ad59f90ff8baea321ce94

Download Submit
C:\Config.Msi\PTF537.tmp
Filesize
494B

MD5
69128a8e5461648ebb8ddffa91e72dfb

SHA1
8dc6521a2b6f72169e69825c047d1b0840fc8f73

SHA256
a75d67380f427dd9f0c4120f1a6373461d660d11d11d2ec45b3d03ac6822ecfa

SHA512
020732ee93be159205d6998865351bd45747b794002c6982b3c2f78f0255c91c6cafee9302f599d5eeab78ad1cbfe94bec69375d94ba0c21ddab9f2232b68df8

Download Submit
C:\Config.Msi\PTF55A.tmp
Filesize
3.4MB

MD5
edef1a27c336772d4491a082f74b557c

SHA1
6414404799ee2f717404deb14f2c4f26d13136f2

SHA256
4da5bce4014e88e9d4eb9e2b9664d3a77e84823dc9a53907bb800870c4369509

SHA512
ccd89d4bfa172f1b9431af0bd3da784658dffdfbf97e423781c110310b033db05e2e5045a7db35c55279ce2a0b1e225c876465ab1f18b4003cd73ed14bf5badd

Download Submit
C:\Config.Msi\PTF57A.tmp
Filesize
111.4MB

MD5
91e66d62493d3889653b0066a1330781

SHA1
554db0697bd0bf87f4a2a5a67fa4eadfa7890330

SHA256
e4ab1c2efe0d02b92b2ee8ff731e805fad7789d9b67f7c32111453d3ffb5b17d

SHA512
4cdd94c85fbdbd5fa075dd35bab0e0241190ddd6b2c43ba8d59bbcb07ba0f35505d3c033c9c25a309c38b94028f882e374ddc745a52712418cb79893c85ccb5a

Download Submit
C:\Config.Msi\PTF730.tmp
Filesize
46KB

MD5
db40f1ca4be5724afe61ef412ba8fb05

SHA1
b3c68efd3497dca40e934bb5164b15e4ee3006fa

SHA256
cc1124885f5e7260379f2f27bffc9a6d3b5cdbf49e50508aed72c8ee86f86a50

SHA512
80beb2394bf37460580c02102b8ccea1c363eb43fc17edd65b7f2fe51bee7ac3f81a07f678814085ff981ed2e539bacd858b5c83439138fcf4916ac967b69df0

Download Submit
C:\Config.Msi\PTF760.tmp
Filesize
34KB

MD5
efe3d3e1f7f854a4d29e5502a18ab7d4

SHA1
15c8b9af7f5d34cc609e86777d07643ab5ea9305

SHA256
a2472224463a0e460c4cbd947bc34f5ad84cde74e8cd204be86fd537820d5475

SHA512
b843f5726debbec1da2cb917b211c4848001f7e72a36acbf07b2d6ef1237acee4efa525eb73e360a26292c67ecf4b538bc1fb6873aa3fb21036213a883ace7f4

Download Submit
C:\Config.Msi\PTF7FE.tmp
Filesize
1KB

MD5
c8ea01f99f863e909e364ee4d5ad05ca

SHA1
5b0bbcdba9496a88f9b5e02614a6ee1fb7c2da80

SHA256
3dc5a7f60a914dba0fe5a74a23f529cb2f9cbdb226aaa15bf17c1f6f655d5709

SHA512
5ec8a382de98b4fd2f54b269e3baa81dde8cda4ab9e976ae1843f732f6ddf6fbbb9f10c065df12762abe480743e08f320afaceae68a85e98065123d264ae2b72

Download Submit
C:\Config.Msi\PTF84F.tmp
Filesize
6.2MB

MD5
88917cc8aca1869fa67b488f7379f429

SHA1
9b7aba8d8942b8134d5fe5c65758be7dbf1a11c1

SHA256
f700e461422b8cd203b75e45214132bc7cb72055c98ecb05c1d888f9d69de2d5

SHA512
a5008ca08c9bc38408f8215cc7fcbbc3dbdccc9dafecc8f151ac26b4365f8ea8aa85ae7e21581ae37d38ff910433513e4167fb95bcf2fe084129eaf9fd4bc2a4

Download Submit
C:\Config.Msi\PTF870.tmp
Filesize
135KB

MD5
0eae510ed08937d542c92a61d31783c8

SHA1
e992c324314798f5646b9a54c1d04c9d0eea7877

SHA256
2d7aab9c1fc0d28611353dcd455bf08aeb82885ccb36be23ba890bad9156b2a5

SHA512
f9eed2ce3ca3adb8aecdac54b09f10787415937157eff554650eb33e1e979492bc1bd55536d3d4bb0d369326f31b4547886084f92489721f220cb64a9970b96e

Download Submit
C:\Config.Msi\PTF881.tmp
Filesize
585B

MD5
4bab3077ec22f2130b1d745f709a06ae

SHA1
fdebca87ebd872db79228eb0c1952ba52baf4198

SHA256
0ee2eac68270a9addb0b3b7b56fdfbc237895a22d348a7848835e6a1f64fd0e4

SHA512
988f22eee94c14ae8cfec9aa99cae02bd3ffae12f2e4eded21cc587e7e2e6a33a25d630a95190a430ac85137f57f5955db84ec7079ae71e42fd71832351c6f18

Download Submit
C:\Config.Msi\PTF8C0.tmp
Filesize
348B

MD5
0a814a61d2260c827679e04432cf4163

SHA1
d50cacaf956cadc1aedf6f59f2ad13fa3293a0b4

SHA256
f6521b0d834c3e7fdaa61bed0081948981d73a41ffa359024a475d6e585243f4

SHA512
ffe95e6c076278520aab73994e5d96c465617465135de4e9c8b1a33ebc4b64b40168ca15ac3c5ad7dc4625b9efdf372a601ba4782c8f660a60798feb5661db04

Download Submit
C:\Config.Msi\PTF8D1.tmp
Filesize
1.7MB

MD5
6ded31d4c9b0d72a6bf4dc86b1e3f570

SHA1
7b6d93e4af7b97f630ce069658e99d6f9b3b1f16

SHA256
81561daab7a183abef8d6429786cb3611a68484f454c7faf7dd5003e468d5d40

SHA512
3c258481df96bb543ea8f909caf77996a25b98c833bb113ac5ebefdad3a2615eed2fc6176cb22bd2bffb4228f373076e57d2c130bb36e1273c37ad64b6a10617

Download Submit
C:\Config.Msi\PTF912.tmp
Filesize
745KB

MD5
e03d8bbcf584de58500efdac4c7b6a97

SHA1
7aac481128eda876bc111b0cb33e202c68ef1f93

SHA256
58cc0c31514e89a743c9b96c7892c256cd9daaa18bdcff784b8ddb1d5c15a163

SHA512
eb3346b4d93137476f57eb43c87e4160b5d85431e2e9a75fbf4250161414d290eead6bcdadb290e23f13158ea265da880ddef1cad4b12cce60c0fa9d4f95c3d2

Download Submit
C:\Config.Msi\PTF923.tmp
Filesize
3.6MB

MD5
9e39ae3421a6f240539ff09950bdff67

SHA1
6274532a9c7c97d3c920b8349b348c91be5fe7e7

SHA256
1a35144fff23180d4f46eda86d9f0c1ae96c7b9ac1b309c03d372f8645f918a6

SHA512
0547c24ecf665f15305d8cf337ad7796a87fcd6bd0d1c0a919a7584b09f9ae7cc57d80257913205a15f0c2f423642d0a790d0707380c699e635f82ea0fd72e65

Download Submit
C:\Config.Msi\PTF933.tmp
Filesize
578B

MD5
5802a338ba88fb8f792231d1ff3d9754

SHA1
284f4f30d11090e973d17a0c55d7066d0a61e5e1

SHA256
60abf61c0833dc2ae0c9c4bcae1399e51bed880859baa7e625de0b862c15fdcf

SHA512
44bcb428258b016f5569c73594577953a98d718bfa998323bc027c82ed4dc2130a1d76b6bcb7a829034e23076d70dd1e470f46553ed31ce40b5a20d81ffd211c

Download Submit
C:\Config.Msi\PTF944.tmp
Filesize
732B

MD5
87fcf50895385bd89cfad44cfa7d0f13

SHA1
f99deb920567542f6298724bef3960a3995acd7b

SHA256
2d0e4e48639839e34807cb4de4052fa89a8f70b2cdadb385807fed4c43a1a553

SHA512
ae7a83a105700e95ba83c4eda7a67fac135cd0997fe1ca53c010ce58793bcbe9cab123c8f820bc35ce2c1ee67bbd511736418e64c954cc21152f2210debd33fc

Download Submit
C:\Config.Msi\PTF955.tmp
Filesize
1KB

MD5
c817ef6e787ac7fd982ca2138cc9ae63

SHA1
4b7579357cb0154ba647ae185ebabffbb8d6657b

SHA256
e0fabe210c875de47988aeb6b6eaaf772fe6457705bde9128f047cd290d0e559

SHA512
d8d665a6f367d37955c81e87c5bd24d61600a1854abd83c1ee3af18061b2b263371fb837177031b8796df61b57daf6127af0d367f173891e076e4dc60df47bcc

Download Submit
C:\Config.Msi\PTF956.tmp
Filesize
482KB

MD5
7d0ffe0d6ee5c9c0e3889768878ad370

SHA1
bc1c6139528998dfd628d6a80bbf0863df73f235

SHA256
e5cfae26f95dbdfbd6ceddf172cb660102e0b8270375dc64106212f3ca286dd1

SHA512
41e71ebd576e759a51dcea9a47f39138c458317db260302659e6758e961e3e35ae14b70ef682ed7a53e73bab2d4eadb152d4aa83750f5f0eceb2b37178c81603

Download Submit
C:\Config.Msi\PTFA53.tmp
Filesize
8.7MB

MD5
7e3c4c5df56c62f1fbd16a443ecadd4a

SHA1
a65464e21b851a21b6b38fe7565f6cece082f37f

SHA256
30f2f696c082ad1204225a8daf747edf5f64f10c9a3b8ee42b90733f1412cb54

SHA512
f180ee6e96ca9037ef82ced2b89402a0616ca9888c001acc5ab6ff0a3ad62d8564257027f34f36ec3cf6679c27e433ddef8df60e6a901781f8300e18923e5c54

Download Submit
C:\Config.Msi\PTFA83.tmp
Filesize
2.7MB

MD5
3195421877c8eb9f66f585b20792ee4a

SHA1
97c8e9cb4e7b5fc9085b665af51d08793a63b82b

SHA256
d946b685b3582fc001282b06b58c3638e9464f314a8a39c7ab21e6ab11a74631

SHA512
5d5b1edf9af8a73fc943c8bb05400d0cde25ca614668e68d099b7f3a7a53b39f3cb3a988e79a9a2a226a1be5b27701bb92d8d365400ac96dc7a10d2533532eb1

Download Submit
C:\Config.Msi\PTFA93.tmp
Filesize
867B

MD5
e2cc78157b027d6276789607e21fe65f

SHA1
55be1e6dd839d1e2ade84a5c1c6eb8d5b9d13e11

SHA256
0fc28cc5046a3980bdc53be5025198a490a666fbd04e56731e9c39fc80b2de58

SHA512
0d048b092f4fb5670b6643dc6d86c93129d6720e0280a69bbe7f884c8d9fd9063a0bf3c4fdb2c88d2b19eb5ee8b3d6e3b83338238dddb24f7c0d26e999af474b

Download Submit
C:\Config.Msi\PTFAA4.tmp
Filesize
639B

MD5
9d99cd18380d35e009ebf6ae64cf6d48

SHA1
6ed6b403ef9c5e0c89267685d85a8bb077f3db52

SHA256
87358aa84713df2beb2466b8090d6c2d4da40da2a5bffc53a76dbb5b06e62311

SHA512
1d06d8c24da50f59b5881259286c0fa17498cdb3a67fb41890a255e460b349dbb595736b7ff42d5ad1b18f6ca06e8575b20ad400546dacec80cdfad829ee0268

Download Submit
C:\Config.Msi\PTFAB4.tmp
Filesize
71KB

MD5
de9bd221d68951f6058877feb8fc8bfa

SHA1
dd37013c856c1089b1438ab88deedbdd93204f25

SHA256
8b4354038c405e8e515fc714014125f848c4f1c80c66527e12d909985b9ce2c4

SHA512
45c13e3a99b9b368a85fc306fcc15e7cc0c29ae2316dcf1d6db1038cec330eead7414b59bd258bc05bc0fde3a1c1900e9ca6db275253be33a1368140f1841e79

Download Submit
C:\Config.Msi\PTFAE4.tmp
Filesize
1.9MB

MD5
247d63a497dbd2570532b6f9a6a5bdb8

SHA1
57bad75187c07a56198ad69c10a2184fcff15df4

SHA256
6f041a20d0fb002e310f15b73dc33d38c23f5a9c786842f5d0f12cbf20b2d781

SHA512
51b48acf145a429664398c96e4f26fd1a7b56b24c9acd0ebf6dcc4f9b4a520d3b3460637622ab6c2d3bdce9a60d631f1a642afaa55297c71ebb7782ea0541a1b

Download Submit
C:\Config.Msi\PTFB72.tmp
Filesize
152KB

MD5
05210c072bd3e41fc3ca079a1ccd6349

SHA1
ec001ecc20b6c11efd1d4ccedfed5998003af50c

SHA256
1bf5f3b30d612d029dd969d54765765355db4a9d5a40d2c62c363ea573bf16de

SHA512
872de4a4fc89e460ee870ae40bf3a870bbb42531ea1ed08b3793026823c9491527f8f59a1b222302638c59a0459920ae34c6fb501264231d12c529f4675b305f

Download Submit
C:\Config.Msi\PTFBC1.tmp
Filesize
663B

MD5
6a99a4bd730d9343d47c0978b8561f09

SHA1
85b587bfb5dba05aa558c2ed398bf5c280362c4d

SHA256
04873ed6e008bf850b12e1b206bfd1d099a63005a6d6fe64ede4594c890142db

SHA512
e2e950ac84bcb7ef268f02e548b48b9c578e648d999955a8f79cd3bf379d35123e0fa0ade19c173d54e73e0e3c38e04e4ed4f72b7a0163ff118c6353534c848e

Download Submit
C:\Config.Msi\PTFBE1.tmp
Filesize
439KB

MD5
92d1176d7aede25908bac87e098b3b4e

SHA1
7619c35393d3553f4ed5c9dae220d2d37aa2896d

SHA256
14865d269c59ff6e0874173e4c567392cf6a05fec259446841a49b7f882530c9

SHA512
3cf187c853ac0aa121d80baaae89a7eacec696df19b00a1687f922fca0b0a191b47b76651f667164630326fd0436f689990a1a6009c185b85c7ac1de6803d638

Download Submit
C:\Config.Msi\PTFC21.tmp
Filesize
280B

MD5
0397bf2f247ac21d2d85c2b58848c3c9

SHA1
b03be60996d31fa7bf34659020835b4ce03307e0

SHA256
a0bdc3e80e47acd42c527f713805ba123231e4e7671e7884016a37047581d04d

SHA512
e6370850f6dc0392b6b657c6f37135e2054f226df5b0d66f00d68edb51a24a9b8738afeef8763afd84e61cd66262189b0c6acd65dc4ae1169fad15b15c8c84e0

Download Submit
C:\Config.Msi\PTFC31.tmp
Filesize
697B

MD5
1ff8efd14b2966fbcf87f59c916fe606

SHA1
cfedb0978bc246a4cd5465b1d20268a2d6d3ba0f

SHA256
4e0273997dd98a0c9028d0a2cf2559589dee0ec122dbc56c0f6bc65d6bd0d3d1

SHA512
9ab2f00f5587acf537c17be4442d1d88100ea49e379acb58772274a45325955e86c92c0e02ca2ba327dfcc6f8af2e5272f2845045a336b684385dc2ca5b5244e

Download Submit
C:\Config.Msi\PTFC71.tmp
Filesize
1.9MB

MD5
1cd89251a9d8825fe9eb5ddbc0de8b27

SHA1
1b7981e5744e0ec2f06547d91b6a7635ad8bbe23

SHA256
2a88d28677f7528767d9506125c7cc31a09cb58179713cc9770e3ea8245bd753

SHA512
d30f2acf799dcede0e42fee0920bf1531a7f56b2d546d4258d52aa99f64ebc9699d51e11f653ff3aac688235a11c6aefa7e896cd8570dcbd047280c76d3160d2

Download Submit
C:\Config.Msi\PTFC82.tmp
Filesize
523KB

MD5
9659d0bb3d086ede0b83bf08c27b1712

SHA1
69f48b7dddcb7df3a811751bc8636b72c5b47a8b

SHA256
90b70c8d1070eba0fc6545bc31b379038d632b4088cc7942894073cffd7fab22

SHA512
27367a2d21d23da0689e909c3707e2dd4af718cbc7c40dd57129751f3624008565f5841cf214867329cffe3bc2279e9303f66b898e5bd226181dac93cebe0195

Download Submit
C:\Config.Msi\PTFC92.tmp
Filesize
1020B

MD5
72d0f7b0c63cd45e996fa200a889fd02

SHA1
6a7d2e8978f16fd8881455957967204f9de181df

SHA256
542bf54c3c610a8b786db5f3bf88148944f786dda63e79dc7c0293ce0fdcf3d3

SHA512
fa6d818c287592804143a81ebea622ff493f9463341aa777f96bc0d003e927486b87d3e888db2f42691b81029a3002dc01b4e04bae75e53d6d5713494ab6dca9

Download Submit
C:\Config.Msi\PTFCA3.tmp
Filesize
556KB

MD5
7ff6f32ff61d4ed998265fbab223e089

SHA1
7772372436e0255054738767a6528f6dfa7da91b

SHA256
08143f12714bde5a21e2699543424794acd71959f2dd1318351f7fb07deb389b

SHA512
783da842704cbf4af52205befcdcfba8e80418a5267202ab323f5f7756912efb3e419d160ccb673346c386818fd589c77429f00e0c8540e773757c622437744d

Download Submit
C:\Config.Msi\PTFCD3.tmp
Filesize
2.8MB

MD5
e38b2e04cc3d3758e48dfcab071c00f5

SHA1
2c7e643159fb7ed9ae2d72ac89b9598428737acf

SHA256
393b6ee143ef6401c4d6495440e266759b035f43e7966912b8a3491ad7ef9c86

SHA512
2bbd81909ba52ad915530c7ba80deffbad435a619c673cf236a6d2ae7444df237a0ffe270fb9a99eb860849bbef000a72534fe6f99c4d5a9374f6b2c5b1fcd06

Download Submit
C:\Config.Msi\PTFD80.tmp
Filesize
19.2MB

MD5
20be061f0871c305460e044a4f65b569

SHA1
4f2e19cfd5c6f0ec3419b60df28f701dcea63b14

SHA256
da13214880c17b421665b730e7c57113dbdf1a643b484a72da314c4ed32e257d

SHA512
bc0b40e6ef0605e22d2de28c2601d418092fdaea194242f1feafa5ba82c49d569641eee480db26822176c37e497f31340f1da774bad1b14a5f08eaf616a256f8

Download Submit
C:\Config.Msi\PTFDCF.tmp
Filesize
386KB

MD5
bb398e0e0143ee33a91daec8788440f4

SHA1
79554379255f397d34b87f33bec4d1e64df01546

SHA256
51953142a68c6f62d1b5ac511f43929f6806cad96fb1723bdcadf1c0c518e495

SHA512
a97187184c7a0b887c6c7f2fff8b25e289162765f292474bbdccb2686c00c689318b47e5331ca61e5a49f4abf659d1b473dc06fb2e0aca886f7efd5d196e08ed

Download Submit
C:\Config.Msi\PTFDF0.tmp
Filesize
569B

MD5
cf6dce5d3322ccd2b30728f6375d009e

SHA1
78c47104ea76272e4364f41d0cc20ef11871d79c

SHA256
6a831a64fbbe34a6bc49ffc15047f2b5e3ebffdf542d412596994e318ad6cd97

SHA512
2b7b61ca3fa823e892a0c992157987e71f939d13cc96c0373f52e2beaf7b76241bb206745a71c908194d6f1b55693dc9e3ef6a52616851b19a477c1aa287eeec

Download Submit
C:\Config.Msi\PTFE01.tmp
Filesize
586B

MD5
2126a996cf399c2fbfb38a924e8c6208

SHA1
72bb633b57cca01f8fcd6e534a2b4c6f3a09992e

SHA256
f54f44cf2802c9e091fa7511c9a52330b502c91b8b01288681e6624f190af3f2

SHA512
fe2da21a67f2182aa2e65bca9e19bbc0240341e2badfd1cb5d504ffb0309d5215b5feef56e4b22d32ab955b0b41736fb78b06390553ccc7c2fcf364a55006ae4

Download Submit
C:\Config.Msi\PTFE70.tmp
Filesize
22KB

MD5
585141aa19fc13b17f44463baca81cce

SHA1
f2e39b12f27c20d4a91afd8dd9c2a07ae4659a6f

SHA256
388f229de85baab4324d6771097fe7789f53edd69a33161cd7661e33f4d3c6bf

SHA512
b17cf5f1457602763c6374a36517d792ec25f1ca93be9a7595390d41ebe9dcd178395df0b2714c7b18469c38f1884eba90d2e32fc5813e7d169ab9f6381e69e8

Download Submit
C:\Config.Msi\PTFE81.tmp
Filesize
428B

MD5
6c83205f28a22b87bd7f2e66dc4d3865

SHA1
3076092b5230e0f7a4df3a6eba99b063d6daee35

SHA256
cfd623ccd8995b10ecbd10235a5d89b173f124abbad5c781891b69b253cad44b

SHA512
30fc170280e51a2ee66482587bae8e9352214ef1ecdcabd185d0f74e87c09cc59dbe06d0cd11b45c54eeded2e60d00677a21be7869d39a1ed0df4ebb1d1f3999

Download Submit
C:\Config.Msi\PTFF0E.tmp
Filesize
1KB

MD5
abe6dfadba31b1e667a98dc9e61fb8b0

SHA1
12d4bee731c3803ce6511099c153ccc52f2c3750

SHA256
53a3deff5fe79bfb1280623f45e4e0f06de63e9c746c9569952c7303b9d8d115

SHA512
94bf81e5fdd0e0fc8aeebd201389aafa641f0c91556deb180227b874d65b86f740589e32a1846e8d0b0579fba6c2fc62fed4cd1785ca6869e8d1864fa60fea44

Download Submit
C:\Config.Msi\PTFF1F.tmp
Filesize
179KB

MD5
12bccd1d5131c57335c3c5116d0b0968

SHA1
6bd555d90479fd44cc617bcc5ea7d172e557a077

SHA256
c37061ed4d009fab4f5fa37c2dbea6472bdffc8bfa9648f3c0f08abfd37149b1

SHA512
41f6c0a0851dafcfbca1b994fe8f2ebbcd9399731218584989c9b144033dbc7a8b209cbdac8193f823f6afc73fead3e1719febc156159d5fcb593649b0c31f1f

Download Submit
C:\Config.Msi\PTFF2F.tmp
Filesize
335B

MD5
97c4abe1070b05a26fe00c3d271826c7

SHA1
4079b0a6e821acae0e6068b7b76fc5b55e9bd75f

SHA256
08618544bfce867ffc3a408d27fa33b3017b5f27721b5a668fdc81f69682d2c6

SHA512
569afb2b7c7a38da453842f1cecbbe698b6632b04e369fa0008b3ddb4862c20776a8ef1c36f4281d6ad2ed60caa25cafb7bac0cd48ab6606f1330598e248459f

Download Submit
C:\Config.Msi\PTFF61.tmp
Filesize
362KB

MD5
f9d6a2a9564fd7e24ff5082dbd40d636

SHA1
d8bc5514d5c80e01633f9e18ba6c7553fbe9228c

SHA256
82238f47c54f1479e38a26de043b5ab923be8feb47d61e55b0874824a0de513f

SHA512
6c160e3e7f351d3792b94e0c1c2b16f5bcec317bcc03dd1a1fa764fc70303f2b9e2e5335743e93bc7183edebbe32239e4319d55f5165a4432d715c487436a24a

Download Submit
C:\Config.Msi\PTFF72.tmp
Filesize
210KB

MD5
486c46a0605f36d6c11257a1f476dce1

SHA1
deea854fe0f21e77cceee02e9f55c9eeb60341bc

SHA256
1fccbf6dc4f97c88997b5b1e598b748c3158d5995973555cdbfc7894f13352c2

SHA512
f8b16d2fb7ef3734f64902bff7ac565e080efd1a7c8ac61db83f8990b3b12e42121486e0034273da1227796873d8b9beb9824af42ba19e051bf391f78f049f91

Download Submit
C:\Config.Msi\PTFFC3.tmp
Filesize
742KB

MD5
979bdc67702d4e86325ee961a2357181

SHA1
4846d3038636e226729def7ddfb1b38faf09a6c9

SHA256
1adcddcbb3acb5e5afbe7c4b7b05bbc5215aa495b99be78f4496330b26e38465

SHA512
9b4a16d3f9f06f955c9f46286a8a82dbbe56842ba943e631c680c1f09d13469ddff32f0681e8a4a0d013342c4ec13ffee0869d334947d0e19f904ac454bf8603

Download Submit
C:\Config.Msi\PTFFD4.tmp
Filesize
286KB

MD5
df84452e1eeea887044f8eed9821799a

SHA1
f6a9b171883df418d0bcb0c1a19474c0c8958b3a

SHA256
b7932be80c552f677aad8ba79d5a8b7da8ba2b7fbe5206fdcabecdeb07545598

SHA512
536e7d35f7a43cc6dfedb84d9645fced7658e10b33c5fe0fae0d67561eb66a0288e2c7dd591c9b3f5ac83d47c8d5a96655cede857f977a53408a2dc4cc63d8e2

Download Submit
C:\PROGRAM FILES\COMMON FILES\ADOBE\ACROBAT\SETUP\{AC76BA86-1033-1033-7760-BC15014EA700}\Abcpy.ini
Filesize
644B

MD5
1965ef76a143599308aa14aa0175b0e1

SHA1
93535ce70dc2598572b59a31401ae7f3bebed9f3

SHA256
d70276e38ea1d8a4a8efeb5686deec4085d0f76b437c679bc80f92d6375231a2

SHA512
df498931cd52a26e850dc007571266c5cd81cc5ac21991df329d6f0569c64a47bf066c140b7ab993166da58c51171cc94380b61cf4a1ec9be2bc5814ddd4767d

Download Submit
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\vulkan-1.dll
Filesize
823KB

MD5
68e82d9bef90e19d33501c9e9eb23965

SHA1
40e0fa46bdd1eb20626c5002d49194540b4e36aa

SHA256
14da67bd81dbf67fdd3e8a6b84aa14e5e99d8392556d1593831440ae7ba820e8

SHA512
fa31b0e7c3685da810317f79060df141e92e777508f50c73740adbaabac21ec938cec79e6bf9e6c530d83c3f2c8c0c47aaacd5e227a9673c35ce82b55fa356d2

Download Submit
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
Filesize
5.3MB

MD5
ebcc0cd3ec36a0f01702d76f4b0d2106

SHA1
2c7c00cfdc5cbd8c5954a2dcb89826d561373ff8

SHA256
2c21a0b8daaa882732e24cb84be9032bc6b5006c07f799b98cd7be117494128f

SHA512
2d9dbb88fe8b37925c81e864b54de0e93e684fced8fff81317ff33d1f8594c92bad1d2f703eaa21137261cf15ede6adae3d536561e24aac25deadac5362aa6a9

Download Submit
C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\nppdf32.dll
Filesize
323KB

MD5
62f4161fc6bc821a06f109f53ea74be6

SHA1
dcbf0f5b6c58031b32190caaabfee2195fc23eaa

SHA256
0d0665e773c8d82500ba74700b49c252d654d987378b704e8826cc22e73f2670

SHA512
4df657898ab547937dfc14d676ed52eb6f9fbea2f0ae1dc59708c4f25c64916ce95d7e637fab261f670148ea44b8d196bdf1fe75c0c266385b37988362e3c12b

Download Submit
C:\Program Files\Adobe\Acrobat DC\Acrobat\Legal\en_US\license.html
Filesize
26KB

MD5
35ad2735d3614f440356a2921cb4d146

SHA1
8e3500e4a0b5dcf59e4b0419f000c7fae0290850

SHA256
c1f97dad9dcec841f0afb36c690d89c7d1f647d753291d4712b843163ce8f02e

SHA512
6bcea5473e21c6b8998388175ed1293800e87c5add2bf236a6e8b0d532d95987f11f6bef53d972c20689483e1fe14f420c3aca385939a9428d4fb8e6d87db7ac

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.ar_EG.txt
Filesize
32KB

MD5
5e594bf69810971fdf2e3d2063149048

SHA1
4363e75c5c264453704ecde36ac960ce8bd5534a

SHA256
0e018c63407cda60b1f4c1a8ecf3b93349c0caa3952b50ab6cbd6777adce4495

SHA512
10f7ea4cf8609b3780fce18349435b8dc054a58b1f8366350783dd861f686bd6207cdf3ff4ea163b5a13982bb2bb72bc5f6cfaacfe27000620928036f1149e96

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt
Filesize
32KB

MD5
c6762a82d75c68a93d7f0c15cf1c23e3

SHA1
89740b6ec2467b83ba8d667e89165c666c5831fd

SHA256
6b7884673a6381ef470660585cb406595d8d898f6ee6b5e92aa180bab92b521a

SHA512
d6c7eb56eaa35a44fb11d8a4cd978f76a4c3d2774ae6d4646650f4404c3e26888ee2ed85688190bae9c8c718c5b829c7b708f2102b24cc417094e44800944b97

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.es_CL.txt
Filesize
33KB

MD5
120d132322fc5e66f7821085c35f3f0a

SHA1
6caa19bf9ddecf1e4773ff4204d962802e292ee5

SHA256
3cc4e057c3405b5d228b0384a33265de4e856255b5c7dedd9be6fb26c73ffe66

SHA512
54835883f8408d00c5e4f551d6d4396b64a92dc3c02f1b6b75d2d349c7fae16ee518842e79c83d376bc6eb882d357d9b90a70c4746daa96cff15d40b6163f20c

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\DC\Linguistics\LanguageNames2\DisplayLanguageNames.nl_NL_PREEURO.txt
Filesize
32KB

MD5
00a942da0a5ae60eb1820fd370d80874

SHA1
c70bc4b100f266ba9ed797af9bf697865ce3277b

SHA256
b3465f55794df1b86e188ee644b36e6c80a7d4e05e00a7294f83f3eac6383f8e

SHA512
a65fc708614cdb8cbb6c72a4ccda39ade381e73a4e7b5481470df6cd02b0391e5181c381bb393ad147b8e48a3c954ca43f83658561de36c5213551156902f2eb

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\AcroPro.msi
Filesize
11.1MB

MD5
2a08127cb509b3a8aeb4f5a495aeee02

SHA1
d1a1e2a8d72e017f23502d924d5d0607821648bf

SHA256
f86b86c5d41407ebbfff7632de74375e743784e4f88c1e74c1e24f64467aa7f6

SHA512
e1ae85aef2c979fe567888662ec5af4a64c2a75973eff7a18ad083356f5c01c5a8f1c68b3711a6a62ec5544d63ee978bc26698b47b066404450daac92a850248

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\AcroRdrDCx64Upd2300120174.msp
Filesize
308.4MB

MD5
0aa7dccc8d338e3e04960b93befab619

SHA1
37ec381318fb4d994adf1e2cb7e0ade7ee3738b5

SHA256
8d7473d938ed3700341184cbf9f4606746db492fd1892ab7e0e353b6cf9c310b

SHA512
07516ba8b194374e84e0febf37e7b4902191524126079e71d859865342c64261cbfb9ff5ed90009447eb3d89dd91bc4efb0a828b9334f812c3a3d30f796a6ef6

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\Core.cab
Filesize
490.5MB

MD5
b80e8040e63617f75bc0e0720832d904

SHA1
851d2cd29f636637d4a96161904ddf83bd40fcc1

SHA256
f9355903a07c4e4174846e62c4d2419a61f4224c6396c76782af784920c0fa49

SHA512
f16c4de487ddaa7b9b66da789391046bd31092ec4c15bd95a807e5f22abe499a95a5d999c859769e4a9b6e342953119e69021888af95ab52b547560a4a4930b3

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe
Filesize
628KB

MD5
2c8712fc6e9dc45b82c002d1244bf0ea

SHA1
9e7f12731806c9da6ac8ce1eaf1f639e6e520b6e

SHA256
2c05c6ba4cbf35d3f7f0eb42858bc7de76a1ec865a9f07b99d2db81ce588132d

SHA512
17e1b84e9424d4abca874141729627f5c21b71174d531cc0f49cded3761914b029b1fe3c4ca61ee52358d135b8ea68cd94b855a5e6a0f4810aa25a09e7c6d323

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.exe
Filesize
628KB

MD5
2c8712fc6e9dc45b82c002d1244bf0ea

SHA1
9e7f12731806c9da6ac8ce1eaf1f639e6e520b6e

SHA256
2c05c6ba4cbf35d3f7f0eb42858bc7de76a1ec865a9f07b99d2db81ce588132d

SHA512
17e1b84e9424d4abca874141729627f5c21b71174d531cc0f49cded3761914b029b1fe3c4ca61ee52358d135b8ea68cd94b855a5e6a0f4810aa25a09e7c6d323

Download Submit
C:\Program Files\Common Files\Adobe\Acrobat\Setup\{AC76BA86-1033-1033-7760-BC15014EA700}\setup.ini
Filesize
369B

MD5
ae4dec1cfc8e6558149d4a7d6f682fed

SHA1
573b8bd3688c0b137606c5f4e6c2f3d4cab87a81

SHA256
d1453a5fb40256f4f3f39389e2a502d99f4132e9a6c20cb3b27b6e5c9e4f322c

SHA512
b5f3d2a494133d43de459a8166ffd8a473af371920b1844c0b75234f8619d100b882dab22d57855210c26f9d3e0f44c251c393166fca83c7f92518ad9e7eb9cb

Download Submit
C:\ProgramData\Adobe\Temp\17864\config.bin
Filesize
3KB

MD5
958258879d9d2389104bfdc899eed1ac

SHA1
0a9d5bae7a8ee970038e36c36c17d238611eae58

SHA256
d646fe98b0bc9e09270a8475c502fc84a7dee4f879b06b0377d49042a0447365

SHA512
1f658f2736466f651a6b91cce41f8bec18b8ba8612a91cdddbe2a7b45af3180bae086a6681138b90a7e69d9ba5a59b7ce9cee72c632da04fe7e9d0ea20a8c149

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
471B

MD5
da27054fdbbdda89365ef871cf050934

SHA1
4ced16d4bb106ee591a2b2d25b3d18f4f9de456e

SHA256
36c6f76502634850bb020bbcac669dde5276287ab17769b7d8b0dd1dd4919344

SHA512
92fe4ffe4d4b4656b9b7ee39aa144c00f91f8299f932cf5dd8c99bc749d23c57568eabc7eb53cf8069612abe08836044cfa9c17db3a44f39ba43838cc8a3ae67

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_EB45B4DDD2CA201E87E40B2FB5245AEF
Filesize
727B

MD5
be0353f40a1a75a275e16b1c961d084e

SHA1
4d6f0ab6bf3458f8ec9b29f89447a42a1b6bb533

SHA256
4b92b89208b95b1e347f4da34a1154366e2f081bf26c6fbd548784d7ce1af668

SHA512
1132a28d700e2191028500d1fab5c153a11576e7909f8cbcd0c027197c64a12554f90a3075fec0a3c4cde67236c26246260b4893bbe4ef0ff3706efd528fa6cc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize
727B

MD5
f40a3405630ee6ab58ee915718ed590a

SHA1
81fb5cecbfb14979be638372252930aa51644602

SHA256
30c5f061508ed2172e17c2a563dc121b96ef98bff7458c64c54baf97b01866af

SHA512
d6ca23b11d67a4df4ef322d14c5975436d9f52ad93c43785b006b5fc6289828c2a37a8e4d67523cdeeb980aaef9987141bf8418b9d22e025d87a74ce10573001

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Filesize
430B

MD5
4472137a4ff85f4797af3c05e194360c

SHA1
0505299724afd5a9376b2742513dde600bc4ebad

SHA256
d21387e69392e529db400dab445f2eecf6066f2f3a190a54726def422bda53a5

SHA512
22f04bd50f8b160fab83236530caea47e5a75473c2c32a87c2aee2498ead5300f0d60f8ce0fa0a0cc91008142a70fbeae2a68edb8d88a3d238ec2eca2ae92fdc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_EB45B4DDD2CA201E87E40B2FB5245AEF
Filesize
434B

MD5
6569091bedb1ee7e076a52c1402f3a1e

SHA1
fc417bf477997fd38d20b927dbf02bccf9424799

SHA256
fd71f494cf4510bb05aaf8dca406d4fe0b7f73b5d96b2bca9cc2cca81460cbb3

SHA512
569a4068116416a1c87b6dae59b3a61811d39b9076c74562af9a29a6be296998a96876a6077804ef6ae5b13f303b1b574a8acba92956ec2c4fd8da50848665b7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Filesize
442B

MD5
ef74c7515e38831e32af44ce1f0f67e3

SHA1
cffb5d9ab290031dc81df165551bca115ba828c5

SHA256
79c5c07b88edfc34740589db78e0b2be50836b42f0939a5c644251c9f590574c

SHA512
7692bb91f8914ce613a7f908b2a688959df34f557b0fd85f67e9b1c46d49f08f0d2391a2e89ac8bf185805128939ea492e9ea8b868e9ad1efff45d4dbc6e8b3e

Download Submit
C:\Users\Admin\AppData\Local\Adobe\EBF4965C-1281-4A00-BD58-764524C1A6DC\B41A2E0C-6A88-48AD-B03A-373B81CF09FB\E9FA3F4F-FE44-4571-8409-A06879CFB783
Filesize
336.2MB

MD5
f1606828921e6d62427861cd956e5c90

SHA1
8255628140ba9630c2ac34353f8d309648233674

SHA256
ad1db3bb2a8e3b5d8c29e3d79fea27bf6233c76b4f319b98748dc9a85a5dc2f8

SHA512
01dc614b605ddbc7eafe6d789ecbb0fc8d7233ab4aff6ef0714fc80577af14f5c347599b4386f30392eeb34d267067cacda110893e848c010563858d2e88100e

Download Submit
C:\Users\Admin\AppData\Local\Adobe\EBF4965C-1281-4A00-BD58-764524C1A6DC\B41A2E0C-6A88-48AD-B03A-373B81CF09FB\E9FA3F4F-FE44-4571-8409-A06879CFB783
Filesize
336.2MB

MD5
f1606828921e6d62427861cd956e5c90

SHA1
8255628140ba9630c2ac34353f8d309648233674

SHA256
ad1db3bb2a8e3b5d8c29e3d79fea27bf6233c76b4f319b98748dc9a85a5dc2f8

SHA512
01dc614b605ddbc7eafe6d789ecbb0fc8d7233ab4aff6ef0714fc80577af14f5c347599b4386f30392eeb34d267067cacda110893e848c010563858d2e88100e

Download Submit
C:\Users\Admin\AppData\Local\Adobe\EBF4965C-1281-4A00-BD58-764524C1A6DC\progressbar_blue_active_100.png
Filesize
14KB

MD5
bb94a177f10bf764d11f94d24a5db5aa

SHA1
6864b58952b19248f4c5ea5c8764c52e207268a7

SHA256
caafea31074ba909ec57c9dcdd1b1c0256e5626939cc768b8a041fe42762e230

SHA512
d2875eb5ad9ff76ff233ada04fa77aecdbb0c9a80bcd85b0c50087786b47e97feec189d18164e15784cd96850849ee4e1920d7d98157ca7ad317ba03e8c66111

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
f9b19e4e879a659f000805794c5021b0

SHA1
3baa17d5f857b517b0c04e2ef44ecc800afcc1cf

SHA256
375956a074199bd616fc5b64ba0c90e4a266cb35340f9d4ea29864439b7b4130

SHA512
7fdcdae71bd6d42310067018ee888fc25b10bc1b4c1436e54aa811814091a23a7fce06bd4399da93a7921a806d8e0d624c06f21b7851bb7ad035c326dcf2d788

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
65f205fb8d88132e60624d0f403f10fc

SHA1
6bd33c800179526400819e490c3aeef0aa871d3a

SHA256
5f696239c56c2c844f5dc6f54d9842d8b3b6e961bf430917de869f831b5ec035

SHA512
6e6ef40b339f7f072d68ac27234bc6e72d47396ad2d44d5ca2a6dab2e9e44aca7b2c6ba4bc36ced017a8438b1244a709f7e9b8db3f0768f51595d68782c83f3d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\06e67e28-7524-42b1-95a8-b51f8d808cac.tmp
Filesize
3KB

MD5
4b4023cf0505a870dee9fd37067d6d22

SHA1
0d04ba093e10c8053252107d8f3b07bb7cc22f5d

SHA256
bf0a3fcb5dddbef12ff0fa56c6a49618a5a1255b3af3568a1fd919945aff4bfb

SHA512
c67e8617191a58b0b7ebdddb1a9bd2147b036637d0a0c9fddf117e5a0b354ebb8aea9f31eade4037ecd460f4bef01d5d2ffff83ccc05e7b49f730f06798fe07a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8fe441b3-91ab-478a-a834-daa028b32a56.tmp
Filesize
4KB

MD5
9c89e4942b7dcce9f4044fdb0b774e71

SHA1
519f368bee69c3b5957f180f1f483f6811add63c

SHA256
30bd785fb10938348fdaf364cd77b53537d0a2218b7b1c119373d375bca78603

SHA512
9d01ee2da229c13f86e2882b53a1a5236b2a2859ace2930dcb4c84bb65f3b70c62af45c285d1da2a21877d6b5f378f81fda5b98db7b0f39e9760be6849ff7868

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Filesize
4KB

MD5
e19b970868a1c0ec631874112ebd14da

SHA1
d9298985e472f22c462a0cee65391e691a62c15e

SHA256
48c272d437baee21d8f60d7e2c2d55f3ab82a1bcdc49b552df9f8c8e58cb7dc1

SHA512
5a23ee2a6e386b709044b8cf838ae1a9f6b0b95d52c381aade0438774009221f8e2323962fb16fdeaecddcfda1c3d98f9539aee613d8f552309ed29c17fe923d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
82d27a988ffa96182e51b06e294054b3

SHA1
49e0b784f56d77efd21d1be4570de57cc165df04

SHA256
3ffec749bf5fbb57745d755cd964bec667230f872a290ab9bf9be7869a1aff7b

SHA512
4464f8d3dbd103267f0b62873b01c9d6d70e929d618635fb495771a9d561260c4d7052a4f4b8fa4f31980681621a7763aff20df8d8e348f644ce2e8d581cb69a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
e8a6f9f8b8e4c3e9240a5be653f1d0fd

SHA1
28957ccec9c63affaad083ee93a5a9e00138d2e4

SHA256
ab6bd208c7fe9d60c80d6b3eb8c47b1f02a762b5a5a166bffa3e10ace2e04f1e

SHA512
eab1ae035bdba0b7d78505560059e688f5a75bdc5240ef17d7c3cbb14cad588b798f259252b7136a667624f8960a60b289a03288b0e396490e554509270798d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Filesize
3KB

MD5
fd64b00af6216c3d19de650a0b857111

SHA1
249d7759697da7a8ec4191b9d6b4ea72f9700db4

SHA256
b6d296a09093cd3f6bacb21aa5ea84750f724dfa7809868ee3d7ceb9a254c4d2

SHA512
4062e78d48285496400c296034760931f7ab19bb27a5a9db77c7613ba58bc578db52ac43832dc21c209d4b1a7e5d6efa836b3f2e119ee578a503f1f8bdf79e04

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\e1ddf3c1-6d1f-4215-adfb-0e02ae5975da.tmp
Filesize
4KB

MD5
f15ab5adf7856c29009428ed7e695e5f

SHA1
375853c3429c8bda3605f95b1c37c89ee7489749

SHA256
3b5697b857a55a36dd4aa7cff638a9a8e3fb2f64c79aaebe678482142fc44c60

SHA512
28e0ca773c3a6a9fbeebb363ef82dd6e12dbd543a9b87f52e8cdcadab9e09721474b1c4b2ceeffa2c36d3959a752296c50b4c0305f9f9ed42cae884ae6a743e4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
476fa11d99bb49952a483280aea2c525

SHA1
296bbc84d1b3f4b1331932667f1559daaa03659a

SHA256
0e571d198ded7d1f69a65c28bd7c20881acd5899f04e504dd0a62007dd56f068

SHA512
af7ee98564376f1c8723de7b1d9bccaca43d14dcbfc5c757256ce86e5ac8aca118361bb9bde9c835002736a84e0babc3ab98b0fe6abb74f1db11e329d0f5e5cd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
0a2dc44d1baf182ada8707adc8696ed1

SHA1
9e1b92c6fca19d55dc7acca90b28bcb3a179b8a3

SHA256
02787da0bfbe3a0a2c7ddd83dd003296db4018d07e3c7ddef1cff18929c05ca6

SHA512
e2bbc3a3882d3c63370359ad5eb6a80cfd2bba4cabb99176833adc5249ca70989adf71948da603f8fc0a1f0268f0de983febbcaf746e4a000c1aeec25cbd7621

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
46feacf47aa2a6daa7f895b25bfdc62d

SHA1
e427c446b4c353cf317a3695f2f51b78c654d7b3

SHA256
cca41dfef5475d78edbc7d68b68bb51091d983c221af915075e087511e133795

SHA512
143f74ad5c43fee1e2e1dc35379150baec311f7e87edcc0b94d5e3230e14cc3fca77d8e1566d095300326d1b962f3ec815651790abe8373aa9105a26e3eac3f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
46feacf47aa2a6daa7f895b25bfdc62d

SHA1
e427c446b4c353cf317a3695f2f51b78c654d7b3

SHA256
cca41dfef5475d78edbc7d68b68bb51091d983c221af915075e087511e133795

SHA512
143f74ad5c43fee1e2e1dc35379150baec311f7e87edcc0b94d5e3230e14cc3fca77d8e1566d095300326d1b962f3ec815651790abe8373aa9105a26e3eac3f1

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
4eecf6aaa95932de18e78d924a1e9ffa

SHA1
9f35ac5e2754a9fa93dda6d33c0616c49c9d2a08

SHA256
edc85d34c8807de0c8ee794e5e0bbfbfe262c185e74e04a0547f9b2e805cea9f

SHA512
58a1a6b6264a8f7504bf6088861ee8dc52cdeeac8f2e39d6e2027667a57271d51bdf888f5da25aeb09756c8ef646de3ff810da313f8b92c0d7a5f3c1f4f9dd0f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
72169cd2669ab23c4e06fda03775ee7d

SHA1
ed0beb23beb989eb9661fc55e951df4729e250c5

SHA256
c6cc5c15b14c7f2d2f6e67611c3ed7c05ffd5871800d37af0ed7d3e7f9614ab1

SHA512
d86cb433a2a503a3d9d0882ca06fa49e406122e259436a721fcf699f8b0983d09bb72dbcc8014f03961473431744150de65c3f8261a0fa3ff631722ac7909f8f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Filesize
4KB

MD5
5034d359a36710362f1adf51e1a47178

SHA1
93c27a83d6f4423d9f227202baac9dae05fad4a9

SHA256
12ccc84e6f496f5f3b0f7cb686dfba558f9b9bda63e58683c8fc7deb28f2d23c

SHA512
a11f640fbaede2f8619800a88dd076874a67d1fa969796aca4b06be13104d9e1a17fb0ae45877d4df89c0785fb6818886cc35564a87d8e663161ed29f74fdc92

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Filesize
10KB

MD5
eb9e7bfb8ff890c6a0c7d238bf590f0b

SHA1
9f7c5a545fc06c414d326f48899722201ce25c8c

SHA256
9a4d54db7b260e4a6e9fe275c70dff1ee937000f86ae2d74e2b47b85aa9e0d2d

SHA512
091e9f3eb387e02ddc276b1c7d0985cbf8e2864c7b0354af0d53ea2f1426ed94ff07eabae07b1c76b1c981572a3820e0fb117ab9413d389b2dbc857c39b235b2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
149KB

MD5
99c047b695240617c70d4c27038fb64b

SHA1
1d91fba060df5401cc3d96f951aea42976d3d015

SHA256
a25af28713c9634f2347fde75b97fc61e49d4739104e53218271905b6b56d810

SHA512
67905752a9c8c86a5babffccdcc0c07470789802c7f68dd3438150824811d3e965c966d2c4c76ba396d6625ccc8c75e41fa2bc5b121735015e65acd44f05a1b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Filesize
149KB

MD5
99c047b695240617c70d4c27038fb64b

SHA1
1d91fba060df5401cc3d96f951aea42976d3d015

SHA256
a25af28713c9634f2347fde75b97fc61e49d4739104e53218271905b6b56d810

SHA512
67905752a9c8c86a5babffccdcc0c07470789802c7f68dd3438150824811d3e965c966d2c4c76ba396d6625ccc8c75e41fa2bc5b121735015e65acd44f05a1b4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
106KB

MD5
eaa2ff512936d2dde4bde594e89271d5

SHA1
8914ef2466bc1a51c2d9d8ad7a124eb4cfcfb714

SHA256
fa9e26122bc1f1d2745d453805eb9f826d9870f16b89580e1e03ea33c1f5effe

SHA512
4ec504e869e28ac7fc5d59c065c26d37b4cacfbe713c310c9b59ff476b4142579315c65e871aa8fde2af5020100c8d19aeb1141ff94d0420a279a6ddcd8d284a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Filesize
114KB

MD5
ace6de603d7adaa6652245641d38fd67

SHA1
52a2077df194b741a3f49f7214a1799ea3c50583

SHA256
7d662cef2bc3565d96a035d7ed79c2636379ce5a6e3a38282ea8dbfb0b66aa1b

SHA512
224d9e5bfef731253657deae50d76e7504533795002e408651fc938f74b7d82c1abc0f1932f0f853c292e1b4840b68c82f4936661e16c5807789eefdba3e9f01

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5a85ea.TMP
Filesize
101KB

MD5
27913a394355e4e0c04072d85fa4d643

SHA1
a7f51b90e30b609916100cfc7c9f4f28f2e65374

SHA256
e2d2e1e34b8de2c7dfcfdc3f55cd83cb9c83c7f91b55530fcde8b78f129d438e

SHA512
3835a7424e6b5978e4e78a574c1b9d8bd412096ac8de5df2d644784d08611b6615371c4f21086e2c59c9ea64243e8636c2600ae052551a1021d57c32da7f1ea0

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3476_1077359162\c9b2dd95-c426-44c7-b8be-2c1844481064.tmp
Filesize
1.3MB

MD5
043b13a96c8bcc7066c3e31e4143a8d1

SHA1
524882d472714577cfc9e9a03b1b5fcc6f80dbfc

SHA256
6e644f43218b49dfd831550ef326678359753f2c8afc396cd4318f807073a936

SHA512
8745341b95df3022d9413faa7d43158fa0ff54ddb91c08d657dbdd35cd747b9cf6b2e3da4b4283705c752e5050ea0d0b6755e1acdb417adc3d410e93d3c7ea4c

Download Submit
C:\Users\Admin\Downloads\readerdc64_uk_hi_cra_mdr_install.exe
Filesize
1.3MB

MD5
311156740707a4914727099e9385351b

SHA1
ab70755a8d9a2987024da1ef8d468e00d5d7a65a

SHA256
ce0fa8df66686a028f02dba185fdd162e4c2b429b8a1dfb7b21f1b35f18baa67

SHA512
9c6a103dda31ab62f7da9caa4c1adb24196d075054001bbeafd6070ae64483ee49933b09dd2a640004a206daa434f5a6991ce828e9de7a30ec1fbf433aab098d

Download Submit
C:\Users\Admin\Downloads\readerdc64_uk_hi_cra_mdr_install.exe
Filesize
1.3MB

MD5
311156740707a4914727099e9385351b

SHA1
ab70755a8d9a2987024da1ef8d468e00d5d7a65a

SHA256
ce0fa8df66686a028f02dba185fdd162e4c2b429b8a1dfb7b21f1b35f18baa67

SHA512
9c6a103dda31ab62f7da9caa4c1adb24196d075054001bbeafd6070ae64483ee49933b09dd2a640004a206daa434f5a6991ce828e9de7a30ec1fbf433aab098d

Download Submit
C:\Users\Admin\Downloads\readerdc64_uk_hi_cra_mdr_install.exe
Filesize
1.3MB

MD5
311156740707a4914727099e9385351b

SHA1
ab70755a8d9a2987024da1ef8d468e00d5d7a65a

SHA256
ce0fa8df66686a028f02dba185fdd162e4c2b429b8a1dfb7b21f1b35f18baa67

SHA512
9c6a103dda31ab62f7da9caa4c1adb24196d075054001bbeafd6070ae64483ee49933b09dd2a640004a206daa434f5a6991ce828e9de7a30ec1fbf433aab098d

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.bg.txt
Filesize
31KB

MD5
bb6bb4f61172a77d3bf0b0fa6128d324

SHA1
9635b9edea6e2c649a1d7718b11d6c0d8d6d9f02

SHA256
fb18393638681be9bbeea50027cc7ccfc40fc301f18ff1fc06cacd0707495e56

SHA512
f2376e3c132d67dd8932838ba76b67032d3b0170204a6acfbe6d429757fde336a7f9ad92d0733661d9c804466bfeadc96617113b52f599ccd76013d35a7e6988

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ca.txt
Filesize
31KB

MD5
8595b4d890fa4967d03666908abc118e

SHA1
1f00a10c240a018995d1aef4713448721e648bde

SHA256
b7ccf9b033c9ebaaa7a288bca328aa1d923c1ca673148b68548b56b2d06b4534

SHA512
9939a204db878de9da21cb63ec10437fccf6a9543ff47c69c223189b60c2a00742338160db33b9b8210ddae806b0a1c7eec2725a120601edb018bffcfd9fb153

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.cs.txt
Filesize
33KB

MD5
299175738825723112605b4dc4b27023

SHA1
fc828fbddda14cb0430e4b5ba22da63a487c1536

SHA256
89b03bd425e5d9971b04f5dffefc20ab7b6a67ad1814ecb3aa9476ed4a36dc85

SHA512
592863c1c1d9a42e35c12ada82712bce64b7fe4238a9c9ff64bdeb55d21d305456775d6811dd6c0a13adde09e74eb00b486dd7a7f8ecfb4bf955fb94293db143

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.da.txt
Filesize
32KB

MD5
821d26f7f31bd9af2364cf0e6f2ebf48

SHA1
80c9eab68c4b2b1c720265a5675369754b31fc8a

SHA256
8c1e43cd2ba738668a8815d1591c4a6dcbd6dbb7a36ca044dbe8ab7307eddf4a

SHA512
aad8b54b49ad4428d4770873e460ad21fc46a1d705a2fd020b6767f0ab55e58226b1cc982b9a139fdcc53695bca3d88eed9d9019311643a395d1ccd726d232a9

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.de_ch.t
Filesize
33KB

MD5
2456f7fed9a90325162a3da013025e1d

SHA1
da5346532b99ef49faec1b6a847c0810f44c21be

SHA256
11e2eba5803b965977b5ff5d4719867967540d7856af60e776b28e93b1b23d84

SHA512
d46daf056067586a309dbc5c73b95b41a0a453ac1f648d8c7dae6f6bc81dd0ef7dca7c9191f6c6a484648d5800072d935d0cf945f90a104bceaa8cc59b35e5e3

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.el.txt
Filesize
32KB

MD5
193c63026cab1bb26dcdd8a5e5cc4dee

SHA1
aac12b3060f18f04df0b81da63f48c088996fc85

SHA256
2232a54e8737ad4634695400e73341566d1fbf33a4bccfc8d03f3c08ef74cba8

SHA512
88df0237bce6e474bbceaa3815046508dc37be7dd3988c402fbb59e4a3a378af9a53475e310d5eaab901e2efc1adf337be14a45f4b01c9a06d38c81c75a14252

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.et.txt
Filesize
31KB

MD5
b4b224a726f93eeeb9662532bd34e315

SHA1
ae4bf08eaf62cac4cf3e8c47260104126e3fec36

SHA256
d1cdefe4eb10c819f01a7e014528e9c4759d979667372a894863b4a02ba4550f

SHA512
80861fe1587cfae41acc944fedc0c07f3264edb8999f9a97b77ffc45530c5028003220cbc2d39aa6f9db365c95a6c42d75d3b86c9c9e0aca3d7cb050c857d26c

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.fi.txt
Filesize
32KB

MD5
3896eb99e5982ae2dfc2a89d2dfda3f8

SHA1
5935bfff00b94d90b6d58e1a3c56427278e7a176

SHA256
c1b27133d097c234eeeed2e8b344abc6702dbe95ed9e7c1679b9f9e6d2078910

SHA512
b317f21c7be4378076c6e4bce1d41118abeec9825622eb7f2c0cc4ec77392aaa89ca91b0607c014d36ff1eb0e4ef40660f1c4c5490ecb0067f5241cd3b74ac2b

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.fr_ca.t
Filesize
32KB

MD5
04c2e61ee0d460274d76b594eb15129e

SHA1
822aefbc780cc7a9de4fb4a4319d5e8b254d88c6

SHA256
4ea238e73ec0c5e82031b62c78d805ab3c38e1612f87f8fbe25592ddf75210dd

SHA512
2670c39fcc528f14fb9b790aa1b7e65a28bf060e7e362c8e5d829b77c064a56447045f268fce1208c89b99b13369b0f16ebaee960d9c925b1a9fd55fad6221cc

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.he.txt
Filesize
30KB

MD5
76c53cbdb1ef55f2e3e6e28571923402

SHA1
156f1025855811b5496058f5dd1778a181986194

SHA256
fb443cd9aa8d61d782014706c2077ba0b875925d4536884a7b7b7da51c072e69

SHA512
e7f8e512e7f05b3286a3bd08e9dada5a4322bd33842d21f8ebef151d67c22214dcb407406d0f4ba6af8adc88809a1ea7daa7fcb9ebea32e46ab65911e1f2aa42

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.hr.txt
Filesize
32KB

MD5
910e4b2070eebc441282656408c98724

SHA1
f3cc4c7630ee6b95da150887a339c7416e02adbf

SHA256
3b4ec9e210f3e9615c89435c298a2f70617d1ce1518b15d9922d9a0ab9f3b0db

SHA512
c04c95311815b49a282cab1c4eeaeae4bd5f43ce790c10bc9364898b04f51268c919cb7268ebcfdf4cbe90952d6c94bad53a6842f193d3bd0707cd81b6e0a14a

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.hu.txt
Filesize
32KB

MD5
f880a47a8d168fe1a1f758ea636781b5

SHA1
940c7a24a964cdbadbebef98dbffda3940a981df

SHA256
097bf744c07c9bd6cc8e61f53974c53d5a68df092bc9e2c52482fedd11b7d5bf

SHA512
56baeadc94048ef76d4045d4f02f4036c9fcbb07622d1d3adc05045991bc930e1eda845e06e0887b1c1f061a613a2b2a016a30386174baf2b0f878b4515ff39c

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ja.txt
Filesize
30KB

MD5
dac2e7b740e6f4c931bee5e3246c7bcd

SHA1
b06fc45860031f40d53a840abe6244996a055815

SHA256
5501f0b0f4a4c99899aa73cb0917a85aa1a067640c2f833f9a5340af245b24c2

SHA512
3717970a0a66b4893ec291e08989ff827933ba9eedce29cf0cff9609d43626ceb5efd74749ef77b1588eb3466fb35a38f174b83ac20bfaa6b61a22a63c870e38

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ko.txt
Filesize
29KB

MD5
32eeecce711d66c64b19c942df807fa5

SHA1
666b705991cc7b407dbceee97c978b86fb37f2e4

SHA256
c7ae533dd39a6f941284fa45457ed8af32675b87ee15a89e88dc82f7de540525

SHA512
d11bf5fd9cc9676a022438dd1d7df18fef29d5eff8e225f3ebc02dd18edacbc6ceafcf463c61aeada8fdd4c6b489d3dfa4a3d46cc3465c415e7fd9e5193e89b5

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.lt.txt
Filesize
31KB

MD5
d8a3038232864ca4b844fe2a9c8238f3

SHA1
d4f398968eea951ba8a704fd07313b95d9e8f0f4

SHA256
ba4801d2db411f5259c0e96784597a23172f7f91230115be91ae2ccedb1579e0

SHA512
c6e86dcd53fe91d0dd509d26e2b0894384ddf71e697da638e976cb59b1f8496afd31447a57263cc96d3ab0d263341a735ede725967e30b944373f46aec4d3829

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.lv.txt
Filesize
31KB

MD5
2f9c2d30cd3c9167ee9a925ec5a37452

SHA1
f4548757b1e0043279b0c5f2f3f920322293ef2a

SHA256
d5b0640745edbf4b303f33b5cd4f597443fb5f06d4622fe97af994634b81ea19

SHA512
af4d25ad02ffb86b649f2a5d2cb48efbddbf06382eb93bcfa3c0450d7de97f8dc0da23b98e21b9975ddebdf6533b1bced4a6c91a05f860eb80353860b381b74c

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.nb.txt
Filesize
32KB

MD5
7694e0c5a6209b167f840ddd79bc325e

SHA1
4f9855878769342d64e87883f2a9760f277b0d17

SHA256
a6f707082c9562816d20ef3e3a0bab43a85299ee550e8abd1190ea3a7b6a7878

SHA512
71440f0948795da402503fa75bc59f269707c648c1b26a243461528f16a9fd6c299ff4a571b7f7ff406704694301db69d853d296282bb772f933eb94083da4e2

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.pl.txt
Filesize
32KB

MD5
318acfda1d773287f8cc8bb3b6664ba3

SHA1
f7cdbcf27a3aa2114ae221cc32e75ce9d8912d4d

SHA256
29018b15062c69a7e691fc3b41208be29a2a0fa2333add3d1f1592ee5c3764a9

SHA512
1b3d8d8bb873042b97332ce589640d137b8a2a4464e8ac77f067c244fde075b7c80b6aa794c130b44705e991017aeb891a3a14f37d1b5fcc8de1ae1c3a17d287

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.pt_pt.t
Filesize
32KB

MD5
4bb1c1166bca272067b36448c9521217

SHA1
5f2b50d61dea2345c369942c1dde526b2ffafe8d

SHA256
941c413d51c6eabf25ff9d7f8bc6862151acb27aa57b33c025fceca7a07c6a95

SHA512
ebfdcb822ebfc74fefba39ea4c42c1c4f038cc1fbcd23c543eb63bf8b484327d0437bc859a82e56679486f31dd6ccd65bf927c90daa86ef96298162c1d5b4409

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ro.txt
Filesize
31KB

MD5
74bbe768be2265f8135bd6583b639672

SHA1
4d2b179ae9998b8262559161e10415855c7bbb6b

SHA256
9637434f7e3f17cbb6dd40fc90e35ab102469b0d570b2c08f771883c2ece7047

SHA512
511cf34b052dedbf18f954bcb51a64f28f2d87001acb51f5ac4fa42e2eebf4fd1896c7fc05fc06d4553b1158a52f35537f92fc57c2b09fd6f23fc0be8173b680

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.ru.txt
Filesize
33KB

MD5
e6cdd6adf41b8d1ab6d485a47b3e2a59

SHA1
5a703bde41edb70091e7b70a53c20b671defeef4

SHA256
28c17cca2835b0e64ecb26cbee663ecf85289d3fe16f50b0246458b9354c5c8d

SHA512
9aa6c199a13bc4b85287a3b482614013e03d8b24121e50de918bbf4f8a5a8b7b365bd30d07eecace56801bb15c70db180e80388505ea54817b4a825f9c32fd92

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.sk.txt
Filesize
32KB

MD5
e23a74363be913c5ded738ab7348ce24

SHA1
0b12d1945684b005d39a546bec3349e35f79181a

SHA256
70c84f9f9e768aac1a43c8e016c043da1462e5674e97dc46779d7ba0bfdfbba8

SHA512
9b36ccb3ff47cd83975c0d37ddb0c9b5a0b3a391a51e445725d2558a78c3cee06556856dd02a09df7f0a896f2d3b8fe821e13836f0caeddb188ee9042eb0e949

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.sl.txt
Filesize
32KB

MD5
f587b4bd0d7ac295ab59c15b8802f2ff

SHA1
fa7fbba21f66c0d348ecabc8e95e9535e443f970

SHA256
bed1c841f196ce84b8f826e922cdc096d529492f400bfc82ba4677880345b131

SHA512
0b44ae8af4796f09adc83630d84d9d7197fa608dd93be7f045b167e02a8f44f0db8e92a60b0d74f4edb47c7d4469c5f9910949f24b859b2aa1edacaa8a9eac28

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.sv.txt
Filesize
33KB

MD5
48f2f38c65096eaa60b3339a9e9b5340

SHA1
a47ecc0f97998f0855a2a5ad1d7f35b6b52a038a

SHA256
1aef30207bf8248f138b958caabafa88e4e80b766e672965d080b814d6e2015b

SHA512
43b51d989635dbf3a136c42d605160ada0c99594f6aec50eba2bca9040c10c20667372e67be6e17070904f705547d3ab8b4e56dbec58ad2fca005ebe3e76954b

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.tr.txt
Filesize
33KB

MD5
3efb4d7c937854400e3ef697a7445080

SHA1
ad6a4db17fe254fa9eada8b38155c19646fbc8d5

SHA256
73adc06422aaed9379705f880520875cd8f6359ce4ad6be94a6ae5f20d764010

SHA512
524df0ad47eb53662ea3978897c85594062576597b6228d3f770e1af3d850ed3242a620b56b3b644c5168f8494570f2af66a20bfbfb5975543b21449f39038b8

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.uk.txt
Filesize
33KB

MD5
01f20f176cb92a9c5243d9dea18e6771

SHA1
9d0815f01b9c4a26e54698eb7712f17f874f7bfd

SHA256
c0d69733d65870f3d52bc4b24c99a65a9db9c001dedbac1a44baf1a3309c8f01

SHA512
167190dda0b69db8d86a62683389a709ff00be5d2455e242d50972738b4412fbcfe28df7f5b0386041aa93437b900f7f839891226fe6cd496d053b32b96732fc

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\displaylanguagenames.zh_tw.t
Filesize
28KB

MD5
8e9d90dbf7f97c669bf3aa335bc2c69f

SHA1
c4d0f9ae921818249309cc3263ed0268e2545114

SHA256
0cba8c340c3e6e26ff96489c4b3457303a708f87a329b1812791b7d5bdd0ddd1

SHA512
0efd046455d57a30d8f8683b0ae03490df0c55ab59afb04172f90826b55bb758a6d3b674fe99353d9e0b06be3e2b031795e8987466eeadf059feb8654fa8cbdb

Download Submit
C:\Windows\Installer\MSI1C5F.tmp
Filesize
141KB

MD5
edb88affffd67bca3523b41d3e2e4810

SHA1
0055b93907665fed56d22a7614a581a87d060ead

SHA256
4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15

SHA512
2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf

Download Submit
C:\Windows\Installer\MSI1C5F.tmp
Filesize
141KB

MD5
edb88affffd67bca3523b41d3e2e4810

SHA1
0055b93907665fed56d22a7614a581a87d060ead

SHA256
4c3d85e7c49928af0f43623dcbed474a157ef50af3cba40b7fd7ac3fe3df2f15

SHA512
2b9d99c57bfa9ab00d8582d55b18c5bf155a4ac83cf4c92247be23c35be818b082b3d6fe38fa905d304d2d8b957f3db73428da88e46acc3a7e3fee99d05e4daf

Download Submit
C:\Windows\Installer\MSI24EC.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI24EC.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2819.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2819.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2982.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2982.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2982.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2ABB.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2ABB.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2BD6.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2BD6.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2CFF.tmp
Filesize
516KB

MD5
51a8dec0247b569e10042f1543fbdb32

SHA1
d27d410739a64b6df18c460e094fcec31810892c

SHA256
8eba0b040fb6dbb0f5dacbdfa9e2929cbaaab12865012ed7dda9ccdc09124a48

SHA512
0c414cf9dfee03732dd284e17446ce0203c0f0c96221a851ad3c9dabbb2db8da9f0c5c02b8a17c029d3446b551018e8fd0565febbb3fb3d2e28af0dea67ad539

Download Submit
C:\Windows\Installer\MSI2CFF.tmp
Filesize
516KB

MD5
51a8dec0247b569e10042f1543fbdb32

SHA1
d27d410739a64b6df18c460e094fcec31810892c

SHA256
8eba0b040fb6dbb0f5dacbdfa9e2929cbaaab12865012ed7dda9ccdc09124a48

SHA512
0c414cf9dfee03732dd284e17446ce0203c0f0c96221a851ad3c9dabbb2db8da9f0c5c02b8a17c029d3446b551018e8fd0565febbb3fb3d2e28af0dea67ad539

Download Submit
C:\Windows\Installer\MSI2DFA.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI2DFA.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI3FBE.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI3FBE.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI408A.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI408A.tmp
Filesize
815KB

MD5
ef258da17814b8fb98d8c1cbf4012183

SHA1
21496b5501ba93c67ef3038501602dfa377747c4

SHA256
f4fe97c2b3415b91a13c8999eebdb7f702c3ce2ffd3b7e79a24bff1420b2066b

SHA512
c7aec5e388493ccec95f26aee9b3f364b2d049be22589a7254bf37589129ea07254c3fbc2da80a56ca8405a63fbae63344c9c0d0b984aca21bc00975c6ef65d7

Download Submit
C:\Windows\Installer\MSI40BA.tmp
Filesize
484KB

MD5
82d689ebdb24eb3c7788a46c0b5f2628

SHA1
0421603165e20ecb9d0421ed350e4ee47b5f411b

SHA256
2f7e2e93d493141ff65149db8aac0c149549f19b4f3ef66111bcda7c7c2feb5b

SHA512
cf89dc63eb3cdc623f3dabb50db6c3cbb3cf8065edd6aeebc0a0c2dd12d0135641e7777300ce93c18ab1b48cf52d5e6c7c552a9729ba00b4826d2fd8728011c1

Download Submit
C:\Windows\Installer\MSI40BA.tmp
Filesize
484KB

MD5
82d689ebdb24eb3c7788a46c0b5f2628

SHA1
0421603165e20ecb9d0421ed350e4ee47b5f411b

SHA256
2f7e2e93d493141ff65149db8aac0c149549f19b4f3ef66111bcda7c7c2feb5b

SHA512
cf89dc63eb3cdc623f3dabb50db6c3cbb3cf8065edd6aeebc0a0c2dd12d0135641e7777300ce93c18ab1b48cf52d5e6c7c552a9729ba00b4826d2fd8728011c1

Download Submit
C:\Windows\Installer\MSI40EA.tmp
Filesize
206KB

MD5
0fb71a79c1269e2ba50fb92eb92866d6

SHA1
7292a917707d174f7f98bbcd7e248000ebcfe9e0

SHA256
e9e4adfa160ce9bbeda6a083c42562fdb33a8c9261f85edc682528333813b7b6

SHA512
0c2e80768302fb009298b288b06bb9e62db91fbd04163f0fad707f9cc84445985cf811839a6c6cf022817f4405276b63b7ba46c5c67e24fd5a90cf976ffd4144

Download Submit
C:\Windows\Installer\MSI40EA.tmp
Filesize
206KB

MD5
0fb71a79c1269e2ba50fb92eb92866d6

SHA1
7292a917707d174f7f98bbcd7e248000ebcfe9e0

SHA256
e9e4adfa160ce9bbeda6a083c42562fdb33a8c9261f85edc682528333813b7b6

SHA512
0c2e80768302fb009298b288b06bb9e62db91fbd04163f0fad707f9cc84445985cf811839a6c6cf022817f4405276b63b7ba46c5c67e24fd5a90cf976ffd4144

Download Submit
C:\Windows\Installer\MSI655B.tmp
Filesize
141KB

MD5
30ac3d04294763687de62b4ca63fab8b

SHA1
8596aa3ed684d6569e3768a1308bba797b9bb735

SHA256
d530dee06d1034921924dd52839009833dbe2b8be4920fdfd4f8cb4c2bc38c6d

SHA512
86adffdda46230f13362b6aa427072221ad285a79187900a1c6321ff2f9f35fcdfb74af640e44b330ed6361452b2470ab4022045faae3e68db3d170f37514cd1

Download Submit
C:\Windows\Installer\MSI655B.tmp
Filesize
141KB

MD5
30ac3d04294763687de62b4ca63fab8b

SHA1
8596aa3ed684d6569e3768a1308bba797b9bb735

SHA256
d530dee06d1034921924dd52839009833dbe2b8be4920fdfd4f8cb4c2bc38c6d

SHA512
86adffdda46230f13362b6aa427072221ad285a79187900a1c6321ff2f9f35fcdfb74af640e44b330ed6361452b2470ab4022045faae3e68db3d170f37514cd1

Download Submit
C:\Windows\Installer\MSI7247.tmp
Filesize
516KB

MD5
51a8dec0247b569e10042f1543fbdb32

SHA1
d27d410739a64b6df18c460e094fcec31810892c

SHA256
8eba0b040fb6dbb0f5dacbdfa9e2929cbaaab12865012ed7dda9ccdc09124a48

SHA512
0c414cf9dfee03732dd284e17446ce0203c0f0c96221a851ad3c9dabbb2db8da9f0c5c02b8a17c029d3446b551018e8fd0565febbb3fb3d2e28af0dea67ad539

Download Submit
C:\Windows\Installer\MSI7B65.tmp
Filesize
206KB

MD5
0fb71a79c1269e2ba50fb92eb92866d6

SHA1
7292a917707d174f7f98bbcd7e248000ebcfe9e0

SHA256
e9e4adfa160ce9bbeda6a083c42562fdb33a8c9261f85edc682528333813b7b6

SHA512
0c2e80768302fb009298b288b06bb9e62db91fbd04163f0fad707f9cc84445985cf811839a6c6cf022817f4405276b63b7ba46c5c67e24fd5a90cf976ffd4144

Download Submit
C:\Windows\Installer\MSID637.tmp
Filesize
486KB

MD5
1566e699ee42eaa571700f3ad30b2dba

SHA1
d2b11f53310ad7118b6893c46ea815f9c7bf9ce2

SHA256
4bc5fc5cd0ae661b4ffe6ad9e12e55b233f471ba84f40cba7beb0cea8822e831

SHA512
52f8b86486bc22198cde10f91d4588a7a939580327e8ba03b254d5a2c915b039775afe696fe2014aaecf83ef514d3123c6ec68244b40603aa5d980f7e4c1ba1b

Download Submit
C:\Windows\Installer\e5de1b9.msp
Filesize
214.3MB

MD5
30a229c5b62597510862f2c1530ca742

SHA1
041c5abe15ed7cd3b13ed1133918fd2f8c40f8dd

SHA256
456d67014fa6e1f4d0363433ed8d88dd2f9b951388d014604fde8588854be7f5

SHA512
c2fbd726e5d348feb87b96d289af64fecacbf93782d554e54f914f77139ea2b7b2f46c0a627a8555e0a096ce56eb6269d7fed2417eb1eb91f03a7e0670aa59e3

Download Submit
C:\Windows\Installer\e5de2da.msi
Filesize
11.1MB

MD5
2a08127cb509b3a8aeb4f5a495aeee02

SHA1
d1a1e2a8d72e017f23502d924d5d0607821648bf

SHA256
f86b86c5d41407ebbfff7632de74375e743784e4f88c1e74c1e24f64467aa7f6

SHA512
e1ae85aef2c979fe567888662ec5af4a64c2a75973eff7a18ad083356f5c01c5a8f1c68b3711a6a62ec5544d63ee978bc26698b47b066404450daac92a850248

Download Submit
C:\Windows\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_89EDA7BD_C470_4EF7_A64B_8E8CA2242D43
Filesize
340KB

MD5
df02ae3d070bb5c771c81e5655f05736

SHA1
bacd0eb2a3ef98db7363091679ac066135a6c0a7

SHA256
1ab814bbf415b35551636726e21e32021d7d187b8b82d7a232048bced23de6ac

SHA512
788a9396a02bec266cdb4f8ed121cda26648ded260facae17584cc0c8f974fd9d83edd8b250c555b3362f571dc1cce1fd3aefc9068c3f05d3d9b8d2fb847a9e4

Download Submit
C:\Windows\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_SC_Acrobat_Standard.ico
Filesize
400KB

MD5
03f16f16a1dd428685c1c41019d15e38

SHA1
144af7271c83bcf5dd1b6337575892e8fa3c66d1

SHA256
4f48a32ab0b4c27da40cf32b8466f6215e76ac1d0e14ff347b65c3f5a716838b

SHA512
56ee6efb1bb94fa1e41761be94edf25ce9fc8d5db8650d826eb38c1271eea42c00a4730feb280e38bcdc0cd7f5408ae9ba4cc84e242c99866a5ca5a4a6b6a5cc

Download Submit
\??\pipe\crashpad_3476_YKSIXQWYJZYQQNNH
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/232-3976-0x0000020F91150000-0x0000020F91186000-memory.dmp

Filesize
216KB

Download
memory/232-3969-0x0000020F91140000-0x0000020F91176000-memory.dmp

Filesize
216KB

Download
memory/232-4408-0x0000020F911A0000-0x0000020F9121E000-memory.dmp

Filesize
504KB

Download
memory/232-4399-0x0000020F911A0000-0x0000020F91225000-memory.dmp

Filesize
532KB

Download
memory/232-4387-0x0000020F911A0000-0x0000020F9126F000-memory.dmp

Filesize
828KB

Download
memory/232-3970-0x0000020F911A0000-0x0000020F911D6000-memory.dmp

Filesize
216KB

Download
memory/764-737-0x0000029EE78A0000-0x0000029EE796F000-memory.dmp

Filesize
828KB

Download
memory/4896-570-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download
memory/4896-504-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download
memory/4896-585-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download
memory/4896-1164-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download
memory/4896-524-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download
memory/4896-535-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download
memory/4896-551-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download
memory/4896-534-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download
memory/4896-421-0x00000000004A0000-0x000000000089C000-memory.dmp

Filesize
4.0MB

Download