hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/MadMan[.]exe

Analysis

max time kernel
295s
max time network
273s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
04/06/2023, 18:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/MadMan.exe

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3056	AcroRd32.exe

Loads dropped DLL 37 IoCs

pid	Process
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2952	msiexec.exe
2952	msiexec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2448	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
2132	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe
3056	AcroRd32.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\Installed = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\NoChange = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\Installed = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\Installed = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\	msiexec.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Saved Games\Microsoft Games\desktop.ini	solitaire.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft Games\Solitaire\desktop.ini	solitaire.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AGMGPUOptIn.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\Words.pdf	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInTray.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\ended_review_or_form.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\README.TXT	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\tl.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\distribute_form.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AXSLE.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-Bold.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_shared.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_sent.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_received.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-It.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\open_original_form.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\APIFile_8.ico	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_all.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\Setup.exe	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_super.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\AdobeID.pdf	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_email.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\DefaultID.pdf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-Bold.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\create_form.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\zy______.pfm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Setup Files\{AC76BA86-7AD7-1033-7B44-A90000000001}\setup.ini	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\JSByteCodeWin.bin	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\info.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\email_initiator.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-It.otf	msiexec.exe

Drops file in Windows directory 59 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIEEC4.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_manifest.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\FDFFile_8.ico	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SecStoreFile.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEBF6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD8D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDF5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF08.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_catalog.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\RMFFile_8.ico	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\APIFile_8.ico	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF7BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFF44.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICDE1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0A0.tmp	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\APIFile_8.ico	MsiExec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\FDFFile_8.ico	MsiExec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\XDPFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFile_8.ico	MsiExec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDXFile_8.ico	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIFF64.tmp	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\XDPFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDXFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC0B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_manifest.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIEEE4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6cbde5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB710.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC844.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID534.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF38.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SecStoreFile.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF26E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF4C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA6E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD4C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	MsiExec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SecStoreFile.ico	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIC0C4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICB22.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0FE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\APIFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF31B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID62F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\00004109110000000000000000F01FEC\14.0.4763\ul_catalog.63E949F6_03BC_5C40_FF1F_C8B3B9A1E18E	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBB07.tmp	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\RMFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD6C.tmp	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\FDFFile_8.ico	msiexec.exe
File created	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDXFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD7D.tmp	msiexec.exe
File created	C:\Windows\Installer\6cbde5.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID554.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\XDPFile_8.ico	MsiExec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Modifies Internet Explorer settings 1 TTPs 20 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\AppName = "AcroRd32Info.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\Local Settings	solitaire.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.XDPDoc\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\XDPFile_8.ico,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IA3DServer.A3DMemoryManager\CLSID\ = "{633D6DA1-70AB-49A5-9539-54E90F132763}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B22D0C7B-1E65-4533-97FA-A7335B8BCD94}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage\.xfd\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFPrevHndlr.PDFPreviewHandler.1\CLSID\ = "{DC6EFB56-9CFA-464D-8880-44885D7DC193}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E8-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\acrobat\shell\open\ddeexec\application	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2DEA7885-1846-411F-A41E-017A8FD778FF}\ = "_AcroAXDocEventSink"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{8215BA54-B69F-4275-AE11-31CB63593B09}\InProcServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\LocalServer32\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32Info.exe\" /PDFShell"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\AcroRd32Info.exe\" /PDFShell"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{789AD2D7-E1C2-4EC7-A049-2DB5BB4CB57A}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\BrowseInPlace = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000_CLASSES\Local Settings\Software\Microsoft\Windows\GameUX\GameStats\{8669ECE8-D1C3-4345-8310-E60F6D44FDAF}	solitaire.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AcroRD32.exe\shell\Read	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F2383816-917A-46CC-AD2A-5013BED3800F}\ = "AcroBroker"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Document.7\protocol\StdFileEditing\SetDataFormats	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\AppID = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.api	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.Document\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7D71146-EBCD-4E6C-916C-E77865BCC53B}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFPrevHndlr.PDFPreviewHandler\CurVer\ = "PDFPrevHndlr.PDFPreviewHandler.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\VersionIndependentProgID\ = "AcroExch.Document"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9B4CD3F0-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.FDFDoc\DefaultIcon\ = "C:\\Windows\\Installer\\{AC76BA86-7AD7-1033-7B44-A90000000001}\\FDFFile_8.ico,0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IA3DServer.A3DMemoryManager.1\CLSID\ = "{633D6DA1-70AB-49A5-9539-54E90F132763}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{A7D71146-EBCD-4E6C-916C-E77865BCC53B}\1.0\FLAGS	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9B4CD3EB-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\5	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PDFShellServer.PDFShellInfo2\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41C5FFFE-36DD-415D-9ED0-2976A342A1C8}\1.0\0\win32\ = "C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Acrobat\\Acrobat.dll\\2"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{2DEA7885-1846-411F-A41E-017A8FD778FF}\ProxyStubClsid	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdx\PDXFileType\ShellNew	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.fdf	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B22D0C7B-1E65-4533-97FA-A7335B8BCD94}\LocalServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdfxml\OpenWithList\Acrobat.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.acrobatsecuritysettings.1\shell\Read\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A7D71146-EBCD-4E6C-916C-E77865BCC53B}\ = "IA3DUtility"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PDFShellServer.PDFShellInfo2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFShell.PDFShell\CLSID\ = "{F9DB5320-233E-11D1-9F84-707F02C10627}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E9-4981-101B-9CA8-9240CE2738AE}\ = "CAcroAVPageView"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3ED-4981-101B-9CA8-9240CE2738AE}\TypeLib\Version = "1.1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D38406DA-E8AA-484b-B80D-3D3DBDCC2FB2}\AppID = "{A5090E95-F1E2-41C8-BDA1-5AEB6C321FDE}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\protocol\StdFileEditing\server\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Acrobat\\Acrobat.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings.1\CLSID\ = "{B801CA65-A1FC-11D0-85AD-444553540000}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf\Extension = ".xfdf"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\ = "Adobe Acrobat Document"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\ = "Broker Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MIME\Database\Content Type\application/vnd.adobe.xfdf	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A7D71146-EBCD-4E6C-916C-E77865BCC53B}\1.0\ = "Adobe 3D Utility 1.0 Type Library"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IA3DServer.FontManager\CurVer\ = "IA3DServer.FontManager.1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{633D6DA1-70AB-49A5-9539-54E90F132763}\LocalServer32\ = "\"C:\\Program Files (x86)\\Adobe\\Reader 9.0\\Reader\\A3DUtility.exe\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B22D0C7B-1E65-4533-97FA-A7335B8BCD94}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pdfxml\ = "AcroExch.pdfxml"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.pdfxml.1\Insertable\	msiexec.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3096	vlc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe
1556	MsiExec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2444	solitaire.exe
3096	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1188	firefox.exe
Token: SeDebugPrivilege	1188	firefox.exe
Token: 33	2824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2824	AUDIODG.EXE
Token: 33	2824	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2824	AUDIODG.EXE
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeSecurityPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe
Token: SeTakeOwnershipPrivilege	2952	msiexec.exe
Token: SeRestorePrivilege	2952	msiexec.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
3096	vlc.exe
3096	vlc.exe
3096	vlc.exe
3096	vlc.exe
3096	vlc.exe
3096	vlc.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
1188	firefox.exe
1188	firefox.exe
1188	firefox.exe
3096	vlc.exe
3096	vlc.exe
3096	vlc.exe
3096	vlc.exe
3096	vlc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
3056	AcroRd32.exe
3056	AcroRd32.exe
3096	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1720 wrote to memory of 1188	1720	firefox.exe	28
PID 1188 wrote to memory of 1096	1188	firefox.exe	29
PID 1188 wrote to memory of 1096	1188	firefox.exe	29
PID 1188 wrote to memory of 1096	1188	firefox.exe	29
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1864	1188	firefox.exe	30
PID 1188 wrote to memory of 1560	1188	firefox.exe	31
PID 1188 wrote to memory of 1560	1188	firefox.exe	31
PID 1188 wrote to memory of 1560	1188	firefox.exe	31
PID 1188 wrote to memory of 1560	1188	firefox.exe	31
PID 1188 wrote to memory of 1560	1188	firefox.exe	31

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/MadMan.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/MadMan.exe
  2⤵
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1188.0.833494560\1062963787" -parentBuildID 20221007134813 -prefsHandle 1204 -prefMapHandle 1196 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {683eadfa-2c52-45aa-8854-ade681be348a} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" 1268 13d1bb58 gpu
    3⤵
    PID:1096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1188.1.2144703316\1203047861" -parentBuildID 20221007134813 -prefsHandle 1472 -prefMapHandle 1468 -prefsLen 21751 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc4d01d6-7237-4565-9907-6fb71ba8716b} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" 1484 3e46058 socket
    3⤵
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1188.2.618003314\553258239" -childID 1 -isForBrowser -prefsHandle 1984 -prefMapHandle 2068 -prefsLen 21899 -prefMapSize 232675 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ac84164-7d6d-4119-b182-ca62b34978f8} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" 1084 197f5058 tab
    3⤵
    PID:1560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1188.3.405946317\1437486565" -childID 2 -isForBrowser -prefsHandle 2860 -prefMapHandle 2856 -prefsLen 26564 -prefMapSize 232675 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a3ae3de-ee6f-474c-8402-4999942d08b0} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" 2872 1c4e1358 tab
    3⤵
    PID:1616
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1188.4.1933030770\1622628730" -childID 3 -isForBrowser -prefsHandle 3336 -prefMapHandle 3364 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ff6e780-1f80-499a-be4a-b788b23a0d55} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" 3296 1c946058 tab
    3⤵
    PID:2332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1188.5.349382317\507957183" -childID 4 -isForBrowser -prefsHandle 3508 -prefMapHandle 3208 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2845b890-0a8d-4064-acfc-a76d95d96d14} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" 3476 1cd1a658 tab
    3⤵
    PID:2488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1188.6.114394961\323685913" -childID 5 -isForBrowser -prefsHandle 3472 -prefMapHandle 3516 -prefsLen 26623 -prefMapSize 232675 -jsInitHandle 828 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6730937c-c782-4619-b06b-09f932b9c249} 1188 "\\.\pipe\gecko-crash-server-pipe.1188" 3556 1cd1b258 tab
    3⤵
    PID:2500

C:\Program Files\Microsoft Games\solitaire\solitaire.exe
"C:\Program Files\Microsoft Games\solitaire\solitaire.exe"
1⤵
- Drops desktop.ini file(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
PID:2444

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4d0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2952
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 34D9D05691A400D7AD51DB38172796B2
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  PID:1556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 53D06352A5B6A7713C1DBAFCA0ABD946 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2132
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll"
  2⤵
  - Loads dropped DLL
  PID:2448

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3056

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RegisterDismount.wav"
1⤵
PID:1476

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RequestCheckpoint.jfif"
1⤵
PID:2680

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\RequestRevoke.midi"
1⤵
PID:3012

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\SearchImport.xps"
1⤵
PID:756

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\UnregisterHide.3gp2"
1⤵
PID:2132

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\UnregisterCopy.docx"
1⤵
PID:2164

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\StepOpen.rmi"
1⤵
PID:2796

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\BackupComplete.mpg"
1⤵
PID:2908

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\CloseRegister.xlt"
1⤵
PID:3044

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\DismountUnregister.tiff"
1⤵
PID:3136

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\DisableExpand.wav"
1⤵
PID:3120

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\DenySkip.ADTS"
1⤵
PID:3112

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\DenyBlock.i64"
1⤵
PID:3104

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ConnectSync.midi"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3096

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\CompressBlock.ogg"
1⤵
PID:3084

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ApproveGet.shtml"
1⤵
PID:2928

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\AddTrace.ps1"
1⤵
PID:2912

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\WatchShow.html"
1⤵
PID:2672

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\UnregisterSet.wmf"
1⤵
PID:2156

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\PopProtect.xht"
1⤵
PID:3268

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\OutExit.M2TS"
1⤵
PID:3260

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\NewUnlock.cr2"
1⤵
PID:3252

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\MoveDismount.gif"
1⤵
PID:3244

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\JoinCopy.dotm"
1⤵
PID:3236

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\InvokeUninstall.dxf"
1⤵
PID:3228

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\InstallUpdate.mht"
1⤵
PID:3220

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\InstallRestore.avi"
1⤵
PID:3212

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ImportRegister.WTV"
1⤵
PID:3204

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\GrantConvertTo.vbe"
1⤵
PID:3192

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\FormatConvert.exe"
1⤵
PID:3180

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\FindWatch.bmp"
1⤵
PID:3172

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ExportWait.ppsx"
1⤵
PID:3164

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ExportLimit.midi"
1⤵
PID:3156

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\ExitConvertTo.vb"
1⤵
PID:3148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\6cbde6.rbs

Filesize
352KB

MD5
beb4b7ebf758ecaf8650fd8b604e9a92

SHA1
f42746f59e62d61a593d33643bfb18d94b35cb26

SHA256
864e44c3c75344081370ec3b0dec75cdcb780f7c6301eae0705b92b66978fefe

SHA512
ca3af7d6cbbe78e5d26c7fe01c2e04cb9432afc0a274b7600212230c6833ad319d6a62fab8520a84035ff76843cbd61f2583c96a2c5ef4e5b71a06fede897905

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H

Filesize
6KB

MD5
6c641ae185949c2bc460339da24e7fad

SHA1
27e52a90f80c1ab5e80853c05d0e2b40f9742d8f

SHA256
e266347319d97af4effe213d404a4a6584f546e06788f3e36222f47016aa472a

SHA512
868361106295feeeb15de52001e0140e34f24dd34b1f12580685373316290a32126d308a3097eb8a8539eb37d5b5c966e65b9c8059bdae5b6a9aa46ec90f402d

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V

Filesize
1KB

MD5
6e8235b12b8fd8440d821d5d10503bac

SHA1
5a7b7531a69c048cb70c2fb04bd6eda0fa191f57

SHA256
23cddb13c0d7da90751a7f1746e2a59a310f4a64e35ca2875f492673cf60625b

SHA512
fd3dbc0bccdad732d2f72f73e68f681b52074cb78d7953493216f498f6278f4a513d9e5ad4b45cc788ac6da6aa5422f4e3ee068cade1f0a00d93a4b97c0ba033

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\APIFile_8.ico

Filesize
288KB

MD5
7db5afdff5369aff13559810ce3cb3ff

SHA1
0241c6a9c1efc3b8776c762b94a77bb166f47903

SHA256
fd2f0d47e3d7024496f4c84d770dcf76b47154d9e195c6fc6424cdb265e91c5d

SHA512
f99b07d031a2dd168fe322792d033790c4977c32dc9845fe0a23d6f1cc2cf7e63178066c1804870cf54b8d09511b573d37010015099b1929aa1620339a51b426

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\FDFFile_8.ico

Filesize
288KB

MD5
978ee8389c1db28afc725eb2bae4934c

SHA1
1857419efe7dbcd200c2431a9b066dccb414409e

SHA256
738a47a0a877ec50fe42b9ea4f350674f54f799789f685176acc8b15bb23f89e

SHA512
ad1075b47145c8be735cea8badb8d3e5e2c18849d07de4e91d5eb41ce2e6f030a9a6f7df43d122212a9c87af699fa391badc3b5f6c1e76aeca0a7672d7ff0861

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDFFile_8.ico

Filesize
288KB

MD5
bfdd2c458a143f4d2209c78d8c9b8871

SHA1
59fdd2a4a6613d6582502cfe127de74890da7fec

SHA256
d5741e41b534670435fb6908a687f622abd8616b9057cf104730da2ba7fc53ce

SHA512
17bf4da5c2c85db84be896201d3cbdcc64be29bd9b8f5851169501634f4cab2b23624bcc3b4101b868dfccbacdded35b31fe35b61e51f6ce875159f9c62adfef

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\PDXFile_8.ico

Filesize
288KB

MD5
e9dac60a98b0ec9845e85c3bab47dc9e

SHA1
fc3de7f919c3d252200c076f39fc5f1c50ef100f

SHA256
67effe324cd9cfd6305f133f73132f395db80610d021ec49c034be8787427865

SHA512
5eb58d770342885417e8c2369118f9a8bd97a0a6791ce80fe41dcbbee2e6ea1b18b7b28bc3b0f8281e7a9cb1eba6bfdf26d4f49f0af93c69d8437949b4e27a2c

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe

Filesize
288KB

MD5
01bbe782a1da233c59881ed2d18f4f06

SHA1
723d4dfdab2b477633455d4775e32bd52f081c7b

SHA256
7ded5e3c9c066789a50305a048639afeab4dffcc9673ae7f1092e5af7c6a91b1

SHA512
492b202ab850c4f120c4ac7854bf7e7acc865505679d8973736ed3ea28f4b77b645c8a15d806805064ebc81ebd1b4bf07e1fd4023307673d3ce4b81d49c7d175

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SecStoreFile.ico

Filesize
288KB

MD5
6bf1b2146ba3540545448a926ff40165

SHA1
66b963a3f0e97eb71492843a68ac3267b61930d3

SHA256
02e55933849f8531e8962b00e4cbce4ea15a02601a59ae1a5391db50351320a3

SHA512
3d5885b62493f2d1f5cc5cc4d5cb7df275aa32d0d895b6aa0c88d4998dd069fad3a721e55b848ad86e89d9864a48faa39166de2022b2f23e44a29779b6e3a49a

Download Submit
C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico

Filesize
288KB

MD5
4f09f865a9fd5d8f05cb77b6ea920eb5

SHA1
83e702dfe668f12f4c351e4114af85bdffb08003

SHA256
602bdde954c8a106a09260eb1b03fb2df8aba378716de04528aa4c3b33a68ab4

SHA512
94307e522ed4db259549394f24ff41a78c5c6400080d6cd98098a79c33ac1bfe80022d30f8d2c5e73c8ec74d313793e7d175025b695aa57595b4de3654c59201

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\nmtc1r04.default-release\activity-stream.discovery_stream.json.tmp

Filesize
145KB

MD5
114d710dffbeb158a55b819dfa00b2dd

SHA1
2c00c6aa620c2a6166cd76bbac8d8db7a1329212

SHA256
372de0196101ddb5a05cee8ef663e77bfc7598df95debb19e377b019c5f57104

SHA512
cdcc95badafbec8d7eee0f2cfed9e46af8187fe83515d515b28756a8c398a772b952f72aab206053b68a339f3900864e1a52e5c789d51da98d8e7601fc090aac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6824f4a902c78fbd.customDestinations-ms

Filesize
5KB

MD5
516d1f1d6b405d2253b311c192cd6908

SHA1
0cd328a05b72e84cd4ac9a329d5417468d1c3894

SHA256
89d4f307f323ee493ac01516adb1bf6fe9bb4258a3f823ca42c7fb72e854f958

SHA512
344f35f7830ca910f1f42ff021a0bd727943989d9c3b84b2dd0fcd9b88c35c21bf1f4452a545a39588ce5788feaae0a0777e7f33cc9b0ae351f07d714108be4e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\addonStartup.json.lz4

Filesize
5KB

MD5
218a6ede36bf96da77cbec9b979bf215

SHA1
72a1d0af732a91ebd9344165a25831656aa5d647

SHA256
f37e929262aee0d3e467ededad98ca7c3c5585ae27e04df14943c48ddfec6082

SHA512
36604958489b3017ddd30505d997382def83c991f840caf90b331f04edbffd62f262560327848ef174f0feac6d984efa513acf28a852e913b796d7abd21988e2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\broadcast-listeners.json

Filesize
204B

MD5
72c95709e1a3b27919e13d28bbe8e8a2

SHA1
00892decbee63d627057730bfc0c6a4f13099ee4

SHA256
9cf589357fceea2f37cd1a925e5d33fd517a44d22a16c357f7fb5d4d187034aa

SHA512
613ca9dd2d12afe31fb2c4a8d9337eeecfb58dabaeaaba11404b9a736a4073dfd9b473ba27c1183d3cc91d5a9233a83dce5a135a81f755d978cea9e198209182

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\prefs.js

Filesize
6KB

MD5
688e8418c56f8bc8f8f741f83d478dba

SHA1
72d1d4bf60bfa4641a44f06e268557771d06f357

SHA256
1e0cab9263cf14166ca223a8bb557403d8d52fecae6c51a2766749f0a4339b36

SHA512
1aa4b446947306aa12744f67bf04542b61fccae7ecae3abb6246ca895ad37e0fceadaf4a2353399773d1ce393fcdae7061743a3cc0a086b903690878c87fb33f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
935B

MD5
bdc21bb56ff54e1ff8b39c65be5b999d

SHA1
6f1e9664dd5dbef30c65a9e2fa85558e1e25670f

SHA256
57422c0db3088d119e000b3b6962ebb839fddaec659058b288050369111d7d92

SHA512
fa21facdd7d2fddbce03476099d08f01eb8c17bbf8248a3c93f711138ffe7f1f8cb249fc0aa740714f3d0fec72fe3047c57cc19dba54aa4188f867415dc5d695

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\nmtc1r04.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Filesize
184KB

MD5
ac600e5a474dce7c0daa5a109a669198

SHA1
2e8f21e3f77a225900302c1fe419969dc615b2f2

SHA256
1fd74a0200c1d22f7283cb8b8742321e89fb545ca65a9c7c8975243dd081247f

SHA512
24e5b62a93133b188e75dfd691070761e81bf6abfa828d67dfa201990b8b7e7a9c78d9278dc6a39603ac7f7fe023e92cf93869658b475a1f5901fd5c46842986

Download Submit
C:\Windows\Installer\MSIB710.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSIBB07.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIBDF5.tmp

Filesize
84KB

MD5
94ee5f4e1500435f1d8eba5a54c231ed

SHA1
d8ab879fd681cdbf7cfab010523ab7c950b68e87

SHA256
5fec0c3e5c0dafcb9950eb84e2b5e59a679877bd128bb9cf7290b47ed76f9495

SHA512
10ea6ff3497d13b2f8e4f20e833297603f68f90ff42ac6224933d04aea8fd28365383b414acb513c155e032b642df33cd948ecb321bd337494de62a1b2f523a7

Download Submit
C:\Windows\Installer\MSIC0C4.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIC844.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIC844.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSICB22.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSICDE1.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSICDE1.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSID0A0.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSID0FE.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSID554.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
C:\Windows\Installer\MSID62F.tmp

Filesize
84KB

MD5
94ee5f4e1500435f1d8eba5a54c231ed

SHA1
d8ab879fd681cdbf7cfab010523ab7c950b68e87

SHA256
5fec0c3e5c0dafcb9950eb84e2b5e59a679877bd128bb9cf7290b47ed76f9495

SHA512
10ea6ff3497d13b2f8e4f20e833297603f68f90ff42ac6224933d04aea8fd28365383b414acb513c155e032b642df33cd948ecb321bd337494de62a1b2f523a7

Download Submit
C:\Windows\Installer\MSIDC0B.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIDF08.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIDF38.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSIEBF6.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSIEEC4.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSIEEE4.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSIF26E.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIF31B.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIF4C1.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIF7BE.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSIFA6E.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\APIFile_8.ico

Filesize
288KB

MD5
7db5afdff5369aff13559810ce3cb3ff

SHA1
0241c6a9c1efc3b8776c762b94a77bb166f47903

SHA256
fd2f0d47e3d7024496f4c84d770dcf76b47154d9e195c6fc6424cdb265e91c5d

SHA512
f99b07d031a2dd168fe322792d033790c4977c32dc9845fe0a23d6f1cc2cf7e63178066c1804870cf54b8d09511b573d37010015099b1929aa1620339a51b426

Download Submit
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\FDFFile_8.ico

Filesize
288KB

MD5
978ee8389c1db28afc725eb2bae4934c

SHA1
1857419efe7dbcd200c2431a9b066dccb414409e

SHA256
738a47a0a877ec50fe42b9ea4f350674f54f799789f685176acc8b15bb23f89e

SHA512
ad1075b47145c8be735cea8badb8d3e5e2c18849d07de4e91d5eb41ce2e6f030a9a6f7df43d122212a9c87af699fa391badc3b5f6c1e76aeca0a7672d7ff0861

Download Submit
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFile_8.ico

Filesize
288KB

MD5
bfdd2c458a143f4d2209c78d8c9b8871

SHA1
59fdd2a4a6613d6582502cfe127de74890da7fec

SHA256
d5741e41b534670435fb6908a687f622abd8616b9057cf104730da2ba7fc53ce

SHA512
17bf4da5c2c85db84be896201d3cbdcc64be29bd9b8f5851169501634f4cab2b23624bcc3b4101b868dfccbacdded35b31fe35b61e51f6ce875159f9c62adfef

Download Submit
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDXFile_8.ico

Filesize
288KB

MD5
e9dac60a98b0ec9845e85c3bab47dc9e

SHA1
fc3de7f919c3d252200c076f39fc5f1c50ef100f

SHA256
67effe324cd9cfd6305f133f73132f395db80610d021ec49c034be8787427865

SHA512
5eb58d770342885417e8c2369118f9a8bd97a0a6791ce80fe41dcbbee2e6ea1b18b7b28bc3b0f8281e7a9cb1eba6bfdf26d4f49f0af93c69d8437949b4e27a2c

Download Submit
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe

Filesize
288KB

MD5
01bbe782a1da233c59881ed2d18f4f06

SHA1
723d4dfdab2b477633455d4775e32bd52f081c7b

SHA256
7ded5e3c9c066789a50305a048639afeab4dffcc9673ae7f1092e5af7c6a91b1

SHA512
492b202ab850c4f120c4ac7854bf7e7acc865505679d8973736ed3ea28f4b77b645c8a15d806805064ebc81ebd1b4bf07e1fd4023307673d3ce4b81d49c7d175

Download Submit
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SecStoreFile.ico

Filesize
288KB

MD5
6bf1b2146ba3540545448a926ff40165

SHA1
66b963a3f0e97eb71492843a68ac3267b61930d3

SHA256
02e55933849f8531e8962b00e4cbce4ea15a02601a59ae1a5391db50351320a3

SHA512
3d5885b62493f2d1f5cc5cc4d5cb7df275aa32d0d895b6aa0c88d4998dd069fad3a721e55b848ad86e89d9864a48faa39166de2022b2f23e44a29779b6e3a49a

Download Submit
C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\XDPFile_8.ico

Filesize
288KB

MD5
4f09f865a9fd5d8f05cb77b6ea920eb5

SHA1
83e702dfe668f12f4c351e4114af85bdffb08003

SHA256
602bdde954c8a106a09260eb1b03fb2df8aba378716de04528aa4c3b33a68ab4

SHA512
94307e522ed4db259549394f24ff41a78c5c6400080d6cd98098a79c33ac1bfe80022d30f8d2c5e73c8ec74d313793e7d175025b695aa57595b4de3654c59201

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll

Filesize
3.5MB

MD5
73268e1e7631874e7a0bee23401ab33c

SHA1
d7f83969a451d0de4a63222de728372c60f2d8dd

SHA256
bc4f488a26fd622c64f01e579d74b27047ada3e26a73ae8529222b1b8029d04e

SHA512
2b9f8e2c69393370e8940082adee9aa52e8fd1e4f899dbda58790af0cf7c8d0c7bed2ab6e0f528a95d8a04bbe82b29e16fdf31ba26b012af03535a9c852cd5d4

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll

Filesize
92KB

MD5
bffee4f37b42ba3d2a45f99862dae391

SHA1
3673487da9c5b8b2402fd190f981c279d5fed7a8

SHA256
f51ab4da2b60760c654318f84fff0f62ddafc1f33f4327d13e74e80d6df24412

SHA512
f64f343ae84147f1465488a3fb36108ae1f163eac900a55720165ad24b9b271d861897070cb258a97210b49141d68b16677ed8f9e919a561e5c882249acc32be

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Reader\icudt36.dll

Filesize
92KB

MD5
bffee4f37b42ba3d2a45f99862dae391

SHA1
3673487da9c5b8b2402fd190f981c279d5fed7a8

SHA256
f51ab4da2b60760c654318f84fff0f62ddafc1f33f4327d13e74e80d6df24412

SHA512
f64f343ae84147f1465488a3fb36108ae1f163eac900a55720165ad24b9b271d861897070cb258a97210b49141d68b16677ed8f9e919a561e5c882249acc32be

Download Submit
\Windows\Installer\MSIB710.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
\Windows\Installer\MSIBB07.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSIBDF5.tmp

Filesize
84KB

MD5
94ee5f4e1500435f1d8eba5a54c231ed

SHA1
d8ab879fd681cdbf7cfab010523ab7c950b68e87

SHA256
5fec0c3e5c0dafcb9950eb84e2b5e59a679877bd128bb9cf7290b47ed76f9495

SHA512
10ea6ff3497d13b2f8e4f20e833297603f68f90ff42ac6224933d04aea8fd28365383b414acb513c155e032b642df33cd948ecb321bd337494de62a1b2f523a7

Download Submit
\Windows\Installer\MSIC0C4.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSIC844.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSICB22.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
\Windows\Installer\MSICDE1.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
\Windows\Installer\MSID0A0.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSID0FE.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSID554.tmp

Filesize
28KB

MD5
85221b3bcba8dbe4b4a46581aa49f760

SHA1
746645c92594bfc739f77812d67cfd85f4b92474

SHA256
f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f

SHA512
060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d

Download Submit
\Windows\Installer\MSID62F.tmp

Filesize
84KB

MD5
94ee5f4e1500435f1d8eba5a54c231ed

SHA1
d8ab879fd681cdbf7cfab010523ab7c950b68e87

SHA256
5fec0c3e5c0dafcb9950eb84e2b5e59a679877bd128bb9cf7290b47ed76f9495

SHA512
10ea6ff3497d13b2f8e4f20e833297603f68f90ff42ac6224933d04aea8fd28365383b414acb513c155e032b642df33cd948ecb321bd337494de62a1b2f523a7

Download Submit
\Windows\Installer\MSIDC0B.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSIDF08.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSIDF38.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
\Windows\Installer\MSIEBF6.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
\Windows\Installer\MSIEEC4.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
\Windows\Installer\MSIEEE4.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
\Windows\Installer\MSIF26E.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSIF31B.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSIF4C1.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSIF7BE.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
\Windows\Installer\MSIFA6E.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
memory/1476-616-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/1476-626-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/1476-624-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/1476-613-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/1476-622-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/1476-619-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/2444-137-0x0000000001F90000-0x0000000001F9A000-memory.dmp

Filesize
40KB

Download
memory/2444-138-0x0000000001F90000-0x0000000001F9A000-memory.dmp

Filesize
40KB

Download
memory/2444-102-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download
memory/2444-103-0x0000000001C80000-0x0000000001C8A000-memory.dmp

Filesize
40KB

Download
memory/2444-197-0x0000000001F90000-0x0000000001F9A000-memory.dmp

Filesize
40KB

Download
memory/2444-104-0x0000000001C80000-0x0000000001C8A000-memory.dmp

Filesize
40KB

Download
memory/2444-174-0x0000000001C70000-0x0000000001C71000-memory.dmp

Filesize
4KB

Download
memory/2796-599-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/2796-602-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/2796-597-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/2796-595-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/2796-605-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/2796-592-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/2928-607-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/2928-615-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/2928-601-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/2928-604-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/2928-612-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/2928-621-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/3044-586-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/3044-551-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/3044-589-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/3044-554-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/3044-546-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/3044-584-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/3104-628-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/3104-630-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/3104-631-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/3104-632-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/3104-633-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/3104-623-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/3164-629-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/3164-627-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/3164-617-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/3164-625-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/3192-606-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/3192-618-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/3192-608-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/3192-611-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/3192-614-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/3192-620-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/3212-593-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/3212-603-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/3212-596-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/3212-600-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/3212-588-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/3212-598-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/3236-590-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/3236-583-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/3236-587-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/3236-574-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/3236-580-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/3236-577-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/3252-594-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/3252-591-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/3252-558-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/3252-585-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/3252-555-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/3252-556-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download
memory/3260-573-0x000007FEF4D20000-0x000007FEF4D38000-memory.dmp

Filesize
96KB

Download
memory/3260-579-0x000007FEF3FB0000-0x000007FEF3FC1000-memory.dmp

Filesize
68KB

Download
memory/3260-578-0x000007FEF4520000-0x000007FEF4537000-memory.dmp

Filesize
92KB

Download
memory/3260-560-0x000007FEF3FD0000-0x000007FEF4284000-memory.dmp

Filesize
2.7MB

Download
memory/3260-557-0x000000013F400000-0x000000013F4F8000-memory.dmp

Filesize
992KB

Download
memory/3260-559-0x000007FEF4D40000-0x000007FEF4D74000-memory.dmp

Filesize
208KB

Download