666859e6c3724513d033e3197dc7efb8736f690eb15603210813a9e5b761d2c7

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/08/2024, 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AdobeReader 10.exe
Size

45.7MB
MD5

4b2f2dd39efca7ab7d69ad6735a26ffc
SHA1

3d5b75ae4bd60262aaacfb35c852e31dd8ade37f
SHA256

666859e6c3724513d033e3197dc7efb8736f690eb15603210813a9e5b761d2c7
SHA512

56b6554f24746f18d742f962f6635649318d0dfaff399853814e4fff22efe9f141eb3bb6455f240fdd9e5eeebf324b0771e3dab3b0b0e18a193180b395fcdfb4
SSDEEP

786432:nUKocG8JHLygNDq4dIQO6kOm256ddCpTe50HWS3Burn0AwdokgFLSw3:RocfLtNDMQDYBXEe0HWJ0A17Sk

Score

8^/10

adware defense_evasion discovery persistence stealer

Malware Config

Signatures

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe

Executes dropped EXE 2 IoCs

pid	Process
2912	setup.exe
1832	Adobe_Updater.exe

Loads dropped DLL 64 IoCs

pid	Process
1708	AdobeReader 10.exe
3000	MsiExec.exe
3000	MsiExec.exe
3000	MsiExec.exe
3000	MsiExec.exe
3000	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
1388	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
1296	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe ARM = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\NoChange = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\Installed = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Reader_sl.exe\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\Installed = "1"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\Installed = "1"	msiexec.exe

Blocklisted process makes network request 3 IoCs

flow	pid	Process
3	2792	msiexec.exe
14	2684	msiexec.exe
16	2684	msiexec.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	msiexec.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 4 IoCs

remove IFEO.

defense_evasion

Clear Persistence

T1070.009

description	ioc	Process
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe	msiexec.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\NoExplorer = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "AcroIEHelperStub"	msiexec.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Elevation.tmp	MsiExec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\forms_distributed.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Acrofx32.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\A3DUtils.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\DEXShare.spi	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Flash.ESP	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Services\Services.asfx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\spn.hyp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroTextExtractor.exe	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Flash.ESP	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Services\DEXShare.asfx	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.es_VE.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Resource\CMap\Identity-V	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\Services.cfg	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\review_email.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins3d\3difr.x3d	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\adoberfp.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Mcimpp.ESP	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.es_BO.txt	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AGMGPUOptIn.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\server_ok.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\ended_review_or_form.gif	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\cryptocme2.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.ESP	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Spelling.ESP	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.es_PE.txt	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ESP\Dynamic.pdf	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\form_responses.gif	msiexec.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\cryptocme2.sig	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Legal\ESP\eula.ini	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\IA32.api	msiexec.exe
File created	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Acroform.ESP	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\DVA.ESP	msiexec.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI3292.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\nppdf32.dll_Apollo	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\dexshare.asfx4	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\eBook.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\CacheSize.txt	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\WindowsMedia.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\WindowsMedia.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Checkers.ESP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\DVA.ESP	msiexec.exe
File created	C:\Windows\Installer\f772793.msi	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroPDF.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroRd32Info.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Updater.api_NON_OPT	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroRd32.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AGM.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\PPKLite.api	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI52F2.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240816231028135.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Flash.mpp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7728.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\ViewerPS.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Spelling.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Checkers.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroForm.api__NON_OPT	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7952.tmp	msiexec.exe
File created	C:\Windows\Installer\f772636.msi	msiexec.exe
File created	C:\Windows\Installer\f772637.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DE9.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AGM.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\QuickTime.mpp	msiexec.exe
File created	C:\Windows\Installer\f772794.msp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\eula.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7796.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\APIFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FAF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\services.cfg	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\accessibility.ESP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\nppdf32.ESP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\EScript.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Spelling.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\PPKLITE.ESP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\eBook.ESP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\CacheSize.txt	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4B50.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\_difr.x3d	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\makeaccessible.ESP	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\_d.x3d	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\authplay.dll	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Annots.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\pddom.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2E17.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Search.api	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\DigSig.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\XDPFile_8.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D6C.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240816231028135.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20240816231028135.0\msvcm90.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\accessibility.ESP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30FA.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Adobe_Updater.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeReader 10.exe

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\AppName = "AcroRd32Info.exe"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08E8D305-8D6D-49fe-8603-03A926E46AE0}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\"	msiexec.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591 = "Windows Easy Transfer Reports"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10059 = "Mahjong Titans"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10103 = "Internet Spades"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\msconfig.exe,-126 = "System Configuration"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\sud.dll,-1 = "Default Programs"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10103 = "Internet Spades"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10209 = "More Games from Microsoft"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\AccessibilityCpl.dll,-10 = "Ease of Access Center"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10054 = "Chess Titans"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005 = "Desktop Gadget Gallery"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-102 = "Windows PowerShell ISE (x86)"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10061 = "Spider Solitaire"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-737 = "Internet Explorer (No Add-ons)"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wucltux.dll,-1 = "Windows Update"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505 = "Sticky Notes"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10209 = "More Games from Microsoft"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet."	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10102 = "Internet Backgammon"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074 = "Windows Journal"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10061 = "Spider Solitaire"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\ehome\ehres.dll,-100 = "Windows Media Center"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\DVD Maker\DVDMaker.exe,-61403 = "Windows DVD Maker"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10082 = "Games Explorer"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Disk Defragmenter"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310 = "Data Sources (ODBC)"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Firewall with Advanced Security"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\rstrui.exe,-100 = "System Restore"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe,-298 = "Personalize Handwriting Recognition"	msiexec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501 = "Connect to a Network Projector"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000 = "Sync Center"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4 = "Windows Media Player"	msiexec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10060 = "Solitaire"	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ProxyStubClsid32\ = "{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\NumMethods	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ColumnHandlers	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithList\AcroRd32.exe	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\VersionIndependentProgID	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\4	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E9-4981-101B-9CA8-9240CE2738AE}\ = "CAcroAVPageView"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\TypeLib	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0000000010\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Adobe.AcrobatSearch	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\5	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.pdfxml.1\shell\Open	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\ = "PSFactoryBuffer"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\TypeLib\Version = "1.0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{46B89F5A-769D-4792-AD9A-E3755915CBC3}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings.1\shell	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFShell.PDFShell.1\ = "Adobe PDF Shell Extension "	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD069A1-50AA-11D1-B8F0-00A0C9259304}\ = "AFormApp Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroExch.pdfxml.1\shell\Open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\0\win32	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\ProxyStubClsid32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDXFileType\shell\ = "Read"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker\ = "Broker Class"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\Programmable	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E8-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFShellServer.PDFShellInfo\CLSID\ = "{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfd+xml	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03C2AEA5-BEFA-4C84-A187-C9245AC784F6}\TypeLib\ = "{C523F390-9C83-11D3-9094-00104BD0D535}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pdf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\TypeLib\ = "{2991F100-D9C3-4243-82A2-A718747FC0CF}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\AcroIEHelperShim.AcroIEHelperShimObj.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PDFPrevHndlr.PDFPreviewHandler.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0\0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\protocol\StdFileEditing\RequestDataFormats	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\TypeLib\ = "{BE79C475-D632-4A57-91B3-DA044FA27CDA}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroPDF.PDF.1\	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.pdx	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F9DB5320-233E-11D1-9F84-707F02C10627}\InprocServer32	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{E64169B3-3592-47d2-816E-602C5C13F328}\1.1	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E8-4981-101B-9CA8-9240CE2738AE}\ = "CAcroAVDoc"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3F0-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{673E8452-7646-11D1-B90B-00A0C9259304}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroAccess.AcrobatAccess\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PDFPrevHndlr.PDFPreviewHandler.1\CLSID\ = "{DC6EFB56-9CFA-464D-8880-44885D7DC193}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F226421-415D-408D-9A09-0DCD94E25B48}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3000	MsiExec.exe
3000	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
1940	MsiExec.exe
2756	MsiExec.exe
2756	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2792	msiexec.exe
Token: SeRestorePrivilege	2684	msiexec.exe
Token: SeTakeOwnershipPrivilege	2684	msiexec.exe
Token: SeSecurityPrivilege	2684	msiexec.exe
Token: SeCreateTokenPrivilege	2792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2792	msiexec.exe
Token: SeLockMemoryPrivilege	2792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2792	msiexec.exe
Token: SeMachineAccountPrivilege	2792	msiexec.exe
Token: SeTcbPrivilege	2792	msiexec.exe
Token: SeSecurityPrivilege	2792	msiexec.exe
Token: SeTakeOwnershipPrivilege	2792	msiexec.exe
Token: SeLoadDriverPrivilege	2792	msiexec.exe
Token: SeSystemProfilePrivilege	2792	msiexec.exe
Token: SeSystemtimePrivilege	2792	msiexec.exe
Token: SeProfSingleProcessPrivilege	2792	msiexec.exe
Token: SeIncBasePriorityPrivilege	2792	msiexec.exe
Token: SeCreatePagefilePrivilege	2792	msiexec.exe
Token: SeCreatePermanentPrivilege	2792	msiexec.exe
Token: SeBackupPrivilege	2792	msiexec.exe
Token: SeRestorePrivilege	2792	msiexec.exe
Token: SeShutdownPrivilege	2792	msiexec.exe
Token: SeDebugPrivilege	2792	msiexec.exe
Token: SeAuditPrivilege	2792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2792	msiexec.exe
Token: SeChangeNotifyPrivilege	2792	msiexec.exe
Token: SeRemoteShutdownPrivilege	2792	msiexec.exe
Token: SeUndockPrivilege	2792	msiexec.exe
Token: SeSyncAgentPrivilege	2792	msiexec.exe
Token: SeEnableDelegationPrivilege	2792	msiexec.exe
Token: SeManageVolumePrivilege	2792	msiexec.exe
Token: SeImpersonatePrivilege	2792	msiexec.exe
Token: SeCreateGlobalPrivilege	2792	msiexec.exe
Token: SeCreateTokenPrivilege	2792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2792	msiexec.exe
Token: SeLockMemoryPrivilege	2792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2792	msiexec.exe
Token: SeMachineAccountPrivilege	2792	msiexec.exe
Token: SeTcbPrivilege	2792	msiexec.exe
Token: SeSecurityPrivilege	2792	msiexec.exe
Token: SeTakeOwnershipPrivilege	2792	msiexec.exe
Token: SeLoadDriverPrivilege	2792	msiexec.exe
Token: SeSystemProfilePrivilege	2792	msiexec.exe
Token: SeSystemtimePrivilege	2792	msiexec.exe
Token: SeProfSingleProcessPrivilege	2792	msiexec.exe
Token: SeIncBasePriorityPrivilege	2792	msiexec.exe
Token: SeCreatePagefilePrivilege	2792	msiexec.exe
Token: SeCreatePermanentPrivilege	2792	msiexec.exe
Token: SeBackupPrivilege	2792	msiexec.exe
Token: SeRestorePrivilege	2792	msiexec.exe
Token: SeShutdownPrivilege	2792	msiexec.exe
Token: SeDebugPrivilege	2792	msiexec.exe
Token: SeAuditPrivilege	2792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2792	msiexec.exe
Token: SeChangeNotifyPrivilege	2792	msiexec.exe
Token: SeRemoteShutdownPrivilege	2792	msiexec.exe
Token: SeUndockPrivilege	2792	msiexec.exe
Token: SeSyncAgentPrivilege	2792	msiexec.exe
Token: SeEnableDelegationPrivilege	2792	msiexec.exe
Token: SeManageVolumePrivilege	2792	msiexec.exe
Token: SeImpersonatePrivilege	2792	msiexec.exe
Token: SeCreateGlobalPrivilege	2792	msiexec.exe
Token: SeCreateTokenPrivilege	2792	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2792	msiexec.exe
2792	msiexec.exe
2792	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1708	AdobeReader 10.exe
1708	AdobeReader 10.exe
1708	AdobeReader 10.exe
2912	setup.exe
2912	setup.exe
2912	setup.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1708 wrote to memory of 2912	1708	AdobeReader 10.exe	30
PID 1708 wrote to memory of 2912	1708	AdobeReader 10.exe	30
PID 1708 wrote to memory of 2912	1708	AdobeReader 10.exe	30
PID 1708 wrote to memory of 2912	1708	AdobeReader 10.exe	30
PID 1708 wrote to memory of 2912	1708	AdobeReader 10.exe	30
PID 1708 wrote to memory of 2912	1708	AdobeReader 10.exe	30
PID 1708 wrote to memory of 2912	1708	AdobeReader 10.exe	30
PID 2912 wrote to memory of 2792	2912	setup.exe	31
PID 2912 wrote to memory of 2792	2912	setup.exe	31
PID 2912 wrote to memory of 2792	2912	setup.exe	31
PID 2912 wrote to memory of 2792	2912	setup.exe	31
PID 2912 wrote to memory of 2792	2912	setup.exe	31
PID 2912 wrote to memory of 2792	2912	setup.exe	31
PID 2912 wrote to memory of 2792	2912	setup.exe	31
PID 2684 wrote to memory of 3000	2684	msiexec.exe	33
PID 2684 wrote to memory of 3000	2684	msiexec.exe	33
PID 2684 wrote to memory of 3000	2684	msiexec.exe	33
PID 2684 wrote to memory of 3000	2684	msiexec.exe	33
PID 2684 wrote to memory of 3000	2684	msiexec.exe	33
PID 2684 wrote to memory of 3000	2684	msiexec.exe	33
PID 2684 wrote to memory of 3000	2684	msiexec.exe	33
PID 2684 wrote to memory of 1940	2684	msiexec.exe	38
PID 2684 wrote to memory of 1940	2684	msiexec.exe	38
PID 2684 wrote to memory of 1940	2684	msiexec.exe	38
PID 2684 wrote to memory of 1940	2684	msiexec.exe	38
PID 2684 wrote to memory of 1940	2684	msiexec.exe	38
PID 2684 wrote to memory of 1940	2684	msiexec.exe	38
PID 2684 wrote to memory of 1940	2684	msiexec.exe	38
PID 2684 wrote to memory of 2756	2684	msiexec.exe	39
PID 2684 wrote to memory of 2756	2684	msiexec.exe	39
PID 2684 wrote to memory of 2756	2684	msiexec.exe	39
PID 2684 wrote to memory of 2756	2684	msiexec.exe	39
PID 2684 wrote to memory of 2756	2684	msiexec.exe	39
PID 2684 wrote to memory of 2756	2684	msiexec.exe	39
PID 2684 wrote to memory of 2756	2684	msiexec.exe	39
PID 2756 wrote to memory of 1832	2756	MsiExec.exe	40
PID 2756 wrote to memory of 1832	2756	MsiExec.exe	40
PID 2756 wrote to memory of 1832	2756	MsiExec.exe	40
PID 2756 wrote to memory of 1832	2756	MsiExec.exe	40
PID 2756 wrote to memory of 1832	2756	MsiExec.exe	40
PID 2756 wrote to memory of 1832	2756	MsiExec.exe	40
PID 2756 wrote to memory of 1832	2756	MsiExec.exe	40
PID 2684 wrote to memory of 1388	2684	msiexec.exe	41
PID 2684 wrote to memory of 1388	2684	msiexec.exe	41
PID 2684 wrote to memory of 1388	2684	msiexec.exe	41
PID 2684 wrote to memory of 1388	2684	msiexec.exe	41
PID 2684 wrote to memory of 1388	2684	msiexec.exe	41
PID 2684 wrote to memory of 1388	2684	msiexec.exe	41
PID 2684 wrote to memory of 1388	2684	msiexec.exe	41
PID 2684 wrote to memory of 1296	2684	msiexec.exe	44
PID 2684 wrote to memory of 1296	2684	msiexec.exe	44
PID 2684 wrote to memory of 1296	2684	msiexec.exe	44
PID 2684 wrote to memory of 1296	2684	msiexec.exe	44
PID 2684 wrote to memory of 1296	2684	msiexec.exe	44
PID 2684 wrote to memory of 1296	2684	msiexec.exe	44
PID 2684 wrote to memory of 1296	2684	msiexec.exe	44

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\AdobeReader 10.exe
"C:\Users\Admin\AppData\Local\Temp\AdobeReader 10.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708
- C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\setup.exe
  "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\setup.exe" /msi DISABLE_CACHE=1
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\msiexec.exe
    msiexec.exe /i "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\AcroRead.msi" DISABLE_CACHE=1 REBOOT="ReallySuppress" PATCH="C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\AdbeRdrUpd1001_Tier2.msp"
    3⤵
    - Blocklisted process makes network request
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2792

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Blocklisted process makes network request
- Drops desktop.ini file(s)
- Enumerates connected drives
- Indicator Removal: Clear Persistence
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A3DF8942714E857A7DF800A7244927F4 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B1D0275951A46EE9DC9D8181AD3C24C9
  2⤵
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 86C7A827D0AAF40E3493974D25FCF403 M Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe
    "C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=5
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1832
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Z "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1388
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\authplay.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:1296

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:832

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D8" "00000000000005D0"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Browser Extensions

T1176

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\PT5459.tmp

Filesize
420KB

MD5
c406f0e2e22c2591a36a1b28fadb6d78

SHA1
48667934c6ef6f6b8d2638b265166076f1cf3471

SHA256
b673388af42c4241d987fd7b7b0b829758734f16022d798b56b27f0dcd84d228

SHA512
27554b51544380b6f11fb99d9a3af64ac846817bf6b037432f6ed05892a9e410a91e1d221d6767a9a4c9240df161ee22f9a83772f11729e16e1f6c844e32abed

Download Submit
C:\Config.Msi\PT545A.tmp

Filesize
1.5MB

MD5
6166b03a18b0e34c9d5d6005967a3a61

SHA1
d9cf925e2ff3ebe11be5f8ed17e8cf100d5c51fc

SHA256
56f95bd8d0230d08e980dac4243cb6ed4c681ccfafa688f1d7d811325d6f00ce

SHA512
5b33c150f370cc1d7826996f577f0993d3b87278d979de97075cd842d841f2b343fd9e6f095e0152851073018cf09bf509a8be833a6707760c741fb4a70bbf10

Download Submit
C:\Config.Msi\PT546C.tmp

Filesize
2KB

MD5
8f767b8effdf18cac9188949f2665fcc

SHA1
06191bf81fb84903331ec58ad356388b9170aa0d

SHA256
d7e9c18b21634f064c1931b6c898697f85c6157d0fe503af2397f31ce0b0c295

SHA512
72bdd098f129e19b932a30f650f12584439501dd65679a6c4da543501c5b1f2caa52d423223c235443b937a636f10706d705a499a354c1b30a6642cd2bb3a22d

Download Submit
C:\Config.Msi\PT546D.tmp

Filesize
8KB

MD5
8a45a8023757ebfedccd275177f86b81

SHA1
0adebacc7f2fcf958f797fd818fb7963b29d4fc7

SHA256
13c5ff97b3e33d1d508e3f40305d327fb1e63e6d8ef833bfdb484ccd91311f44

SHA512
4306499e363910ab9e87388f738a7d2ffac05df12ef0c6842232950bd6cad654dea9e9278d3653d705837a8e0b98b6a9a29bbc51c39efc11745e3754b25b3a27

Download Submit
C:\Config.Msi\PT547E.tmp

Filesize
2KB

MD5
aa1dc94fd7841f026c66314d06802c5a

SHA1
5b2cc203e632a197cd60129d4241eb8b203f4777

SHA256
610afbe4b0dd37d9686b00eb759319974ac5553bbb3e69ef104e43e32eb54f40

SHA512
6b77c7933d5a341d5b3553cd850bc147288405368be2e04844549e47c56f455bfa36c9891cdbd280b4bf8609622bce27d175d10ac9e8f851ed1b37737f454810

Download Submit
C:\Config.Msi\PT547F.tmp

Filesize
2KB

MD5
0e7cae9ef0618016a017933473240bc4

SHA1
b6015175db8802b4750894955e89f81024b1d0d1

SHA256
86787220a61f27119ee702514cb5f5a90ad9476545758ae56243e742a4e546dd

SHA512
0063b90af889ede358e1c02211451e1e03862687abc5635b2827850945dfb1e8194d628281e22eab6da7f45030d3c45dc8875391f607f9aa800826f9fd943e8c

Download Submit
C:\Config.Msi\PT5480.tmp

Filesize
272KB

MD5
f24c83401d5c70b5a9cd387ecfbbac21

SHA1
7b2f803e68863c12eb69a476c261e7d66c464bbe

SHA256
ac4b1a22a45720e77bd65c371057a5df4f382aac8cdea969cdeb73fdd1b352d5

SHA512
c70cd55e2bce4811e0e31e09274590ed2362068aadb5578551e9d7e7899bf0c28eddc027baa6d5001cc6452909b31b5218e9b8984c8ab8ac48324b4d57577869

Download Submit
C:\Config.Msi\PT5490.tmp

Filesize
213KB

MD5
5059a247666159bf441e72d642213cf9

SHA1
29301805956decb2ad36f574b1af900650426cef

SHA256
a5637d50cfc9acd2d596f78c8a2bbc6ff2afc7c96f3915ff869bb147c2abeb2f

SHA512
73997db04c88e6156e5ff234284a5b4c2cd0a6af4396b4268e32233f8ddf7916f0b3a96424dab468ca4c063429a1d6c9e6f10d68f71ec75d2a0ddf7a34b9cdd1

Download Submit
C:\Config.Msi\PT5491.tmp

Filesize
91KB

MD5
52517f9c2f895b6d5b49521088dfb5e5

SHA1
077c4535d93f7d3d8acf50ef9a5c780430f84abb

SHA256
b654cebab8c8d7ae01c315aad66c2746bf8514c5973e34421d218e5bc81a2d3c

SHA512
49094d79036e1f5121b0509c5bc9703bdd31497378aa8f488fa5a0c27a639701ede63a1865bedcb964d5169899489bff05bba274575c043f9f94684e3649f572

Download Submit
C:\Config.Msi\PT5492.tmp

Filesize
118KB

MD5
e2c8e69ee9d877e6688bdd6bffbe07e4

SHA1
fd10464f3614c7ea91fd57fa0142e3304d469049

SHA256
a1d05675051e2ee543a6eaeb120275d5364303282587b940e645c087b1c9a5d4

SHA512
2a232867f5831636365feaf60d550d4dcf88050749ed30b820f5d4a1315e1badbecd26591fbb12ccbc1e2c38884becda7756473d7fda61222c331cda65ef699b

Download Submit
C:\Config.Msi\PT54A3.tmp

Filesize
7KB

MD5
fdb91a81b12c8479e449bcaeb85903fc

SHA1
cfafdd1323a90ae5b959cc14c1e3369cb1ae60f1

SHA256
587e1a09582af5b649386f47845d3b9f135480e1d8120071a1e679594945a9e0

SHA512
bb9f19d7d621eb3e21b2feba70c9d4f402272ccfc780f145174bc181c44a7c977ffe337bc2cb1981ef1bd32b8199c2b538b814438f109e570348990f038b358e

Download Submit
C:\Config.Msi\PT54C7.tmp

Filesize
60KB

MD5
0ee9e4d28cc1c671061cad0334c9b59f

SHA1
75747ea76f64900e99f9c963da713d054f8e8081

SHA256
93218971e299fe40b953e8a0aa809149bfbd1ceae5902710bc5f8ccd51dcb0e6

SHA512
1a75babaeb9e84d0c01cece224eff40d1c57d15e40f0898683ff8992639d67ad8abe583505c86691764c2b863817f3902474bf10dd6006d3572ee7207b706a98

Download Submit
C:\Config.Msi\PT54D8.tmp

Filesize
44KB

MD5
25caae1b2884bf6d0ce72c844ca6d655

SHA1
4ba9b1e940b3fc34b26a0d827850942331212a61

SHA256
696ab4305901cdc9cb6cfade3019a4d4e6b3b311f43f8a88ca5d409dfaf738a9

SHA512
1fa9a0bd83e42cde0fb33381fddc98703552e694a828714d4ed54683df56a2b436b16686d929ee4dba6c95f416c34aa84250dc7657319013f5adc4e6f5d8228e

Download Submit
C:\Config.Msi\PT54E8.tmp

Filesize
11KB

MD5
5752c08f3ea019fcd9624e258ac30513

SHA1
c9e7f24de3f5763513b3401f3e5d3ffcf36422d0

SHA256
6f3540c99320184244f8fbc9c012e08f887b200810882346038170745856c49e

SHA512
6a558b166a9094e3e349a4bbfe9fa9740547bbea678704305b1ba248b724a63b53457ea0815221f74d5b69b312ad8fe3464e7848e58b7b689b04bfd7a4b18914

Download Submit
C:\Config.Msi\PT54E9.tmp

Filesize
4KB

MD5
0259ebb19401b2ff7d63779b491a5898

SHA1
169a384a6136476a68629b779fcdf66bade7db25

SHA256
cd122cc34e0c474833322c958a4c35b5b3d96fe8be14b9b7ea536fbe4d395dbc

SHA512
075d13e642fdbe2283506cb16baaad3382f48049610026103cac2fafa84e798e0040b0fd80b47962c9e725d349de0da7e4b22f4404d9e23061544af8e41b4fa0

Download Submit
C:\Config.Msi\PT54EA.tmp

Filesize
396KB

MD5
726ee22a0acbae712dbc0d6bb031f02d

SHA1
5f5cde6370a971411318509245265bce215572bf

SHA256
b800e2bf2b5d49f06a7a780f18b232178e717097c0503147b06daabb533b9ddc

SHA512
85bf01c042f49e653d9a4415ec07a23041ea10cce8d011f79fefe7020c6c189e1075bbd33b037dd06c5df57dbc8ae14bebe5f7b01a3bb2995d8b99fa6b8cb859

Download Submit
C:\Config.Msi\PT54FB.tmp

Filesize
81KB

MD5
bc12c8727dfabff44619ac651e5e4d05

SHA1
6a9e0e593e279ba3c04a9ba4c1578267eff5f18a

SHA256
27165d01a0e807c280c6078306c702edaf84ff67276b06398bf8fa9b74feeace

SHA512
be6891ecbe46b0bb69ecdb387b9527eb53b7a9b6ea0904e2a858c78f72dddc7b0538787ca4e85a934ae703a046520f6bdc7b966733a621a998e3e1ece33dda5f

Download Submit
C:\Config.Msi\PT54FC.tmp

Filesize
420KB

MD5
2769affad441ee7a919b428e9ab0f865

SHA1
d755e315d6b81f6882ebaa87f7888be5850c29d5

SHA256
5dde8141f6681827dc2367bb724e44c1e2c6449ef582ea222fbfc4960b6d7caf

SHA512
fde5ff5df4cb598e9a253e59b55132b11ad2453c5af3575c2280a3c067a02041d7a03fe4d4c94daaaed44ea3ae422008e31619759ff58ffc10f15a56f829c185

Download Submit
C:\Config.Msi\PT54FD.tmp

Filesize
18KB

MD5
2303a6ad453f906c2e1e2c003f2e97f1

SHA1
f0d2af5b3b3b5eb06137ca36726ea8cf794b5ba2

SHA256
0c2ddaf207f4b83dd9c766115e471d6d416d6f116910dab9c63d67eed8cb3639

SHA512
a02e6540754d127e823fd8aa81ede1c0908020bff208c9ae227eff9fca863c649dd3d4de59e794eaac4fbc3d7165fe2f9ff3e68e6d58cff1dbb207d6cd7b7c73

Download Submit
C:\Config.Msi\PT550D.tmp

Filesize
339KB

MD5
f0407b1d6a2c627ad6ac114aa35f2a54

SHA1
7c174a6b39d04e5cbb3e2841b8f7b8965d7a3b05

SHA256
5e3dd1b3b97c27c6b5b58608f122247bf5594ec7fe9c5fac99555dc118996084

SHA512
2b73326f676ad34d3655bb909b28b386def52e6c961de1b079906e89f0bd59c116197ef058bfd286d59eca575570320d62e9f5fb6b8eca25a393122fb579de1e

Download Submit
C:\Config.Msi\PT550E.tmp

Filesize
507KB

MD5
5a4140491263d37505776123f77235c1

SHA1
d82c31f1a46e820be1e0d655b21d5e15242d9a8b

SHA256
df6489d0e2304dfdc19f07f6c5a312fb89d7449358b4a6414ebe3ffad0cf9ad0

SHA512
2c30d4d56731600fe7ef1130ab5b5d97c1a914ac2404006d2d6591a1dfa66b83ba84ee03acf234d61f9aa7ef7d8e38f63e9dd8812c083b2347fefc1607bc7e19

Download Submit
C:\Config.Msi\PT550F.tmp

Filesize
212KB

MD5
e1fc45321c24b28102b93a1589ddd803

SHA1
1622a64d5bb6970938b6843e37e128134ac1624d

SHA256
b0fc26852d54b0ff07d010b5c0668e40c5f086caf05d50125550a9f07e4bacb7

SHA512
3060c8b250dda1d99acba01ae245bf4ca89d321320fc43b435f86d87f929925b055b85a952b2e1a690cc0df0f689771a1de4aa942d810c4d7f7c186bb3240b2e

Download Submit
C:\Config.Msi\PT5520.tmp

Filesize
21KB

MD5
46c274f7e02cef2a2f11418bdf92687c

SHA1
edde0bed32f4eff9ca720149aa615bd005b76a25

SHA256
8aae6aceaef9d6b86ba8c4e3461fc5a47dcd4981b296c7b18cd03c3cd6f01969

SHA512
fc511b82f18d352187617811eedb3d62aa3ab8ae5fcee1dfc221907b90227d2cc31c6493a20f81050765a5153abade054805e2c5920b91846a88fc70ec0628d0

Download Submit
C:\Config.Msi\PT5521.tmp

Filesize
795KB

MD5
f395916718ab00eecf7ac21ae4d4c844

SHA1
9a4291d9b4e07308402106c438d4a3b41461ffb6

SHA256
a4b14a9a54b1161a8b999bbe2ee7a3b839395f878cc751dbacff5bcdb5fc345d

SHA512
b42dd348f83657d453771efb07d336e9e605431390ff2b26dd9bc6af93b9a52a54fe902083dab6d0c5e90591ed2e8215e39ec31baade52ec3c5c37cd91bfa583

Download Submit
C:\Config.Msi\PT5522.tmp

Filesize
425KB

MD5
d242de821997d14da6926dc07ff22f60

SHA1
2880d0a3f0e7076e449413b7f639b80ae6b6ecaa

SHA256
f0cd6c0e97c7a5da4f8d6d5cc0a03be1a968f6aadd3e981a1dc542e637ead15f

SHA512
b0e8a2bd13bd7ed17a29a4bfc0703e1197fa16533249d4d7486f5b6503fe42e0d094b803ab8720eeb9d8c7d34d2c09600aca5eb527c7e5b41cd17a45844d3868

Download Submit
C:\Config.Msi\PT5533.tmp

Filesize
262KB

MD5
a0c3c65f6295169e29d2c374fff3edde

SHA1
9cb0bf82b2697e0cc991b6178090e32d15215b80

SHA256
98bc4ea92ec57f49a4ef2a455035e74c4d4105eb48fe29e606a80d9c20f655d6

SHA512
16a68082a4cf75fb2974f6a1bd35c589cdace55fda05285791d7f458f9c6c890abb2f36662dd5e12fdf0bfd8e1cefd986b9e1070cf8c77023361bc1de24a7cf3

Download Submit
C:\Config.Msi\PT5534.tmp

Filesize
538KB

MD5
6ec34187a77bb756975eceabed5dad57

SHA1
1d809f3e767f38b8133efb7e26017a2306f3290a

SHA256
f86eea66f9fc96f42bdec20e97a9248a33c1a24936ffa77fcc8f09c8440bc985

SHA512
2d7f8d15c181cc0a5ab474610b34bf40a97ea25f6f934aa273405cd1250c41518ecd00640d04cc3c37069652a973c1043f158868183db966e878c27d8e5bbaa4

Download Submit
C:\Config.Msi\PT5535.tmp

Filesize
2.1MB

MD5
c0754ca35e01ed37f22807aadd29cb7c

SHA1
76762d4aaf4564a398f72a68a52f2fd07921d4a2

SHA256
e557e3c7a7a38996d97448031e878701893fbd1e5446dfade39a97407ec36c7a

SHA512
f06d62419b138867c13f1a70ce0ae6ce106867c55a3f9e45c925a69f0984d8a72b28910b614791168b2425c60718956d20497fa9b662f8585c3329b66de76447

Download Submit
C:\Config.Msi\PT5545.tmp

Filesize
3.0MB

MD5
1907bc8d94c34248beb1dfac4183df9b

SHA1
3173360152b3a3af34423d7b8913d3a0bd23bb72

SHA256
cc0401b7c2e0041998fc87e4efca49663f3b86c20eed04f6304ac163584aff8e

SHA512
59aaadb083fe2499878ea1cd656f8e93b4ba3adc25446d1c9e0737e950153fcc63a70800e9e1f3ccf96820c4c0b3292dc7ee1de4b1b046c5d79162ab5444ddbd

Download Submit
C:\Config.Msi\PT5594.tmp

Filesize
270KB

MD5
e18d14e92c27c5104f3deefc27b98f2e

SHA1
932f03cc25677c646c9166a6ed75d4170beeb23b

SHA256
3f596a567be47e84f7603206d8659d8076d4c21ee20788bb23cdb38bc98feefc

SHA512
344036de0fb83b839079f2b495075feb5df85f9a3daa64ad30d39451c0c3de639c30fb3362f8756395cc94ad7c6d301bc5dfef3a393f4df780e62efe1263fa97

Download Submit
C:\Config.Msi\PT5595.tmp

Filesize
10KB

MD5
269b2580369f264537ff7d6cf0c18770

SHA1
afa6f8152151bed9f6df26d794291f5774c9ca99

SHA256
f90b5e5eeb88dd7dbbef57bdf77d78b49295c7aa13b0f404886b36e1e28d192f

SHA512
50d7888ac29ae6477f9b6788537c2264cd00119de2f273d117cd6e818dc63fc277239563e2fc44e4b4b89d3cd3af33d3e61d8908f9d30a70ce605249ef4a115d

Download Submit
C:\Config.Msi\PT55A6.tmp

Filesize
165KB

MD5
eabaa403d1b0fed2f0d7286d951df73d

SHA1
85f7f0421b65d116d47301357cb79a4ce127da60

SHA256
a8917de7fb93972b4822301600c6ad6a258d35f9ff3096fd5dabe268c1668f35

SHA512
cc381cc983cef8c6af8ce27f5ecc85a5ab7033f903140b50ea47592144aa15037605c2be476306d00ea8054ad3c1d30dce6a02aed56c7af518101e81e11633a1

Download Submit
C:\Config.Msi\PT55A7.tmp

Filesize
10KB

MD5
dbd4bf78d34726a6cde6989f009c36cb

SHA1
2c6ecdcb0216fa7dad1f897f41be1c7a27c7f1e2

SHA256
58131568ea485d4d92005970c6cd4ffa75228db1d0488d9f26576571cdee52e4

SHA512
3b1fae090b799f9ebd605fa174b3773d0a28d50f77080929500f7604afe8276ff0d5fa59d061f7e6ba49475558dced6742721274731ef0e91bb24272dcd734ed

Download Submit
C:\Config.Msi\PT565A.tmp

Filesize
6KB

MD5
51badd63b5844913137192d38cdb8691

SHA1
53b08bad8b101d7e572f63abb458999ab5336a88

SHA256
d4d79711dc99f759a05bac1e653f7e0c353fcdfe8c064e5b0f975275322190f0

SHA512
1984d2735553cf6c6315e6061c6f2b8ebbb04aa25513c265101c017a2ada83cd6652b0830c4ae4ca1737d4034edbb7dd523cd9ca294721888a2b313d23c1d28f

Download Submit
C:\Config.Msi\PT574E.tmp

Filesize
1.2MB

MD5
51e39ccc441abdd7ca9cf4f3d82c6f57

SHA1
95a93e29a8e91d304fed5d11caff770122de2cb2

SHA256
937bc0faa9e96dbcdbc069d5530fbf5b31bd4cd94373127b24e087630abf0a04

SHA512
bcef76f2adabe3a5d19ef7c476506fc159807f7fdc62f9bd795c14472e8c7554fb0387dedba747f809f301e659e519c2db603f7e5a446ff0fbfe1b6fb2c19e99

Download Submit
C:\Config.Msi\PT577F.tmp

Filesize
287KB

MD5
9abb1c39202e54c46b5e0338d4f7de8a

SHA1
b5b475c02c527592191989cb932441abe5ceb1a0

SHA256
f4e5572c7f295a9a20a317b71dee97cf8ed041b1ddd6b178c718fb269423c199

SHA512
2515d86a8c3c90d93a88cfaf78ec7bb36e8ff6285f334e40fd1bed8e3547626aedba8ed13e7d850882067790ea5fac97dd7373bd61bf63a9a43e153f0a237b40

Download Submit
C:\Config.Msi\PT5790.tmp

Filesize
92KB

MD5
ac9d27ed8b94ac802057acdba66464a8

SHA1
7fca89188fc2955caaeabf03151fc0c9f44b6370

SHA256
6bcf76bc4b2a4945ffd006ba2f77b32fa150f680ac94ef9ec6ec5b4414b9a4e1

SHA512
cc35d1c1641a3e0e98875a90eb6e956b1f21ab19c0d4c9f1a6948e0acfd9c880f5a54c5fe238cce360864cbc350edf2a42e6605b0e08f22fe13e1c8520162e06

Download Submit
C:\Config.Msi\PT57A0.tmp

Filesize
5.9MB

MD5
86f84905e89ad76d291c5b3057bcab97

SHA1
0a6c671fd981978512d3d72934fbd725f3829686

SHA256
0e125566236a90649b78245a302b8631353fb2495aee4090c2916a9a722885ff

SHA512
10720f3495a6725515a165d2b3e38611ebf678a2c107c42493634133920e19b6cb050f5f434b50d2e32b5dd172f2686ab98d80822c79d457f5fd14aaa3081890

Download Submit
C:\Config.Msi\PT57B2.tmp

Filesize
37KB

MD5
112482ea63d4370b711844381b98d737

SHA1
6211793a1b01deea2fce33c8e48f07b7c7d20fc1

SHA256
d5fedd79a6cf46a99b416419a78a5f3b1dee712a8bcc9c77424d2f2d03975a26

SHA512
6e03112fa65d33fb6aea719956f4d70451df95c563bad36c32a35d80eb1911d8580b2926c144059c5926924edf408fb4c21e8f57f4fbb618a94caf7d87ef06bb

Download Submit
C:\Config.Msi\PT57D2.tmp

Filesize
31KB

MD5
ea1c35dd541d60819d55482130bd585d

SHA1
dc4f51268894e90afcf41fcb1feb26966926c3ed

SHA256
29b87ea913098368d64a2a88f95b519017e925d990fa1eadc8163b6a1cfe8448

SHA512
a606284b672a7b7d539ea7167f02fab6f73472a9adbcbe65af4b90bf54e2d735b3cd80b34801e9cf18d320998e347dbfa305ed69521a0f3107655e480f5f6d17

Download Submit
C:\Config.Msi\PT57D3.tmp

Filesize
1.0MB

MD5
e3e8352636b674dfe55fe59f23123e5c

SHA1
aed492f1b21e2abd39f156b25667478a85c4ff9b

SHA256
b841755bc7e671c1b73fd33d55622df2f9a3a50206c2cbbb95289f7a94419e21

SHA512
1a1100cc637aaf903243a99165bc66082d7d4cf9f12b68b62799c17bb920f2fd263620a35664ba88c5852e03a31daa0dfab92f153120b1269d6e02c85b63f589

Download Submit
C:\Config.Msi\PT57E4.tmp

Filesize
71KB

MD5
7a4cd632681c7ffaa7edf947ae82bdfc

SHA1
96120da280deaacc3bad1647cc96679746610154

SHA256
31ee00e9202feba9db22f46bc54857dbd8a426dbf619660368a35889844ccbbc

SHA512
78c8d850836111143e47ce9c618d3539ccd507eebe8c719a0ff9a79f455e45e0f1c435780b5ee4293768ebd3d324c0fca5ee38c50b0003d5b1f0664fdcd4c9b0

Download Submit
C:\Config.Msi\PT5845.tmp

Filesize
436KB

MD5
37a7a76c44edbea4a497fd4b8289b8a4

SHA1
c0ebc0718e047942212082fe47f1d07873b54764

SHA256
b3959052dac81bd86f5bfc42d992f2b44a70462c85fb2a99b32c4f0362288292

SHA512
3c27071889b3e330247576a11035e82c0813f8ac0daaeabdaf8b2e1ea97a409c236b108f4e14e22cc5b8b71ab9d848617bd023944a84760fddef978a97774348

Download Submit
C:\Config.Msi\PT5855.tmp

Filesize
527KB

MD5
994e47110a8beb48cc285293d77a9372

SHA1
a83bd7a8234871435eb45435698ab63daa009797

SHA256
8e9bb4bfc97b92d8cd34ebceae57650eba6be154ef2961a22c988e3e7919b19f

SHA512
ca3ebd07bd8faa9ce7961bd5797534ddead801873936f5a76e8b3821c1259349053e3bc74ca2c92b2bd8b1ac8999956d66eab84f6276d0c6567a88e4620f7eb3

Download Submit
C:\Config.Msi\PT5856.tmp

Filesize
3KB

MD5
89c413369f96f860bb6e6185ac5b4a79

SHA1
9a3314426c0025c5a4d727cf436211468a8a295f

SHA256
cc4a5a15ac9f5a95389979ad8d8dd2de97a4025018da895beecd1f58b8504be8

SHA512
87abdc2dd19b21a7243ad20631907df67258295a330177bb074745fafdce4d7dc9241dfe14769966f58b70c2f09124bc231e1583fcc0fb75a506f99d4f0ddfac

Download Submit
C:\Config.Msi\PT5857.tmp

Filesize
130KB

MD5
3299a88dfcb3d630bef9fa5e4f09d301

SHA1
3cf19b8b73878421748022a57dc70792b10b7410

SHA256
02cb0b283926e0c53badd0a2d1d6121b8b464ad459f2a5d3481891cefa4b1c57

SHA512
acbe43e6414479f0edc7703a3f5e2f98b88ce1e926e6cc46e48bccef4b48eba4092eee1166590c455c208f310f32069c92692755e13fbd458cd4139553a28318

Download Submit
C:\Config.Msi\PT5868.tmp

Filesize
41KB

MD5
fd1aafa5eaa25ec8f4109ff75e38e7d8

SHA1
78a851c0d4a76087b3acf710af605240808400c7

SHA256
7c9eba1b2d0b1ec917777eafd89db960aba7f111ec196905f4d807c0d00d2280

SHA512
1ca2bfe55be9db6e7be11b7c4c95f5d7e0175d7a4961128d531ecf9ad065a4b8cd2d6c74ef87102e2d312c41656d2fc68c89cc02cd5b7c36e2b30c013eb4d320

Download Submit
C:\Config.Msi\PT5869.tmp

Filesize
27KB

MD5
0fdae340d3024526dc59f9f456f7cff6

SHA1
ed7e0c3ea0cb4d8ff013743d8d0dbbb831d71623

SHA256
ca44067445fc401e90d9d637b8afeeec48fa4307ad5248dec8e8049440a7ec14

SHA512
979fcb1cd32e12d64e2122b70be7042ef568b82e6d83d67406a2b0799ab4d63385584bac1cea9101d6810ec75878eecd6ad47c0a5a6e881479fe879885aa73e3

Download Submit
C:\Config.Msi\PT5879.tmp

Filesize
16KB

MD5
b412f512f36561265564460400579cdd

SHA1
4737df30053520fd6227ef1d860cb133b858f949

SHA256
3be9bcec2f78e3898f815387bbbaf1bac41e8dccd1438487d6eb2ab23a29ac0a

SHA512
c676c08f3a95b3805ba2ab5b1a1793dda781cb46c66b622aba55a3cce42e96d56cb82414e5687abc0cd33d2e9bb0f955c01c4d750ce4974c9751807a469cde4b

Download Submit
C:\Config.Msi\PT587A.tmp

Filesize
24KB

MD5
ef810a38c372fe84e843b25ccf2094d0

SHA1
cb7928bb217aad111560a25c9d2bd284d5e314ec

SHA256
d75e889307f8b67c10d491578698e093e8df1bd843878993444cadb28ab3a4a8

SHA512
95348f24c85c25a7e96f5b186894d15b47c41c017a164bc4d44c41a163b45f8aff7274aa444f4f94682028bd8a3b21464b908bff359e35818795221bfb53adbd

Download Submit
C:\Config.Msi\PT587B.tmp

Filesize
19KB

MD5
c8e8f6638c381824c209188b2fdf4a01

SHA1
ea24a05cfd553aa272be27546f2442beda693ae3

SHA256
58cc65a877055e607ab0283b50d1874f2d4e90b3aaa8a10f3fcf18a43187f5d1

SHA512
94f2718d54735106448f336bae49a63ba4695ce8f7c4b434ac1a395eac9cb049b0920fb63caed07ba81047b3689f1887124ccb3d30ce2f5e44f1ff8e089c6cd0

Download Submit
C:\Config.Msi\PT588C.tmp

Filesize
127KB

MD5
ec69dbd895449bcd243923622c3874d1

SHA1
f5e3af14f274aab87ffaddd0aa3595653cd890c4

SHA256
dce7c2b79cae17a4bcf35a6f5661d044ff43630c3871195f2cfd1fe1c213ee6b

SHA512
a35a5cef7d8980d7a76cecf10eb026b047f0741b63b6c18a63d58fcc570668fbcf193273d8e9bb2032e146ed051f80ff5dbccbcfb314f8d6b665791de5476b27

Download Submit
C:\Config.Msi\PT588D.tmp

Filesize
507KB

MD5
27bd58f85c2912d55b1a28ded0d3d86c

SHA1
a1659c726639c1b1cd5eb25e0d3ff7e85fd48785

SHA256
8fed871bb88bd3dbcf2148031271f73bdff9bbe027711cc2233a44be3101d40a

SHA512
94ecf511ed2554de7b2d6e6dc1c0c817bf5b29ffd085188707e3cc7652d4ee6e1a39ab1ae0af0000abf694884b244c28cff15580531ba06a812465b63ba506f4

Download Submit
C:\Config.Msi\PT588E.tmp

Filesize
44KB

MD5
e5abe55e2f1dd5a510f3f4c4450c1a55

SHA1
1853f586862ddd3b80ce3d93e4115c6ddf00851a

SHA256
af76aaf8df3cf7b858a6b9f4512b279f4df209db52abe8dca6153b9e72f64567

SHA512
52bb2bd7071e60369fa3333404216342b2305f68140d858717d869e75e7e57868b0ab4789ac4ae639b5f9302a993cf2d1cabd7448cc125abde07f10db87fe403

Download Submit
C:\Config.Msi\PT589F.tmp

Filesize
151KB

MD5
5109c07f0ab6045b04cab4996064b6d2

SHA1
04f418c3294f35c7102bcf063ae37efc8470b59e

SHA256
8f134e706ecb3a800d6d51eff3ce887e7d2702cbd2ebce49aa15227c3687813e

SHA512
80d666b754d770f2de1d63b77f61607dd8888e3b7694d9b5b224c474edb9ad4279f6887d84cc5c46cd73aa9626b79ebbaf0f902837090bf61057cb98537df6f6

Download Submit
C:\Config.Msi\PT58A0.tmp

Filesize
1.7MB

MD5
19c48d62db3b7e0aca7800aeb6de8a1e

SHA1
d9f41165b07f4486006c09a36b827281336e0de4

SHA256
d4a4cad640a58b9e0d087c051a68d2dd9151efb2a9fddb91dda680eb9ffcc824

SHA512
38ca333efe2e49994d29f5ef6cd800bc1941c81fbcdc727ac579541b417b901281ddfab6140e8a6ede7c2cdeb68387317a1d74524e0adae1b7f696d4294525ed

Download Submit
C:\Config.Msi\PT58B0.tmp

Filesize
1.4MB

MD5
3ba78c856225026994fa2029c7133977

SHA1
beff697b125922d8d348f359c3452c1d8dea65dc

SHA256
54dcd672e0b59a5051974ccf839413b79b42ce0011aad064049c7f104665a865

SHA512
65678fc3b3c6faefd3a4f3c32c2d84c2e65a68182753355f5c6d7985f7483c2db7147f7218b515bc24efac8d9c15beee717bffb515004e1a2607b88bf4c69094

Download Submit
C:\Config.Msi\PT58B1.tmp

Filesize
7KB

MD5
598f43c58ceb7e2bcbd59d936d51b6d6

SHA1
a38262c9e27ae8486c5c8b8b14c23fc6fd91d197

SHA256
2b60a17963740740faa766e7c7d6dec401a6e05239e225ec1ad50172283eb1bd

SHA512
b74b0d08b4aa8a07754992e13dc09d0f68bd8675c312314dc13dc958e802432814c434b3ef6786ac71c190893e1c5495e20ba16fa68e83d9f8863b1475af6929

Download Submit
C:\Config.Msi\PT58C2.tmp

Filesize
10KB

MD5
0d94fe256c5af53edbd76e8e822817fb

SHA1
1b0f6783148ca69b75174ad8a857e7725cd28afc

SHA256
c3c5256cb16906720b449829c9f290aaded672132d29b033e815ab9fec8c4de2

SHA512
4465bfdf92f28ed83439feb3066675a4aa58f44b7158989e8061ca156ff5bf3b0c9e52633572c45e1d2e26303da4692833ad45e32d5f610fb243a533c7a48b3c

Download Submit
C:\Config.Msi\PT58C3.tmp

Filesize
7.2MB

MD5
9261565634a7145766a64c24cb678e38

SHA1
afd5e053a2e704659eb6e7ec1dbe801565f99971

SHA256
24d389f935215702c5e83f7f102a58b3d498f91eb97cfab97276d81cf86975f2

SHA512
0c58f546bd0d828278957ed20543c1b4d8f13b6783b8833ae37dc075ba55c16cb5132ea5930d9322ae5eb4f11fb88296f2d91afc727a034125194e3de309e2b7

Download Submit
C:\Config.Msi\PT58D3.tmp

Filesize
109KB

MD5
141cb8d50cf317cc2720f1afaa34e976

SHA1
1e92c8965fd059dd08eabf7b2531325dd882ea06

SHA256
b05e2c71ce6a203faaff617782de0838d44ecd2d27a0c866ee43679f46c8917e

SHA512
0c00f636891346b00979cb8fdc673711d76fd96d8d872444c239b42e574881d7b0766fb87220edea19996bff14ae1d4eefe52ecc0e42dfc110fbfa5fd4f762ac

Download Submit
C:\Config.Msi\PT58D4.tmp

Filesize
841KB

MD5
998df5c87c7ccac8dd4fc1ebdfc80844

SHA1
16d309be5f47e9a34dc595ba8bba86a2319cc6d3

SHA256
7046966f806c9565905138b9069b1b4821dc557f75dfba4c5cd2a2121c546411

SHA512
aa9b4e96d439cd9516a6d0f344d48a3e4b9853aceb39cc171596d754d69c2314de5c4956bd32fb5b69a2c432a3426fa3b883fcbe44a634bf43cecbf8e5b01c68

Download Submit
C:\Config.Msi\PT58D5.tmp

Filesize
52KB

MD5
9633174157ae5b1caf300f416c746679

SHA1
4d729ed083410b492c3833ebd5695906230ef258

SHA256
bce639f33239cc1bfbea2433313aa73dd12e95f0474a2863d519ffc5328cb7bf

SHA512
ccadbd9ee9959368a90cb0f0d1569d5d81d2d32337108f0fe01a5f851515dc179eb928273dfd813a6ceba914322ec2fa5cf4e941529328194779411bc150a23b

Download Submit
C:\Config.Msi\PT58E6.tmp

Filesize
5.9MB

MD5
6635f86baddf87972be9fe3c705265fd

SHA1
b4745fe967220d1cfb5e7cca5e45fc4ee6caee92

SHA256
f5fc6a2ae68a5e108dcdc0426d49d1493a79fe0fec832b26d7b63f871bde082f

SHA512
9b636f2cfcc7df93445e23a9cbebf9204161c23819497fac50377abcc3e9296dafd3c37630d148e6f3825be830c29d612eba28a81bf4626f199fcb1d53d33f59

Download Submit
C:\Config.Msi\PT58E7.tmp

Filesize
97KB

MD5
5b06080301844d1e81601157b087e6fd

SHA1
3294d45c9a89cc1a47c4ea894cb2573ae6f9323e

SHA256
ba06a8d71c0d5994b211f810d46c355b49e955ab1bf80a5d6b338d77672d4a6b

SHA512
0a846921a1bf5162319c52a2292430643b10186fa5d5bc56513fa9537c762d8a87094ddc9c867dd46673787d488ae3536348444f4ddb15371eb5a069fbc5db67

Download Submit
C:\Config.Msi\PT58F8.tmp

Filesize
146KB

MD5
43c7689142011473cc34b76bfb3944ff

SHA1
a12a52103421dc901e68415e36f29d204e476d1c

SHA256
e9b4217ce95f661f665bf76186c25f2fc8f8dfa85565024911880da5b5d6d7d6

SHA512
9260dfff83611c4d5f1a32b9e1f11f8d394b28c3474aa2382a42e7414e05bc8a7575bcfa268b84d823112eeffcd1309234557c18c37f62eaad52e1c80dc4fb9b

Download Submit
C:\Config.Msi\PT58F9.tmp

Filesize
299KB

MD5
e6181cbd20befddd952e6977a705eb13

SHA1
9eab8ad77f1ec115552c84a9bb7c85c5cf0fc856

SHA256
28134718d87406dc64a9de67b9d63e66782d340165731a98b353b2e2d30dc6c8

SHA512
7fd2aaaf947fbf32e3158264b18b89af7eef532b2691c8870a2fdfef9bb746f883db4fef3b4235d3516312d39d101c024c8d334be1e0bb9ff41d0cf8b0c4a6b8

Download Submit
C:\Config.Msi\PT5909.tmp

Filesize
10.9MB

MD5
fe643b5b7cca55b39cb081d2b2c5333c

SHA1
55f5339754d30504f72ec573168cd53530ec6804

SHA256
9615d2f230a6ca7e93eff8f8255b3e517e09d7d96eaaadca56f1e5e9bb6d22c7

SHA512
0323635f2dd1437ac542effcd1db26dc4848b04565c5fc80edc3a7be4423a4b3b8c800af2d199eae6fbb910c723e9968798d80287a10dad13ae79ffd23d2a012

Download Submit
C:\Config.Msi\PT5A13.tmp

Filesize
200KB

MD5
7d913328d94b07673dba6d6182ce283b

SHA1
3a1179648d9b67bb6815d429d294adb4b526f616

SHA256
09e00c229c36ab82120fca768ecdc98067fe43a2e2ec5d77ba366044a42ca85f

SHA512
0b9085656c3c06cf75444f3e98e816fc9b7997c7645205c562bb8bdc3bc3d9db99244ec29ad7a7575796a00556e2dd87a65ff5778c0da1ed9faa4c5e8908900f

Download Submit
C:\Config.Msi\PT5A4E.tmp

Filesize
132KB

MD5
48d3610944bc3eb0c90a9153a7d71bd8

SHA1
78ef5d569526298a3b4865d214ef49d6b20ca17a

SHA256
cd722bc332b1f2ddbf0c7e8d65cc0e743045444b64e604c36cb94b6ec69a6f5a

SHA512
a7e7b1bf5b049ab76ea15b1e0c8ee17b59d8115f5da002c41dd89ea2ab54c64b8ea4ca06f40c847331c5fa30eb3088c680ff323ad24dd0182bb25dcdacfa507d

Download Submit
C:\Config.Msi\PT5A93.tmp

Filesize
101KB

MD5
ca48a693af143aa11e2b59883ed076f7

SHA1
47472a23676516dc3ce43a3f6e87a092cc0cc8bd

SHA256
34bd8145acf8cf864c43c0eee2060b20469530cf8e92e4ea7e04defa8b64e19d

SHA512
2143bcbdffb98b3e42e700b1fcf91b339cdcaa325a9814d6da40e8403d227f6fc4ac02d5fb3b09790a5041ac2771309c8a4aca498c122af3c4fb8eac8c40fe4c

Download Submit
C:\Config.Msi\PT5AA5.tmp

Filesize
61KB

MD5
6242c7eae42f95e0b08f66b744f3895e

SHA1
3be81abf6990803a22c6954272487dd64af28048

SHA256
2d8cf27fcfbea5f2192b5f1ebed408e66a01990982b20a56c82647ea275e9067

SHA512
b112487bb50b0fa7b5d29b4515a51939fcab39919c43fdc7db7bf291521791d760e1de9125514ed39bb6a458aebfb5541da40954bbba2eff12b0b0d2b83afd03

Download Submit
C:\Config.Msi\PT5C63.tmp

Filesize
17KB

MD5
db7bba989705e5eaa035056296e09ab8

SHA1
a749df4d371006ca24d3fa18a6a81502daef6453

SHA256
c99f3b1b17d40f7d24ffe34a310ace541c0a1cf7ee4db3f31f6bf28d8724f928

SHA512
22ccb680bfb0c109fdc513544b9b4c09249881af8bafb43cb2a59eb3540b7b621b3c2565d26b7aef1de46d05ff2d2abf8ec4f6dfe7a6854f32b8bcea9052dbd5

Download Submit
C:\Config.Msi\PT5C76.tmp

Filesize
47KB

MD5
dfc7946f16ea9125d8e53c0ae75eb30a

SHA1
333ad31c3ada0d18bfacea071b5552594091cb0f

SHA256
5dad0a1d8ee141d7d4ac9695dede839f31ade76ac645c0c7958846005e2851f4

SHA512
21579740cc48e4e93b55980ba6c5bce6379ef9ec80d822278b90526d4e4f866e27a6841e171e73c7857b92ad3791ca5fa0c6bcf9976b5a9de1e1adf313a7c5b8

Download Submit
C:\Config.Msi\PT5CEC.tmp

Filesize
665KB

MD5
48bb5d10d5502211b3d38f4d948e5726

SHA1
6e11e759812c666e075c198a0604e20a9fe09f7c

SHA256
d2bf705a324beff0a2e8761c97cd9202d20d82aa1411944d2a2d19deb79c3139

SHA512
72e57b30c7db288ac0f5ff56a4ad605f31cdb26110c3e74e7ce82959a128ec53fadbfed5ee51390c7914ec41c1c16d8c50b546683ca5994d9cb4a4b46f5f14db

Download Submit
C:\Config.Msi\PT5CFE.tmp

Filesize
82KB

MD5
1cee683c63f5673b8050d17b54adbc34

SHA1
07a933e381ec3eb787e434dca7f3516a3b94ccb3

SHA256
e15a0aa8b9b4e8396c8937dc1773deea8f57d852ea87571e07084282ace2fe0d

SHA512
33c72c41a89b6bace4b6da9ebb630f5d3c093416cc5e47f63123ae3c728860d42423ac40ce6e3ed57830a1938c22eac73feb3075cbbaa03ac4778c5223525bbb

Download Submit
C:\Config.Msi\PT5D11.tmp

Filesize
34KB

MD5
8a6683ac1dafa824615bb3857ef8c709

SHA1
121aa154815960dcd78b83f02880d47fae3b526c

SHA256
3e0c4a19e9dc29d74dbce53a58e5e196bba2d4603c9d0cde73face6c214a4154

SHA512
1e0dc360bd357de1a0641b1319893a058ac1bc0c72be49a99667c371dcf8ea243c4a46ff5396cedf7b5f3cd9738a13a38b32b2871358d9945a1409c63ea129c7

Download Submit
C:\Config.Msi\PT5D14.tmp

Filesize
16KB

MD5
8e601a8aef493689612a300b6837ce75

SHA1
216bbf99bb96ce9175ba9f27a34beae1f5969e9b

SHA256
209b9f5fd42fd63ac49655554aea2559af8fa3ec99048111db131a197d55d2bb

SHA512
4d1e989087b7e365ee806e845fed9225bbb442302626a705c87933283bf1385f5a4f08b4210650d392173039b7cef8de97d4e4bf178a76dc0c19c3488569ecc7

Download Submit
C:\Config.Msi\PT5D27.tmp

Filesize
1.3MB

MD5
e35db1506668d9c5dd45873922547dcc

SHA1
167467750f056f38cfa100493f5216542a305acb

SHA256
2367e86034108e5d6cdedea65a0668e9c4c97512d2f79dadae720ecb1539d5a3

SHA512
36558ece17cf6b22d00b675e8c612a92a7e0f84a2a6480cdc8b5dd966857cd3f4da20ac949085f199ebf283185a71407a45e7742a8a42afa5638ece0b0142440

Download Submit
C:\Config.Msi\PT5D9D.tmp

Filesize
272KB

MD5
ef4f1d6d1e78694b3f4a19641fcfb310

SHA1
3f0e1fd375ac51fb1a99c80e0d8fb1aa246cbf73

SHA256
94095648d1905831b77958d316a2212c21b1490cb47a3eafd56150b1df69549f

SHA512
e28aefc8730f23cb09535e7d1fc259eab98677b994bf22a928419b6a74bb8ceb764b467b7f72c2a603c23eb577d9be41cdd220fd4a890c841e0a42778e066525

Download Submit
C:\Config.Msi\PT5DBF.tmp

Filesize
213KB

MD5
5d96f56ef706fd2ceb371be3c397e468

SHA1
c969839a18c9c7b4098db2cb7e08520e861cf1b6

SHA256
3b92346542cea57abb1e793c2b55527aed3eef21b9676e649000d9a5348f6067

SHA512
d8e65a6f7846c154b8a1463adeaf535632baec0538cab9baa522cdc777c4b0cf2b021806a810e77ee392463dbad7b96c3f34517f87b05099ae6cd0bacb1e0d12

Download Submit
C:\Config.Msi\PT5DD2.tmp

Filesize
91KB

MD5
5ad74471ff57bfbe2070547281de5be3

SHA1
b02bcd7dc491786c86c0256e3893f10290e8de8b

SHA256
5e03130d1e0906e4816e56cc8ab6bd31d6609da33c5abcef64954abea2a85a73

SHA512
62ac459a71c6e7ea4e236ab3717e18fa46cff2f5ddd768025960d5502e59840c53ceada1bb49838c1c1233c77b11482d89ec499038f211594589a3f932d91fb8

Download Submit
C:\Config.Msi\PT5DE4.tmp

Filesize
118KB

MD5
73ca131826e3b7d8c159e32deee9e00e

SHA1
be17dcc7e49da2ea1c91d57de0704c110f4c7c38

SHA256
46f70504952d2e5b56ec5e030c230387a842edb7a08a9d9250dede60b56ea8c0

SHA512
cddf85cfb6623b793ec803d57243555f822b71ca375135ca4b135298846dddfe9e5e1c4e7db9eb2298508dff13833c7a05f3d71c8563d24f8961027298f173c0

Download Submit
C:\Config.Msi\PT5E83.tmp

Filesize
212KB

MD5
80d03f4a6af42eb3b34f9abd41c3fb65

SHA1
a319f1c5142b7a7dab67b9962bc840b2ea679384

SHA256
234a4aeb8a58803b1de13ffa9fba17cd0e094d5fff453f16a95604a14f779eb8

SHA512
695840fbb475748822a1cc7509d975c3d219d456d5a309c5e5999b54e1cf68b695e3c1d02fa309dca574d8234575a9132be35fc615c225026102e16bc4e9ca58

Download Submit
C:\Config.Msi\PT5E95.tmp

Filesize
21KB

MD5
f9f0a8cf272ecd3af4fa94073264e095

SHA1
753bf1063b03a81a5a2055e5562de1272158fcae

SHA256
d4a5625b3ce5df9fbefc677288f6c1be097b2bd2516bcf57fbbf747c6a1facce

SHA512
55bfdf494831a8b2066fab685532a4bd902a4dc4d0d4722b3a1f7f1314f3bb3fc116f77bb88b83be3a87614673541e5c359200ab81e6c4c82a2b2b649dbb92f4

Download Submit
C:\Config.Msi\PT5EA8.tmp

Filesize
795KB

MD5
c604ac32abea7a52b9e39e9208ce67f5

SHA1
89f9468a3e3ba44a7ffe2923d20d7190d5edfa85

SHA256
159dd63d3b185f10657d34457416f1231583d2d5fb76f3ad41d924b93f7d6469

SHA512
3779da5b6ba6cf247cbb8192cc5f5a43c795bbbd63fc4e1d7cde757bc5e974fa95c0b9065fbef8459b7c40e32532355382aefcf4f604f4000e43ae12a39b05f4

Download Submit
C:\Config.Msi\PT5EDA.tmp

Filesize
425KB

MD5
8b891650fa07a5c667e97418a88e54f4

SHA1
db8564315edf4739999162ff20acd1808693d727

SHA256
03f41969b7dad8efdc8b24f9384b45e0fcee3efa668e72c2bb9d8a9156486e27

SHA512
cb888bc0c2b0105c32d36f0e0c3a30b744db67720ef0a77b468ecbd67c2b1dffff6b3371f6688b90fe9741c7a23bb42d212080308b9c1e9db8d35591d31898a5

Download Submit
C:\Config.Msi\PT5EEC.tmp

Filesize
262KB

MD5
532cd62c29830f7e4b33cf3df5735845

SHA1
cea98775eddfc46d96ba60775a42c59494a6307e

SHA256
ddfbda79b346a69d802449efe495e9d181bc089a8f8fd47e765275981434d7de

SHA512
546d7ab2cf60c45510de33c4e29eb3bb13707f7611c9536b0874bf1f63d16eab9c61d366e27281c326011feea6ebb1b247524997ee59e0af7dd852773b934654

Download Submit
C:\Config.Msi\PT5F0E.tmp

Filesize
538KB

MD5
1fc870f4f358a13abb5c567b08953411

SHA1
24f8866d33a0adc09889396a175df5da99b63088

SHA256
172507137005c5dad796118afc9089f34aec3eaef93e272b6aaeb19fa1eb687d

SHA512
6102241f3cbfb016b7940d03c8f94ed6a6599f6a46b0909b21e369dc091bc7416efd273f412dcda6d357f97b5d968da5f24dc8472408bc2986ea495679ac14af

Download Submit
C:\Config.Msi\PT5F31.tmp

Filesize
2.1MB

MD5
ee96d0530aa828b97b32a2376b07ee81

SHA1
6932ea20a0b720b0d226c0d533109cf709f7dd6d

SHA256
9ada767b89cda6bc87a80d0506a46f384be356138d7a818aadb2042982eca89f

SHA512
2ab2cddbbebfcfe661ff4976bb9817b0531a7d45207dd5bd523c46b33050f21148cd023cb9505836a9f10d22b17f8503c0c2a6fcae2ded30152d13f35f9dd47a

Download Submit
C:\Config.Msi\PT5F72.tmp

Filesize
3.0MB

MD5
83850a7ac00d7066a08edab180bc99a9

SHA1
88148da9dc5202e2b00564743b6753d083bcaf92

SHA256
12b833a75690e1227770102dcc30fe21400b3f063d272fd1e57ab8e0e8f5a1db

SHA512
0d973ac27aa8ff7eeda92d788227199a690fcf357679ee91cebf4483133754e4d2b24b88c57947b32212a3acdd2ee08ba71a621a505b55576018fe253f101574

Download Submit
C:\Config.Msi\PT6046.tmp

Filesize
1.2MB

MD5
f778e9136ab0db9de9802a7043de50a7

SHA1
850dca074534a14fdb9ada6afaceea88558764e0

SHA256
90803a583e9f693de5e7b8a196832436f6f648b27fb82e55904c256f30cc8b3a

SHA512
cd6c5c3537f05ad5826d503e38b8e6ef2eaf668616bec15ba51ad3d81e0337a72779d7ca6af9e8ebee12d713891b30c0b73bf34718552bc9f4e7d8909b998156

Download Submit
C:\Config.Msi\PT6078.tmp

Filesize
288KB

MD5
a13bfe522abc659704965388ad4581ee

SHA1
1e5e32c35af6bebeb800083f5c637cb03fac3e37

SHA256
1f64f01063b26bf05d4b076d54816e54dacd08b7fd6e5bc9cc5d11a548ff2215

SHA512
34b02ff3bb42b81890747bb0fa9f8689f7e3577aa68e25f4a1aa9ca336e975a0e9d400e89e4d9b1bd11866df80b9baf9a1d7c9df7b7f4cce4cb2c45e47abc7a2

Download Submit
C:\Config.Msi\PT609A.tmp

Filesize
92KB

MD5
e5bd9b6a047a6fd3ecdda458cd661b3e

SHA1
90a4727e4df3c31182cd035d53a0a9364161a4c8

SHA256
a071d5f1a6c2d6ffcbe11fc9d31e0f103369d081c1ea06bf4cc39564da26d8af

SHA512
05f808783bf9ae075c498e5eaea39b4d3b3c96889d08ee80e8767b68a72fcf0d8bceb1e9a31446dddbd31dd6ba2d95d5ae23c433801f77748ed72eda685123fa

Download Submit
C:\Config.Msi\PT613C.tmp

Filesize
32KB

MD5
98813d442ab6f9865ff408e9459d2d78

SHA1
ab3d8f212239d839dc76b8c6c410d49c259850a3

SHA256
ec35f38573e6ee2a2026be85a00f17282a7d621aedb4c8296f2e603a5cd6515c

SHA512
c80de2e10b16b65182b807271d96e8b7b4aca3fac1e0a9eba897c4db03c1fc46b1dc8d9bb965097576924098b91a747025f5d4566faef8b3faf3c5ee22afea4f

Download Submit
C:\Config.Msi\PT61BC.tmp

Filesize
1.0MB

MD5
40fe609bed5aef58fd8456fb4f726d57

SHA1
aa211bf14186b51d09bee213c41f5a17ecba85c6

SHA256
322b40a7748e43f405444201df2e9907e8187aa2b5aba772893da5bc528effeb

SHA512
7f4a615db8fd4bde5306a1d265af61a9815695d23f5ccf11c6b7d4ebdd359cf6a681d676dd408e93920ab8b8b2f1abec69da5d9ea5ce45b6a45d95c80accfd23

Download Submit
C:\Config.Msi\PT61FD.tmp

Filesize
71KB

MD5
814ccef0ddc67302c4291c353a44ce9d

SHA1
29484925f6f3925555cd9011732a2f94de997525

SHA256
545c011a87906e845720c4efedf515cfd53b37d3258f218444138842f3826bfd

SHA512
1fe88302cbca7e83e9fde37ca793f3714889ee689739423b0b8cb82e99684c24826c6780e88031d591f9c7e6ef6579b17df47de26edf8ef2310c3d48d916f88b

Download Submit
C:\Config.Msi\PT6210.tmp

Filesize
44KB

MD5
5885834af7b6dec542aa899a6510544c

SHA1
789f494758acb0ea6cc10189d34f962f08291dec

SHA256
0c5ec4790ac9c0cd8afd02026811be484b0d9f631dd6e4842ed2568d527d0e62

SHA512
d23306540d2bdf11b09cc825b65a80e899328f35794a5368665ce10d2043529f9cdfba992abae821f3879cff7305813025e2f2cddfd10328965fa6e487c331a0

Download Submit
C:\Config.Msi\PT6780.tmp

Filesize
82KB

MD5
9bda689b3866d289b4e2cef042a85abd

SHA1
a9c7e01c65662a17b3c1ae37a5ccfb96803a45d1

SHA256
9e5840d28285688b371de8e444b3de4ca6d43307c68824c3b7e34b088668ff4a

SHA512
1840bf7379ef7c6217ae908e3edf7160a2053e5193acd50c7f135add6cce88bd42c4f42a3bc0d4107b61f41789c846dc91932ac9d524a902c1b52720f2752850

Download Submit
C:\Config.Msi\PT6793.tmp

Filesize
13KB

MD5
d384fb316e4c2e664ef9e3d571e18416

SHA1
d068b5dac1e7bced5f04e7941a481e8b3535fed8

SHA256
ddc0bf91c96d1079be5d52465ac157bb61a78b5ba9c952e5edd4fb51a78d9e43

SHA512
ebd09f8f6eb5982ecf29cf9f0af3757465bc05e049d3d0d557b2bc977d129d91d644c9b8acd56cfb1aa002ca50162a17f99b4f84b2db9e615e596a48a06e0348

Download Submit
C:\Config.Msi\PT67A5.tmp

Filesize
1.3MB

MD5
06403dcc1d4c10d91abaf931e9f273f4

SHA1
a46188a338165e468c733f60fa992ba1ff08db10

SHA256
0ff4341eee78c5b8ce6d9715fad8a4e1e70de40e915e4cd63fd7777a6c1acc00

SHA512
b461a3d0254494c2e6dffd32b2df67a1330b2f14a2f7b28f7f27ba837ed15bf22fb9dec1436613bcdf3356e983a332eb1e4e208892fe619404082c13390af846

Download Submit
C:\Config.Msi\PT67C8.tmp

Filesize
2KB

MD5
c4a42826e8687703ad8af713149ccdb9

SHA1
2ed4ebbd48a0e9a593e060ffa593f732161b75bf

SHA256
12095eeb7021a534a8a404d40bbcddeab53af6aebf3b14fe2aa820af93e77983

SHA512
066a6142692e250336a6f5ad851379a9de0715731ab9174229038c0b19a933243d5ecbaa5a5ba5ddcadbd8d1607be0a564edef8f289599cc1f91917b3a5aba2b

Download Submit
C:\Config.Msi\PT67CB.tmp

Filesize
8KB

MD5
1c4af9d2903709106fa12e54d85154e2

SHA1
622b63a755e80780c8ab04f9a6d04a0015c93ec4

SHA256
d4a7245821d342107668b10711ef75260905864ea1492064f9d66c7a0da21d98

SHA512
440dbbdbfdcd424cd2213540b390956d3db98e93ca58cba548dee6daad59404fa4be117052a31a833d223f23f1fd44a2a1f04494c89e91a906c80e8d41dfa96e

Download Submit
C:\Config.Msi\PT67DD.tmp

Filesize
2KB

MD5
5a1f6ff4de980e2eec754b6b7a1f6ddf

SHA1
d76fd4e3157c928d99d8f7cd5e5dd96cfccd2e60

SHA256
b830bff57e7a46b214171b9bf5cc8fd0b898f39229187e87185466d0e6545c79

SHA512
5aa755b254e5b3781408da0b4b4eef1a8a84399a92c8e0bfd12a8d654e9ddaeef7196eb81ce58b424d22c544bb3e3576e6c0d55ec0fd7c4ec73e5e4f3935bf53

Download Submit
C:\Config.Msi\PT67F0.tmp

Filesize
2KB

MD5
76d2a13fa68fe24d1ba77d8469d13be9

SHA1
1cb2e389e9cadcf1da9876dbd8a44274a1eaae69

SHA256
0f7968296f62e384c524cc84baa16639b91517298031f1bfe4df3aa8182658bd

SHA512
3093c955f7f42670477feeff2f9dbe7e557716d6a7cf5a6b2225b6ab0741def094c3fc17fa37b85537321a167a56582f816824a05b21c8923a928a9bdcc5526d

Download Submit
C:\Config.Msi\PT67F3.tmp

Filesize
44KB

MD5
4a1ab6e25dcf074919ddbaee0b14dd42

SHA1
4e513fdfdfa7e3bf2882e8870649169862b02bc7

SHA256
fa6162425808eed3482f09717a51777717f3fee22d61634c171d4204b59905fb

SHA512
5a63e8ba1adfaddc495aed22e5a7b2dbcb0255e9b1e6f140bed2c791fb79f0d69a45d89f699092add3f8be5e7b44afdef94638d10da3b66e7c680b2b470446a8

Download Submit
C:\Config.Msi\PT6805.tmp

Filesize
11KB

MD5
2b285d35ccb41aaa1bc5e0d369501fd3

SHA1
fdcb7345eb68e35c52b4942f3066b108d21fcc86

SHA256
b26f6e7ea617b94ea4bf74f99dd22aecabddb3f48e3bf146849e3ba7fd50ee93

SHA512
b5b2b2baeef8418ddbdc5d717a732ebce220356d5ee9aacdeac76cb33f81be6cdea42de50378726b501841252c618804545d6ace37f06b7620ef9fcb6da881cf

Download Submit
C:\Config.Msi\PT6818.tmp

Filesize
4KB

MD5
7c0e6d40f4027ba55551a37ee6250389

SHA1
6af54202574064d75a18619c04a3d8d96aed3252

SHA256
1e5b424db0693e30c0461e4daa09831f5a93976a03724797cb641f6d058ba4c8

SHA512
a5e6b238fbd1c932e44d3aa66c42b3481cb83fd835cc61be16140462703c85e2398469bcf54a425b7a00b3b0a8729c95a1b70b4c20299f3051e749f729d76a32

Download Submit
C:\Config.Msi\PT682B.tmp

Filesize
81KB

MD5
fa318fd428d11dba2eacfec6bf540674

SHA1
f77d482b9b5f5537d6a8d3eceb746e323427a97c

SHA256
96277e36773419dfc9b5a65c0ee51dad986a7e8b0a5c25b42bed2cd29bd31f18

SHA512
b13c849a03537afcd72d41d470f03f6d9f2c21ca7b00db7740dd7d8882ab51b642c2d48ff5742068c7319832591d3644b4836b16fae0175d5669601dec8c8e2c

Download Submit
C:\Config.Msi\PT682E.tmp

Filesize
18KB

MD5
0562edd844f45f9332899048d1ef5188

SHA1
5807cb7e046ebfc8795e725d43c1a45dfe0152f8

SHA256
e71e4421c1f19a1b42866b57e1728392320cf5115334400c8e9c75ccc3365bc2

SHA512
be024bcb18e6dab317ec95840702e6a072ccecfc3ffcc647db2f39819880ffb74fe6ca8be8de68b0982a17985e8b8e552457dfd2d344519bd85c236f2d379a7a

Download Submit
C:\Config.Msi\PT6840.tmp

Filesize
10KB

MD5
d1954887e55ba2b95d2faab5d0fcf7e0

SHA1
b3cd9e4e6c230227b7cd179e4a84a8b6d5fb3082

SHA256
537889353ad7681479031192556d21669e1ee925f1e7a556b631c1569bd91678

SHA512
27effb18cb5f04a4eb92db917b17f2ccf2042d967b682d29fde738b78eb09707bb802b824688f8bef39d2fb366d8c946fa8e022a96d19215693cd8efa7a26a63

Download Submit
C:\Config.Msi\PT6853.tmp

Filesize
10KB

MD5
ed56d89f0277e7dfd617d61fbff83587

SHA1
d08f0df2a7cb71df1a7ff424ebe49406f0135e30

SHA256
1c18fe7cb32b19839f2442d202101b91b6cd9c47128c44516052cfb028e97ea5

SHA512
87f754af834b0ff130bce8a7694acbaa3846faafd2ee6964ceb1cffaf7922129d77165701cfd599b273118c3bb8570953b6c06e30a159b24e958e181091d25d2

Download Submit
C:\Config.Msi\PT6856.tmp

Filesize
6KB

MD5
aca1951d698bd3b6f95573749d1575a4

SHA1
35a0b6a30b2510c4e19263b238a778aa46fa28a3

SHA256
b507ad95fe94ce549791740ac49cedd1e92c9fb424dad70463969346b9f79831

SHA512
43da75508cccff9900bc93517e057af2b5e95e6eb9b4cb74ef9a0000d3832a806e39d2d5e3583291f64c16877f3bfe9eb068224b10e27dbc45db530536dc33a5

Download Submit
C:\Config.Msi\PT6868.tmp

Filesize
7KB

MD5
6b7e2f6b921825e92c0503bcf8928e21

SHA1
a890f3a8e819d1f1c757698ed6d37522d7355ddd

SHA256
1bb5a889de322d328b07dac78c09806eba3886c3e218e9d1a5f1f1bd89a529e4

SHA512
62dca3d15a618974949b7b3eb51437b893f0bea61246f0340048657f1d8c16655c9b6c1755bd140635e89b50cec4387aeba8a3828f2052307641d668c4e4acf5

Download Submit
C:\Config.Msi\PT687B.tmp

Filesize
436KB

MD5
e92e9a2b7cd15e4f23e4178c3241732c

SHA1
64cb74a2311a03fc5b33ccfaef45a82c42c60ffd

SHA256
feddf1be71547b95dde12fc2374162f6c8b744f23813fcd4fc8803cc61fef921

SHA512
7ba90192d6bb65afb36ee0bfa19dadd16e70c1f8d69cdddc06a2b9318345566588206819ca55cd2513535fe31520de9101b8d15e04c5cec43323d974c1914c3f

Download Submit
C:\Config.Msi\PT689D.tmp

Filesize
527KB

MD5
0088331e38c41c8c50007172cd818835

SHA1
b7563c8bd0b022b0319ebc8482bea440d7f60aa3

SHA256
644b0eeb2f4db50553e3f66adadcd2660ac43c2b110a253328b14354577e4e1c

SHA512
8f7c132ebeaa9796e9880c00705f629d79a8c51681044da4b8ce137f27a3e696f726c61928e57eebd6416d487a2e73e8665cf771140fdb8c2dd20f1bcb20c5a1

Download Submit
C:\Config.Msi\PT68BF.tmp

Filesize
3KB

MD5
ce65c3bb141fbcf3c673af52e08a201e

SHA1
e0ac12e3384dcc151d5e848a8b73c39907b1a87c

SHA256
ba19a100120f60453c2396b57284b601f81c3eb1c4cb82e4eee070fe07b987ed

SHA512
fdce9af9a8bc1eefcbee1d8d3e62b864d2ed7e8401cb4979b98ce6ff87d811f9b26244f407a3900bf2587f8cab9e47bc8e7768fa8bfa7d035cdefeecb5ea9cea

Download Submit
C:\Config.Msi\PT68D2.tmp

Filesize
130KB

MD5
ed50f659fc0800a46ae55ea2e1954c59

SHA1
247ad04f854b20b96eb9b6e90f1042ac6d123f66

SHA256
0da0a131767658ee19483def5884ccd222191a6acb6a2163a13d6959968acd03

SHA512
999c8b9b13f71352b9e1bdfe1f4d3140d00d2ccfbafda854d3de5cd8798461a6b4d49e9409403828813e294b15cd2a63235cf188fb3ad437a5a8233687ace625

Download Submit
C:\Config.Msi\PT68E5.tmp

Filesize
41KB

MD5
e4543a399403a806138980ffbed34a59

SHA1
910e00e60fe0a52f6d143429a50ca3265e508107

SHA256
50eb37b3241439ae04562d12c5e07b0529f876aa70d34bcd20cd34bf8f8b024e

SHA512
4f306859a9fdebd1e3aaa348d07af1cb65a7c8c0ebf392bce87e05e854408503f20b09e8ccf22b9a048f47d9c8959914fc6a0003ca9089720b4a1d9f75f0ff05

Download Submit
C:\Config.Msi\PT68F7.tmp

Filesize
27KB

MD5
e5756c290e3f66737f08839ba9d35147

SHA1
430c4501a65c145dd3b2bf09441f55d5077a0f7a

SHA256
d4a05b693631360e309bd63c59363232a3d836a7a152414ae2957bf253ad7e68

SHA512
88f4f0f19575eb4046c1b1725c3fc36bbabd380fd5f7301480d7110e9a240a4539d4e82eda570145a9ed584ef99d63f32935602c92695170ed06f631ffb21354

Download Submit
C:\Config.Msi\PT690A.tmp

Filesize
16KB

MD5
9c6e36d4dd53bcb8f3a4de422c2d414b

SHA1
7fefb556aaec673fa347b27f453f547e528e8897

SHA256
c163b5f0d227ce4f22da54d3224c452a4ee362ba78601e3aa1d405eaa3ec4ced

SHA512
3cb4a973fc29eaf60af5a192e420e58b5fceb0b5058aafc32170f0d8f8409c0d964098ccd4e81d6399fb32ed66b209ef49af3f92702f4f13275e054fde928bec

Download Submit
C:\Config.Msi\PT690D.tmp

Filesize
24KB

MD5
b6e9b6419e78178494668059297bc34f

SHA1
261ba5cbb3daf58f34de7616c23118d8f78c178e

SHA256
99f79f5bfeed42721524ad0913fd4cfa6a57a62959a418485a752548e9c7fdcb

SHA512
8f61ca8e024af29cd5508456ae05976ddcbb75b37d594496f0048753bc033913f1f85238ef169e3227ebec360aeda05e9f645ac2f439e530cfbba1b89267e871

Download Submit
C:\Config.Msi\PT691F.tmp

Filesize
19KB

MD5
f5d26d796df0e0715baa3f4fadebc6b9

SHA1
ba7b8375f00af2968b977e1dab913bc5542511a4

SHA256
0a074ff8f95901bdbfa9c38ff13bb4fa4f834e21811fc943b6147ab2007bacad

SHA512
f80027f38f32cf78c8eb875e0da33c8d98bd20262958cf7923263f0f5d033f3475ec6d01724e4e03f062920813ea34159b6ec32b0019989433ae002a2f4d187d

Download Submit
C:\Config.Msi\PT6932.tmp

Filesize
127KB

MD5
507518de067152b8dd21ca15d9b2e50c

SHA1
709df5bd6b0b6134ddd0c384727b7607df587f6d

SHA256
4520b513200bcac360c38cdffe684147590901f74e0e05be712e4ed62f5de426

SHA512
3a490f19ade1441fbf621d27a0a3e04fc9dcf06e78fdb36024103e048a1655248caf0254fafb3fc895afd85b9695853f34402fcd23152134623777af8cdfe6b6

Download Submit
C:\Config.Msi\PT6945.tmp

Filesize
507KB

MD5
e767dc8f7f92b459ba8d1e78fa992533

SHA1
259dc37c6ca65d57f4d8a15b82969a2ac6adab9d

SHA256
356e5e6468d5037e0430a8913defbf78dc64980f973ee7558ee7bdc622fd944c

SHA512
94fcb077a3dd15eb92e897d273218a6cff8beb5f91955329027cc5fdc5da3709bf348265e4deacf7032b126846f504a0a8b85f2d6889c41630660da17d8b51fd

Download Submit
C:\Config.Msi\PT6967.tmp

Filesize
7KB

MD5
ded49734bed134b4f105f03053bf1f17

SHA1
a855ebf285013361196e1cb9a133f6a1697cb5fa

SHA256
1f77ab3701e634e67a911f57cc04eb17748b30a1d120d2f1c49766c24a93b600

SHA512
e832a7a1b9f307f2889dfe15f077c4c61c394f458d339db3bf236a7ee720f70336337898dde7eb6632045d9fafc55bfddd2969622e4742bbe586302f7ccfabed

Download Submit
C:\Config.Msi\PT696A.tmp

Filesize
10KB

MD5
fa88b3e702cf0377fe2e7322fd11c27e

SHA1
18a232f0f41f937703eaf5d8b625ede9ce92f006

SHA256
fe1a0e0758f55c532097df3d768ad3eab9d6d4ab4d013d33ec94ff8c334c2a66

SHA512
ae39b5e02b5befae8e15112e0f8eb7ae2d7cd138fef34fecef7de806dc091133fcb242f6780182dbddbf8ccee9a3b23548e08aff1861716314f86cef079d467a

Download Submit
C:\Config.Msi\f77263b.rbs

Filesize
466KB

MD5
db8ddc964658c847359b83d2dbc6e666

SHA1
40917fe565718454b4b1c42e18e2fbae26b67e50

SHA256
4cf880041cc9e1af77f79d05936b8f74426fdbf15df934c88a2e67010bd9cfc7

SHA512
fed7de81fb29adeab8850cb3cba20414733da75daecd4495c47d2600a99e85e28cde1f21f02a9d266f57b7998638e2b3ad962349a270e5145b279e6a6bd8319a

Download Submit
C:\Config.Msi\f77263c.rbf

Filesize
2KB

MD5
e320fca2257788c2bc0677e264fb4697

SHA1
69d28e8a47ca0be4dacecd018c27cfbc83672aa3

SHA256
ae3fa21bcb8704d9d3cc6852f3bdda0b4418f3d5babada34814508a88f16f93e

SHA512
e6349696b722992bea6ef1e4b9271bfcf2c3109209a0d9a8a8d70b0ff6065d1ea865a3e8056595f3536776dea7e4a705fd5bb276079f1d95b5e7abdc306806a1

Download Submit
C:\Config.Msi\f77263d.rbf

Filesize
1KB

MD5
27b3a8f6ab36cc23c1309b8f38cc4929

SHA1
8bf499eb629d3eec700dfaa907f28831f0604635

SHA256
d33c53eaaa371af7a8a1193330afc1256e44bd75c9bf4e4270a09df849991ef9

SHA512
97cea7e50a6817bb91a133183b431367bac6e6e049284e06ca38567fd0ae6a8008ee7265183ebe87483df274d8745bb86139e00328cbf686b64aa72c653787a5

Download Submit
C:\Config.Msi\f772733.rbf

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\PROGRAMDATA\ADOBE\SETUP\{AC76BA86-7AD7-1034-7B44-AA0000000001}\Abcpy.ini

Filesize
1KB

MD5
8e50f582a84c800ed8919f84c77332ca

SHA1
5c818feb6ec42660b894a9641002874241ab865f

SHA256
2c3dfca37d2618d54781b65d12ad25651eef1f6b321808826e5c22acc0fe2901

SHA512
7b7e45303881b77d33f844eb76937ac0c021d626b15eb11843cb0478fa218b85ed7781c0c612e7b113decc299ebc63c466b9bde197b80500568c4f0c2dd7db3e

Download Submit
C:\Program Files (x86)\Adobe\Reader 10.0\Leame.htm

Filesize
16KB

MD5
af0fc9aa684c789909cbdcd137ee8214

SHA1
792c708c11a6845291d9f8647399191110a74318

SHA256
fb854fc720e6dc6b15a5755b4252ab88c262718f9c55cdec56e6c35c1a22fe9c

SHA512
0e97cd24de6431daeacdd6bb0d90dc0dd4854b10b445f4b7e96d9e931ea854f67473cb49621811163f4b0ebe711623a1f0bf113690127a1708916a622407ca0d

Download Submit
C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll

Filesize
132KB

MD5
0bf28e777209ef48ad215c809ad2cbb5

SHA1
b78cd7d7463ed106cfdfb1c2217f66a1a1f8cb70

SHA256
d59eee5d7d362fb4127777163be55f66086f8b9370d105013fd2c2aac48213d8

SHA512
51f6f6e1d320f58be7cdfc3a1d3213220711d5e88aa2ee415ecad091a6b54de79675da4b975d0745f9d6de8bb95870ee42a36e867a4aaf0da5b8093db2b00e53

Download Submit
C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.es_PY.txt

Filesize
27KB

MD5
296ad6c2a8df22602f542d72b553ea28

SHA1
be5fd1b4cfdb4e2568abb13a2c1a826cbcef268d

SHA256
78e044d2c67c06b75416fd9fc8929632a321ffa1e3a55ea530814957b1df1154

SHA512
b6ddb2fd7ea0b33c4d7e28de4e301163b0485fe727443df5dfb90d369320357b64815aeaa5c0a3afaefaf13f0b43102f6f040450969f84254aed7260f46eaa3d

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\AcroRead.msi

Filesize
2.2MB

MD5
dffe2c18cb45ee1557463633fa060df1

SHA1
668d1cb4ab20ed085c215e8cd815521686ebc32b

SHA256
0579d853b52f854eb6257b86465b70ec6d9317a2733bf38adc95b8bfb178f20d

SHA512
4a797e53450f5ece0bb9ad47a8894b8938bc37ca60d0c3ba9aee715f7999bacc9dd107f8aad34bbe2fc35e0fda719d438bcd4a2f71bc7af362cba4b66090e1fc

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\AdbeRdrUpd1001_Tier2.msp

Filesize
12.0MB

MD5
f4158dfce3aa1b3da5469f2b34c40248

SHA1
85960f7b30096c81b38794c34bc4fa0970807421

SHA256
e7336642f0c1e08bee66470d9409fc0f71e93c8eec7c925fac89c397baa8dede

SHA512
9658f887a97bfaaa6d307b2d0f38edfc7355d9066f05b33ce05d748c9473cce2e95eb60255ea40a314b199011a28ab4fb29e0a2128d31aad5ea51b64f4e4f6a3

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\Setup.ini

Filesize
212B

MD5
7bb337959d26a4dd4a18c311cffc94f8

SHA1
56884ac3ca54b8d1cb4d6b2e9ec51cc1248c50c9

SHA256
71bf727c4976dccd39628d1e71fbdb1de69da8cee6eae8f76e320ffd4668586b

SHA512
5c844292e359767f005c7f9b6505debbddad6b6388333d0b9fbe06c09c590f4a7f22e3e53245dbf06f8e2bc3987dd818738f7a7da4b7ad8e595ce0ed6d9f9e74

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9

Filesize
5B

MD5
5bfa51f3a417b98e7443eca90fc94703

SHA1
8c015d80b8a23f780bdd215dc842b0f5551f63bd

SHA256
bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128

SHA512
4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9

Filesize
404B

MD5
37099922b35756869497ca591360a7ae

SHA1
f5621a4a184be20767992d89dd7a73f36ba5c17d

SHA256
a33e31fc78a3b016d6f229b883997e40aeffcd1e05bc13fc38162e8d4dd24c4d

SHA512
3238b985d3d661ed05b7fefd865165ca078c303efdbf8319a8206fe4392c430185c90e9a30d16b583d2bff2ef3d3bdae1ee61d51e5e80dbe760a29b892339dda

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Updater6\AdobeUpdaterPrefs.dat

Filesize
198B

MD5
b90ac8c690853c6185252fb6a9f849a5

SHA1
9cb48053897f3a995fb03eeee0e995c616cd4af3

SHA256
a0a5eaf1aa3b38cb3487634b6d76f153c2c28c63a95508a6cd6e389129d62f2f

SHA512
181b6486cee75a38d349306575cce3db2e075ec09799b2ba43f8cc2ec50afe90da2cd281b6d1eddf1cd0ba7244beda03a44bd7e3d65555aaaaeb176a213d1d88

Download Submit
C:\Users\Admin\AppData\Local\Temp\22269\config.bin

Filesize
3KB

MD5
30c61a855268759e06a28a85c4e43808

SHA1
8fbb462eac7026a2cb61ed59b117a168b896c783

SHA256
f1cb73c52a99d86ee2525499c7cc5bd2f66046038154caa2d2e41f261951656b

SHA512
683ba39f98a4425f0fa8d256b1d8f9f4e5821f9be2d0c9f94d80677e3384f47afe9833f4683d857eb7cb2053d6a8414991777d2a60729bee2cf27bbab745e80f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2B64.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MSIB34C.tmp

Filesize
74KB

MD5
9195c6e38aaf230af745fa3db9b8d6ae

SHA1
8f851520547ab60431527d96bbb9bcd87be8b0ac

SHA256
04f46b66656b1ae7b12c7f4f76c821ec15afa8b1b68271a1d9c48f9842f4dfcb

SHA512
a23c2f582162e627fa205f8af4e16e05176c450d0b6a38e4eee818440307a5e9007317c60acf3b9d8169a505dbaa27f57baa70fe64524eae37f4b2b9a7445768

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\ADMPlugin.apl

Filesize
1.3MB

MD5
998cce19eb7838e54b239e5f5bc2c2fc

SHA1
28f3c708f4f8a695918583de23e0e5f9d541a748

SHA256
fcdd93521e5875fa1ca7e5aed49cb84d3c5ea0a26016fe32a65ec038b28fff4e

SHA512
55936ad14d7d2c5ea9796488134c7494c37f241cb9d2552e11095fbe2acee8966205dc0939aca31d2179d5af0a965295e2e4916bf675ca5df3f25845ab264d7c

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AGM.dll

Filesize
5.2MB

MD5
0cd1441c8e92b345e31ac1d95f6527f9

SHA1
622898f34bc9f1dd0a1140ff2ce4bb564ec7ea8d

SHA256
94d8589869f21ffbd4f2251a06806b0edb464cf5e6aed0d5749fd764591e8308

SHA512
ae1f480d8ee413f50b1f47c1e5d5f99bdf03875d146cfa802726ac0a7820e2374ab9366257a7c642326a9a05b7832d38b1aa5ddc05c548555953ea8c495f4815

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroIEHelper.dll

Filesize
63KB

MD5
99e7e4e081509feee835c7fff8f8ff12

SHA1
f9c90523099fb94472f091d7474409f76f4ce940

SHA256
b466443b17cb84823e732eb1d5cf5a022474dea07383664846d80b4d70ca14dc

SHA512
d946791e0f81e071b19d3bf1a0c748250c2eb012adcb7381978b97c63aa259d514cf5b30fab699d5c6451ed4727c5485214671ce9bd0523d57c864e1331f2ec0

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroPDF.ESP

Filesize
305KB

MD5
cae3a122c9602595600570a36ffde6bb

SHA1
6e2bdd543a1521e897f0961ced7e68d412368bd7

SHA256
6773561d083eabda2ec9df3ce6f387b953819a9c228daf62eccd72eaf68bae8f

SHA512
c1f013a7f352d1d5b49087350f9e7e59c58f7b23f81fbb6c52ffd1f6630880853a5fd8a1fa71459dbef6a4b387020517b0bf54e5192e492554d36dc432926e84

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroPDF.dll

Filesize
685KB

MD5
4e4fbb57b6fe5357ddfbf27e364dca97

SHA1
5f6a7a6cab64bec0537b6166f5540b77388bc1c3

SHA256
ad5127eeb7bacd057d2a0511747280b66ba5cb8e62529a0d176dd686ca92db36

SHA512
8c871e94c12355b43345eeda15befe61b605c8bd7469fca9f3ab703c9c677d2f0e318c95a10dd7ee3eef201f4784ff8ad88088415c2a4b03729bcddda682a00d

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroRd32.dll

Filesize
22.6MB

MD5
9b492e53629fba9f72037673b62c33ca

SHA1
09fcd6e96ea3b4a31d1a342590f90dd9892a2dc4

SHA256
1884b8a5a7810d1379d6472c2c0c42b135a344e65bdb1ac5b86596357a73cc36

SHA512
d02b922803813be543fe14b6af01466a9854163293ee964dfe46969500f93288f07f0f668c945fb065777ed74d240744743d9f497d9997457e9ae67ac51d1d97

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroRd32.exe

Filesize
1.2MB

MD5
6e3d7f11d087fe1ac7865f702665d768

SHA1
734199dce95fef9f98506206dea2bf0ce8af402c

SHA256
33f890c10390ce6b587cb3255cef97ac4d545e4996c359a61fcc4caa9da077bb

SHA512
646cfb7793e3e89f52c778e56cf302b686ccaee4b1b569a9e5e5c986cb2a3fcd5233c811cb3ac26e06b035cccb5efe7c1b1038328c4de6dc874e1aa959b37a45

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroRd32Info.exe

Filesize
17KB

MD5
036b2e07902689d0c782d26c7b09d1e2

SHA1
7d8e1c00cb917ca31dfe178073c65cf39c2352b1

SHA256
4d8bf153d9335f419830f8c8b2f63a59b8f0113a9cf42b576bfd87bed0293321

SHA512
3f29c46428488138f89cd2d65ec989bb63b4fc0208194743faa98d6c75a1d1a4d5297ea9dc1887dd8e1dc24a85d7992d9e0e547dde75659e560ad3c2ebbfdbb7

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Acrofx32.dll

Filesize
61KB

MD5
72afbd173dbcd7b8a893247bf61650ce

SHA1
bfff181020fb66897320f669d80deef2e77d6018

SHA256
8b109335ed643f3ae6be758e2c2ee48a04cac9f54c95bc1e70aea1ae1b0f88c5

SHA512
939654d945bda335a73262809d6d143f6d029261a8df4b642bab8013d71917e208f70b9d8be471fe4e9e0b610f3d9ba1883ea9208702db5554782b0ad26e5242

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AiodLite.dll

Filesize
101KB

MD5
78d57b15b74647b512f0002ac4e71c64

SHA1
99dd24c8f0767c79e36b97b01544e4ef9bf91ed0

SHA256
42a5635bbf129768ef0623bc63c674f6cfc2b83769ff73e729073eb9678e3c09

SHA512
d29ab3df36c10c9c2d87f185e85796cc6a9ccae54b65b7cfc940b19395351a9ad968d9c6d0c9c75c8b7dd134279f5ab310a305d8c66bb7f999172062684df596

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\CoolType.dll_NON_OPT

Filesize
2.7MB

MD5
900dce1a1ff4aaa64bda12dabfd44651

SHA1
1d83d40e1a8e3919ac63e36b480bfef100373c87

SHA256
451a934f5797ed124d9cf2bacf96a3b687248a1549c579afcc8cf3436d977342

SHA512
7aded1ace6ccb24a3089647e48f91dd5c676b54f7a0adcb32aa8b2327fe3233698fa04d5ee39635af63d13931aa247bc6fde32a03248aa18325afddaed1ca43e

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\JP2KLib.dll

Filesize
665KB

MD5
c8cec2a540dba03596ce173507830c2c

SHA1
320b913bf7a98417dbd327f2e8ea6f5d2e5d250f

SHA256
f5b0738cdddaaba004d934b5752c7f785501eae67ed86986ded7eb5922a6dd6f

SHA512
0c714e777765d5e126116d184370bcc6449c4e219667b90feb92dacdd3eae8b9ca425b84ebc3d3d67a81a4bce3886691116a4ff7276e149bdbcd84be2a3b6388

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Multimedia.ESP

Filesize
82KB

MD5
8159c58ba23c40a985aa8c9bc733c0ae

SHA1
eb89ead1a3b2832b6deb13e1415b4da2dd8820fb

SHA256
e7be1f5e1dcdc63f8137f7edd9568a6df913be2b0a85ec8fcb37699846978a8f

SHA512
6a15554353c91b6cb563f2ecf4559bd873398c44128ddf69764601fb3bc731f75bf68ea628fb320003457d4eb58e8e0abfeae942dd25121c8773c460c1a84a18

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\PDFPrevHndlr.dll

Filesize
82KB

MD5
d0910759e749285c754ba2b1f98a147d

SHA1
b72e90cf64d4f40c523207b49d35e648e736a130

SHA256
2e0b3c4ea6d4ef0df43994eb56a88a3023694e1b69562294d0554a02c4282c8f

SHA512
befc71fda73645139eb5b4871c11de726ae8b54768aa56634e0e5e4f230001dda264998a6fd5aa28289a6cd4c7b2f5510c12b43d35c467fbafec2d7bf85b5fe2

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\RdLang32.ESP

Filesize
1.3MB

MD5
25161689626fa135dd7cdc3a28431982

SHA1
d7f7a0b54e48a616980eb22116381b924f9bc020

SHA256
99d099227bb3e558db357502b3eb47e4e156c1a78160801052a7a1416c745f40

SHA512
0f616287c47c761f710830a19bca5ec7a75d91b818c361aa7e90c1b034477ac6cd33e407cd1db925aa94e61b86f6d037229f38774a6615edd917b7bc3fc03c60

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\ViewerPS.dll

Filesize
16KB

MD5
598f347c8688d5c3d646b23074c296c6

SHA1
1dda646c673e601c5652e40207417fb987abeb89

SHA256
5de2bfe87a508238da30801f591239f06732a6ee55bff0643559d02555542fc5

SHA512
f670e4c19aa9a62aafe5fb8e442eb52053a225f07fae7627fdd0c1459801780378c1f3d17751744026a4a07b2450ddd613912024f4b453af91043d5341c8eef5

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\a3dutils.dll

Filesize
200KB

MD5
4088463164100ced1efb77f214036d2d

SHA1
e2670cc205f2c3a089784725092e47405c97933b

SHA256
5e3c5d235aa102794f26e0fcb516ddc34ccf5a1abc127ac4c408a6688aabe711

SHA512
3615edc7b0a2527fb5695c01f914fc614aeb05092c1268ea738acec053025eb7974ec25c873d18567e67cc480ed54e07f5bf93ef6c5ec0f6ced8b5ab41ff3d30

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\acrotextextractor.exe

Filesize
47KB

MD5
628f37e5e96ea57a302544ff4b9fa890

SHA1
1f3f4a0942104a28c2859c64fb6fd3200c5a4150

SHA256
3150c6cf7adc97d2cc406cf38944bb602756c276e2511a32e69b6d92ebcee366

SHA512
cecb5a4f2df8d8151943a661879741c3d83790c68010cd73c4726742c36e4594edd6ec35baffe0102ebc6034406daefd8324b0ac8c7538046ac95be280892e3c

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\brdlang32.esp

Filesize
13KB

MD5
c52a19a7f2644a8036488e3553c5ccda

SHA1
edf2480e75f1ede4d1a7e1928927fb90080054df

SHA256
794c231ab14170694ca2c5c600bc47f4118470f26867b93ccd61eda5c37a7260

SHA512
ebdcdad66d3f54cb003da1459a9c8a70f8a303df8974051cf1f039357677f6b6082d5989c21e267314c3f4505f18ab3be98513a784110f09d07a968275a00a34

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\nppdf32.dll

Filesize
132KB

MD5
ac05c6e4465bfbe6ef41fd6dd46e5b59

SHA1
f06ff3be60dd37a118db97ba43d514dda802d05c

SHA256
89fc167a56945e25cdbd8307a8375810f441ffc00e91bd3989d4effae3a8ae5b

SHA512
d99ad285088b11aca9782b3787fdf4e6d273899cc5e3787669019a2758103464228a6fecf722c272382b89f4f36058c790a8131b1576ed029f1f3487a6ad050e

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\nppdf32.dll_Apollo

Filesize
132KB

MD5
c2ddd94f7d49798ea49994571384f256

SHA1
3b770647212a06e13527ebf3c6a4a86ad87f2bfa

SHA256
a814bc475c794cd6224bd3096798f1144cc0670fe6fb34a1adebc927b14b4dc3

SHA512
a4fc849ee4a2065a7ed152595c16cdc63f103d283c57cee33b37299ff6ac0921e360076b835a7eb3ed11d8988c9c352e819eac04878795c3228ef9cc2bd6abc4

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\pdfshell.dll

Filesize
381KB

MD5
814161c6f897c330a461397f870e786b

SHA1
ea927d1664fea6a0a27db0b7f502f73ca323f533

SHA256
303d3a32fd1b7b7d1e74444e4d5c1029a895485cd5f4cfad0ee933ceb11100cd

SHA512
a489052d0972f213ee110b29530e4a191bad4a55fdf2274dbb6f7b98a0622d4498d0e03b538cee96156abc9e62f14ed646995ad77f2b16dcbbc4845b4d8f7025

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\pdfshell.esp

Filesize
294KB

MD5
a5828710a2a852bf3a9e25411fae001e

SHA1
34547b52c9cd51e9995630661ba89e87ce9e8ab5

SHA256
5c356cc204662e48ec6e6d77268f49f1100f815fad978e44bdedf15f00223819

SHA512
289511f20d173d6c3848beced41be5a9d352ee9f7807213e733a3c6669d879811cb352a358489949fe90a18e6e32de387704207727f8f1136415aad1a9e88504

Download Submit
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\reader_sl.exe

Filesize
34KB

MD5
e97140424c378acbd47df493a6ab7235

SHA1
93b5397da034392ca9f349969e944795e8397c34

SHA256
00f26f670ad6b03c465c4fc834dc993b551b8a8e73b603fe7b9cffa893094a3d

SHA512
54d470f4d3667f5e3d91bbff345705d2cee12fe149973cc800db43ea2f942b213fdafe7b31ddcccce14e06af47afcd4c6c0f3a590b4442dbaefdcd3803c2eade

Download Submit
C:\Windows\Installer\MSI2D2A.tmp

Filesize
113KB

MD5
dc3698e917e65b65a54ee1cf85c89bbe

SHA1
92e42c3439c40db4d04a3aaff4f20f4b7436d6c5

SHA256
edd97ad49f47c3b1f1979ab65357430e789ad43ba52ac0c0dc24d12ace68ee2f

SHA512
7e828fc3b1e3a8def67ac9acce1c89da047510a2cf60717588f37d3cbd19f0ff9b745e075ff639fb92eb5bba91fbf0e4b86611f398d029c2501a232895843c67

Download Submit
C:\Windows\Installer\MSI30D9.tmp

Filesize
112KB

MD5
8f680e0f517d35bb14f984a7f197e35c

SHA1
1ad84f7120c2712a32ef5aa82edde5b704eeb27f

SHA256
030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805

SHA512
dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a

Download Submit
C:\Windows\Installer\MSI30FA.tmp

Filesize
156KB

MD5
a44986470c4513447017ebf68fd2903b

SHA1
d5816fd82873fc9b1b35131624daf70fb86c2e72

SHA256
b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5

SHA512
1b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84

Download Submit
C:\Windows\Installer\MSI311A.tmp

Filesize
84KB

MD5
94ee5f4e1500435f1d8eba5a54c231ed

SHA1
d8ab879fd681cdbf7cfab010523ab7c950b68e87

SHA256
5fec0c3e5c0dafcb9950eb84e2b5e59a679877bd128bb9cf7290b47ed76f9495

SHA512
10ea6ff3497d13b2f8e4f20e833297603f68f90ff42ac6224933d04aea8fd28365383b414acb513c155e032b642df33cd948ecb321bd337494de62a1b2f523a7

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeUpdater.dll

Filesize
509KB

MD5
59143f3aa9ed77ff02a51960ad812c8f

SHA1
8f66dabcde28d3e3f596c6680dcab5e1e28611a2

SHA256
7de1126a16072b1518b57b910b13419912c2b844b11613fbd2d6a11e8fd79358

SHA512
2e181cee10f478d28b7a2b95b5c91b1f1f8d90571377b2e564195bd0722ce276837cc5f891a16084f61984bc94d65e1b2b0caac6d3dfa66d0cc0546ad590ee61

Download Submit
\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Updater.api

Filesize
165KB

MD5
b05fc6a19d2275728ece7610eaf06a66

SHA1
9a090f6347dd4e0f072b2297d9bd938f97a50a60

SHA256
0df6ab70121fb80cb050d287d5d156c103fe7448c1ba97c525c945248b576d2e

SHA512
9e91a276d33c476ce86e69392db9d9d54d396578a6d73463f39980bcde951cf1ff4d5b31f907506fbe17840dc716a5fc478d84a666789e233e5b1d6c6063e70b

Download Submit
\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe

Filesize
2.4MB

MD5
34c4db669b76a662c5fa7c199e4f7519

SHA1
b047730ff73cbb63a540a2a0cd4e632ad594bbc4

SHA256
5a9619856991c1184c789d732f7c597cbe8d0add0732660a4ba358c6a3f258f8

SHA512
da596adb60d4c5ade81b196cc4277c3bfd523e70d72ed2f27d4426833f72182a99fa4bc8f069805deac958e65a4ebed7f43919853fc5fdc5b91a6e62089f2c09

Download Submit
\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\setup.exe

Filesize
329KB

MD5
298b89d914f1a0a5a75c48a5ae9b75b9

SHA1
fe9f329d755e4d42ae5140e31875a9ea989043a5

SHA256
0ac3d080d42d4d1bde82bd0b20883e5fb5e7ed9d287f51dfda0b3ce6f9f83557

SHA512
f0e2ad4b706ea88c1f84ae5b604093f75ff295e6e7ca48a78ec62efc31a6def4ce8c8421791a2082c47ec153ba6db31a72aa7841b99db8da9bfb6eb3b02a90a2

Download Submit
\Users\Admin\AppData\Local\Temp\MSIB260.tmp

Filesize
52KB

MD5
4a908ee9c6f2f4aad63382cccee731e4

SHA1
e572580949f277987fe232757ce88c2ac35e0223

SHA256
459f503fb8b4fc4a600261430ac77bf70118d41fa19f7b2620d43ba6e9c8fa5e

SHA512
75ba5856df7ed1457b6192e3b12c5dbb9cd0c6860d787357b37d5e2aabdd1dddb1fd6195064cad1b166431a71dee233b76cb6304d8e868050d79c731ef6e567f

Download Submit
\Users\Admin\AppData\Local\Temp\MSIB2CE.tmp

Filesize
75KB

MD5
0c6864f73134ebdacf4458c7a2c3251f

SHA1
99cc4dd14f972dd58badc51ed9001dbcdb80e938

SHA256
862ad396ee52836a9b7a8f8142a177875f79c81964b542c3168dd8b242e19a23

SHA512
78048337cbdb4f7cd900366348537c80dbd9135c9a79b220895d77a494317258fc1a8ec5f7225e6652a8f44a9a2d1253a65af735a451f842d47d30376c0eb089

Download Submit
\Users\Admin\AppData\Local\Temp\MSIB3CA.tmp

Filesize
175KB

MD5
c87ab761aaad15556b0017da46f737b1

SHA1
e8dec8ea029c78f8c492296801b046f7fc699de9

SHA256
c17d59766f6c4f4162f6427346dec4e3abbd5afbfb396a8642fce375154bc351

SHA512
895ad32c6af2ae79f27296e3e52e09e55ad9b43cb2d16d02d656dda267c815fefe50eb95d8e08e69eb3dbcd43cd76582b019fdc00594223253f763c711dd6e47

Download Submit
memory/2756-2363-0x0000000073860000-0x00000000738E3000-memory.dmp

Filesize
524KB

Download
memory/2756-1026-0x0000000073860000-0x00000000738E3000-memory.dmp

Filesize
524KB

Download