Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
16/08/2024, 23:08
Static task
static1
Behavioral task
behavioral1
Sample
AdobeReader 10.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
AdobeReader 10.exe
Resource
win10v2004-20240802-en
General
-
Target
AdobeReader 10.exe
-
Size
45.7MB
-
MD5
4b2f2dd39efca7ab7d69ad6735a26ffc
-
SHA1
3d5b75ae4bd60262aaacfb35c852e31dd8ade37f
-
SHA256
666859e6c3724513d033e3197dc7efb8736f690eb15603210813a9e5b761d2c7
-
SHA512
56b6554f24746f18d742f962f6635649318d0dfaff399853814e4fff22efe9f141eb3bb6455f240fdd9e5eeebf324b0771e3dab3b0b0e18a193180b395fcdfb4
-
SSDEEP
786432:nUKocG8JHLygNDq4dIQO6kOm256ddCpTe50HWS3Burn0AwdokgFLSw3:RocfLtNDMQDYBXEe0HWJ0A17Sk
Malware Config
Signatures
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation = "0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 2912 setup.exe 1832 Adobe_Updater.exe -
Loads dropped DLL 64 IoCs
pid Process 1708 AdobeReader 10.exe 3000 MsiExec.exe 3000 MsiExec.exe 3000 MsiExec.exe 3000 MsiExec.exe 3000 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 1388 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 1296 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe -
Adds Run key to start application 2 TTPs 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe ARM = "\"C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\NoChange = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\Installed = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\ msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Adobe Reader Speed Launcher = "\"C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\Reader_sl.exe\"" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\Installed = "1" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\ msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\Installed = "1" msiexec.exe -
Blocklisted process makes network request 3 IoCs
flow pid Process 3 2792 msiexec.exe 14 2684 msiexec.exe 16 2684 msiexec.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini msiexec.exe File opened for modification C:\Users\Public\Desktop\desktop.ini msiexec.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
description ioc Process Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe\DisableExceptionChainValidation msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32.exe msiexec.exe Delete value \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe\DisableExceptionChainValidation msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AcroRd32Info.exe msiexec.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\NoExplorer = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\ = "AcroIEHelperStub" msiexec.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\Elevation.tmp MsiExec.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInTray.gif msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\cryptocme2.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\forms_distributed.gif msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Acrofx32.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\acro20.lng msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Bold.otf msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\A3DUtils.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\DEXShare.spi msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Flash.ESP msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Services\Services.asfx msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_super.gif msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\Providers\Proximity\11.00\spn.hyp msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroTextExtractor.exe msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Flash.ESP msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\PFM\SY______.PFM msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Services\DEXShare.asfx msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Onix32.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvSOFT.x3d msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\GREEK.TXT msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.es_VE.txt msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOnNotificationInAcrobat.gif msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Resource\CMap\Identity-V msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Services\Services.cfg msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_browser.gif msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\review_email.gif msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins3d\3difr.x3d msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\ICELAND.TXT msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\adoberfp.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Mcimpp.ESP msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AcroRd32.exe msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.LIC msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.es_BO.txt msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AGMGPUOptIn.ini msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\main.css msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\server_ok.gif msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\ended_review_or_form.gif msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\cryptocme2.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.ESP msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Spelling.ESP msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Accessibility.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeXMP.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\logsession.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.es_PE.txt msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\Annotations\Stamps\ESP\Dynamic.pdf msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Tracker\form_responses.gif msiexec.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Flash.mpp msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\MakeAccessible.api msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\ccme_base.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\cryptocme2.sig msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIB.dll msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Legal\ESP\eula.ini msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\reader_sl.exe msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\plug_ins\IA32.api msiexec.exe File created C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\Acroform.ESP msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Locale\es_ES\DVA.ESP msiexec.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-Oblique.otf msiexec.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSI3292.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\nppdf32.dll_Apollo msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\dexshare.asfx4 msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\eBook.ESP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\CacheSize.txt msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\WindowsMedia.ESP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\WindowsMedia.ESP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Checkers.ESP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\DVA.ESP msiexec.exe File created C:\Windows\Installer\f772793.msi msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroPDF.ESP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroRd32Info.exe msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Updater.api_NON_OPT msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroRd32.exe msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AGM.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\PPKLite.api msiexec.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File opened for modification C:\Windows\Installer\MSI52F2.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240816231028135.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.manifest msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Flash.mpp msiexec.exe File opened for modification C:\Windows\Installer\MSI7728.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\ViewerPS.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Spelling.api msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Checkers.api msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AcroForm.api__NON_OPT msiexec.exe File opened for modification C:\Windows\Installer\MSI7952.tmp msiexec.exe File created C:\Windows\Installer\f772636.msi msiexec.exe File created C:\Windows\Installer\f772637.msp msiexec.exe File opened for modification C:\Windows\Installer\MSI4DE9.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\AGM.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\QuickTime.mpp msiexec.exe File created C:\Windows\Installer\f772794.msp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\CacheSize.txt msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\eula.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI7796.tmp msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\APIFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI2FAF.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\services.cfg msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\accessibility.ESP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\nppdf32.ESP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\EScript.api msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Spelling.ESP msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\PPKLITE.ESP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\eBook.ESP msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0000000010\CacheSize.txt msiexec.exe File opened for modification C:\Windows\Installer\MSI4B50.tmp msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\_difr.x3d msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\makeaccessible.ESP msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\_d.x3d msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\authplay.dll msiexec.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Annots.api msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\pddom.ESP msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\PDFFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI2E17.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3A29.tmp msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\Search.api msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\DigSig.ESP msiexec.exe File opened for modification C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\XDPFile_8.ico msiexec.exe File opened for modification C:\Windows\Installer\MSI4D6C.tmp msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240816231028135.0\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_d08d0375.cat msiexec.exe File created C:\Windows\WinSxS\InstallTemp\20240816231028135.0\msvcm90.dll msiexec.exe File opened for modification C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\accessibility.ESP msiexec.exe File opened for modification C:\Windows\Installer\MSI30FA.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Adobe_Updater.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdobeReader 10.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppName = "AdobeCollabSync.exe" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppName = "AcroBroker.exe" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\Policy = "3" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\AppName = "AcroRd32Info.exe" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B} msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\Policy = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B}\Policy = "3" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3}\AppPath = "C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppName = "AdobeARM.exe" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{08E8D305-8D6D-49fe-8603-03A926E46AE0} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E1F80F4-953F-41E7-8460-E64AE5BE4ED3} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{15B3FB63-66F4-4EFC-B717-BB283B85E79B} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\ msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9C6A861C-B233-4994-AFB1-C158EE4FC578}\AppName = "AcroRd32.exe" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{358E6F10-DE8A-4602-8424-179CA217F8EE}\Policy = "3" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\Compatibility Flags = "1024" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{76E2369A-75BA-41F9-8B9E-16059E5CF9A6}\AppPath = "C:\\Program Files (x86)\\Common Files\\Adobe\\ARM\\1.0\\" msiexec.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\migwiz\wet.dll,-591 = "Windows Easy Transfer Reports" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10059 = "Mahjong Titans" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10103 = "Internet Spades" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wsecedit.dll,-718 = "Local Security Policy" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\msconfig.exe,-126 = "System Configuration" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\sud.dll,-1 = "Default Programs" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10103 = "Internet Spades" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10209 = "More Games from Microsoft" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\AccessibilityCpl.dll,-10 = "Ease of Access Center" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10054 = "Chess Titans" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Sidebar\sidebar.exe,-1005 = "Desktop Gadget Gallery" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe,-102 = "Windows PowerShell ISE (x86)" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10061 = "Spider Solitaire" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\ie4uinit.exe,-737 = "Internet Explorer (No Add-ons)" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\wucltux.dll,-1 = "Windows Update" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SNTSearch.dll,-505 = "Sticky Notes" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\MdSched.exe,-4001 = "Windows Memory Diagnostic" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10209 = "More Games from Microsoft" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@"%windir%\System32\ie4uinit.exe",-732 = "Finds and displays information and Web sites on the Internet." msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\SnippingTool.exe,-15051 = "Snipping Tool" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10102 = "Internet Backgammon" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Windows Journal\Journal.exe,-3074 = "Windows Journal" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@gameux.dll,-10061 = "Spider Solitaire" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\ehome\ehres.dll,-100 = "Windows Media Center" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\DVD Maker\DVDMaker.exe,-61403 = "Windows DVD Maker" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\comres.dll,-3410 = "Component Services" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10082 = "Games Explorer" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\FXSRESM.dll,-114 = "Windows Fax and Scan" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\dfrgui.exe,-103 = "Disk Defragmenter" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\odbcint.dll,-1310 = "Data Sources (ODBC)" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\AuthFWGP.dll,-20 = "Windows Firewall with Advanced Security" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\rstrui.exe,-100 = "System Restore" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Program Files\Common Files\Microsoft Shared\Ink\ShapeCollector.exe,-298 = "Personalize Handwriting Recognition" msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\NetProjW.dll,-501 = "Connect to a Network Projector" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000 = "Sync Center" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\unregmp2.exe,-4 = "Windows Media Player" msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\@C:\Windows\system32\gameux.dll,-10060 = "Solitaire" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{3B813CE7-7C10-4F84-AD06-9DF76D97A9AA}\ProxyStubClsid32\ = "{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\NumMethods msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{566A7BC7-B295-41B7-A818-12F9E5CA46CA}\ProxyStubClsid32\ = "{671B6145-4169-4ADD-9AF3-E6990EB2B325}" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ColumnHandlers msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.acrobatsecuritysettings\OpenWithList\AcroRd32.exe msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}\VersionIndependentProgID msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\4 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E9-4981-101B-9CA8-9240CE2738AE}\ = "CAcroAVPageView" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{9B4CD3E6-4981-101B-9CA8-9240CE2738AE}\TypeLib msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8}\TypeLib msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\68AB67CA7DA73301B7449A0000000010\SourceList\Net msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Adobe.AcrobatSearch msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\DataFormats\GetSet\5 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroExch.pdfxml.1\shell\Open msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C52A2CC-66F1-4B2B-A9E4-9723791F0BBD}\ProxyStubClsid32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\ProxyStubClsid msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings\CLSID msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{12BA069D-0FC6-4577-97C6-5DF634CE6E84}\ = "PSFactoryBuffer" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\TypeLib\Version = "1.0" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{46B89F5A-769D-4792-AD9A-E3755915CBC3} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{08A9E040-9A9C-4F42-B5F5-2029B8F17E1D}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.acrobatsecuritysettings.1\shell msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3EA-4981-101B-9CA8-9240CE2738AE} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFShell.PDFShell.1\ = "Adobe PDF Shell Extension " msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD069A1-50AA-11D1-B8F0-00A0C9259304}\ = "AFormApp Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroExch.pdfxml.1\shell\Open\command msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{57A0E746-3863-4D20-A811-950C84F1DB9B}\1.1\0\win32 MsiExec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8D46C1B6-BBAB-450D-A61F-4DDC898B21D4}\ProxyStubClsid32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000}\EnableFullPage msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDXFileType\shell\ = "Read" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroBroker.Broker\ = "Broker Class" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{EE5A151A-AD2A-4CEE-AD65-228B59F5B4AD}\ProxyStubClsid msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\Programmable msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E8-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFShellServer.PDFShellInfo\CLSID\ = "{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.xfd+xml msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{03C2AEA5-BEFA-4C84-A187-C9245AC784F6}\TypeLib\ = "{C523F390-9C83-11D3-9094-00104BD0D535}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\.pdf\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f} msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{41738EEA-442F-477F-92CF-2889BD6CD7E7}\1.0\HELPDIR msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{FDA6EEC2-325B-4E8A-A8C7-1C75DFBE72D5}\TypeLib\ = "{2991F100-D9C3-4243-82A2-A718747FC0CF}" msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\ProgID msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\AcroIEHelperShim.AcroIEHelperShimObj.1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA8A9780-280D-11CF-A24D-444553540000} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D3F22039-E3CF-4FC4-9A30-426A46056B8C}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\PDFPrevHndlr.PDFPreviewHandler.1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0F6D3808-7974-4B1A-94C2-3200767EACE8}\1.0\0 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.7\protocol\StdFileEditing\RequestDataFormats msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDE0D630-7801-47cd-984E-1F0AFBC5ACBF}\TypeLib\ = "{BE79C475-D632-4A57-91B3-DA044FA27CDA}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AcroPDF.PDF.1\ msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.adobe.pdx msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F9DB5320-233E-11D1-9F84-707F02C10627}\InprocServer32 msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{671B6145-4169-4ADD-9AF3-E6990EB2B325}\ProxyStubClsid32 msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{E64169B3-3592-47d2-816E-602C5C13F328}\1.1 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3EE-4981-101B-9CA8-9240CE2738AE} msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3E8-4981-101B-9CA8-9240CE2738AE}\ = "CAcroAVDoc" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7EA23D88-569E-4EFD-9851-A1528A7745F9}\TypeLib\ = "{05BFD3F1-6319-4F30-B752-C7A22889BCC4}" msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B4CD3F0-4981-101B-9CA8-9240CE2738AE}\ProxyStubClsid msiexec.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{673E8452-7646-11D1-B90B-00A0C9259304} msiexec.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AcroAccess.AcrobatAccess\CurVer msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFPrevHndlr.PDFPreviewHandler.1\CLSID\ = "{DC6EFB56-9CFA-464D-8880-44885D7DC193}" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5F226421-415D-408D-9A09-0DCD94E25B48}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Common Files\\Adobe\\Acrobat\\ActiveX\\" msiexec.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3000 MsiExec.exe 3000 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 1940 MsiExec.exe 2756 MsiExec.exe 2756 MsiExec.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeRestorePrivilege 2684 msiexec.exe Token: SeTakeOwnershipPrivilege 2684 msiexec.exe Token: SeSecurityPrivilege 2684 msiexec.exe Token: SeCreateTokenPrivilege 2792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2792 msiexec.exe Token: SeLockMemoryPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeMachineAccountPrivilege 2792 msiexec.exe Token: SeTcbPrivilege 2792 msiexec.exe Token: SeSecurityPrivilege 2792 msiexec.exe Token: SeTakeOwnershipPrivilege 2792 msiexec.exe Token: SeLoadDriverPrivilege 2792 msiexec.exe Token: SeSystemProfilePrivilege 2792 msiexec.exe Token: SeSystemtimePrivilege 2792 msiexec.exe Token: SeProfSingleProcessPrivilege 2792 msiexec.exe Token: SeIncBasePriorityPrivilege 2792 msiexec.exe Token: SeCreatePagefilePrivilege 2792 msiexec.exe Token: SeCreatePermanentPrivilege 2792 msiexec.exe Token: SeBackupPrivilege 2792 msiexec.exe Token: SeRestorePrivilege 2792 msiexec.exe Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeDebugPrivilege 2792 msiexec.exe Token: SeAuditPrivilege 2792 msiexec.exe Token: SeSystemEnvironmentPrivilege 2792 msiexec.exe Token: SeChangeNotifyPrivilege 2792 msiexec.exe Token: SeRemoteShutdownPrivilege 2792 msiexec.exe Token: SeUndockPrivilege 2792 msiexec.exe Token: SeSyncAgentPrivilege 2792 msiexec.exe Token: SeEnableDelegationPrivilege 2792 msiexec.exe Token: SeManageVolumePrivilege 2792 msiexec.exe Token: SeImpersonatePrivilege 2792 msiexec.exe Token: SeCreateGlobalPrivilege 2792 msiexec.exe Token: SeCreateTokenPrivilege 2792 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 2792 msiexec.exe Token: SeLockMemoryPrivilege 2792 msiexec.exe Token: SeIncreaseQuotaPrivilege 2792 msiexec.exe Token: SeMachineAccountPrivilege 2792 msiexec.exe Token: SeTcbPrivilege 2792 msiexec.exe Token: SeSecurityPrivilege 2792 msiexec.exe Token: SeTakeOwnershipPrivilege 2792 msiexec.exe Token: SeLoadDriverPrivilege 2792 msiexec.exe Token: SeSystemProfilePrivilege 2792 msiexec.exe Token: SeSystemtimePrivilege 2792 msiexec.exe Token: SeProfSingleProcessPrivilege 2792 msiexec.exe Token: SeIncBasePriorityPrivilege 2792 msiexec.exe Token: SeCreatePagefilePrivilege 2792 msiexec.exe Token: SeCreatePermanentPrivilege 2792 msiexec.exe Token: SeBackupPrivilege 2792 msiexec.exe Token: SeRestorePrivilege 2792 msiexec.exe Token: SeShutdownPrivilege 2792 msiexec.exe Token: SeDebugPrivilege 2792 msiexec.exe Token: SeAuditPrivilege 2792 msiexec.exe Token: SeSystemEnvironmentPrivilege 2792 msiexec.exe Token: SeChangeNotifyPrivilege 2792 msiexec.exe Token: SeRemoteShutdownPrivilege 2792 msiexec.exe Token: SeUndockPrivilege 2792 msiexec.exe Token: SeSyncAgentPrivilege 2792 msiexec.exe Token: SeEnableDelegationPrivilege 2792 msiexec.exe Token: SeManageVolumePrivilege 2792 msiexec.exe Token: SeImpersonatePrivilege 2792 msiexec.exe Token: SeCreateGlobalPrivilege 2792 msiexec.exe Token: SeCreateTokenPrivilege 2792 msiexec.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2792 msiexec.exe 2792 msiexec.exe 2792 msiexec.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1708 AdobeReader 10.exe 1708 AdobeReader 10.exe 1708 AdobeReader 10.exe 2912 setup.exe 2912 setup.exe 2912 setup.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 1708 wrote to memory of 2912 1708 AdobeReader 10.exe 30 PID 1708 wrote to memory of 2912 1708 AdobeReader 10.exe 30 PID 1708 wrote to memory of 2912 1708 AdobeReader 10.exe 30 PID 1708 wrote to memory of 2912 1708 AdobeReader 10.exe 30 PID 1708 wrote to memory of 2912 1708 AdobeReader 10.exe 30 PID 1708 wrote to memory of 2912 1708 AdobeReader 10.exe 30 PID 1708 wrote to memory of 2912 1708 AdobeReader 10.exe 30 PID 2912 wrote to memory of 2792 2912 setup.exe 31 PID 2912 wrote to memory of 2792 2912 setup.exe 31 PID 2912 wrote to memory of 2792 2912 setup.exe 31 PID 2912 wrote to memory of 2792 2912 setup.exe 31 PID 2912 wrote to memory of 2792 2912 setup.exe 31 PID 2912 wrote to memory of 2792 2912 setup.exe 31 PID 2912 wrote to memory of 2792 2912 setup.exe 31 PID 2684 wrote to memory of 3000 2684 msiexec.exe 33 PID 2684 wrote to memory of 3000 2684 msiexec.exe 33 PID 2684 wrote to memory of 3000 2684 msiexec.exe 33 PID 2684 wrote to memory of 3000 2684 msiexec.exe 33 PID 2684 wrote to memory of 3000 2684 msiexec.exe 33 PID 2684 wrote to memory of 3000 2684 msiexec.exe 33 PID 2684 wrote to memory of 3000 2684 msiexec.exe 33 PID 2684 wrote to memory of 1940 2684 msiexec.exe 38 PID 2684 wrote to memory of 1940 2684 msiexec.exe 38 PID 2684 wrote to memory of 1940 2684 msiexec.exe 38 PID 2684 wrote to memory of 1940 2684 msiexec.exe 38 PID 2684 wrote to memory of 1940 2684 msiexec.exe 38 PID 2684 wrote to memory of 1940 2684 msiexec.exe 38 PID 2684 wrote to memory of 1940 2684 msiexec.exe 38 PID 2684 wrote to memory of 2756 2684 msiexec.exe 39 PID 2684 wrote to memory of 2756 2684 msiexec.exe 39 PID 2684 wrote to memory of 2756 2684 msiexec.exe 39 PID 2684 wrote to memory of 2756 2684 msiexec.exe 39 PID 2684 wrote to memory of 2756 2684 msiexec.exe 39 PID 2684 wrote to memory of 2756 2684 msiexec.exe 39 PID 2684 wrote to memory of 2756 2684 msiexec.exe 39 PID 2756 wrote to memory of 1832 2756 MsiExec.exe 40 PID 2756 wrote to memory of 1832 2756 MsiExec.exe 40 PID 2756 wrote to memory of 1832 2756 MsiExec.exe 40 PID 2756 wrote to memory of 1832 2756 MsiExec.exe 40 PID 2756 wrote to memory of 1832 2756 MsiExec.exe 40 PID 2756 wrote to memory of 1832 2756 MsiExec.exe 40 PID 2756 wrote to memory of 1832 2756 MsiExec.exe 40 PID 2684 wrote to memory of 1388 2684 msiexec.exe 41 PID 2684 wrote to memory of 1388 2684 msiexec.exe 41 PID 2684 wrote to memory of 1388 2684 msiexec.exe 41 PID 2684 wrote to memory of 1388 2684 msiexec.exe 41 PID 2684 wrote to memory of 1388 2684 msiexec.exe 41 PID 2684 wrote to memory of 1388 2684 msiexec.exe 41 PID 2684 wrote to memory of 1388 2684 msiexec.exe 41 PID 2684 wrote to memory of 1296 2684 msiexec.exe 44 PID 2684 wrote to memory of 1296 2684 msiexec.exe 44 PID 2684 wrote to memory of 1296 2684 msiexec.exe 44 PID 2684 wrote to memory of 1296 2684 msiexec.exe 44 PID 2684 wrote to memory of 1296 2684 msiexec.exe 44 PID 2684 wrote to memory of 1296 2684 msiexec.exe 44 PID 2684 wrote to memory of 1296 2684 msiexec.exe 44 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\AdobeReader 10.exe"C:\Users\Admin\AppData\Local\Temp\AdobeReader 10.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\setup.exe"C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\setup.exe" /msi DISABLE_CACHE=12⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\SysWOW64\msiexec.exemsiexec.exe /i "C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\AcroRead.msi" DISABLE_CACHE=1 REBOOT="ReallySuppress" PATCH="C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1034-7B44-AA0000000001}\AdbeRdrUpd1001_Tier2.msp"3⤵
- Blocklisted process makes network request
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2792
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Adds Run key to start application
- Blocklisted process makes network request
- Drops desktop.ini file(s)
- Enumerates connected drives
- Indicator Removal: Clear Persistence
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding A3DF8942714E857A7DF800A7244927F4 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3000
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B1D0275951A46EE9DC9D8181AD3C24C92⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 86C7A827D0AAF40E3493974D25FCF403 M Global\MSI00002⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe"C:\Program Files (x86)\Common Files\Adobe\Updater6\Adobe_Updater.exe" -AU_LAUNCH_MODE=53⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1832
-
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Z "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\authplay.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1388
-
-
C:\Windows\syswow64\MsiExec.exe"C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\authplay.dll"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1296
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:832
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "00000000000005D8" "00000000000005D0"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:1704
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
420KB
MD5c406f0e2e22c2591a36a1b28fadb6d78
SHA148667934c6ef6f6b8d2638b265166076f1cf3471
SHA256b673388af42c4241d987fd7b7b0b829758734f16022d798b56b27f0dcd84d228
SHA51227554b51544380b6f11fb99d9a3af64ac846817bf6b037432f6ed05892a9e410a91e1d221d6767a9a4c9240df161ee22f9a83772f11729e16e1f6c844e32abed
-
Filesize
1.5MB
MD56166b03a18b0e34c9d5d6005967a3a61
SHA1d9cf925e2ff3ebe11be5f8ed17e8cf100d5c51fc
SHA25656f95bd8d0230d08e980dac4243cb6ed4c681ccfafa688f1d7d811325d6f00ce
SHA5125b33c150f370cc1d7826996f577f0993d3b87278d979de97075cd842d841f2b343fd9e6f095e0152851073018cf09bf509a8be833a6707760c741fb4a70bbf10
-
Filesize
2KB
MD58f767b8effdf18cac9188949f2665fcc
SHA106191bf81fb84903331ec58ad356388b9170aa0d
SHA256d7e9c18b21634f064c1931b6c898697f85c6157d0fe503af2397f31ce0b0c295
SHA51272bdd098f129e19b932a30f650f12584439501dd65679a6c4da543501c5b1f2caa52d423223c235443b937a636f10706d705a499a354c1b30a6642cd2bb3a22d
-
Filesize
8KB
MD58a45a8023757ebfedccd275177f86b81
SHA10adebacc7f2fcf958f797fd818fb7963b29d4fc7
SHA25613c5ff97b3e33d1d508e3f40305d327fb1e63e6d8ef833bfdb484ccd91311f44
SHA5124306499e363910ab9e87388f738a7d2ffac05df12ef0c6842232950bd6cad654dea9e9278d3653d705837a8e0b98b6a9a29bbc51c39efc11745e3754b25b3a27
-
Filesize
2KB
MD5aa1dc94fd7841f026c66314d06802c5a
SHA15b2cc203e632a197cd60129d4241eb8b203f4777
SHA256610afbe4b0dd37d9686b00eb759319974ac5553bbb3e69ef104e43e32eb54f40
SHA5126b77c7933d5a341d5b3553cd850bc147288405368be2e04844549e47c56f455bfa36c9891cdbd280b4bf8609622bce27d175d10ac9e8f851ed1b37737f454810
-
Filesize
2KB
MD50e7cae9ef0618016a017933473240bc4
SHA1b6015175db8802b4750894955e89f81024b1d0d1
SHA25686787220a61f27119ee702514cb5f5a90ad9476545758ae56243e742a4e546dd
SHA5120063b90af889ede358e1c02211451e1e03862687abc5635b2827850945dfb1e8194d628281e22eab6da7f45030d3c45dc8875391f607f9aa800826f9fd943e8c
-
Filesize
272KB
MD5f24c83401d5c70b5a9cd387ecfbbac21
SHA17b2f803e68863c12eb69a476c261e7d66c464bbe
SHA256ac4b1a22a45720e77bd65c371057a5df4f382aac8cdea969cdeb73fdd1b352d5
SHA512c70cd55e2bce4811e0e31e09274590ed2362068aadb5578551e9d7e7899bf0c28eddc027baa6d5001cc6452909b31b5218e9b8984c8ab8ac48324b4d57577869
-
Filesize
213KB
MD55059a247666159bf441e72d642213cf9
SHA129301805956decb2ad36f574b1af900650426cef
SHA256a5637d50cfc9acd2d596f78c8a2bbc6ff2afc7c96f3915ff869bb147c2abeb2f
SHA51273997db04c88e6156e5ff234284a5b4c2cd0a6af4396b4268e32233f8ddf7916f0b3a96424dab468ca4c063429a1d6c9e6f10d68f71ec75d2a0ddf7a34b9cdd1
-
Filesize
91KB
MD552517f9c2f895b6d5b49521088dfb5e5
SHA1077c4535d93f7d3d8acf50ef9a5c780430f84abb
SHA256b654cebab8c8d7ae01c315aad66c2746bf8514c5973e34421d218e5bc81a2d3c
SHA51249094d79036e1f5121b0509c5bc9703bdd31497378aa8f488fa5a0c27a639701ede63a1865bedcb964d5169899489bff05bba274575c043f9f94684e3649f572
-
Filesize
118KB
MD5e2c8e69ee9d877e6688bdd6bffbe07e4
SHA1fd10464f3614c7ea91fd57fa0142e3304d469049
SHA256a1d05675051e2ee543a6eaeb120275d5364303282587b940e645c087b1c9a5d4
SHA5122a232867f5831636365feaf60d550d4dcf88050749ed30b820f5d4a1315e1badbecd26591fbb12ccbc1e2c38884becda7756473d7fda61222c331cda65ef699b
-
Filesize
7KB
MD5fdb91a81b12c8479e449bcaeb85903fc
SHA1cfafdd1323a90ae5b959cc14c1e3369cb1ae60f1
SHA256587e1a09582af5b649386f47845d3b9f135480e1d8120071a1e679594945a9e0
SHA512bb9f19d7d621eb3e21b2feba70c9d4f402272ccfc780f145174bc181c44a7c977ffe337bc2cb1981ef1bd32b8199c2b538b814438f109e570348990f038b358e
-
Filesize
60KB
MD50ee9e4d28cc1c671061cad0334c9b59f
SHA175747ea76f64900e99f9c963da713d054f8e8081
SHA25693218971e299fe40b953e8a0aa809149bfbd1ceae5902710bc5f8ccd51dcb0e6
SHA5121a75babaeb9e84d0c01cece224eff40d1c57d15e40f0898683ff8992639d67ad8abe583505c86691764c2b863817f3902474bf10dd6006d3572ee7207b706a98
-
Filesize
44KB
MD525caae1b2884bf6d0ce72c844ca6d655
SHA14ba9b1e940b3fc34b26a0d827850942331212a61
SHA256696ab4305901cdc9cb6cfade3019a4d4e6b3b311f43f8a88ca5d409dfaf738a9
SHA5121fa9a0bd83e42cde0fb33381fddc98703552e694a828714d4ed54683df56a2b436b16686d929ee4dba6c95f416c34aa84250dc7657319013f5adc4e6f5d8228e
-
Filesize
11KB
MD55752c08f3ea019fcd9624e258ac30513
SHA1c9e7f24de3f5763513b3401f3e5d3ffcf36422d0
SHA2566f3540c99320184244f8fbc9c012e08f887b200810882346038170745856c49e
SHA5126a558b166a9094e3e349a4bbfe9fa9740547bbea678704305b1ba248b724a63b53457ea0815221f74d5b69b312ad8fe3464e7848e58b7b689b04bfd7a4b18914
-
Filesize
4KB
MD50259ebb19401b2ff7d63779b491a5898
SHA1169a384a6136476a68629b779fcdf66bade7db25
SHA256cd122cc34e0c474833322c958a4c35b5b3d96fe8be14b9b7ea536fbe4d395dbc
SHA512075d13e642fdbe2283506cb16baaad3382f48049610026103cac2fafa84e798e0040b0fd80b47962c9e725d349de0da7e4b22f4404d9e23061544af8e41b4fa0
-
Filesize
396KB
MD5726ee22a0acbae712dbc0d6bb031f02d
SHA15f5cde6370a971411318509245265bce215572bf
SHA256b800e2bf2b5d49f06a7a780f18b232178e717097c0503147b06daabb533b9ddc
SHA51285bf01c042f49e653d9a4415ec07a23041ea10cce8d011f79fefe7020c6c189e1075bbd33b037dd06c5df57dbc8ae14bebe5f7b01a3bb2995d8b99fa6b8cb859
-
Filesize
81KB
MD5bc12c8727dfabff44619ac651e5e4d05
SHA16a9e0e593e279ba3c04a9ba4c1578267eff5f18a
SHA25627165d01a0e807c280c6078306c702edaf84ff67276b06398bf8fa9b74feeace
SHA512be6891ecbe46b0bb69ecdb387b9527eb53b7a9b6ea0904e2a858c78f72dddc7b0538787ca4e85a934ae703a046520f6bdc7b966733a621a998e3e1ece33dda5f
-
Filesize
420KB
MD52769affad441ee7a919b428e9ab0f865
SHA1d755e315d6b81f6882ebaa87f7888be5850c29d5
SHA2565dde8141f6681827dc2367bb724e44c1e2c6449ef582ea222fbfc4960b6d7caf
SHA512fde5ff5df4cb598e9a253e59b55132b11ad2453c5af3575c2280a3c067a02041d7a03fe4d4c94daaaed44ea3ae422008e31619759ff58ffc10f15a56f829c185
-
Filesize
18KB
MD52303a6ad453f906c2e1e2c003f2e97f1
SHA1f0d2af5b3b3b5eb06137ca36726ea8cf794b5ba2
SHA2560c2ddaf207f4b83dd9c766115e471d6d416d6f116910dab9c63d67eed8cb3639
SHA512a02e6540754d127e823fd8aa81ede1c0908020bff208c9ae227eff9fca863c649dd3d4de59e794eaac4fbc3d7165fe2f9ff3e68e6d58cff1dbb207d6cd7b7c73
-
Filesize
339KB
MD5f0407b1d6a2c627ad6ac114aa35f2a54
SHA17c174a6b39d04e5cbb3e2841b8f7b8965d7a3b05
SHA2565e3dd1b3b97c27c6b5b58608f122247bf5594ec7fe9c5fac99555dc118996084
SHA5122b73326f676ad34d3655bb909b28b386def52e6c961de1b079906e89f0bd59c116197ef058bfd286d59eca575570320d62e9f5fb6b8eca25a393122fb579de1e
-
Filesize
507KB
MD55a4140491263d37505776123f77235c1
SHA1d82c31f1a46e820be1e0d655b21d5e15242d9a8b
SHA256df6489d0e2304dfdc19f07f6c5a312fb89d7449358b4a6414ebe3ffad0cf9ad0
SHA5122c30d4d56731600fe7ef1130ab5b5d97c1a914ac2404006d2d6591a1dfa66b83ba84ee03acf234d61f9aa7ef7d8e38f63e9dd8812c083b2347fefc1607bc7e19
-
Filesize
212KB
MD5e1fc45321c24b28102b93a1589ddd803
SHA11622a64d5bb6970938b6843e37e128134ac1624d
SHA256b0fc26852d54b0ff07d010b5c0668e40c5f086caf05d50125550a9f07e4bacb7
SHA5123060c8b250dda1d99acba01ae245bf4ca89d321320fc43b435f86d87f929925b055b85a952b2e1a690cc0df0f689771a1de4aa942d810c4d7f7c186bb3240b2e
-
Filesize
21KB
MD546c274f7e02cef2a2f11418bdf92687c
SHA1edde0bed32f4eff9ca720149aa615bd005b76a25
SHA2568aae6aceaef9d6b86ba8c4e3461fc5a47dcd4981b296c7b18cd03c3cd6f01969
SHA512fc511b82f18d352187617811eedb3d62aa3ab8ae5fcee1dfc221907b90227d2cc31c6493a20f81050765a5153abade054805e2c5920b91846a88fc70ec0628d0
-
Filesize
795KB
MD5f395916718ab00eecf7ac21ae4d4c844
SHA19a4291d9b4e07308402106c438d4a3b41461ffb6
SHA256a4b14a9a54b1161a8b999bbe2ee7a3b839395f878cc751dbacff5bcdb5fc345d
SHA512b42dd348f83657d453771efb07d336e9e605431390ff2b26dd9bc6af93b9a52a54fe902083dab6d0c5e90591ed2e8215e39ec31baade52ec3c5c37cd91bfa583
-
Filesize
425KB
MD5d242de821997d14da6926dc07ff22f60
SHA12880d0a3f0e7076e449413b7f639b80ae6b6ecaa
SHA256f0cd6c0e97c7a5da4f8d6d5cc0a03be1a968f6aadd3e981a1dc542e637ead15f
SHA512b0e8a2bd13bd7ed17a29a4bfc0703e1197fa16533249d4d7486f5b6503fe42e0d094b803ab8720eeb9d8c7d34d2c09600aca5eb527c7e5b41cd17a45844d3868
-
Filesize
262KB
MD5a0c3c65f6295169e29d2c374fff3edde
SHA19cb0bf82b2697e0cc991b6178090e32d15215b80
SHA25698bc4ea92ec57f49a4ef2a455035e74c4d4105eb48fe29e606a80d9c20f655d6
SHA51216a68082a4cf75fb2974f6a1bd35c589cdace55fda05285791d7f458f9c6c890abb2f36662dd5e12fdf0bfd8e1cefd986b9e1070cf8c77023361bc1de24a7cf3
-
Filesize
538KB
MD56ec34187a77bb756975eceabed5dad57
SHA11d809f3e767f38b8133efb7e26017a2306f3290a
SHA256f86eea66f9fc96f42bdec20e97a9248a33c1a24936ffa77fcc8f09c8440bc985
SHA5122d7f8d15c181cc0a5ab474610b34bf40a97ea25f6f934aa273405cd1250c41518ecd00640d04cc3c37069652a973c1043f158868183db966e878c27d8e5bbaa4
-
Filesize
2.1MB
MD5c0754ca35e01ed37f22807aadd29cb7c
SHA176762d4aaf4564a398f72a68a52f2fd07921d4a2
SHA256e557e3c7a7a38996d97448031e878701893fbd1e5446dfade39a97407ec36c7a
SHA512f06d62419b138867c13f1a70ce0ae6ce106867c55a3f9e45c925a69f0984d8a72b28910b614791168b2425c60718956d20497fa9b662f8585c3329b66de76447
-
Filesize
3.0MB
MD51907bc8d94c34248beb1dfac4183df9b
SHA13173360152b3a3af34423d7b8913d3a0bd23bb72
SHA256cc0401b7c2e0041998fc87e4efca49663f3b86c20eed04f6304ac163584aff8e
SHA51259aaadb083fe2499878ea1cd656f8e93b4ba3adc25446d1c9e0737e950153fcc63a70800e9e1f3ccf96820c4c0b3292dc7ee1de4b1b046c5d79162ab5444ddbd
-
Filesize
270KB
MD5e18d14e92c27c5104f3deefc27b98f2e
SHA1932f03cc25677c646c9166a6ed75d4170beeb23b
SHA2563f596a567be47e84f7603206d8659d8076d4c21ee20788bb23cdb38bc98feefc
SHA512344036de0fb83b839079f2b495075feb5df85f9a3daa64ad30d39451c0c3de639c30fb3362f8756395cc94ad7c6d301bc5dfef3a393f4df780e62efe1263fa97
-
Filesize
10KB
MD5269b2580369f264537ff7d6cf0c18770
SHA1afa6f8152151bed9f6df26d794291f5774c9ca99
SHA256f90b5e5eeb88dd7dbbef57bdf77d78b49295c7aa13b0f404886b36e1e28d192f
SHA51250d7888ac29ae6477f9b6788537c2264cd00119de2f273d117cd6e818dc63fc277239563e2fc44e4b4b89d3cd3af33d3e61d8908f9d30a70ce605249ef4a115d
-
Filesize
165KB
MD5eabaa403d1b0fed2f0d7286d951df73d
SHA185f7f0421b65d116d47301357cb79a4ce127da60
SHA256a8917de7fb93972b4822301600c6ad6a258d35f9ff3096fd5dabe268c1668f35
SHA512cc381cc983cef8c6af8ce27f5ecc85a5ab7033f903140b50ea47592144aa15037605c2be476306d00ea8054ad3c1d30dce6a02aed56c7af518101e81e11633a1
-
Filesize
10KB
MD5dbd4bf78d34726a6cde6989f009c36cb
SHA12c6ecdcb0216fa7dad1f897f41be1c7a27c7f1e2
SHA25658131568ea485d4d92005970c6cd4ffa75228db1d0488d9f26576571cdee52e4
SHA5123b1fae090b799f9ebd605fa174b3773d0a28d50f77080929500f7604afe8276ff0d5fa59d061f7e6ba49475558dced6742721274731ef0e91bb24272dcd734ed
-
Filesize
6KB
MD551badd63b5844913137192d38cdb8691
SHA153b08bad8b101d7e572f63abb458999ab5336a88
SHA256d4d79711dc99f759a05bac1e653f7e0c353fcdfe8c064e5b0f975275322190f0
SHA5121984d2735553cf6c6315e6061c6f2b8ebbb04aa25513c265101c017a2ada83cd6652b0830c4ae4ca1737d4034edbb7dd523cd9ca294721888a2b313d23c1d28f
-
Filesize
1.2MB
MD551e39ccc441abdd7ca9cf4f3d82c6f57
SHA195a93e29a8e91d304fed5d11caff770122de2cb2
SHA256937bc0faa9e96dbcdbc069d5530fbf5b31bd4cd94373127b24e087630abf0a04
SHA512bcef76f2adabe3a5d19ef7c476506fc159807f7fdc62f9bd795c14472e8c7554fb0387dedba747f809f301e659e519c2db603f7e5a446ff0fbfe1b6fb2c19e99
-
Filesize
287KB
MD59abb1c39202e54c46b5e0338d4f7de8a
SHA1b5b475c02c527592191989cb932441abe5ceb1a0
SHA256f4e5572c7f295a9a20a317b71dee97cf8ed041b1ddd6b178c718fb269423c199
SHA5122515d86a8c3c90d93a88cfaf78ec7bb36e8ff6285f334e40fd1bed8e3547626aedba8ed13e7d850882067790ea5fac97dd7373bd61bf63a9a43e153f0a237b40
-
Filesize
92KB
MD5ac9d27ed8b94ac802057acdba66464a8
SHA17fca89188fc2955caaeabf03151fc0c9f44b6370
SHA2566bcf76bc4b2a4945ffd006ba2f77b32fa150f680ac94ef9ec6ec5b4414b9a4e1
SHA512cc35d1c1641a3e0e98875a90eb6e956b1f21ab19c0d4c9f1a6948e0acfd9c880f5a54c5fe238cce360864cbc350edf2a42e6605b0e08f22fe13e1c8520162e06
-
Filesize
5.9MB
MD586f84905e89ad76d291c5b3057bcab97
SHA10a6c671fd981978512d3d72934fbd725f3829686
SHA2560e125566236a90649b78245a302b8631353fb2495aee4090c2916a9a722885ff
SHA51210720f3495a6725515a165d2b3e38611ebf678a2c107c42493634133920e19b6cb050f5f434b50d2e32b5dd172f2686ab98d80822c79d457f5fd14aaa3081890
-
Filesize
37KB
MD5112482ea63d4370b711844381b98d737
SHA16211793a1b01deea2fce33c8e48f07b7c7d20fc1
SHA256d5fedd79a6cf46a99b416419a78a5f3b1dee712a8bcc9c77424d2f2d03975a26
SHA5126e03112fa65d33fb6aea719956f4d70451df95c563bad36c32a35d80eb1911d8580b2926c144059c5926924edf408fb4c21e8f57f4fbb618a94caf7d87ef06bb
-
Filesize
31KB
MD5ea1c35dd541d60819d55482130bd585d
SHA1dc4f51268894e90afcf41fcb1feb26966926c3ed
SHA25629b87ea913098368d64a2a88f95b519017e925d990fa1eadc8163b6a1cfe8448
SHA512a606284b672a7b7d539ea7167f02fab6f73472a9adbcbe65af4b90bf54e2d735b3cd80b34801e9cf18d320998e347dbfa305ed69521a0f3107655e480f5f6d17
-
Filesize
1.0MB
MD5e3e8352636b674dfe55fe59f23123e5c
SHA1aed492f1b21e2abd39f156b25667478a85c4ff9b
SHA256b841755bc7e671c1b73fd33d55622df2f9a3a50206c2cbbb95289f7a94419e21
SHA5121a1100cc637aaf903243a99165bc66082d7d4cf9f12b68b62799c17bb920f2fd263620a35664ba88c5852e03a31daa0dfab92f153120b1269d6e02c85b63f589
-
Filesize
71KB
MD57a4cd632681c7ffaa7edf947ae82bdfc
SHA196120da280deaacc3bad1647cc96679746610154
SHA25631ee00e9202feba9db22f46bc54857dbd8a426dbf619660368a35889844ccbbc
SHA51278c8d850836111143e47ce9c618d3539ccd507eebe8c719a0ff9a79f455e45e0f1c435780b5ee4293768ebd3d324c0fca5ee38c50b0003d5b1f0664fdcd4c9b0
-
Filesize
436KB
MD537a7a76c44edbea4a497fd4b8289b8a4
SHA1c0ebc0718e047942212082fe47f1d07873b54764
SHA256b3959052dac81bd86f5bfc42d992f2b44a70462c85fb2a99b32c4f0362288292
SHA5123c27071889b3e330247576a11035e82c0813f8ac0daaeabdaf8b2e1ea97a409c236b108f4e14e22cc5b8b71ab9d848617bd023944a84760fddef978a97774348
-
Filesize
527KB
MD5994e47110a8beb48cc285293d77a9372
SHA1a83bd7a8234871435eb45435698ab63daa009797
SHA2568e9bb4bfc97b92d8cd34ebceae57650eba6be154ef2961a22c988e3e7919b19f
SHA512ca3ebd07bd8faa9ce7961bd5797534ddead801873936f5a76e8b3821c1259349053e3bc74ca2c92b2bd8b1ac8999956d66eab84f6276d0c6567a88e4620f7eb3
-
Filesize
3KB
MD589c413369f96f860bb6e6185ac5b4a79
SHA19a3314426c0025c5a4d727cf436211468a8a295f
SHA256cc4a5a15ac9f5a95389979ad8d8dd2de97a4025018da895beecd1f58b8504be8
SHA51287abdc2dd19b21a7243ad20631907df67258295a330177bb074745fafdce4d7dc9241dfe14769966f58b70c2f09124bc231e1583fcc0fb75a506f99d4f0ddfac
-
Filesize
130KB
MD53299a88dfcb3d630bef9fa5e4f09d301
SHA13cf19b8b73878421748022a57dc70792b10b7410
SHA25602cb0b283926e0c53badd0a2d1d6121b8b464ad459f2a5d3481891cefa4b1c57
SHA512acbe43e6414479f0edc7703a3f5e2f98b88ce1e926e6cc46e48bccef4b48eba4092eee1166590c455c208f310f32069c92692755e13fbd458cd4139553a28318
-
Filesize
41KB
MD5fd1aafa5eaa25ec8f4109ff75e38e7d8
SHA178a851c0d4a76087b3acf710af605240808400c7
SHA2567c9eba1b2d0b1ec917777eafd89db960aba7f111ec196905f4d807c0d00d2280
SHA5121ca2bfe55be9db6e7be11b7c4c95f5d7e0175d7a4961128d531ecf9ad065a4b8cd2d6c74ef87102e2d312c41656d2fc68c89cc02cd5b7c36e2b30c013eb4d320
-
Filesize
27KB
MD50fdae340d3024526dc59f9f456f7cff6
SHA1ed7e0c3ea0cb4d8ff013743d8d0dbbb831d71623
SHA256ca44067445fc401e90d9d637b8afeeec48fa4307ad5248dec8e8049440a7ec14
SHA512979fcb1cd32e12d64e2122b70be7042ef568b82e6d83d67406a2b0799ab4d63385584bac1cea9101d6810ec75878eecd6ad47c0a5a6e881479fe879885aa73e3
-
Filesize
16KB
MD5b412f512f36561265564460400579cdd
SHA14737df30053520fd6227ef1d860cb133b858f949
SHA2563be9bcec2f78e3898f815387bbbaf1bac41e8dccd1438487d6eb2ab23a29ac0a
SHA512c676c08f3a95b3805ba2ab5b1a1793dda781cb46c66b622aba55a3cce42e96d56cb82414e5687abc0cd33d2e9bb0f955c01c4d750ce4974c9751807a469cde4b
-
Filesize
24KB
MD5ef810a38c372fe84e843b25ccf2094d0
SHA1cb7928bb217aad111560a25c9d2bd284d5e314ec
SHA256d75e889307f8b67c10d491578698e093e8df1bd843878993444cadb28ab3a4a8
SHA51295348f24c85c25a7e96f5b186894d15b47c41c017a164bc4d44c41a163b45f8aff7274aa444f4f94682028bd8a3b21464b908bff359e35818795221bfb53adbd
-
Filesize
19KB
MD5c8e8f6638c381824c209188b2fdf4a01
SHA1ea24a05cfd553aa272be27546f2442beda693ae3
SHA25658cc65a877055e607ab0283b50d1874f2d4e90b3aaa8a10f3fcf18a43187f5d1
SHA51294f2718d54735106448f336bae49a63ba4695ce8f7c4b434ac1a395eac9cb049b0920fb63caed07ba81047b3689f1887124ccb3d30ce2f5e44f1ff8e089c6cd0
-
Filesize
127KB
MD5ec69dbd895449bcd243923622c3874d1
SHA1f5e3af14f274aab87ffaddd0aa3595653cd890c4
SHA256dce7c2b79cae17a4bcf35a6f5661d044ff43630c3871195f2cfd1fe1c213ee6b
SHA512a35a5cef7d8980d7a76cecf10eb026b047f0741b63b6c18a63d58fcc570668fbcf193273d8e9bb2032e146ed051f80ff5dbccbcfb314f8d6b665791de5476b27
-
Filesize
507KB
MD527bd58f85c2912d55b1a28ded0d3d86c
SHA1a1659c726639c1b1cd5eb25e0d3ff7e85fd48785
SHA2568fed871bb88bd3dbcf2148031271f73bdff9bbe027711cc2233a44be3101d40a
SHA51294ecf511ed2554de7b2d6e6dc1c0c817bf5b29ffd085188707e3cc7652d4ee6e1a39ab1ae0af0000abf694884b244c28cff15580531ba06a812465b63ba506f4
-
Filesize
44KB
MD5e5abe55e2f1dd5a510f3f4c4450c1a55
SHA11853f586862ddd3b80ce3d93e4115c6ddf00851a
SHA256af76aaf8df3cf7b858a6b9f4512b279f4df209db52abe8dca6153b9e72f64567
SHA51252bb2bd7071e60369fa3333404216342b2305f68140d858717d869e75e7e57868b0ab4789ac4ae639b5f9302a993cf2d1cabd7448cc125abde07f10db87fe403
-
Filesize
151KB
MD55109c07f0ab6045b04cab4996064b6d2
SHA104f418c3294f35c7102bcf063ae37efc8470b59e
SHA2568f134e706ecb3a800d6d51eff3ce887e7d2702cbd2ebce49aa15227c3687813e
SHA51280d666b754d770f2de1d63b77f61607dd8888e3b7694d9b5b224c474edb9ad4279f6887d84cc5c46cd73aa9626b79ebbaf0f902837090bf61057cb98537df6f6
-
Filesize
1.7MB
MD519c48d62db3b7e0aca7800aeb6de8a1e
SHA1d9f41165b07f4486006c09a36b827281336e0de4
SHA256d4a4cad640a58b9e0d087c051a68d2dd9151efb2a9fddb91dda680eb9ffcc824
SHA51238ca333efe2e49994d29f5ef6cd800bc1941c81fbcdc727ac579541b417b901281ddfab6140e8a6ede7c2cdeb68387317a1d74524e0adae1b7f696d4294525ed
-
Filesize
1.4MB
MD53ba78c856225026994fa2029c7133977
SHA1beff697b125922d8d348f359c3452c1d8dea65dc
SHA25654dcd672e0b59a5051974ccf839413b79b42ce0011aad064049c7f104665a865
SHA51265678fc3b3c6faefd3a4f3c32c2d84c2e65a68182753355f5c6d7985f7483c2db7147f7218b515bc24efac8d9c15beee717bffb515004e1a2607b88bf4c69094
-
Filesize
7KB
MD5598f43c58ceb7e2bcbd59d936d51b6d6
SHA1a38262c9e27ae8486c5c8b8b14c23fc6fd91d197
SHA2562b60a17963740740faa766e7c7d6dec401a6e05239e225ec1ad50172283eb1bd
SHA512b74b0d08b4aa8a07754992e13dc09d0f68bd8675c312314dc13dc958e802432814c434b3ef6786ac71c190893e1c5495e20ba16fa68e83d9f8863b1475af6929
-
Filesize
10KB
MD50d94fe256c5af53edbd76e8e822817fb
SHA11b0f6783148ca69b75174ad8a857e7725cd28afc
SHA256c3c5256cb16906720b449829c9f290aaded672132d29b033e815ab9fec8c4de2
SHA5124465bfdf92f28ed83439feb3066675a4aa58f44b7158989e8061ca156ff5bf3b0c9e52633572c45e1d2e26303da4692833ad45e32d5f610fb243a533c7a48b3c
-
Filesize
7.2MB
MD59261565634a7145766a64c24cb678e38
SHA1afd5e053a2e704659eb6e7ec1dbe801565f99971
SHA25624d389f935215702c5e83f7f102a58b3d498f91eb97cfab97276d81cf86975f2
SHA5120c58f546bd0d828278957ed20543c1b4d8f13b6783b8833ae37dc075ba55c16cb5132ea5930d9322ae5eb4f11fb88296f2d91afc727a034125194e3de309e2b7
-
Filesize
109KB
MD5141cb8d50cf317cc2720f1afaa34e976
SHA11e92c8965fd059dd08eabf7b2531325dd882ea06
SHA256b05e2c71ce6a203faaff617782de0838d44ecd2d27a0c866ee43679f46c8917e
SHA5120c00f636891346b00979cb8fdc673711d76fd96d8d872444c239b42e574881d7b0766fb87220edea19996bff14ae1d4eefe52ecc0e42dfc110fbfa5fd4f762ac
-
Filesize
841KB
MD5998df5c87c7ccac8dd4fc1ebdfc80844
SHA116d309be5f47e9a34dc595ba8bba86a2319cc6d3
SHA2567046966f806c9565905138b9069b1b4821dc557f75dfba4c5cd2a2121c546411
SHA512aa9b4e96d439cd9516a6d0f344d48a3e4b9853aceb39cc171596d754d69c2314de5c4956bd32fb5b69a2c432a3426fa3b883fcbe44a634bf43cecbf8e5b01c68
-
Filesize
52KB
MD59633174157ae5b1caf300f416c746679
SHA14d729ed083410b492c3833ebd5695906230ef258
SHA256bce639f33239cc1bfbea2433313aa73dd12e95f0474a2863d519ffc5328cb7bf
SHA512ccadbd9ee9959368a90cb0f0d1569d5d81d2d32337108f0fe01a5f851515dc179eb928273dfd813a6ceba914322ec2fa5cf4e941529328194779411bc150a23b
-
Filesize
5.9MB
MD56635f86baddf87972be9fe3c705265fd
SHA1b4745fe967220d1cfb5e7cca5e45fc4ee6caee92
SHA256f5fc6a2ae68a5e108dcdc0426d49d1493a79fe0fec832b26d7b63f871bde082f
SHA5129b636f2cfcc7df93445e23a9cbebf9204161c23819497fac50377abcc3e9296dafd3c37630d148e6f3825be830c29d612eba28a81bf4626f199fcb1d53d33f59
-
Filesize
97KB
MD55b06080301844d1e81601157b087e6fd
SHA13294d45c9a89cc1a47c4ea894cb2573ae6f9323e
SHA256ba06a8d71c0d5994b211f810d46c355b49e955ab1bf80a5d6b338d77672d4a6b
SHA5120a846921a1bf5162319c52a2292430643b10186fa5d5bc56513fa9537c762d8a87094ddc9c867dd46673787d488ae3536348444f4ddb15371eb5a069fbc5db67
-
Filesize
146KB
MD543c7689142011473cc34b76bfb3944ff
SHA1a12a52103421dc901e68415e36f29d204e476d1c
SHA256e9b4217ce95f661f665bf76186c25f2fc8f8dfa85565024911880da5b5d6d7d6
SHA5129260dfff83611c4d5f1a32b9e1f11f8d394b28c3474aa2382a42e7414e05bc8a7575bcfa268b84d823112eeffcd1309234557c18c37f62eaad52e1c80dc4fb9b
-
Filesize
299KB
MD5e6181cbd20befddd952e6977a705eb13
SHA19eab8ad77f1ec115552c84a9bb7c85c5cf0fc856
SHA25628134718d87406dc64a9de67b9d63e66782d340165731a98b353b2e2d30dc6c8
SHA5127fd2aaaf947fbf32e3158264b18b89af7eef532b2691c8870a2fdfef9bb746f883db4fef3b4235d3516312d39d101c024c8d334be1e0bb9ff41d0cf8b0c4a6b8
-
Filesize
10.9MB
MD5fe643b5b7cca55b39cb081d2b2c5333c
SHA155f5339754d30504f72ec573168cd53530ec6804
SHA2569615d2f230a6ca7e93eff8f8255b3e517e09d7d96eaaadca56f1e5e9bb6d22c7
SHA5120323635f2dd1437ac542effcd1db26dc4848b04565c5fc80edc3a7be4423a4b3b8c800af2d199eae6fbb910c723e9968798d80287a10dad13ae79ffd23d2a012
-
Filesize
200KB
MD57d913328d94b07673dba6d6182ce283b
SHA13a1179648d9b67bb6815d429d294adb4b526f616
SHA25609e00c229c36ab82120fca768ecdc98067fe43a2e2ec5d77ba366044a42ca85f
SHA5120b9085656c3c06cf75444f3e98e816fc9b7997c7645205c562bb8bdc3bc3d9db99244ec29ad7a7575796a00556e2dd87a65ff5778c0da1ed9faa4c5e8908900f
-
Filesize
132KB
MD548d3610944bc3eb0c90a9153a7d71bd8
SHA178ef5d569526298a3b4865d214ef49d6b20ca17a
SHA256cd722bc332b1f2ddbf0c7e8d65cc0e743045444b64e604c36cb94b6ec69a6f5a
SHA512a7e7b1bf5b049ab76ea15b1e0c8ee17b59d8115f5da002c41dd89ea2ab54c64b8ea4ca06f40c847331c5fa30eb3088c680ff323ad24dd0182bb25dcdacfa507d
-
Filesize
101KB
MD5ca48a693af143aa11e2b59883ed076f7
SHA147472a23676516dc3ce43a3f6e87a092cc0cc8bd
SHA25634bd8145acf8cf864c43c0eee2060b20469530cf8e92e4ea7e04defa8b64e19d
SHA5122143bcbdffb98b3e42e700b1fcf91b339cdcaa325a9814d6da40e8403d227f6fc4ac02d5fb3b09790a5041ac2771309c8a4aca498c122af3c4fb8eac8c40fe4c
-
Filesize
61KB
MD56242c7eae42f95e0b08f66b744f3895e
SHA13be81abf6990803a22c6954272487dd64af28048
SHA2562d8cf27fcfbea5f2192b5f1ebed408e66a01990982b20a56c82647ea275e9067
SHA512b112487bb50b0fa7b5d29b4515a51939fcab39919c43fdc7db7bf291521791d760e1de9125514ed39bb6a458aebfb5541da40954bbba2eff12b0b0d2b83afd03
-
Filesize
17KB
MD5db7bba989705e5eaa035056296e09ab8
SHA1a749df4d371006ca24d3fa18a6a81502daef6453
SHA256c99f3b1b17d40f7d24ffe34a310ace541c0a1cf7ee4db3f31f6bf28d8724f928
SHA51222ccb680bfb0c109fdc513544b9b4c09249881af8bafb43cb2a59eb3540b7b621b3c2565d26b7aef1de46d05ff2d2abf8ec4f6dfe7a6854f32b8bcea9052dbd5
-
Filesize
47KB
MD5dfc7946f16ea9125d8e53c0ae75eb30a
SHA1333ad31c3ada0d18bfacea071b5552594091cb0f
SHA2565dad0a1d8ee141d7d4ac9695dede839f31ade76ac645c0c7958846005e2851f4
SHA51221579740cc48e4e93b55980ba6c5bce6379ef9ec80d822278b90526d4e4f866e27a6841e171e73c7857b92ad3791ca5fa0c6bcf9976b5a9de1e1adf313a7c5b8
-
Filesize
665KB
MD548bb5d10d5502211b3d38f4d948e5726
SHA16e11e759812c666e075c198a0604e20a9fe09f7c
SHA256d2bf705a324beff0a2e8761c97cd9202d20d82aa1411944d2a2d19deb79c3139
SHA51272e57b30c7db288ac0f5ff56a4ad605f31cdb26110c3e74e7ce82959a128ec53fadbfed5ee51390c7914ec41c1c16d8c50b546683ca5994d9cb4a4b46f5f14db
-
Filesize
82KB
MD51cee683c63f5673b8050d17b54adbc34
SHA107a933e381ec3eb787e434dca7f3516a3b94ccb3
SHA256e15a0aa8b9b4e8396c8937dc1773deea8f57d852ea87571e07084282ace2fe0d
SHA51233c72c41a89b6bace4b6da9ebb630f5d3c093416cc5e47f63123ae3c728860d42423ac40ce6e3ed57830a1938c22eac73feb3075cbbaa03ac4778c5223525bbb
-
Filesize
34KB
MD58a6683ac1dafa824615bb3857ef8c709
SHA1121aa154815960dcd78b83f02880d47fae3b526c
SHA2563e0c4a19e9dc29d74dbce53a58e5e196bba2d4603c9d0cde73face6c214a4154
SHA5121e0dc360bd357de1a0641b1319893a058ac1bc0c72be49a99667c371dcf8ea243c4a46ff5396cedf7b5f3cd9738a13a38b32b2871358d9945a1409c63ea129c7
-
Filesize
16KB
MD58e601a8aef493689612a300b6837ce75
SHA1216bbf99bb96ce9175ba9f27a34beae1f5969e9b
SHA256209b9f5fd42fd63ac49655554aea2559af8fa3ec99048111db131a197d55d2bb
SHA5124d1e989087b7e365ee806e845fed9225bbb442302626a705c87933283bf1385f5a4f08b4210650d392173039b7cef8de97d4e4bf178a76dc0c19c3488569ecc7
-
Filesize
1.3MB
MD5e35db1506668d9c5dd45873922547dcc
SHA1167467750f056f38cfa100493f5216542a305acb
SHA2562367e86034108e5d6cdedea65a0668e9c4c97512d2f79dadae720ecb1539d5a3
SHA51236558ece17cf6b22d00b675e8c612a92a7e0f84a2a6480cdc8b5dd966857cd3f4da20ac949085f199ebf283185a71407a45e7742a8a42afa5638ece0b0142440
-
Filesize
272KB
MD5ef4f1d6d1e78694b3f4a19641fcfb310
SHA13f0e1fd375ac51fb1a99c80e0d8fb1aa246cbf73
SHA25694095648d1905831b77958d316a2212c21b1490cb47a3eafd56150b1df69549f
SHA512e28aefc8730f23cb09535e7d1fc259eab98677b994bf22a928419b6a74bb8ceb764b467b7f72c2a603c23eb577d9be41cdd220fd4a890c841e0a42778e066525
-
Filesize
213KB
MD55d96f56ef706fd2ceb371be3c397e468
SHA1c969839a18c9c7b4098db2cb7e08520e861cf1b6
SHA2563b92346542cea57abb1e793c2b55527aed3eef21b9676e649000d9a5348f6067
SHA512d8e65a6f7846c154b8a1463adeaf535632baec0538cab9baa522cdc777c4b0cf2b021806a810e77ee392463dbad7b96c3f34517f87b05099ae6cd0bacb1e0d12
-
Filesize
91KB
MD55ad74471ff57bfbe2070547281de5be3
SHA1b02bcd7dc491786c86c0256e3893f10290e8de8b
SHA2565e03130d1e0906e4816e56cc8ab6bd31d6609da33c5abcef64954abea2a85a73
SHA51262ac459a71c6e7ea4e236ab3717e18fa46cff2f5ddd768025960d5502e59840c53ceada1bb49838c1c1233c77b11482d89ec499038f211594589a3f932d91fb8
-
Filesize
118KB
MD573ca131826e3b7d8c159e32deee9e00e
SHA1be17dcc7e49da2ea1c91d57de0704c110f4c7c38
SHA25646f70504952d2e5b56ec5e030c230387a842edb7a08a9d9250dede60b56ea8c0
SHA512cddf85cfb6623b793ec803d57243555f822b71ca375135ca4b135298846dddfe9e5e1c4e7db9eb2298508dff13833c7a05f3d71c8563d24f8961027298f173c0
-
Filesize
212KB
MD580d03f4a6af42eb3b34f9abd41c3fb65
SHA1a319f1c5142b7a7dab67b9962bc840b2ea679384
SHA256234a4aeb8a58803b1de13ffa9fba17cd0e094d5fff453f16a95604a14f779eb8
SHA512695840fbb475748822a1cc7509d975c3d219d456d5a309c5e5999b54e1cf68b695e3c1d02fa309dca574d8234575a9132be35fc615c225026102e16bc4e9ca58
-
Filesize
21KB
MD5f9f0a8cf272ecd3af4fa94073264e095
SHA1753bf1063b03a81a5a2055e5562de1272158fcae
SHA256d4a5625b3ce5df9fbefc677288f6c1be097b2bd2516bcf57fbbf747c6a1facce
SHA51255bfdf494831a8b2066fab685532a4bd902a4dc4d0d4722b3a1f7f1314f3bb3fc116f77bb88b83be3a87614673541e5c359200ab81e6c4c82a2b2b649dbb92f4
-
Filesize
795KB
MD5c604ac32abea7a52b9e39e9208ce67f5
SHA189f9468a3e3ba44a7ffe2923d20d7190d5edfa85
SHA256159dd63d3b185f10657d34457416f1231583d2d5fb76f3ad41d924b93f7d6469
SHA5123779da5b6ba6cf247cbb8192cc5f5a43c795bbbd63fc4e1d7cde757bc5e974fa95c0b9065fbef8459b7c40e32532355382aefcf4f604f4000e43ae12a39b05f4
-
Filesize
425KB
MD58b891650fa07a5c667e97418a88e54f4
SHA1db8564315edf4739999162ff20acd1808693d727
SHA25603f41969b7dad8efdc8b24f9384b45e0fcee3efa668e72c2bb9d8a9156486e27
SHA512cb888bc0c2b0105c32d36f0e0c3a30b744db67720ef0a77b468ecbd67c2b1dffff6b3371f6688b90fe9741c7a23bb42d212080308b9c1e9db8d35591d31898a5
-
Filesize
262KB
MD5532cd62c29830f7e4b33cf3df5735845
SHA1cea98775eddfc46d96ba60775a42c59494a6307e
SHA256ddfbda79b346a69d802449efe495e9d181bc089a8f8fd47e765275981434d7de
SHA512546d7ab2cf60c45510de33c4e29eb3bb13707f7611c9536b0874bf1f63d16eab9c61d366e27281c326011feea6ebb1b247524997ee59e0af7dd852773b934654
-
Filesize
538KB
MD51fc870f4f358a13abb5c567b08953411
SHA124f8866d33a0adc09889396a175df5da99b63088
SHA256172507137005c5dad796118afc9089f34aec3eaef93e272b6aaeb19fa1eb687d
SHA5126102241f3cbfb016b7940d03c8f94ed6a6599f6a46b0909b21e369dc091bc7416efd273f412dcda6d357f97b5d968da5f24dc8472408bc2986ea495679ac14af
-
Filesize
2.1MB
MD5ee96d0530aa828b97b32a2376b07ee81
SHA16932ea20a0b720b0d226c0d533109cf709f7dd6d
SHA2569ada767b89cda6bc87a80d0506a46f384be356138d7a818aadb2042982eca89f
SHA5122ab2cddbbebfcfe661ff4976bb9817b0531a7d45207dd5bd523c46b33050f21148cd023cb9505836a9f10d22b17f8503c0c2a6fcae2ded30152d13f35f9dd47a
-
Filesize
3.0MB
MD583850a7ac00d7066a08edab180bc99a9
SHA188148da9dc5202e2b00564743b6753d083bcaf92
SHA25612b833a75690e1227770102dcc30fe21400b3f063d272fd1e57ab8e0e8f5a1db
SHA5120d973ac27aa8ff7eeda92d788227199a690fcf357679ee91cebf4483133754e4d2b24b88c57947b32212a3acdd2ee08ba71a621a505b55576018fe253f101574
-
Filesize
1.2MB
MD5f778e9136ab0db9de9802a7043de50a7
SHA1850dca074534a14fdb9ada6afaceea88558764e0
SHA25690803a583e9f693de5e7b8a196832436f6f648b27fb82e55904c256f30cc8b3a
SHA512cd6c5c3537f05ad5826d503e38b8e6ef2eaf668616bec15ba51ad3d81e0337a72779d7ca6af9e8ebee12d713891b30c0b73bf34718552bc9f4e7d8909b998156
-
Filesize
288KB
MD5a13bfe522abc659704965388ad4581ee
SHA11e5e32c35af6bebeb800083f5c637cb03fac3e37
SHA2561f64f01063b26bf05d4b076d54816e54dacd08b7fd6e5bc9cc5d11a548ff2215
SHA51234b02ff3bb42b81890747bb0fa9f8689f7e3577aa68e25f4a1aa9ca336e975a0e9d400e89e4d9b1bd11866df80b9baf9a1d7c9df7b7f4cce4cb2c45e47abc7a2
-
Filesize
92KB
MD5e5bd9b6a047a6fd3ecdda458cd661b3e
SHA190a4727e4df3c31182cd035d53a0a9364161a4c8
SHA256a071d5f1a6c2d6ffcbe11fc9d31e0f103369d081c1ea06bf4cc39564da26d8af
SHA51205f808783bf9ae075c498e5eaea39b4d3b3c96889d08ee80e8767b68a72fcf0d8bceb1e9a31446dddbd31dd6ba2d95d5ae23c433801f77748ed72eda685123fa
-
Filesize
32KB
MD598813d442ab6f9865ff408e9459d2d78
SHA1ab3d8f212239d839dc76b8c6c410d49c259850a3
SHA256ec35f38573e6ee2a2026be85a00f17282a7d621aedb4c8296f2e603a5cd6515c
SHA512c80de2e10b16b65182b807271d96e8b7b4aca3fac1e0a9eba897c4db03c1fc46b1dc8d9bb965097576924098b91a747025f5d4566faef8b3faf3c5ee22afea4f
-
Filesize
1.0MB
MD540fe609bed5aef58fd8456fb4f726d57
SHA1aa211bf14186b51d09bee213c41f5a17ecba85c6
SHA256322b40a7748e43f405444201df2e9907e8187aa2b5aba772893da5bc528effeb
SHA5127f4a615db8fd4bde5306a1d265af61a9815695d23f5ccf11c6b7d4ebdd359cf6a681d676dd408e93920ab8b8b2f1abec69da5d9ea5ce45b6a45d95c80accfd23
-
Filesize
71KB
MD5814ccef0ddc67302c4291c353a44ce9d
SHA129484925f6f3925555cd9011732a2f94de997525
SHA256545c011a87906e845720c4efedf515cfd53b37d3258f218444138842f3826bfd
SHA5121fe88302cbca7e83e9fde37ca793f3714889ee689739423b0b8cb82e99684c24826c6780e88031d591f9c7e6ef6579b17df47de26edf8ef2310c3d48d916f88b
-
Filesize
44KB
MD55885834af7b6dec542aa899a6510544c
SHA1789f494758acb0ea6cc10189d34f962f08291dec
SHA2560c5ec4790ac9c0cd8afd02026811be484b0d9f631dd6e4842ed2568d527d0e62
SHA512d23306540d2bdf11b09cc825b65a80e899328f35794a5368665ce10d2043529f9cdfba992abae821f3879cff7305813025e2f2cddfd10328965fa6e487c331a0
-
Filesize
82KB
MD59bda689b3866d289b4e2cef042a85abd
SHA1a9c7e01c65662a17b3c1ae37a5ccfb96803a45d1
SHA2569e5840d28285688b371de8e444b3de4ca6d43307c68824c3b7e34b088668ff4a
SHA5121840bf7379ef7c6217ae908e3edf7160a2053e5193acd50c7f135add6cce88bd42c4f42a3bc0d4107b61f41789c846dc91932ac9d524a902c1b52720f2752850
-
Filesize
13KB
MD5d384fb316e4c2e664ef9e3d571e18416
SHA1d068b5dac1e7bced5f04e7941a481e8b3535fed8
SHA256ddc0bf91c96d1079be5d52465ac157bb61a78b5ba9c952e5edd4fb51a78d9e43
SHA512ebd09f8f6eb5982ecf29cf9f0af3757465bc05e049d3d0d557b2bc977d129d91d644c9b8acd56cfb1aa002ca50162a17f99b4f84b2db9e615e596a48a06e0348
-
Filesize
1.3MB
MD506403dcc1d4c10d91abaf931e9f273f4
SHA1a46188a338165e468c733f60fa992ba1ff08db10
SHA2560ff4341eee78c5b8ce6d9715fad8a4e1e70de40e915e4cd63fd7777a6c1acc00
SHA512b461a3d0254494c2e6dffd32b2df67a1330b2f14a2f7b28f7f27ba837ed15bf22fb9dec1436613bcdf3356e983a332eb1e4e208892fe619404082c13390af846
-
Filesize
2KB
MD5c4a42826e8687703ad8af713149ccdb9
SHA12ed4ebbd48a0e9a593e060ffa593f732161b75bf
SHA25612095eeb7021a534a8a404d40bbcddeab53af6aebf3b14fe2aa820af93e77983
SHA512066a6142692e250336a6f5ad851379a9de0715731ab9174229038c0b19a933243d5ecbaa5a5ba5ddcadbd8d1607be0a564edef8f289599cc1f91917b3a5aba2b
-
Filesize
8KB
MD51c4af9d2903709106fa12e54d85154e2
SHA1622b63a755e80780c8ab04f9a6d04a0015c93ec4
SHA256d4a7245821d342107668b10711ef75260905864ea1492064f9d66c7a0da21d98
SHA512440dbbdbfdcd424cd2213540b390956d3db98e93ca58cba548dee6daad59404fa4be117052a31a833d223f23f1fd44a2a1f04494c89e91a906c80e8d41dfa96e
-
Filesize
2KB
MD55a1f6ff4de980e2eec754b6b7a1f6ddf
SHA1d76fd4e3157c928d99d8f7cd5e5dd96cfccd2e60
SHA256b830bff57e7a46b214171b9bf5cc8fd0b898f39229187e87185466d0e6545c79
SHA5125aa755b254e5b3781408da0b4b4eef1a8a84399a92c8e0bfd12a8d654e9ddaeef7196eb81ce58b424d22c544bb3e3576e6c0d55ec0fd7c4ec73e5e4f3935bf53
-
Filesize
2KB
MD576d2a13fa68fe24d1ba77d8469d13be9
SHA11cb2e389e9cadcf1da9876dbd8a44274a1eaae69
SHA2560f7968296f62e384c524cc84baa16639b91517298031f1bfe4df3aa8182658bd
SHA5123093c955f7f42670477feeff2f9dbe7e557716d6a7cf5a6b2225b6ab0741def094c3fc17fa37b85537321a167a56582f816824a05b21c8923a928a9bdcc5526d
-
Filesize
44KB
MD54a1ab6e25dcf074919ddbaee0b14dd42
SHA14e513fdfdfa7e3bf2882e8870649169862b02bc7
SHA256fa6162425808eed3482f09717a51777717f3fee22d61634c171d4204b59905fb
SHA5125a63e8ba1adfaddc495aed22e5a7b2dbcb0255e9b1e6f140bed2c791fb79f0d69a45d89f699092add3f8be5e7b44afdef94638d10da3b66e7c680b2b470446a8
-
Filesize
11KB
MD52b285d35ccb41aaa1bc5e0d369501fd3
SHA1fdcb7345eb68e35c52b4942f3066b108d21fcc86
SHA256b26f6e7ea617b94ea4bf74f99dd22aecabddb3f48e3bf146849e3ba7fd50ee93
SHA512b5b2b2baeef8418ddbdc5d717a732ebce220356d5ee9aacdeac76cb33f81be6cdea42de50378726b501841252c618804545d6ace37f06b7620ef9fcb6da881cf
-
Filesize
4KB
MD57c0e6d40f4027ba55551a37ee6250389
SHA16af54202574064d75a18619c04a3d8d96aed3252
SHA2561e5b424db0693e30c0461e4daa09831f5a93976a03724797cb641f6d058ba4c8
SHA512a5e6b238fbd1c932e44d3aa66c42b3481cb83fd835cc61be16140462703c85e2398469bcf54a425b7a00b3b0a8729c95a1b70b4c20299f3051e749f729d76a32
-
Filesize
81KB
MD5fa318fd428d11dba2eacfec6bf540674
SHA1f77d482b9b5f5537d6a8d3eceb746e323427a97c
SHA25696277e36773419dfc9b5a65c0ee51dad986a7e8b0a5c25b42bed2cd29bd31f18
SHA512b13c849a03537afcd72d41d470f03f6d9f2c21ca7b00db7740dd7d8882ab51b642c2d48ff5742068c7319832591d3644b4836b16fae0175d5669601dec8c8e2c
-
Filesize
18KB
MD50562edd844f45f9332899048d1ef5188
SHA15807cb7e046ebfc8795e725d43c1a45dfe0152f8
SHA256e71e4421c1f19a1b42866b57e1728392320cf5115334400c8e9c75ccc3365bc2
SHA512be024bcb18e6dab317ec95840702e6a072ccecfc3ffcc647db2f39819880ffb74fe6ca8be8de68b0982a17985e8b8e552457dfd2d344519bd85c236f2d379a7a
-
Filesize
10KB
MD5d1954887e55ba2b95d2faab5d0fcf7e0
SHA1b3cd9e4e6c230227b7cd179e4a84a8b6d5fb3082
SHA256537889353ad7681479031192556d21669e1ee925f1e7a556b631c1569bd91678
SHA51227effb18cb5f04a4eb92db917b17f2ccf2042d967b682d29fde738b78eb09707bb802b824688f8bef39d2fb366d8c946fa8e022a96d19215693cd8efa7a26a63
-
Filesize
10KB
MD5ed56d89f0277e7dfd617d61fbff83587
SHA1d08f0df2a7cb71df1a7ff424ebe49406f0135e30
SHA2561c18fe7cb32b19839f2442d202101b91b6cd9c47128c44516052cfb028e97ea5
SHA51287f754af834b0ff130bce8a7694acbaa3846faafd2ee6964ceb1cffaf7922129d77165701cfd599b273118c3bb8570953b6c06e30a159b24e958e181091d25d2
-
Filesize
6KB
MD5aca1951d698bd3b6f95573749d1575a4
SHA135a0b6a30b2510c4e19263b238a778aa46fa28a3
SHA256b507ad95fe94ce549791740ac49cedd1e92c9fb424dad70463969346b9f79831
SHA51243da75508cccff9900bc93517e057af2b5e95e6eb9b4cb74ef9a0000d3832a806e39d2d5e3583291f64c16877f3bfe9eb068224b10e27dbc45db530536dc33a5
-
Filesize
7KB
MD56b7e2f6b921825e92c0503bcf8928e21
SHA1a890f3a8e819d1f1c757698ed6d37522d7355ddd
SHA2561bb5a889de322d328b07dac78c09806eba3886c3e218e9d1a5f1f1bd89a529e4
SHA51262dca3d15a618974949b7b3eb51437b893f0bea61246f0340048657f1d8c16655c9b6c1755bd140635e89b50cec4387aeba8a3828f2052307641d668c4e4acf5
-
Filesize
436KB
MD5e92e9a2b7cd15e4f23e4178c3241732c
SHA164cb74a2311a03fc5b33ccfaef45a82c42c60ffd
SHA256feddf1be71547b95dde12fc2374162f6c8b744f23813fcd4fc8803cc61fef921
SHA5127ba90192d6bb65afb36ee0bfa19dadd16e70c1f8d69cdddc06a2b9318345566588206819ca55cd2513535fe31520de9101b8d15e04c5cec43323d974c1914c3f
-
Filesize
527KB
MD50088331e38c41c8c50007172cd818835
SHA1b7563c8bd0b022b0319ebc8482bea440d7f60aa3
SHA256644b0eeb2f4db50553e3f66adadcd2660ac43c2b110a253328b14354577e4e1c
SHA5128f7c132ebeaa9796e9880c00705f629d79a8c51681044da4b8ce137f27a3e696f726c61928e57eebd6416d487a2e73e8665cf771140fdb8c2dd20f1bcb20c5a1
-
Filesize
3KB
MD5ce65c3bb141fbcf3c673af52e08a201e
SHA1e0ac12e3384dcc151d5e848a8b73c39907b1a87c
SHA256ba19a100120f60453c2396b57284b601f81c3eb1c4cb82e4eee070fe07b987ed
SHA512fdce9af9a8bc1eefcbee1d8d3e62b864d2ed7e8401cb4979b98ce6ff87d811f9b26244f407a3900bf2587f8cab9e47bc8e7768fa8bfa7d035cdefeecb5ea9cea
-
Filesize
130KB
MD5ed50f659fc0800a46ae55ea2e1954c59
SHA1247ad04f854b20b96eb9b6e90f1042ac6d123f66
SHA2560da0a131767658ee19483def5884ccd222191a6acb6a2163a13d6959968acd03
SHA512999c8b9b13f71352b9e1bdfe1f4d3140d00d2ccfbafda854d3de5cd8798461a6b4d49e9409403828813e294b15cd2a63235cf188fb3ad437a5a8233687ace625
-
Filesize
41KB
MD5e4543a399403a806138980ffbed34a59
SHA1910e00e60fe0a52f6d143429a50ca3265e508107
SHA25650eb37b3241439ae04562d12c5e07b0529f876aa70d34bcd20cd34bf8f8b024e
SHA5124f306859a9fdebd1e3aaa348d07af1cb65a7c8c0ebf392bce87e05e854408503f20b09e8ccf22b9a048f47d9c8959914fc6a0003ca9089720b4a1d9f75f0ff05
-
Filesize
27KB
MD5e5756c290e3f66737f08839ba9d35147
SHA1430c4501a65c145dd3b2bf09441f55d5077a0f7a
SHA256d4a05b693631360e309bd63c59363232a3d836a7a152414ae2957bf253ad7e68
SHA51288f4f0f19575eb4046c1b1725c3fc36bbabd380fd5f7301480d7110e9a240a4539d4e82eda570145a9ed584ef99d63f32935602c92695170ed06f631ffb21354
-
Filesize
16KB
MD59c6e36d4dd53bcb8f3a4de422c2d414b
SHA17fefb556aaec673fa347b27f453f547e528e8897
SHA256c163b5f0d227ce4f22da54d3224c452a4ee362ba78601e3aa1d405eaa3ec4ced
SHA5123cb4a973fc29eaf60af5a192e420e58b5fceb0b5058aafc32170f0d8f8409c0d964098ccd4e81d6399fb32ed66b209ef49af3f92702f4f13275e054fde928bec
-
Filesize
24KB
MD5b6e9b6419e78178494668059297bc34f
SHA1261ba5cbb3daf58f34de7616c23118d8f78c178e
SHA25699f79f5bfeed42721524ad0913fd4cfa6a57a62959a418485a752548e9c7fdcb
SHA5128f61ca8e024af29cd5508456ae05976ddcbb75b37d594496f0048753bc033913f1f85238ef169e3227ebec360aeda05e9f645ac2f439e530cfbba1b89267e871
-
Filesize
19KB
MD5f5d26d796df0e0715baa3f4fadebc6b9
SHA1ba7b8375f00af2968b977e1dab913bc5542511a4
SHA2560a074ff8f95901bdbfa9c38ff13bb4fa4f834e21811fc943b6147ab2007bacad
SHA512f80027f38f32cf78c8eb875e0da33c8d98bd20262958cf7923263f0f5d033f3475ec6d01724e4e03f062920813ea34159b6ec32b0019989433ae002a2f4d187d
-
Filesize
127KB
MD5507518de067152b8dd21ca15d9b2e50c
SHA1709df5bd6b0b6134ddd0c384727b7607df587f6d
SHA2564520b513200bcac360c38cdffe684147590901f74e0e05be712e4ed62f5de426
SHA5123a490f19ade1441fbf621d27a0a3e04fc9dcf06e78fdb36024103e048a1655248caf0254fafb3fc895afd85b9695853f34402fcd23152134623777af8cdfe6b6
-
Filesize
507KB
MD5e767dc8f7f92b459ba8d1e78fa992533
SHA1259dc37c6ca65d57f4d8a15b82969a2ac6adab9d
SHA256356e5e6468d5037e0430a8913defbf78dc64980f973ee7558ee7bdc622fd944c
SHA51294fcb077a3dd15eb92e897d273218a6cff8beb5f91955329027cc5fdc5da3709bf348265e4deacf7032b126846f504a0a8b85f2d6889c41630660da17d8b51fd
-
Filesize
7KB
MD5ded49734bed134b4f105f03053bf1f17
SHA1a855ebf285013361196e1cb9a133f6a1697cb5fa
SHA2561f77ab3701e634e67a911f57cc04eb17748b30a1d120d2f1c49766c24a93b600
SHA512e832a7a1b9f307f2889dfe15f077c4c61c394f458d339db3bf236a7ee720f70336337898dde7eb6632045d9fafc55bfddd2969622e4742bbe586302f7ccfabed
-
Filesize
10KB
MD5fa88b3e702cf0377fe2e7322fd11c27e
SHA118a232f0f41f937703eaf5d8b625ede9ce92f006
SHA256fe1a0e0758f55c532097df3d768ad3eab9d6d4ab4d013d33ec94ff8c334c2a66
SHA512ae39b5e02b5befae8e15112e0f8eb7ae2d7cd138fef34fecef7de806dc091133fcb242f6780182dbddbf8ccee9a3b23548e08aff1861716314f86cef079d467a
-
Filesize
466KB
MD5db8ddc964658c847359b83d2dbc6e666
SHA140917fe565718454b4b1c42e18e2fbae26b67e50
SHA2564cf880041cc9e1af77f79d05936b8f74426fdbf15df934c88a2e67010bd9cfc7
SHA512fed7de81fb29adeab8850cb3cba20414733da75daecd4495c47d2600a99e85e28cde1f21f02a9d266f57b7998638e2b3ad962349a270e5145b279e6a6bd8319a
-
Filesize
2KB
MD5e320fca2257788c2bc0677e264fb4697
SHA169d28e8a47ca0be4dacecd018c27cfbc83672aa3
SHA256ae3fa21bcb8704d9d3cc6852f3bdda0b4418f3d5babada34814508a88f16f93e
SHA512e6349696b722992bea6ef1e4b9271bfcf2c3109209a0d9a8a8d70b0ff6065d1ea865a3e8056595f3536776dea7e4a705fd5bb276079f1d95b5e7abdc306806a1
-
Filesize
1KB
MD527b3a8f6ab36cc23c1309b8f38cc4929
SHA18bf499eb629d3eec700dfaa907f28831f0604635
SHA256d33c53eaaa371af7a8a1193330afc1256e44bd75c9bf4e4270a09df849991ef9
SHA51297cea7e50a6817bb91a133183b431367bac6e6e049284e06ca38567fd0ae6a8008ee7265183ebe87483df274d8745bb86139e00328cbf686b64aa72c653787a5
-
Filesize
3B
MD521438ef4b9ad4fc266b6129a2f60de29
SHA15eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd
SHA25613bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354
SHA51237436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237
-
Filesize
1KB
MD58e50f582a84c800ed8919f84c77332ca
SHA15c818feb6ec42660b894a9641002874241ab865f
SHA2562c3dfca37d2618d54781b65d12ad25651eef1f6b321808826e5c22acc0fe2901
SHA5127b7e45303881b77d33f844eb76937ac0c021d626b15eb11843cb0478fa218b85ed7781c0c612e7b113decc299ebc63c466b9bde197b80500568c4f0c2dd7db3e
-
Filesize
16KB
MD5af0fc9aa684c789909cbdcd137ee8214
SHA1792c708c11a6845291d9f8647399191110a74318
SHA256fb854fc720e6dc6b15a5755b4252ab88c262718f9c55cdec56e6c35c1a22fe9c
SHA5120e97cd24de6431daeacdd6bb0d90dc0dd4854b10b445f4b7e96d9e931ea854f67473cb49621811163f4b0ebe711623a1f0bf113690127a1708916a622407ca0d
-
Filesize
132KB
MD50bf28e777209ef48ad215c809ad2cbb5
SHA1b78cd7d7463ed106cfdfb1c2217f66a1a1f8cb70
SHA256d59eee5d7d362fb4127777163be55f66086f8b9370d105013fd2c2aac48213d8
SHA51251f6f6e1d320f58be7cdfc3a1d3213220711d5e88aa2ee415ecad091a6b54de79675da4b975d0745f9d6de8bb95870ee42a36e867a4aaf0da5b8093db2b00e53
-
C:\Program Files (x86)\Adobe\Reader 10.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.es_PY.txt
Filesize27KB
MD5296ad6c2a8df22602f542d72b553ea28
SHA1be5fd1b4cfdb4e2568abb13a2c1a826cbcef268d
SHA25678e044d2c67c06b75416fd9fc8929632a321ffa1e3a55ea530814957b1df1154
SHA512b6ddb2fd7ea0b33c4d7e28de4e301163b0485fe727443df5dfb90d369320357b64815aeaa5c0a3afaefaf13f0b43102f6f040450969f84254aed7260f46eaa3d
-
Filesize
2.2MB
MD5dffe2c18cb45ee1557463633fa060df1
SHA1668d1cb4ab20ed085c215e8cd815521686ebc32b
SHA2560579d853b52f854eb6257b86465b70ec6d9317a2733bf38adc95b8bfb178f20d
SHA5124a797e53450f5ece0bb9ad47a8894b8938bc37ca60d0c3ba9aee715f7999bacc9dd107f8aad34bbe2fc35e0fda719d438bcd4a2f71bc7af362cba4b66090e1fc
-
Filesize
12.0MB
MD5f4158dfce3aa1b3da5469f2b34c40248
SHA185960f7b30096c81b38794c34bc4fa0970807421
SHA256e7336642f0c1e08bee66470d9409fc0f71e93c8eec7c925fac89c397baa8dede
SHA5129658f887a97bfaaa6d307b2d0f38edfc7355d9066f05b33ce05d748c9473cce2e95eb60255ea40a314b199011a28ab4fb29e0a2128d31aad5ea51b64f4e4f6a3
-
Filesize
212B
MD57bb337959d26a4dd4a18c311cffc94f8
SHA156884ac3ca54b8d1cb4d6b2e9ec51cc1248c50c9
SHA25671bf727c4976dccd39628d1e71fbdb1de69da8cee6eae8f76e320ffd4668586b
SHA5125c844292e359767f005c7f9b6505debbddad6b6388333d0b9fbe06c09c590f4a7f22e3e53245dbf06f8e2bc3987dd818738f7a7da4b7ad8e595ce0ed6d9f9e74
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9
Filesize5B
MD55bfa51f3a417b98e7443eca90fc94703
SHA18c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA256bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
SHA5124cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4DD39726D4B55AC3B4119B35A893323C_46CCCFB940A93F39A734F69EFCDD76E9
Filesize404B
MD537099922b35756869497ca591360a7ae
SHA1f5621a4a184be20767992d89dd7a73f36ba5c17d
SHA256a33e31fc78a3b016d6f229b883997e40aeffcd1e05bc13fc38162e8d4dd24c4d
SHA5123238b985d3d661ed05b7fefd865165ca078c303efdbf8319a8206fe4392c430185c90e9a30d16b583d2bff2ef3d3bdae1ee61d51e5e80dbe760a29b892339dda
-
Filesize
198B
MD5b90ac8c690853c6185252fb6a9f849a5
SHA19cb48053897f3a995fb03eeee0e995c616cd4af3
SHA256a0a5eaf1aa3b38cb3487634b6d76f153c2c28c63a95508a6cd6e389129d62f2f
SHA512181b6486cee75a38d349306575cce3db2e075ec09799b2ba43f8cc2ec50afe90da2cd281b6d1eddf1cd0ba7244beda03a44bd7e3d65555aaaaeb176a213d1d88
-
Filesize
3KB
MD530c61a855268759e06a28a85c4e43808
SHA18fbb462eac7026a2cb61ed59b117a168b896c783
SHA256f1cb73c52a99d86ee2525499c7cc5bd2f66046038154caa2d2e41f261951656b
SHA512683ba39f98a4425f0fa8d256b1d8f9f4e5821f9be2d0c9f94d80677e3384f47afe9833f4683d857eb7cb2053d6a8414991777d2a60729bee2cf27bbab745e80f
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
74KB
MD59195c6e38aaf230af745fa3db9b8d6ae
SHA18f851520547ab60431527d96bbb9bcd87be8b0ac
SHA25604f46b66656b1ae7b12c7f4f76c821ec15afa8b1b68271a1d9c48f9842f4dfcb
SHA512a23c2f582162e627fa205f8af4e16e05176c450d0b6a38e4eee818440307a5e9007317c60acf3b9d8169a505dbaa27f57baa70fe64524eae37f4b2b9a7445768
-
Filesize
1.3MB
MD5998cce19eb7838e54b239e5f5bc2c2fc
SHA128f3c708f4f8a695918583de23e0e5f9d541a748
SHA256fcdd93521e5875fa1ca7e5aed49cb84d3c5ea0a26016fe32a65ec038b28fff4e
SHA51255936ad14d7d2c5ea9796488134c7494c37f241cb9d2552e11095fbe2acee8966205dc0939aca31d2179d5af0a965295e2e4916bf675ca5df3f25845ab264d7c
-
Filesize
5.2MB
MD50cd1441c8e92b345e31ac1d95f6527f9
SHA1622898f34bc9f1dd0a1140ff2ce4bb564ec7ea8d
SHA25694d8589869f21ffbd4f2251a06806b0edb464cf5e6aed0d5749fd764591e8308
SHA512ae1f480d8ee413f50b1f47c1e5d5f99bdf03875d146cfa802726ac0a7820e2374ab9366257a7c642326a9a05b7832d38b1aa5ddc05c548555953ea8c495f4815
-
Filesize
63KB
MD599e7e4e081509feee835c7fff8f8ff12
SHA1f9c90523099fb94472f091d7474409f76f4ce940
SHA256b466443b17cb84823e732eb1d5cf5a022474dea07383664846d80b4d70ca14dc
SHA512d946791e0f81e071b19d3bf1a0c748250c2eb012adcb7381978b97c63aa259d514cf5b30fab699d5c6451ed4727c5485214671ce9bd0523d57c864e1331f2ec0
-
Filesize
305KB
MD5cae3a122c9602595600570a36ffde6bb
SHA16e2bdd543a1521e897f0961ced7e68d412368bd7
SHA2566773561d083eabda2ec9df3ce6f387b953819a9c228daf62eccd72eaf68bae8f
SHA512c1f013a7f352d1d5b49087350f9e7e59c58f7b23f81fbb6c52ffd1f6630880853a5fd8a1fa71459dbef6a4b387020517b0bf54e5192e492554d36dc432926e84
-
Filesize
685KB
MD54e4fbb57b6fe5357ddfbf27e364dca97
SHA15f6a7a6cab64bec0537b6166f5540b77388bc1c3
SHA256ad5127eeb7bacd057d2a0511747280b66ba5cb8e62529a0d176dd686ca92db36
SHA5128c871e94c12355b43345eeda15befe61b605c8bd7469fca9f3ab703c9c677d2f0e318c95a10dd7ee3eef201f4784ff8ad88088415c2a4b03729bcddda682a00d
-
Filesize
22.6MB
MD59b492e53629fba9f72037673b62c33ca
SHA109fcd6e96ea3b4a31d1a342590f90dd9892a2dc4
SHA2561884b8a5a7810d1379d6472c2c0c42b135a344e65bdb1ac5b86596357a73cc36
SHA512d02b922803813be543fe14b6af01466a9854163293ee964dfe46969500f93288f07f0f668c945fb065777ed74d240744743d9f497d9997457e9ae67ac51d1d97
-
Filesize
1.2MB
MD56e3d7f11d087fe1ac7865f702665d768
SHA1734199dce95fef9f98506206dea2bf0ce8af402c
SHA25633f890c10390ce6b587cb3255cef97ac4d545e4996c359a61fcc4caa9da077bb
SHA512646cfb7793e3e89f52c778e56cf302b686ccaee4b1b569a9e5e5c986cb2a3fcd5233c811cb3ac26e06b035cccb5efe7c1b1038328c4de6dc874e1aa959b37a45
-
Filesize
17KB
MD5036b2e07902689d0c782d26c7b09d1e2
SHA17d8e1c00cb917ca31dfe178073c65cf39c2352b1
SHA2564d8bf153d9335f419830f8c8b2f63a59b8f0113a9cf42b576bfd87bed0293321
SHA5123f29c46428488138f89cd2d65ec989bb63b4fc0208194743faa98d6c75a1d1a4d5297ea9dc1887dd8e1dc24a85d7992d9e0e547dde75659e560ad3c2ebbfdbb7
-
Filesize
61KB
MD572afbd173dbcd7b8a893247bf61650ce
SHA1bfff181020fb66897320f669d80deef2e77d6018
SHA2568b109335ed643f3ae6be758e2c2ee48a04cac9f54c95bc1e70aea1ae1b0f88c5
SHA512939654d945bda335a73262809d6d143f6d029261a8df4b642bab8013d71917e208f70b9d8be471fe4e9e0b610f3d9ba1883ea9208702db5554782b0ad26e5242
-
Filesize
101KB
MD578d57b15b74647b512f0002ac4e71c64
SHA199dd24c8f0767c79e36b97b01544e4ef9bf91ed0
SHA25642a5635bbf129768ef0623bc63c674f6cfc2b83769ff73e729073eb9678e3c09
SHA512d29ab3df36c10c9c2d87f185e85796cc6a9ccae54b65b7cfc940b19395351a9ad968d9c6d0c9c75c8b7dd134279f5ab310a305d8c66bb7f999172062684df596
-
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\CoolType.dll_NON_OPT
Filesize2.7MB
MD5900dce1a1ff4aaa64bda12dabfd44651
SHA11d83d40e1a8e3919ac63e36b480bfef100373c87
SHA256451a934f5797ed124d9cf2bacf96a3b687248a1549c579afcc8cf3436d977342
SHA5127aded1ace6ccb24a3089647e48f91dd5c676b54f7a0adcb32aa8b2327fe3233698fa04d5ee39635af63d13931aa247bc6fde32a03248aa18325afddaed1ca43e
-
Filesize
665KB
MD5c8cec2a540dba03596ce173507830c2c
SHA1320b913bf7a98417dbd327f2e8ea6f5d2e5d250f
SHA256f5b0738cdddaaba004d934b5752c7f785501eae67ed86986ded7eb5922a6dd6f
SHA5120c714e777765d5e126116d184370bcc6449c4e219667b90feb92dacdd3eae8b9ca425b84ebc3d3d67a81a4bce3886691116a4ff7276e149bdbcd84be2a3b6388
-
Filesize
82KB
MD58159c58ba23c40a985aa8c9bc733c0ae
SHA1eb89ead1a3b2832b6deb13e1415b4da2dd8820fb
SHA256e7be1f5e1dcdc63f8137f7edd9568a6df913be2b0a85ec8fcb37699846978a8f
SHA5126a15554353c91b6cb563f2ecf4559bd873398c44128ddf69764601fb3bc731f75bf68ea628fb320003457d4eb58e8e0abfeae942dd25121c8773c460c1a84a18
-
Filesize
82KB
MD5d0910759e749285c754ba2b1f98a147d
SHA1b72e90cf64d4f40c523207b49d35e648e736a130
SHA2562e0b3c4ea6d4ef0df43994eb56a88a3023694e1b69562294d0554a02c4282c8f
SHA512befc71fda73645139eb5b4871c11de726ae8b54768aa56634e0e5e4f230001dda264998a6fd5aa28289a6cd4c7b2f5510c12b43d35c467fbafec2d7bf85b5fe2
-
Filesize
1.3MB
MD525161689626fa135dd7cdc3a28431982
SHA1d7f7a0b54e48a616980eb22116381b924f9bc020
SHA25699d099227bb3e558db357502b3eb47e4e156c1a78160801052a7a1416c745f40
SHA5120f616287c47c761f710830a19bca5ec7a75d91b818c361aa7e90c1b034477ac6cd33e407cd1db925aa94e61b86f6d037229f38774a6615edd917b7bc3fc03c60
-
Filesize
16KB
MD5598f347c8688d5c3d646b23074c296c6
SHA11dda646c673e601c5652e40207417fb987abeb89
SHA2565de2bfe87a508238da30801f591239f06732a6ee55bff0643559d02555542fc5
SHA512f670e4c19aa9a62aafe5fb8e442eb52053a225f07fae7627fdd0c1459801780378c1f3d17751744026a4a07b2450ddd613912024f4b453af91043d5341c8eef5
-
Filesize
200KB
MD54088463164100ced1efb77f214036d2d
SHA1e2670cc205f2c3a089784725092e47405c97933b
SHA2565e3c5d235aa102794f26e0fcb516ddc34ccf5a1abc127ac4c408a6688aabe711
SHA5123615edc7b0a2527fb5695c01f914fc614aeb05092c1268ea738acec053025eb7974ec25c873d18567e67cc480ed54e07f5bf93ef6c5ec0f6ced8b5ab41ff3d30
-
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\acrotextextractor.exe
Filesize47KB
MD5628f37e5e96ea57a302544ff4b9fa890
SHA11f3f4a0942104a28c2859c64fb6fd3200c5a4150
SHA2563150c6cf7adc97d2cc406cf38944bb602756c276e2511a32e69b6d92ebcee366
SHA512cecb5a4f2df8d8151943a661879741c3d83790c68010cd73c4726742c36e4594edd6ec35baffe0102ebc6034406daefd8324b0ac8c7538046ac95be280892e3c
-
Filesize
13KB
MD5c52a19a7f2644a8036488e3553c5ccda
SHA1edf2480e75f1ede4d1a7e1928927fb90080054df
SHA256794c231ab14170694ca2c5c600bc47f4118470f26867b93ccd61eda5c37a7260
SHA512ebdcdad66d3f54cb003da1459a9c8a70f8a303df8974051cf1f039357677f6b6082d5989c21e267314c3f4505f18ab3be98513a784110f09d07a968275a00a34
-
Filesize
132KB
MD5ac05c6e4465bfbe6ef41fd6dd46e5b59
SHA1f06ff3be60dd37a118db97ba43d514dda802d05c
SHA25689fc167a56945e25cdbd8307a8375810f441ffc00e91bd3989d4effae3a8ae5b
SHA512d99ad285088b11aca9782b3787fdf4e6d273899cc5e3787669019a2758103464228a6fecf722c272382b89f4f36058c790a8131b1576ed029f1f3487a6ad050e
-
C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA74301B744AA0000000010\10.0.0\nppdf32.dll_Apollo
Filesize132KB
MD5c2ddd94f7d49798ea49994571384f256
SHA13b770647212a06e13527ebf3c6a4a86ad87f2bfa
SHA256a814bc475c794cd6224bd3096798f1144cc0670fe6fb34a1adebc927b14b4dc3
SHA512a4fc849ee4a2065a7ed152595c16cdc63f103d283c57cee33b37299ff6ac0921e360076b835a7eb3ed11d8988c9c352e819eac04878795c3228ef9cc2bd6abc4
-
Filesize
381KB
MD5814161c6f897c330a461397f870e786b
SHA1ea927d1664fea6a0a27db0b7f502f73ca323f533
SHA256303d3a32fd1b7b7d1e74444e4d5c1029a895485cd5f4cfad0ee933ceb11100cd
SHA512a489052d0972f213ee110b29530e4a191bad4a55fdf2274dbb6f7b98a0622d4498d0e03b538cee96156abc9e62f14ed646995ad77f2b16dcbbc4845b4d8f7025
-
Filesize
294KB
MD5a5828710a2a852bf3a9e25411fae001e
SHA134547b52c9cd51e9995630661ba89e87ce9e8ab5
SHA2565c356cc204662e48ec6e6d77268f49f1100f815fad978e44bdedf15f00223819
SHA512289511f20d173d6c3848beced41be5a9d352ee9f7807213e733a3c6669d879811cb352a358489949fe90a18e6e32de387704207727f8f1136415aad1a9e88504
-
Filesize
34KB
MD5e97140424c378acbd47df493a6ab7235
SHA193b5397da034392ca9f349969e944795e8397c34
SHA25600f26f670ad6b03c465c4fc834dc993b551b8a8e73b603fe7b9cffa893094a3d
SHA51254d470f4d3667f5e3d91bbff345705d2cee12fe149973cc800db43ea2f942b213fdafe7b31ddcccce14e06af47afcd4c6c0f3a590b4442dbaefdcd3803c2eade
-
Filesize
113KB
MD5dc3698e917e65b65a54ee1cf85c89bbe
SHA192e42c3439c40db4d04a3aaff4f20f4b7436d6c5
SHA256edd97ad49f47c3b1f1979ab65357430e789ad43ba52ac0c0dc24d12ace68ee2f
SHA5127e828fc3b1e3a8def67ac9acce1c89da047510a2cf60717588f37d3cbd19f0ff9b745e075ff639fb92eb5bba91fbf0e4b86611f398d029c2501a232895843c67
-
Filesize
112KB
MD58f680e0f517d35bb14f984a7f197e35c
SHA11ad84f7120c2712a32ef5aa82edde5b704eeb27f
SHA256030d6e3dadf9da76a1f5e15657cb7673265ea545402f181624cbf64a45e53805
SHA512dda5cec6042f2c255dcc814c5f19e7692beb07de9ab950bf817169d076b368cdfb268aff1b5b5caa12409058e015124206a9b87714133226b84d3eb5b850013a
-
Filesize
156KB
MD5a44986470c4513447017ebf68fd2903b
SHA1d5816fd82873fc9b1b35131624daf70fb86c2e72
SHA256b75408cd4961060f0ebc89340d37fb94c42509c17d7540464f6a13e6a94c57c5
SHA5121b28e5f30049d8b50e1d4245b988a995a5901a250f8af3fea21a6b9155c7529ba6720784f7da0f63ad2be33b118c5a8f6c734939d8c49711d20486dd89ea0b84
-
Filesize
84KB
MD594ee5f4e1500435f1d8eba5a54c231ed
SHA1d8ab879fd681cdbf7cfab010523ab7c950b68e87
SHA2565fec0c3e5c0dafcb9950eb84e2b5e59a679877bd128bb9cf7290b47ed76f9495
SHA51210ea6ff3497d13b2f8e4f20e833297603f68f90ff42ac6224933d04aea8fd28365383b414acb513c155e032b642df33cd948ecb321bd337494de62a1b2f523a7
-
Filesize
509KB
MD559143f3aa9ed77ff02a51960ad812c8f
SHA18f66dabcde28d3e3f596c6680dcab5e1e28611a2
SHA2567de1126a16072b1518b57b910b13419912c2b844b11613fbd2d6a11e8fd79358
SHA5122e181cee10f478d28b7a2b95b5c91b1f1f8d90571377b2e564195bd0722ce276837cc5f891a16084f61984bc94d65e1b2b0caac6d3dfa66d0cc0546ad590ee61
-
Filesize
165KB
MD5b05fc6a19d2275728ece7610eaf06a66
SHA19a090f6347dd4e0f072b2297d9bd938f97a50a60
SHA2560df6ab70121fb80cb050d287d5d156c103fe7448c1ba97c525c945248b576d2e
SHA5129e91a276d33c476ce86e69392db9d9d54d396578a6d73463f39980bcde951cf1ff4d5b31f907506fbe17840dc716a5fc478d84a666789e233e5b1d6c6063e70b
-
Filesize
2.4MB
MD534c4db669b76a662c5fa7c199e4f7519
SHA1b047730ff73cbb63a540a2a0cd4e632ad594bbc4
SHA2565a9619856991c1184c789d732f7c597cbe8d0add0732660a4ba358c6a3f258f8
SHA512da596adb60d4c5ade81b196cc4277c3bfd523e70d72ed2f27d4426833f72182a99fa4bc8f069805deac958e65a4ebed7f43919853fc5fdc5b91a6e62089f2c09
-
Filesize
329KB
MD5298b89d914f1a0a5a75c48a5ae9b75b9
SHA1fe9f329d755e4d42ae5140e31875a9ea989043a5
SHA2560ac3d080d42d4d1bde82bd0b20883e5fb5e7ed9d287f51dfda0b3ce6f9f83557
SHA512f0e2ad4b706ea88c1f84ae5b604093f75ff295e6e7ca48a78ec62efc31a6def4ce8c8421791a2082c47ec153ba6db31a72aa7841b99db8da9bfb6eb3b02a90a2
-
Filesize
52KB
MD54a908ee9c6f2f4aad63382cccee731e4
SHA1e572580949f277987fe232757ce88c2ac35e0223
SHA256459f503fb8b4fc4a600261430ac77bf70118d41fa19f7b2620d43ba6e9c8fa5e
SHA51275ba5856df7ed1457b6192e3b12c5dbb9cd0c6860d787357b37d5e2aabdd1dddb1fd6195064cad1b166431a71dee233b76cb6304d8e868050d79c731ef6e567f
-
Filesize
75KB
MD50c6864f73134ebdacf4458c7a2c3251f
SHA199cc4dd14f972dd58badc51ed9001dbcdb80e938
SHA256862ad396ee52836a9b7a8f8142a177875f79c81964b542c3168dd8b242e19a23
SHA51278048337cbdb4f7cd900366348537c80dbd9135c9a79b220895d77a494317258fc1a8ec5f7225e6652a8f44a9a2d1253a65af735a451f842d47d30376c0eb089
-
Filesize
175KB
MD5c87ab761aaad15556b0017da46f737b1
SHA1e8dec8ea029c78f8c492296801b046f7fc699de9
SHA256c17d59766f6c4f4162f6427346dec4e3abbd5afbfb396a8642fce375154bc351
SHA512895ad32c6af2ae79f27296e3e52e09e55ad9b43cb2d16d02d656dda267c815fefe50eb95d8e08e69eb3dbcd43cd76582b019fdc00594223253f763c711dd6e47