26:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:T9c6,https://pastelink.net/slmnbm6p%20https:/pastelink.net/c5bua7r4%20https:/pastelink.net/w77sl4he%20https:/pastelink.net/rrek2d0v%20https:/pastelink.net/lf2mmnkv%20https:/pastelink.net/o6bs8g3x%20https:/pastelink.net/sv0b4qa9%20https:/pastelink.net/c6u9nee4%20https:/pastelink.net/yklx1eml%20https:/pastelink.net/ejvmwd35%20https:/pastelink.net/yfjbwm9q%20https:/pastelink.net/f3ije4rn%20https:/pastelink.net/n0vpplq5%20https:/pastelink.net/4o5p4t1e%20https:/pastelink.net/0g0oks2g%20https:/pastelink.net/fhe5mdwg%20https:/pastelink.net/uizp9lg2%20https:/pastelink.net/xbubntxd%20https:/controlc.com/30971f5a%20https:/pastelink.net/cu6tz8rh%20https:/pastelink.net/zp9cyenk%20https:/pastelink.net/on445evq%20https:/pastelink.net/ivahmdun%20https:/pastelink.net/zzhsirdg%20https:/pastelink.net/5kdr6tpu%20https:/pastelink.net/vq6gdp53%20https:/pastelink.net/8o1ddhs6%20https:/pastelink.net/x7853ihz%20https:/pastelink.net/vzwglp2z%20https:/pastelink.net/fp0i5s27%20https:/pastelink.net/kd5mv5sd%20https:/pastelink.net/i04a9xrc%20https:/pastelink.net/dl55f43i%20https:/pastelink.net/ckzonmix%20https:/pastelink.net/2y2jfgk0%20https:/pastelink.net/2gdc7kff%20https:/pastelink.net/agnj6xib%20https:/pastelink.net/c0xemm18%20https:/pastelink.net/4yqfhyu3%20https:/pastelink.net/n533q2e6%20https:/pastelink.net/7j1pv0mx%20https:/pastelink.net/k90ac1ui%20https:/pastelink.net/a08ohtqe%20https:/pastelink.net/h1uua6pi%20https:/pastelink.net/zty5g468%09%20https:/pastelink.net/plqk2zap%20https:/pastelink.net/avxcgjix%20https:/pastelink.net/m2o2l2gd%20https:/pastelink.net/k1m36nn4%20https:/pastelink.net/g4gkb76u%20https:/pastelink.net/wn29p25r%20https:/pastelink.net/3e4d0shn%20https:/pastelink.net/7org2zz0%20https:/pastelink.net/z0mt0b5h%20https:/pastelink.net/ulg9heak%20https:/pastelink.net/2ekrxhzb%20https:/pastelink.net/b0h1q351%20https:/pastelink.net/h4l5mcqw%20https:/pastelink.net/tz29jia6%20https:/pastelink.net/ds6d4uqg%20https:/pastelink.net/yw1fjihn%20https:/pastelink.net/ezkw9j8t%20https:/pastelink.net/sdkjgobh%20https:/pastelink.net/2vub3kla%20https:/pastelink.net/z40ymt1y%20https:/pastelink.net/crqornll%20https:/pastelink.net/62f2j8j7%20https:/pastelink.net/507qn222%20https:/pastelink.net/2s4vadit%20https:/snippet.host/xdemxt%20https:/www.wowace.com/paste/fb478950%20https:/bitbin.it/7tvSw2M4/%20https:/paste.ee/p/ykeId%20https:/glot.io/snippets/gs27oxvllr%20https:/glot.io/snippets/gs27qazufv%20https:/baskadia.com/post/244q8%20https:/www.justgiving.com/crowdfunding/jkukujkmujk-ujkujkujkj28:T1155,"MsiExec.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\adobe\acrobat dc\acrobat\acrocef_2_1\locales\ (UID: 00000000-00009376) "MsiExec.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\adobe\acrobat dc\acrobat\acrocef_2_1\swiftshader\ (UID: 00000000-00009376) "MsiExec.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\adobe\acrobat dc\acrobat\acrocef_2_1\ (UID: 00000000-00009376) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__\private (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\__VERSION__ (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\prod (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement\stage (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\appmeasurement (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\fonts (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\css (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\fonts (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\images (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default\js (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP\default (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\OWP (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\cef (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev\libs (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app\dev (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\app (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\cef (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev\libs (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "RemoveDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\static\css\core\dev (UID: 00000000-00009488)29:T4ee,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000c93849c0fb7f000080000000000000000000000000000000404c702d8b0100001033d4c2fb7f0000000000000000000000008ec1fb7f0000a0eb6b2a2e000000104146c0fb7f0000c0296f2d8b01000060eb6b2a2e000000000000000000000000000000000000000100000000000000b84046c0fb7f00000200000000000000010000000000000000008ec1fb7f00003b4d78c0fb7f0000000000000000000058f06b2a2e0000000000000000000000d02aa0c1fb7f000010b306c2fb7f0000e8f845c0fb7f000010b306c2fb7f0000d02aa0c1fb7f00000d000000fb7f00000d00000000000000a0f6f6c1fb7f0000f5879bc1fb7f0000d02aa0c1 (UID: 00000000-00008164) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008164)2a:T1553,"MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\AcroCEF.exe to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\cef.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\cef_100_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_100_percent.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\cef_200_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_200_percent.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\cef_extensions.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_extensions.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\chrome_100_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_100_percent.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\chrome_200_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_200_percent.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\chrome_elf.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_elf.dll (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\COPYING.LGPLv2.1.txt to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\COPYING.LGPLv2.1.txt (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\icudtl.dat to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\icudtl.dat (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\libcef.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\libcef.dll (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\LICENSE.txt to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\LICENSE.txt (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\locales\en-US.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\en-US.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\resources.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\resources.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\SingleClientServicesUpdater.exe to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\snapshot_blob.bin to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\snapshot_blob.bin (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\swiftshader\libEGL.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libEGL.dll (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\swiftshader\libGLESv2.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libGLESv2.dll (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\v8_context_snapshot.bin to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\v8_context_snapshot.bin (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\vk_swiftshader.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\vk_swiftshader.dll (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\vk_swiftshader_icd.json to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\vk_swiftshader_icd.json (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_2\vulkan-1.dll to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\vulkan-1.dll (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\AcroCEF\cef.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef.pak (UID: 00000000-00009376) "MsiExec.exe" called "CopyFileW" to copy %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\AcroCEF\cef_100_percent.pak to new location %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_100_percent.pak (UID: 00000000-00009376)2b:T678,"MsiExec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1 (UID: 00000000-00009376) "MsiExec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\locales (UID: 00000000-00009376) "MsiExec.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader (UID: 00000000-00009376) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\WebInstaller (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter %PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\WebResources\Resource2 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter OWP (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter OWP\default (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter OWP\default\css (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter OWP\default\fonts (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter OWP\default\images (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter OWP\default\js (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter app1 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "CreateDirectoryW" with parameter app1\__VERSION__ (UID: 00000000-00009488)2c:T4099,"MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB6F3.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msi.dll (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB8C8.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB917.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB976.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIB9C5.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIBA53.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIBAC1.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIBB8D.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIBC98.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIBCE7.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIBD65.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC371.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC3DF.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIC42F.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSID353.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSID40F.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSID45E.tmp (UID: 00000000-00004452) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIEB43.tmp (UID: 00000000-00004452) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008164) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008164) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008164) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008164) "rundll32.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00008164) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00008164) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00008164) "rundll32.exe" called "LoadLibrary" with a parameter msIso.dll (UID: 00000000-00008164) "rundll32.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00008164) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ADVAPI32.DLL (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIF08.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\msi.dll (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI115B.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI11D9.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1218.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1267.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI12B6.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI12F6.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1364.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI13B3.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1422.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1480.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI14D0.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI150F.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI155E.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1E39.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1E98.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1EE7.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI357D.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI357E.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI361B.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI366A.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI36B9.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI3709.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI3758.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI37C6.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI7C34.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI21EE.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI9434.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI9473.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI94C2.tmp (UID: 00000000-00005820) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLE32.DLL (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\RPCRT4.DLL (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8A7D.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\KERNEL32.DLL (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8EB5.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI8FFE.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI906D.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI90EB.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI913A.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI9189.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIA7D1.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIEBA9.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI656.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI657.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI704.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSICF0.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSID3F.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSID8F.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIDDE.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIE2D.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIE7C.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIEEA.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIF49.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSIFB7.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1016.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI1065.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI10B4.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter ieframe (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI126B.tmp (UID: 00000000-00009376) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI226C.tmp (UID: 00000000-00009376) "MSI8D3D.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006576) "MSI8D3D.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006576) "MSI8D3D.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006576) "MSI8D3D.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006576) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter COMCTL32 (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\OLE32.DLL (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter Msi.dll (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\RPCRT4.DLL (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI2607.tmp (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\KERNEL32.DLL (UID: 00000000-00006600) "MsiExec.exe" called "LoadLibrary" with a parameter %WINDIR%\Installer\MSI29F0.tmp (UID: 00000000-00006600) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00003480)2d:Tcd9e,"MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetCustomInstallerProperties (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter MsiGetComponentPathExW (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter WerUnregisterRuntimeExceptionModule (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetARMMode (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter IsWin11OrLater (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter IsCitrixEnv (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusInstalled (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CheckServices (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerInit (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter DetectAndSetShortcutProps (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter InitializePluginProperties (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter IsElevated (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetAllUsersDocuments (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetupAdobeHome (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetPDFMakerPaths (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter Set64bitLanguageKey (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerSet (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusProgramDirectory (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter SetInstallStateForFeature (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CollectDataForARM (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00004452) "MsiExec.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00004452) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SHAnsiToUnicode (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SHGetValueW (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter PSCreatePropertyStoreFromObject (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter TaskDialogIndirect (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008164) "rundll32.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00008164) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetCustomInstallerProperties (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter MsiGetComponentPathExW (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter WerUnregisterRuntimeExceptionModule (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetARMMode (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter IsWin11OrLater (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter IsCitrixEnv (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusInstalled (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CheckServices (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerInit (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter DetectAndSetShortcutProps (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter InitializePluginProperties (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter IsElevated (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetAllUsersDocuments (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetupAdobeHome (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetPDFMakerPaths (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter Set64bitLanguageKey (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerSet (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusProgramDirectory (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetInstallStateForFeature (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetCacheDirSource (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CloseApplications (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter DetectAndCopyChromeExtReg (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter TransferPrefRegistry (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CollectMntProperties (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter SetSecondaryInstallParams (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CollectCustomTablesData (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CollectProperties (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter DefragmentFiles (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter RegisterReboot (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter RefreshShellIcons (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CleanupRunTime (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00005820) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CoIsHandlerConnected (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter I_RpcBindingInqLocalClientPID (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter BroadcastUnloadAcrobatComponents (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter WerUnregisterRuntimeExceptionModule (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter RegisterProperties (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter TerminateProcesses (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter DeleteChromeExtRegForReprompt (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerBackup (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter BroadcastUnloadStubMessage (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter RestoreEnterpriseFiles (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter InstallColorFiles (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter InstallCEF (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter DefragmentFiles (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter InstEnterpriseFiles (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter InstEnterpriseRegistry (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter ProcessDeleteFilesEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter ProcessDeleteRegistryEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter ProcessDeleteComponentsEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter ProcessDeleteProductsEx (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter SetLotusIni (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter FileTypesOwnerRestore (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateDDENameRegistry (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateForceASLRRegEntries (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseAppEntryPoints (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter UpdateCitrixRegistry (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter SetupAutoCAD (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter RestartInternetExplorer (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter IERefreshElevationPolicy (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CreateChromeExtRegForReprompt (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CEFCleanup (UID: 00000000-00009376) "MsiExec.exe" called "GetProcAddress" with a parameter CoDisconnectObject (UID: 00000000-00009376) "MSI8D3D.tmp" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006576) "MSI8D3D.tmp" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006576) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006600) "MsiExec.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00006600) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00009488) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003480) "SingleClientServicesUpdater.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00003480)2e:Tbe2,Antivirus vendors marked dropped file "Acrobat.exe" as clean (type is "PE32 executable (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "AcroCEF.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ReaderUC.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "icuuc71.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "AIDE.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "icucnv71.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "rt3d.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "CRClient.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "AcroDunamis.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "AdobeXMP.dll" as clean (type is "PE32+ executable (DLL) (console) x86-64 for MS Windows"), Antivirus vendors marked dropped file "Adobe Crash Processor.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "AdobeXMP.dll" as clean (type is "PE32 executable (DLL) (console) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "ExtendScript.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "Aiod.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ScCore.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "JP2KLib.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ADNotificationManager.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "AdobeLinguistic.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ahclient.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "JP2KLib.dll" as clean (type is "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"), Antivirus vendors marked dropped file "MSRMSPIBroker.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "CRWindowsClientService.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "ADelRCP.exe" as clean (type is "PE32+ executable (GUI) x86-64 for MS Windows"), Antivirus vendors marked dropped file "nppdf32.dll" as clean (type is "PE32+ executable (DLL) (GUI) x86-64 for MS Windows")2f:T114c,"ReaderUC.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "icuuc71.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AIDE.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "icucnv71.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "rt3d.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "CRClient.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AcroDunamis.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AdobeXMP.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "Adobe Crash Processor.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AdobeXMP.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "ExtendScript.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "Aiod.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ScCore.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "JP2KLib.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ADNotificationManager.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "AdobeLinguistic.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ahclient.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "JP2KLib.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT "MSRMSPIBroker.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "CRWindowsClientService.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "ADelRCP.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "nppdf32.dll" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA "WCChromeNativeMessagingHost.exe" has flags like IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA30:Ta7e,"MsiExec.exe" touched "Msi install server" (Path: "HKCU\CLSID\{000C101C-0000-0000-C000-000000000046}") "MsiExec.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{000C103E-0000-0000-C000-000000000046}") "MsiExec.exe" touched "Application Registration" (Path: "HKCU\CLSID\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\TREATAS") "rundll32.exe" touched "URL Shortcut PropSetStorage Mapping" (Path: "HKCU\CLSID\{06EEE834-461C-42C2-8DCF-1502B527B1F9}") "rundll32.exe" touched "INI Property Set Storage Handler" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{942BC614-676C-464E-B384-D3202AAA02DA}") "rundll32.exe" touched "Private Profile Object" (Path: "HKCU\CLSID\{4DFED3F9-B794-4D3C-973B-DDA1C28105A9}\TREATAS") "rundll32.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "MsiExec.exe" touched "PDFShellInfo2 Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{D38406DA-E8AA-484B-B80D-3D3DBDCC2FB2}\LOCALSERVER32") "MsiExec.exe" touched "PDFShellInfo Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{98D9A6F1-4696-4B5E-A2E8-36B3F9C1E12C}\LOCALSERVER32") "MsiExec.exe" touched "Adobe PDF Preview Handler for Vista" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DC6EFB56-9CFA-464D-8880-44885D7DC193}") "MsiExec.exe" touched "Broker Class" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{BD57A9B2-4E7D-4892-9107-9F4106472DA4}\LOCALSERVER32") "MsiExec.exe" touched "Adobe Acrobat Document" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\LOCALSERVER32") "MsiExec.exe" touched "Computer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "MsiExec.exe" touched "Memory Mapped Cache Mgr" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "MsiExec.exe" touched "Control Panel" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") "MsiExec.exe" touched "All Control Panel Items" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{21EC2020-3AEA-1069-A2DD-08002B30309D}\SHELLFOLDER") "MsiExec.exe" touched "Printers" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2227A280-3AEA-1069-A2DE-08002B30309D}\SHELLFOLDER") "MsiExec.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "MsiExec.exe" touched "Recycle Bin" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") "MsiExec.exe" touched "Computers and Devices" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{F02C1A0D-BE21-4350-88B0-7367FC96EF3C}\SHELLFOLDER") "MsiExec.exe" touched "TaskScheduler class" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS")31:T4d9,Process "MsiExec.exe" (UID: 00000000-00004452) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-8LD9T6N", LOGONSERVER="\\DESKTOP-8LD9T6N", OneDrive="%USERPROFILE%\OneDrive", HOMEPATH="\Users\%OSUSER%", HOMEDRIVE="C:"" Process "MsiExec.exe" (UID: 00000000-00004452) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, COMPUTERNAME, TEMP, USERPROFILE, TMP" Process "rundll32.exe" (UID: 00000000-00008164) was launched with new environment variables: "PROMPT="$P$G", PROCESSOR_ARCHITEW6432="AMD64", EFC_5020="1"" Process "rundll32.exe" (UID: 00000000-00008164) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, COMPUTERNAME, ProgramFiles" Process "MsiExec.exe" (UID: 00000000-00005820) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, PSModulePath, CommonProgramFiles, Path, COMPUTERNAME, ProgramFiles" Process "MsiExec.exe" (UID: 00000000-00005820) was launched with missing environment variables: "PROMPT, PROCESSOR_ARCHITEW6432, EFC_5020" Process "SingleClientServicesUpdater.exe" (UID: 00000000-00003480) was launched with modified environment variables: "Path"32:T8a0,"MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_100_percent.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_200_percent.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\cef_extensions.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_100_percent.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_200_percent.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\chrome_elf.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\COPYING.LGPLv2.1.txt" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\icudtl.dat" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\libcef.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\LICENSE.txt" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\locales\en-US.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\resources.pak" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\SingleClientServicesUpdater.exe" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\snapshot_blob.bin" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libEGL.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\swiftshader\libGLESv2.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\v8_context_snapshot.bin" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\vk_swiftshader.dll" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\vk_swiftshader_icd.json" "MsiExec.exe" touched file "C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\vulkan-1.dll"33:T38d0,Found string "!This program cannot be run in DOS mode.Rich.text`.rdata@.data.pdata@.rsrc@.reloc\$0HUVWATAUAVAWHUpE3D$(HT$ HD$`HcHD$`HcHD$`HcHl$HLD$HHExH;A'H;CExfDT$PID$HHD$`HcHD$`HA_A^A]A\_^]CpH9\$0H\$0H\$0H@SVH|$ HL$PHt$@LD$HHt$HHT$@Ht$PHD$@HD$HHD$PH|$ HD$0tbGpI9L$0Ht$@H\$8HVWAVHL90uL90u HL$@H\$HHl$PH A^_^@SWAWH A__[Hl$@Ht$HHt$XL~-H;O@Hct$XH+l$@Ht$HH A__[t$ AVHl$@Ht$HHl$@Ht$HH A^H\$0H|$8H;N8Hc|$8HFpI9u%H;t$HH+\$0Hl$@H|$ UHWPLcGpI9D$8HD$0HD$(HD$ HAPHc|$0H|$0H|$0H\$0HSpI9\$0H\$ WHQXLcApI9D$H@|$@HD$8HD$xHD$0LL$AHD$XHD$(LD$@HD$PHL$@Ht$HHD$XH+L$XLH9D$PL$xH3CpH9|$0fff|$0H\$8Ht$@IA'H;l$8H\$0Ht$@HA'H;t$8H\$0H|$@HApI9\$0H\$0HD$XH|$xHD$0HD$ LL$XL|$xHL$XH3|$0HD$8H+L$8LL$XH3CpH9t$8H\$0HL$ HVWAVH\$ H\$XH0A^_^VWAWHt$@HH'H;t$@Hl$PH\$HH A__^t$PHt$ Ht$(LL$(LD$ HT$PHD$PHD$ HD$(HT$(HL$0H\$XHt$`H\$XHt$`Ht$@J|$HH|$HHt$@HD$ I\$ UVWHD$HH\$HH\$HH\$PH\$HH\$XH _^]UVWATAUAVAWH\$0Ht$ 3)D$ LT$ HPA_A^A]A\_^]|$0H\$8Hl$@H|$0f|$0H\$8Hl$@H|$ AVHt$0HA'H;t$0H\$8Hl$@H|$HH\$ UVAWH|$@Ld$HLt$PLH'H;d$HH|$@Lt$PH\$XH A_^]@VWAUAVH\$PE3l$XHd$`L|$ MA'H;D$pOd$`Hl$XH\$PL|$ H(A^A]_^WATAUAVAWHt$pE3A'H;T$xO\$PHt$`fDl$XH A_A^A]A\_J'H;WATAUAVAWH\$ E2L$(HLHH\$ Dd$(E$HcHL!HH\$xH@A_A^A]A\_t$ HWATAUAVAWHL$ HD$(H\$hId$hL\$pHt$xH0A_A^A]A\_@USVWATAVAWHfF9$Bud$ E3A_A^A\_^[]SUVWAUAVHL$0LHA^A]_^][|$@@|$@tL$4LHA^A]_^][SVWATAVAWHt$0Lt$8fD$8DL$0Dd$ LHA_A^A\_^[UVWATAUAVAWHd$0Dd$ LL$8Ld$ LL$0Ld$ LL$0LD$PLd$`Ld$hMfF9$CuL$PH|$hH\$PHt$`HL$PED$pLT$PEL$pH|$pHL$p@T$p@L$pH|$pHD$p@T$@IL$PH|$PH\$`HD$P@T$hHL$PHL$`HL$pHA_A^A]A\_^]\$@H\$@Ht$HHt$ Ht$HHVWATAVAWH\$pI|1(Ht$ HL1HHD0PH@t+HT1XHT1XH\$pH\$pL|$ HL9HH\$hH0A_A^A\_^\$(IUVAVH\$PH A^^]|$@H|$HHA'H;|$@L|$HH\$PH A^^]@SVATAVHl$PI|$XHl$`H|$ H;H'H;l$pMl$`H|$XHl$PL|$ H(A^A\^[UWAVHT$0HD$(HM7H3A^_]USVWATAUAVAWHL$HHT$PL?_u-D$XLt$hLt$pLcT$pHL$XHD$x3T$hH+L$XHCL$XHD$(HT$ HD$@?T$xHCT$xLL$xHT$pHL$XHMxH3A_A^A]A\_^[]|$ UHL$ E3MGH3t$ WHD$HHL$ HL$(HCL$(HT$@HL$(HD$8@l$(HL$HH3\$hHl$pHt$xHUVWATAUAVAWHE0HcD$8E3|$@fL$ E3L$ Dt$HH|$@Hd$8M+L$ E3E fDM0H3A_A^A]A\_^]t$ H\$HHl$PHt$XHD$8HD$8fullHT$8HL$ LT$pHL$XHD$hf|$XHT$PHL$8H|$HHL$xHWATAUAVAWHL$pAD$`HL$ E3\$HH\$ LL$HAt$XHL$ E3\$`HD$hH\$`HD$HHL$HA|$@Lt$XL|$pIA_A^A]A\_VWAVHL$ DA^_^H'H;\$0Hl$8Ht$@Ht$0Ht$0H\$8H@SVAVAWHl$PH|$XLd$`Ml$ HA'H;<>fE<>fEd$`H|$XHl$PLl$ H(A_A^^[WATAUAVAWH,'L;wYH;A'H;\$PHl$XHt$`H A_A^A]A\_SVWATAUAVAWHD$ Ht$xIL$'I;t$xIt$(Ht$pI|$pIuRH;tCfff|$pID$ H0A_A^A]A\_^[\$ UHD$H3t$hHl$8HD$(HD$(H;T$@HL$(H8 u$l$@ID$(HD$(H;D$(HT$@HL$(Ht$hH|$pHL$HH3\$xH\$ UVWHD$XHD$ HL$HH;l$HHL$8Lt$PLt$8IL$XH3`_^]WAVAWH|$`It:fff\$@Hl$HHt$PH A_A^_|$ ATAVAWHt$`3A'H;T$hJ|$XH\$@Hl$HH A_A^A\t$ HWATAUAVAWHl$8Ll$0Dl$(Ll$ 3D$HIl$XMM'H;\$HH|$XL|$PLl$8Ll$0D|$(H\$ At/H+\$`IA_A^A]A\_t$ HWATAUAVAWHd$(Ld$ ED$8Id$HIK'H;|$8Ht$HLd$8Ml$(H|$ Mt5H+\$PIA_A^A]A\_\$ VAVAWHl$@H|$HLd$PE3A'H;|$HHl$@Ld$PH\$XH A_A^^UVWATAUAVAWHL$(3L$`HL$@A|$0Ld$0Ll$HIL$@Kt\H;t(fA9L$@LT$hHL$PHoT$`A_A^A]A\_^]UVWATAUAVAWHL$(3L$`HL$@At$0Ld$0Ll$HIL$@KL$@HT$hHL$PHoT$`A_A^A]A\_^]\$ UVWHL$(3L$@AL$0LD$pHL$pHT$hHL$PHD$`fl$PHT$HHL$0HUVWAVAWHL$PAD$@HT$XHL$@HD$ E3T$8fD|$ HD$@L|$PL|$XHD$@HD$ H;T$8HL$ H|$0HL$0LT$xHL$`H|$pH|$`HT$XHL$@HT$ HD$ HT$8HL$ H|$0H|$ HA_A^_^]l$ VWAVHD$PHL$(E3L$@ET$0HT$HHL$0HL$@H;D$0H;T$HHL$0HL$PH3\$`IA^_^l$ VWAVHL$ ECfffA^_^@UVWAUAWH\$pId$xMd$xH|$(I@A_A]_^]@VWAVH\$@Hl$HH|$PMA'H;D$hNT$`Hl$HH\$@L|$PH A^_^@UVWATHD$@HD$ H|$8Hl$ H|$ ID$0H8Actiut-E3|$PHL$@H3XA\_^]D$HHL$HH3L$HH3D$@fL$P3D$`ID$`.lckID$@H;T$XHL$@HD$PfL$PHT$xHL$`HL$@HCL$@HT$XHL$@HD$PfL$@HCL$@L$@HCL$@T$XHL$@HD$hH\$ H\$ HT$@HL$(HT$`HL$HHL$hH3SVWATAVAWHL$PHT$`LD$hLL$p3|$XID$xf.lckHD$xI;L$xH\$xAD$xAL$xHCL$xHD$HHL$xH\$xIL$xHCL$xL$xHCL$xL$xH\$xID$ IT$PHL$xHCL$xL$xHCL$x|$XLt$`Ht$hH|$pHL$xH\$xIA_A^A\_^[D$xHT$pHL$XHT$@HL$@HL$PHT$HHL$xH3T$pHL$XHT$pHL$XHT$PHL$PHL$@HT$HHUVWATAUAVAWH\$8H\$8HD$ Ll$0HT$ It$(L\$ L+\$ I;t$(H;D$ HD$(HT$ I|$(L\$ L+D$PH.xmlHD$pH\$ I;|$(H\$ HT$0H+A_A^A]A\_^]UVWATAUAVAWH\$8H\$8HD$ Ll$0HT$ It$(L\$ L+\$ I;t$(H;D$ HD$(HT$ It$(L\$ L+\$ I;t$(H;D$ HD$(HT$ I|$(L\$ L+D$PH.dmpHD$pH\$ I;|$(H\$ HT$0H+A_A^A]A\_^]|$ AVHD$xLL$xHD$XLt$hLt$pHt$xHCt$xH\$hAA'H;D$XH\$hH|$pLD$XHD$PLt$0LD$0HT$XHT$pHL$XHt$hHD$ HD$ HD$@HD$ HD$ LT$0HL$ HD$8HD$(LD$ IT$ HD$ HD$XLt$hHD$XHD$XHT$@HT$pHL$XHD$XLt$hHD$XHD$XHT$@HT$pHL$XHD$XHD$fLD$XHT$@HT$pHL$XHD$XHD$fLD$XHT$@HT$pHL$XHT$ HT$0HL$xHt$xH@SVWHD$HH|$PH\$@H _^[D$@H _^[\$0H\$0H\$0H\$0HD$PHT$(3D$0Dt$@AL$HED$@HD$0ICD$0FL$HL~RMcD$0ICD$0MT$0EET$0AL$PH3\$pHUVWATAUAVAWHD$8HD$@HcHE`H9D$@HcHD$@HCUPH:rCHD$ :*r:HC]pHD$ *D$0HA_A^A]A\_^]UWATAVAWHL$0Ht$(HL$0H\$(HM8L+CE(HL$0HD$(Ht$(HL$xLL$xHD$xHD$hHCD$hfDL$XLL$XHT$`HD$XHD$HHCD$HfDT$`HL$HHL$hHA_A^A\_]UVWHD$HHt$XHt$`DL$0HD$(HL$xH+D$hHCD$hHL$0HD$(HD$ ,D$XH+L$HHCL$HH\$(HD$ HE(H;T$`HL$HHL$hHt$xHt$hH\$ UVWAVAWHN@E3L$8HL$0H\$(H|$ LM'H3A_A^_^]@SUVWATAUAVAWHD$p3D$PH\$`H\$hE3l$(Ld$ LL$PH\$@HD$@HL$8HL$@HL$0H\$(H|$ LD$PHT$@HT$hHL$PHA_A^A]A\_^][UVWAVAWH!r%HL$0HD$(HM/H3A_A^_^]\$ UVWAVAWHD$`ML$PAD$@HT$XHL$@H\$ E3L$0H\$(H\$ E3L$`H3pA_A^_^]t$ WHL$PAD$8HL$03t$(Ht$ LD$@HT$`HT$XHL$@HD$Pft$@HT$xHL$`H@SUVWHD$@fL$P3l$@LL$@LD$8HL$0Hl$(Hl$ LD$@HT$`HT$XHL$@HD$Pfl$@HT$xHL$`H_^][t$@H\$HHt$PH|$ H\$HHt$PHt$ UWAVHL$@3t$ HD$PHD$`HT$hHD$PHcHD$PHcHD$hHD$0HT$(HL$PHcQL$PHcQA^_]|$ MI9JhsBXHcB A+|$ H|$ AVI9JhsD$0LBXHcB A+t$ H|$(H@PHcPhI;|$ ATAVAWHAXHc8H?s6HN'H;\$@Hl$HHt$PH|$XH A_A^A\CXHcCPHcWATAUAVAWH,out of memory%s%s%s1.2.12internal error: deflate stream corruptrequested length does not fit in int deflate 1.2.12 Copyright 1995-2022 Jean-loup Gailly and Mark Adler n;^Qkkbali]Wb9a&gMGiIwn>Jj#.zf+o*7F;geoO|@+* cf.{procT@xekvs7K"qa+jb>[P&VwiIAl'7w+z&. Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icucnv58.dll]- [targetUID: 00000000-00008804] "icuuc58.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icuuc58.dll]- [targetUID: 00000000-00008804] "icuuc67.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icuuc67.dll]- [targetUID: 00000000-00008804] "icucnv67.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icucnv67.dll]- [targetUID: 00000000-00008804] "icucnv69.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icucnv69.dll]- [targetUID: 00000000-00008804] "icuuc69.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icuuc69.dll]- [targetUID: 00000000-00008804] "libGLESv2.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\libGLESv2.dll]- [targetUID: 00000000-00009376] "icudt58.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icudt58.dll]- [targetUID: 00000000-00008804] "icudt69.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icudt69.dll]- [targetUID: 00000000-00008804] "libEGL.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\AcroCEF\swiftshader\libEGL.dll]- [targetUID: 00000000-00009376] "icudt67.dll" has type "Composite Document File V2 Document Little Endian Os: Windows Version 5.1 MSI Installer Code page: 1252 Last Printed: Thu Mar 12 23:16:49 2009 Create Time/Date: Thu Mar 12 23:16:49 2009 Name of Creating Application: Windows Installer Title: Installation Database Keywords: InstallMSI Comments: This installer database contains the logic and data required to install . Template: ;0 Last Saved By: jitao Revision Number: {17020777-B3DC-4E7D-9DEE-C47D540454D1} Last Saved Time/Date: Wed May 6 06:32:30 2009 Number of Pages: 100 Number of Words: 0 Security: 0"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\icudt67.dll]- [targetUID: 00000000-00008804] "MakeAccessible.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\MakeAccessible.api]- [targetUID: 00000000-00009376] "PPKLite.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\PPKLite.api]- [targetUID: 00000000-00009376] "AcroForm.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm.api]- [targetUID: 00000000-00009376] "Annots.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\Annots.api]- [targetUID: 00000000-00009376] "EScript.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\EScript.api]- [targetUID: 00000000-00009376] "prcr.x3d" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins3d\prcr.x3d]- [targetUID: 00000000-00008804] "Multimedia.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\Multimedia.api]- [targetUID: 00000000-00009376] "DigSig.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\DigSig.api]- [targetUID: 00000000-00009376] "Checkers.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\Checkers.api]- [targetUID: 00000000-00009376] "MSI155E.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%WINDIR%\Installer\MSI155E.tmp]- [targetUID: 00000000-00008804] "2d.x3d" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins3d\2d.x3d]- [targetUID: 00000000-00008804] "Accessibility.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\Accessibility.api]- [targetUID: 00000000-00009376] "StorageConnectors.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\StorageConnectors.api]- [targetUID: 00000000-00008804] "Search.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\Search.api]- [targetUID: 00000000-00009376] "SendMail.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\SendMail.api]- [targetUID: 00000000-00009376] "SaveAsRTF.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\SaveAsRTF.api]- [targetUID: 00000000-00009376] "MSI1065.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%WINDIR%\Installer\MSI1065.tmp]- [targetUID: 00000000-00009376] "DataMatrix.pmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\DataMatrix.pmp]- [targetUID: 00000000-00008804] "PDDom.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\PDDom.api]- [targetUID: 00000000-00009376] "MSI1480.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%WINDIR%\Installer\MSI1480.tmp]- [targetUID: 00000000-00008804] "MSI13B3.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%WINDIR%\Installer\MSI13B3.tmp]- [targetUID: 00000000-00008804] "drvDX9.x3d" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvDX9.x3d]- [targetUID: 00000000-00008804] "reflow.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\reflow.api]- [targetUID: 00000000-00009376] "_SC_Acrobat_3D.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_SC_Acrobat_3D.ico]- [targetUID: 00000000-00008804] "Spelling.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\Spelling.api]- [targetUID: 00000000-00009376] "weblink.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\weblink.api]- [targetUID: 00000000-00009376] "_SecStoreFile.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_SecStoreFile.ico]- [targetUID: 00000000-00008804] "_FormsDocument.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_FormsDocument.ico]- [targetUID: 00000000-00008804] "_APIFile.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_APIFile.ico]- [targetUID: 00000000-00008804] "_XFDFileType.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_XFDFileType.ico]- [targetUID: 00000000-00008804] "_SequenceFile.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_SequenceFile.ico]- [targetUID: 00000000-00008804] "_XMLFormsDocument.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_XMLFormsDocument.ico]- [targetUID: 00000000-00008804] "_729C1918_D5B6_4B24_97EC_8B387AE953A9" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_729C1918_D5B6_4B24_97EC_8B387AE953A9]- [targetUID: 00000000-00008804] "_RightsManagementFile.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_RightsManagementFile.ico]- [targetUID: 00000000-00008804] "_BatchPDFIndex.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_BatchPDFIndex.ico]- [targetUID: 00000000-00008804] "_XDPFileType.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_XDPFileType.ico]- [targetUID: 00000000-00008804] "_PDFFile.ico" has type "PE32 executable (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_PDFFile.ico]- [targetUID: 00000000-00008804] "MSI7C34.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%WINDIR%\Installer\MSI7C34.tmp]- [targetUID: 00000000-00008804] "DropboxStorage.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\DropboxStorage.api]- [targetUID: 00000000-00008804] "3difr.x3d" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins3d\3difr.x3d]- [targetUID: 00000000-00008804] "IA32.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\IA32.api]- [targetUID: 00000000-00009376] "MSI1422.tmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%WINDIR%\Installer\MSI1422.tmp]- [targetUID: 00000000-00008804] "drvSOFT.x3d" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins3d\drvSOFT.x3d]- [targetUID: 00000000-00008804] "ReadOutLoud.api" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\ReadOutLoud.api]- [targetUID: 00000000-00009376] "MSI2607.tmp" has type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows"- Location: [%WINDIR%\Installer\MSI2607.tmp]- [targetUID: 00000000-00008804] "AdobePDF417.pmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\AdobePDF417.pmp]- [targetUID: 00000000-00008804] "QRCode.pmp" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins\AcroForm\PMP\QRCode.pmp]- [targetUID: 00000000-00008804] "MSI8D3D.tmp" has type "PE32+ executable (GUI) x86-64 for MS Windows"- Location: [%WINDIR%\Installer\MSI8D3D.tmp]- [targetUID: 00000000-00008804] "tesselate.x3d" has type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows"- Location: [%PROGRAMFILES%\Adobe\Acrobat DC\Acrobat\plug_ins3d\tesselate.x3d]- [targetUID: 00000000-00008804]3b:T697,"MsiExec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32.EXE") "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32.EXE"; Key: "MITIGATIONOPTIONS"; Value: "0001000000000000") "MsiExec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACROBATINFO.EXE") "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACROBATINFO.EXE"; Key: "MITIGATIONOPTIONS"; Value: "0001000000000000") "MsiExec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACROBAT.EXE") "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACROBAT.EXE"; Key: "MITIGATIONOPTIONS"; Value: "0001000000000000") "MsiExec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACROCEF.EXE") "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACROCEF.EXE"; Key: "MITIGATIONOPTIONS"; Value: "0001000000000000") "MsiExec.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACROSERVICESUPDATER.EXE") "MsiExec.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACROSERVICESUPDATER.EXE"; Key: "MITIGATIONOPTIONS"; Value: "0001000000000000")3c:T43b,"MsiExec.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter System" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00004452) "MsiExec.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00004452)3d:Tb90,File type "PE32+ executable (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\$PatchCache$\Managed\68AB67CA330133017706CB5110E47A00\21.1.20135\ADNotificationManager.exe" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSI155E.tmp" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSI1065.tmp" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSI1480.tmp" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSI13B3.tmp" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_SC_Acrobat_3D.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_SecStoreFile.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_FormsDocument.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_APIFile.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_XFDFileType.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_SequenceFile.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_XMLFormsDocument.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_729C1918_D5B6_4B24_97EC_8B387AE953A9" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_RightsManagementFile.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_BatchPDFIndex.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_XDPFileType.ico" File type "PE32 executable (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\{AC76BA86-1033-1033-7760-BC15014EA700}\_PDFFile.ico" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSI7C34.tmp" File type "PE32+ executable (DLL) (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSI1422.tmp" File type "PE32 executable (DLL) (GUI) Intel 80386 for MS Windows" was dropped at "%WINDIR%\Installer\MSI2607.tmp" File type "PE32+ executable (GUI) x86-64 for MS Windows" was dropped at "%WINDIR%\Installer\MSI8D3D.tmp"24:["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"f39c055fd6385b9fa46bbff59db592416a2e5cb3fcb24a187f267401d4f6fac7","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"no specific threat","threat_score":0,"unified_at_epoch_ms":1790525187562,"unified_at":"2026-09-27T16:06:27.562Z","metadata":{"hashes":{"sha256":"f39c055fd6385b9fa46bbff59db592416a2e5cb3fcb24a187f267401d4f6fac7","sha1":"ccecd7aa9ee8280fb6ab8246f4e27e9e409d4d74","md5":"cf683989e2666266aefadc69c040d145","sha512":"75b188f467189d9657501d8a31c6f12b24ee3064539a34640047ce9b5e3e637bdc3467643c8b52d3d580f1aa9cecb17f28330bfa0822f6dcae4d459c0815795c","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"$27","file_type":["url"],"file_type_id":"url","file_size":0,"is_container_sample":false,"url_analysis":true},"submissions":{"first_seen":1704125066000,"last_seen":1704125066000,"last_multi_scan":1704125066000}},"detections":{"summary":{"verdict":"no specific threat","score":0,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":48,"suspicious_count":11,"malicious_count":2,"total":61},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cylance":{"name":"Cylance","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"type":"informative","value":"Writes a file to the start menu"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Creates/edits LNK file (Windows shortcut)"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Defense Evasion","technique":"Msiexec","attack_id":"T1218.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/007","identifiers":[{"type":"informative","value":"Detected msiexec.exe process execution"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"},{"type":"informative","value":"Drops files on the desktop"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in program files directory"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops XML files"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"SingleClientServicesUpdater.exe\" called \"FindResourceA\" with parameter \"101\" - (UID: 00000000-00009488)\n \"SingleClientServicesUpdater.exe\" called \"FindResourceA\" with parameter \"102\" - (UID: 00000000-00009488)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\"SingleClientServicesUpdater.exe\" called \"LoadResource with parameter {'hModule': '140699316781056', 'hResInfo': '140699317199120'}\" (UID: 00000000-00009488)\n \"SingleClientServicesUpdater.exe\" called \"LoadResource with parameter {'hModule': '140699316781056', 'hResInfo': '140699317199136'}\" (UID: 00000000-00009488)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"$28","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Detected msiexec.exe process execution","description":"Process \"MsiExec.exe\" with commandline \"-Embedding 757D7360F075474E2C6BD462AB11E27A\" (UID: 00000000-00004452)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 00840E0ECD1FEA8C49C90EB09DCB87B4\" (UID: 00000000-00005820)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 5E48D192E27F8F224E6B642DD94F8B71 E Global\\\\MSI0000\" (UID: 00000000-00009376)\n\n Process \"MsiExec.exe\" with commandline \"-Embedding 88367FB2FD655B0565B33A56D5C017A2 E Global\\\\MSI0000\" (UID: 00000000-00006600)\n","origin":"Monitored Target","mitre_attack_id":"T1218.007","relevance":2,"id":"target-152","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"rundll32.exe\" called \"GetWindowTextW\" (UID: 00000000-00008164)\n \"rundll32.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00008164)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"MsiExec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004452)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008164)\n \"MsiExec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005820)\n \"MsiExec.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00009376)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"MsiExec.exe\" called \"OpenMutexW\" with parameter \"Global\\ARM Update Mutex\" - (UID: 00000000-00009376)\n \"MSI8D3D.tmp\" called \"OpenMutexW\" with parameter \"Global\\ARM Update Mutex\" - (UID: 00000000-00006576)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"MSI8D3D.tmp\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"SingleClientServicesUpdater.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"SingleClientServicesUpdater.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINWORD.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EXCEL.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERPNT.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\VISIO.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WINPROJ.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MSIEXEC.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"MsiExec.exe\" trying to touch file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$2a","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2c","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2d","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8164:304:WilStaging_02\"\n \"\\Sessions\\1\\BaseNamedObjects\\InternetShortcutMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\SM0:8164:120:WilError_03\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8164:120:WilError_03\"\n \"InternetShortcutMutex\"\n \"Local\\SM0:8164:304:WilStaging_02\"\n \"Local\\SM0:8164:120:WilError_03\"\n \"SM0:8164:120:WilError_03\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"$2e","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$2f","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at C02A0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at BF9F0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at C02A0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 77330000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72B80000\n \"SingleClientServicesUpdater.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at C02A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C0FF0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C0FF0000\n \"MSI8D3D.tmp\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C0FF0000\n \"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 75980000\n \"SingleClientServicesUpdater.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at C0FF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$30","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$31","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"MsiExec.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SCURRENCY\")\n \"MsiExec.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"ICALENDARTYPE\")\n \"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"MsiExec.exe\" with commandline \"-Embedding 757D7360F075474E2C6BD462AB11E27A\" (UID: 00000000-00004452)\n Spawned process \"rundll32.exe\" with commandline \"\"%WINDIR%\\\\System32\\\\ieframe.dll\",OpenURL C:\\\\sample.url\" (UID: 00000000-00008164)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 00840E0ECD1FEA8C49C90EB09DCB87B4\" (UID: 00000000-00005820)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 5E48D192E27F8F224E6B642DD94F8B71 E Global\\\\MSI0000\" (UID: 00000000-00009376)\n Spawned process \"MSI8D3D.tmp\" with commandline \"/b 2 300 0\" (UID: 00000000-00006576)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 88367FB2FD655B0565B33A56D5C017A2 E Global\\\\MSI0000\" (UID: 00000000-00006600)\n Spawned process \"SingleClientServicesUpdater.exe\" with commandline \"23.008.20421 --SingleClientApp\" (UID: 00000000-00009488)\n Spawned process \"SingleClientServicesUpdater.exe\" with commandline \"--postMsg\" (UID: 00000000-00003480)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"MsiExec.exe\" with commandline \"-Embedding 757D7360F075474E2C6BD462AB11E27A\" (UID: 00000000-00004452)\n Spawned process \"rundll32.exe\" with commandline \"\"%WINDIR%\\\\System32\\\\ieframe.dll\",OpenURL C:\\\\sample.url\" (UID: 00000000-00008164)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 00840E0ECD1FEA8C49C90EB09DCB87B4\" (UID: 00000000-00005820)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 5E48D192E27F8F224E6B642DD94F8B71 E Global\\\\MSI0000\" (UID: 00000000-00009376)\n Spawned process \"MSI8D3D.tmp\" with commandline \"/b 2 300 0\" (UID: 00000000-00006576)\n Spawned process \"MsiExec.exe\" with commandline \"-Embedding 88367FB2FD655B0565B33A56D5C017A2 E Global\\\\MSI0000\" (UID: 00000000-00006600)\n Spawned process \"SingleClientServicesUpdater.exe\" with commandline \"23.008.20421 --SingleClientApp\" (UID: 00000000-00009488)\n Spawned process \"SingleClientServicesUpdater.exe\" with commandline \"--postMsg\" (UID: 00000000-00003480)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"AIDE.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"AdobeXMP.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"JP2KLib.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates/edits LNK file (Windows shortcut)","description":"\"msiexec.exe\" writes to LNK file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Acrobat.lnk\"\n \"msiexec.exe\" writes to LNK file \"%PUBLIC%\\Desktop\\Adobe Acrobat.lnk\"","origin":"API Call","mitre_attack_id":"T1547.009","relevance":3,"id":"api-204","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"details too long to display","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"adobepdf.xdc\" has type \"XML 1.0 document ASCII text with very long lines with CRLF line terminators\" - Location: [%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\plug_ins\\AcroForm\\adobepdf.xdc]\n \"Info.plist\" has type \"XML 1.0 document ASCII text with CRLF line terminators\" - Location: [%COMMONPROGRAMFILES%\\Adobe\\Acrobat\\DC\\Linguistics\\Providers\\Plugins2\\AdobeHunspellPlugin\\Info.plist]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 8164)\n \"SingleClientServicesUpdater.exe\" queries basic process information of the \"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\SingleClientServicesUpdater.exe\" (UID: 9488)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"MsiExec.exe\" touched file \"C:\\Windows\\SysWOW64\\Elevation.tmp\"\n \"MsiExec.exe\" touched file \"\\Device\\HarddiskVolume3\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"MsiExec.exe\" trying to access LNK file \"\\Device\\HarddiskVolume3\\Users\\Public\\Desktop\\Adobe Acrobat DC.lnk\"\n \"MsiExec.exe\" trying to access LNK file \"\\Device\\HarddiskVolume3\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Acrobat DC.lnk\"\n \"MsiExec.exe\" trying to access LNK file \"\\Device\\HarddiskVolume3\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Acrobat Distiller DC.lnk\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"MsiExec.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume3\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\ccme_ecdrbg.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"MsiExec.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume3\\MsiWerCrashmetadata-41\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\ieframe.dll.manifest\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\rundll32.exe.Local\\\"\n \"rundll32.exe\" trying to access non-existent file \"\\Device\\HarddiskVolume3\\Windows\\SystemResources\\USER32.dll.mun\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes a file to the start menu","description":"\"msiexec.exe\" wrote to file \"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Adobe Acrobat.lnk\"","origin":"API Call","mitre_attack_id":"T1547.001","relevance":10,"id":"api-53","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$33","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.8.0.7\"\n \"1.12.61.0\"\n \"3.6.83.1\"\n \"4.5.0.0\"\n \"112.5.0.0\"\n \"112.0.0.0\"\n \"14.5.1.0\"\n \"7.1.3.1\"\n \"1.0.0.1\"\n \"6.0.4.1\"\n \"4.0.8.1\"\n \"14.0.0.0\"\n \"8.3.4.1\"\n \"4.1.2.0\"\n \"3.15.3.29\"\n \"8.8.0.7\"\n \"5.0.0.1\"\n \"71.1.0.0\"\n \"1.0.4.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$34","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"16845712\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68448\"\n \"cx\": \"350\"\n \"cy\": \"93\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68522\"\n \"cx\": \"68\"\n \"cy\": \"23\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"68454\"\n \"cx\": \"68\"\n \"cy\": \"23\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"MsiExec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"MsiExec.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"SingleClientServicesUpdater.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"SingleClientServicesUpdater.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"MsiExec.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$35","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"\"; File: \"ui-strings.js\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files on the desktop","description":"Dropped file: \"Adobe Acrobat.lnk\" - Location: [%PUBLIC%\\Desktop\\Adobe Acrobat.lnk]- [targetUID: 00000000-00008804]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-36","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"$36","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"MsiExec.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"rundll32.exe\" at 00000000-00008164-00000C13-40917947","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"$37","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Tries to save executable or command in registry","description":"$38","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"\"MsiExec.exe\" called \"FileTimeToSystemTime\" (UID: 00000000-00009376)","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries the installation properties of user installed products","description":"\"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\68AB67CA330133017706CB5110E47A00\\INSTALLPROPERTIES\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\68AB67CA330133017706CB5110E47A00\\INSTALLPROPERTIES\"; Key: \"VERSIONMAJOR\")\n \"MsiExec.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INSTALLER\\USERDATA\\S-1-5-18\\PRODUCTS\\68AB67CA330133017706CB5110E47A00\\INSTALLPROPERTIES\"; Key: \"INSTALLLOCATION\")","origin":"Registry Access","relevance":10,"id":"registry-71","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"General","name":"Writes archive files","description":"\"SingleClientServicesUpdater.exe\" writes archive file \"C:\\Program Files\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\WebInstaller\\JOIKRJXVTBGVXKAT.7z\"\n \"SingleClientServicesUpdater.exe\" writes archive file \"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\WebInstaller\\JOIKRJXVTBGVXKAT.7z\"","origin":"API Call","mitre_attack_id":"T1560","relevance":5,"id":"api-168","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$3a","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$3c","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"MsiExec.exe\" opened \"\\Device\\HarddiskVolume3\\MsiWerCrashmetadata-41\" with delete access\n \"MsiExec.exe\" opened \"C:\\Windows\\SysWOW64\\Elevation.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"$3d","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"MsiExec.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 72860000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries the installation properties of user installed products"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]}]},"activity":{"stats":{"process_count":9,"spawned_processes_count":9,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":68,"dropped_files_count":0,"extracted_files_count":94,"files_written_count":356,"files_deleted_count":0,"registry_keys_created_count":13,"registry_keys_modified_count":0,"registry_keys_deleted_count":5,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":18,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Extracted Files","User Comment"],"sandbox_reports":[{"id":"6592e28a0ec40a5ce90de2bf","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"undetected","threat_score":80,"submit_name":"f39c055fd6385b9fa46bbff59db592416a2e5cb3fcb24a187f267401d4f6fac7.url","analysis_start_time":"2024-01-01T16:26:25+00:00","indicators_count":{"informative":48,"suspicious":19,"malicious":2},"tags":["Multi-Process","Extracted Files","User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}],"processes":[{"pid":8804,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00008804","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB8UlEQVR4Xu2TO0vDUBiGXUVBZydBNwfBwX/gDxGcXAKKFxBE1HoDUVddXRxExNHFa71UrdZSbZPGNDVJY2/qIhbkNadqrDmHctKIOPSFh4Yczvs9OUlrav5jhgf6MTxYIdZeQRDg7HQVUlQoFCqC7B0fG/Em4VVATSjeJLwKkF9PEr8h4EnitwQIFUk4S9zA2utaglXCy+z0JP3X/GTIwjmLGS8C5SC9zlnMVAWqAlWBqsCfCpjmM1LpJxiEh0foFpqZL3KfyiFp5KAaWSR0Cy2DTPaZKuaFKUCGuklcTVPFvDAFyJO6iaiYVDEvTAFyvKV5en1D14aBzjW9SMfqPXq3H+z1qJyiinlhCijWe3Vm9DgPYTeDlpUEGhdltC0r9lpE0qliXpgCcjJdMvo7M0c5NMxLaFqQ0LoUt++HYxpVzAtTQEyYJWM/Mu3PoX5OxNRBFt3rGprnYvZa6DZJFfPCFIjepUpGA1OHWdTNxODb+3g1wpaB9iXJXg9GVKqYF6ZAJK7b5b79DGp9UUzu/vwu8i9v9vV5WKGKeWEKhEXNLu/ZNDCxw/4mvnIauqOKeWEKhKJJ54yyOb6UqWJemALBG9U5o2z8F1KxqCIG+miBgHWkZ9cKAgTrmhzxyZVcfNKjYBx+gjX08JODgEiXeMg7c/ehsUO96z4AAAAASUVORK5CYII="},{"pid":4452,"ppid":8804,"name":"MsiExec.exe","command_line":"-Embedding 757D7360F075474E2C6BD462AB11E27A","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00008804","uid":"00000000-00004452"},{"pid":5820,"ppid":8804,"name":"MsiExec.exe","command_line":"-Embedding 00840E0ECD1FEA8C49C90EB09DCB87B4","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00008804","uid":"00000000-00005820"},{"pid":9376,"ppid":8804,"name":"MsiExec.exe","command_line":"-Embedding 5E48D192E27F8F224E6B642DD94F8B71 E Global\\MSI0000","sha256":"5a31ea6a517a065166fafa01a0ac6a350d0e2dcba1b6dd4fdb41ae59109568e1","normalized_path":"%WINDIR%\\System32\\MsiExec.exe","parent_uid":"00000000-00008804","uid":"00000000-00009376"},{"pid":6576,"ppid":8804,"name":"MSI8D3D.tmp","command_line":"/b 2 300 0","sha256":"22be8934cb869d87fc18901ec5a8774b9fd654910d0cce1e5350e1cca843bc2c","normalized_path":"%WINDIR%\\Installer\\MSI8D3D.tmp","parent_uid":"00000000-00008804","uid":"00000000-00006576"},{"pid":6600,"ppid":8804,"name":"MsiExec.exe","command_line":"-Embedding 88367FB2FD655B0565B33A56D5C017A2 E Global\\MSI0000","sha256":"04de630d6f6cd8888597b55581032d01d6b6f1c26e106e7aae40ce6f2374d865","normalized_path":"%WINDIR%\\syswow64\\MsiExec.exe","parent_uid":"00000000-00008804","uid":"00000000-00006600"},{"pid":9488,"ppid":8804,"name":"SingleClientServicesUpdater.exe","command_line":"23.008.20421 --SingleClientApp","sha256":"e7c12b770c724a899ef8ae24eedf025cf8ad00b21984a970cdadabbe38902055","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\SingleClientServicesUpdater.exe","parent_uid":"00000000-00008804","uid":"00000000-00009488"},{"pid":3480,"ppid":9488,"name":"SingleClientServicesUpdater.exe","command_line":"--postMsg","sha256":"e7c12b770c724a899ef8ae24eedf025cf8ad00b21984a970cdadabbe38902055","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\AcroCEF\\SingleClientServicesUpdater.exe","parent_uid":"00000000-00009488","uid":"00000000-00003480"},{"pid":8164,"ppid":0,"name":"rundll32.exe","command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\sample.url","sha256":"98d37eff504a7adb864131ea4a042aaf4d79c4356960a8ab2fa656cc59aec014","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00008164","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB8UlEQVR4Xu2TO0vDUBiGXUVBZydBNwfBwX/gDxGcXAKKFxBE1HoDUVddXRxExNHFa71UrdZSbZPGNDVJY2/qIhbkNadqrDmHctKIOPSFh4Yczvs9OUlrav5jhgf6MTxYIdZeQRDg7HQVUlQoFCqC7B0fG/Em4VVATSjeJLwKkF9PEr8h4EnitwQIFUk4S9zA2utaglXCy+z0JP3X/GTIwjmLGS8C5SC9zlnMVAWqAlWBqsCfCpjmM1LpJxiEh0foFpqZL3KfyiFp5KAaWSR0Cy2DTPaZKuaFKUCGuklcTVPFvDAFyJO6iaiYVDEvTAFyvKV5en1D14aBzjW9SMfqPXq3H+z1qJyiinlhCijWe3Vm9DgPYTeDlpUEGhdltC0r9lpE0qliXpgCcjJdMvo7M0c5NMxLaFqQ0LoUt++HYxpVzAtTQEyYJWM/Mu3PoX5OxNRBFt3rGprnYvZa6DZJFfPCFIjepUpGA1OHWdTNxODb+3g1wpaB9iXJXg9GVKqYF6ZAJK7b5b79DGp9UUzu/vwu8i9v9vV5WKGKeWEKhEXNLu/ZNDCxw/4mvnIauqOKeWEKhKJJ54yyOb6UqWJemALBG9U5o2z8F1KxqCIG+miBgHWkZ9cKAgTrmhzxyZVcfNKjYBx+gjX08JODgEiXeMg7c/ehsUO96z4AAAAASUVORK5CYII="}],"all_imported_dlls":["vcruntime140_1.dll","vcruntime140.dll","AcLayers.dll","msvcp_win.dll","ole32.dll","VxSSL64.dll","ws2_32.dll","ieframe.dll","wow64.dll","imagehlp.dll","duser.dll","sspicli.dll","gdi32.dll","oleaut32.dll","wow64win.dll","taskschd.dll","msIso.dll","atlthunk.dll","TextShaping.dll","ntdll.dll","advapi32.dll","sechost.dll","SHCore.dll","psapi.dll","winhttp.dll","userenv.dll","VxSSL32.dll","bcryptprimitives.dll","clbcatq.dll","msctf.dll","user32.dll","combase.dll","fltLib.dll","WinTypes.dll","iertutil.dll","wow64cpu.dll","version.dll","ntmarta.dll","kernel32.dll","xmllite.dll","winsta.dll","gdi32full.dll","shell32.dll","cfgmgr32.dll","cryptbase.dll","TextInputFramework.dll","rpcrt4.dll","msi.dll","KernelBase.dll","comctl32.dll","propsys.dll","profapi.dll","wtsapi32.dll","CoreUIComponents.dll","win32u.dll","ucrtbase.dll","bcrypt.dll","windows.storage.dll","msvcp140.dll","apphelp.dll","shlwapi.dll","imm32.dll","wow64base.dll","wow64con.dll","msvcrt.dll","CoreMessaging.dll","kernel.appcore.dll","uxtheme.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"ADNotificationManager.exe","sha256":"2dc60b3930a45e15dfbbe2b9e940abe7e9a0611a12a0326a541dfd7c3d06c4e1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"ADelRCP.exe","sha256":"1ceac0a3b05c5647464508137dd776df5a4eb2505abd3f6fcd9c41a863273316","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AcroCEF.exe","sha256":"3e75174604a284b939979d1a45938c85666f48483f5a089c86f4197293ebe67d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AcroDunamis.dll","sha256":"a429f1dbb6f983ad1713d49cfb6bc32f223b9eaa8ceeacde60d45d3ec6f2d41d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AcroTextExtractor.exe","sha256":"8097c09c0a7dd9f7a7e3ec0ae98fb8771545cd3ae134b6e797757afa88d0e170","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AcrobatInfo.exe","sha256":"a7fd0b587807a4cc3c2e77f46885a8d0937b6e956191f1e3d9586e7cdfaf6f0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Adobe Crash Processor.exe","sha256":"0260700806a9a0c0c1567ebd80f7db95ae6bd057c15e1e5fbd27041d18dcb129","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AdobeLinguistic.dll","sha256":"e2915df125308489beafd8f02060ebf26105d0e73da4cdb00b8b8a6c5771303e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AdobeXMP.dll","sha256":"979e4b0fa210583213df89ad9289f8310c4f9c9b74e7a6a76dceba2c62ce0c56","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"nppdf32.dll","sha256":"52e70845e77670648dcaf10ee503ba8b28c3d16f7fb56bc25250fb972f0ada08","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"WCChromeNativeMessagingHost.exe","sha256":"c29d8453d386e9a5cd8f2e9b0fa729101213b5510e878558c6a28dd5ed87c01d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"CRClient.dll","sha256":"3bfc7aae47b41955897ce9a6f545c9adcc7e6945eb408733c21a457eb3714adb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"CRLogTransport.exe","sha256":"f7ba438c0e2d48f7722a48751889a9b1e0579256190619eb58461cde5cf90b9f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"CRWindowsClientService.exe","sha256":"56484de9aabbfae6a0d2f1e1d40d0fb9814ce08cd66b8fc4eb2bca842ba4a914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"ExtendScript.dll","sha256":"af340fccc6612c4fe229dfd04ef4baa63c0c4f0e86d77b3aad9f4c2457150d49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"JP2KLib.dll","sha256":"b8d517b9b20cc5af341e95b96a5015ecba73a12009a21857e3e55e395f17bcf5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"ReaderUC.dll","sha256":"06d29bcf193b55e4733155e56bd943222972407781c28a37abf2bbb09b8be4ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"ScCore.dll","sha256":"860285698dc76d1bf6f557101e139e89ea11834a776f62d7e7d9954587a04b0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"ahclient.dll","sha256":"48263a31215fc3f28b2f53dfb643ecfd0bc70b3d065b34b94ef6d4cd788e0e33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icucnv71.dll","sha256":"1483436958471fa0e5e0898fc2b2d1d55b04db541bdb74ca1c5b59807987f6fd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icuuc71.dll","sha256":"8d4313a6f8508b28d922d12e5ffb192250951e0466efa7330cc2318a6ea0a8a1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"MSRMSPIBroker.exe","sha256":"abe2c1bd3ecf0f8c4b0ce9a37df39da794b14fb32f2023818d84c8566b6885b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"rt3d.dll","sha256":"2af55c9750bcbcec56a806930fdc37c6d1002973df8670efc686edd499a5b40a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AIDE.dll","sha256":"78c406693f8dedb7550892fd9234fa9fb3bcb7017c50424a6980283f914eb567","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Acrobat.exe","sha256":"2d45965593ac3975c2a820d5f1ab3c9a701352aef2ad735bdd81a2c0752615f1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Aiod.dll","sha256":"624cb6b538110c26430e254c8ceb0124afd52560245604f4ba7122e8b8fecc0e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Adobe Acrobat.lnk","sha256":"4a6bbc147ae74030b0cb4eba95ec03275079bb5dfbf7d089bb567a070c7a4a07","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ar_AE.txt","sha256":"ab65abe1b2d292eb98f7b01ca5b5a460d4d66f7b2e20595db935edc257d02727","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ar_EG.txt","sha256":"529e065122d0f7a062a29fe79fb16d1d33cf3b85caa52a6e6ccd7309177cbd34","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.bg.txt","sha256":"bf2321f11a983e2de439bf4132ae4c9aa7ca215ff74882aee611090e87bc30d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ca.txt","sha256":"182f39967007e902114a8bb35c12ba92ed08b6b35302230a2c1a0c734cdb1694","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.cs.txt","sha256":"1e3c42ba2f7b96b3f3774c1fcf3a367b281f4c3a9794b58b0b8b1781c0e26015","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.da.txt","sha256":"16edaf6158ce0824f8e56abcb0459c4152e7e7f49a94ae3889c152c32575b4ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.de_CH.txt","sha256":"319d0d473845a1c299950212b59bf3d638a8b65827200bf94e2c5401848670ce","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.de_DE.txt","sha256":"903dd02d71be59691cf77aa5d19de9af0de6cace757409280ec813f27299c9ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.de_DE_PREEURO.txt","sha256":"be66acf17ed667636a3c824e602da907cd48ca04b2bb41dca024ca92394d5981","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.el_GR.txt","sha256":"2771a725a0b1c04f4285f96f3741b19a59ba218321b3d2b3a674db509ec114f9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.el_GR_PREEURO.txt","sha256":"3570595fc1f25a38a8f1b45bd45cd2c3dad7e41a897e73863eb703489645727e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.en_US_POSIX.txt","sha256":"3dd21e0ba84bfc31ca439ba3306ba26760684626b18e72ae1a2adcffe01c2f6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.es.txt","sha256":"56217e944ac45fcb1542987dc5733b60adaade527946dd1a0549315c2f9cc35b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.es_CO.txt","sha256":"a21f3ac5ef655127d6896ea9ee836436820120b84fabcb37929df178cbcb13ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.es_EC.txt","sha256":"8d8f752c2b91104a4ec6fc180aaae3f0011204ba7d1882631d04d159cc24553f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.es_ES.txt","sha256":"9dfbf0b85d3e82bcc69f4b5bed439b7e07b18d039aa62bead4ece48cf55b7ed1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.es_MX.txt","sha256":"7330705d783ca01437302e3f84b656970d5866c99d2a58dbd2d901c33f1f8856","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.es_NI.txt","sha256":"97a9072623b952fdb0022a42aea8b1bfbc584b8b48714ffba48f5e0a74100e03","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.es_PY.txt","sha256":"20995e244722deb156ac6b4158bf7a85d92801890397faf51e3fa9cda60e880a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.et.txt","sha256":"99ded58e6f1691ad01b0cf8d4798cad811683da74db3c41937356387d6796377","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.fi.txt","sha256":"a1b36909f3ef1924257c85f9835662dbd983d68a227101942d2b3a5d47034131","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.fi_FI_PREEURO.txt","sha256":"1736aedb5210fd4e2d095c367bd39e76759ef4fff1e388beba4c7f0ab6ddaf59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.fr_CA.txt","sha256":"f03431aaf42cb7fa573e913c416bd2450cddbf77df495f6102a28ea18ab9a4c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.fr_FR.txt","sha256":"35bccd0ea3f3422cdf973a536f6828eb70c19048a7ca5e057398c270c445ff54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.fr_FR_PREEURO.txt","sha256":"39ed81735c2126b91188bdfac330d7c5837891d1c452a6f72eae0d596caa1672","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.he.txt","sha256":"ae2fad894469a01d18aa2f94638b76cf14ee0c67ae4d660f32914a033a5237f5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.hr.txt","sha256":"e35c70aec77e61485333dec1fc3c60f70d3510c2a3c3e13e9fbed3e9f1d393e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.hu_HU.txt","sha256":"aeead7eb4e30ec69fc26f5f010bbeabd28a861024419817690602965c83b40d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.it_IT.txt","sha256":"3cfef57f8b4ed4af1f405034261f7c662adb61f11c43168ea715722c8a07c77b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.it_IT_PREEURO.txt","sha256":"b9bed86d4ddba0132d1b7703c12ecf465f3eb843537728c2ba74f4c85d8d6553","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ja_JP.txt","sha256":"4db58c0e60f5ac7980ec5feb102c5403e62133d08aca569c264bccf50eee8fd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ja_JP_TRADITIONAL.txt","sha256":"1d2979b73c0db069f70776218abb919ffae11a3193bbd97d78ab39a9fcb6d6ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ko.txt","sha256":"b44b8cd12e08eda061d6bb7d4fd8e745fa0be298590cde919b6c8730d4e4e37f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.lt_LT.txt","sha256":"fdd45c211b3d35ab624132ecb75672821b46cc76d2314c5bdffa844be7059265","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.lv_LV.txt","sha256":"419a888bf15c175803a1271410f2e641a85ac103ffb7d07909059053e6f3881d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.nb.txt","sha256":"83db3fe974dbee5caf7080da599d70d5b7adbde4ea8eaaa19b23c966fc6e38fa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.nl.txt","sha256":"3b3ce9f1ca53c9b7f39d8f5991577618b2d84f65789c137ef9201c48e8d1aa3c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.nl_BE_PREEURO.txt","sha256":"713b50bcfed16155fb3193d41d535160d4e11a3ad89e2cd92e503bb5f745e8f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.nn_NO.txt","sha256":"9f49a7c805e674a4986f4996c69a168d7c1a169cbd9a79e227a0e619b11924cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.pl.txt","sha256":"d2d25e4775a5390729341ef606882eecf5df0991f1db2cf2eb4ec69e09ad74ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.pt_BR.txt","sha256":"09eea193c6515100f510eb8e4a6e7cade378a0bb4adaa67949ef6d66c836f07a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.pt_PT.txt","sha256":"bf800ff5f8fec55ef156faec26561c04f2d63998bce74ae4347253f23e8c8b7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.pt_PT_PREEURO.txt","sha256":"d752dfd8f4ca57b724ad86612a61cd008bc89137d3713e9daa4ec533c156e5f4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ro.txt","sha256":"3cb61abd974c39ad748384b769fa745cd735c0e1f0504667de44df61bc961331","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ru_RU.txt","sha256":"a34b24bd621518abf3bf691207ed0621f05788ac51adbcff8532ee161ac16638","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.ru_UA.txt","sha256":"3f01e795332f75308b66a5201c740c9eaf3884c35d5aef9499e2178c89134e93","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.sk_SK.txt","sha256":"6cc46a0c213f66bd16a2e67cc9fc914214f98c8cf86b410eaa5355a8b500b5ec","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.sl_SI.txt","sha256":"65786622a5adddfdc5576b964a5f40095792ac46212ef2c429e61d35367c8b8c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"DisplayLanguageNames.sv_FI.txt","sha256":"2a3c5662a0a300531f72ab0baba0ed18416e81524a6c2f6c4d0992e819363f90","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AdobeHunspellPlugin.dll","sha256":"31978034e53b8c11cc741a2b02142e1fa34b056a67f266308eaf69e1cd569c2f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"SingleClientServicesUpdater.exe","sha256":"20903ba8bf28162f14c2e8f35886dc727285f1ffbb61cca47663a39a5409845e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"libEGL.dll","sha256":"4a8796b200241fc7b7eba815a17c0640f049fa02b6244b4cb5fcac55072b0d68","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"libGLESv2.dll","sha256":"f1dbffaafa6eeddd8d9d7b335a487a8503cabaa2f58d7db39a9da5f8311941ed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Acrobat.dll","sha256":"b309c0068b4abbe3522bbfa4372e511bb1f222675a002771b81b9bedb5c3fc94","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AcrobatRes.dll","sha256":"477ae6b5893ae81b7b437aaef66795e3cf96d327a2dea239ac530b30202327fe","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"AdobeCollabSync.exe","sha256":"b754272abca97360fae64d775c01a9ea2d509b99262d35d5377bb6580a1fbcda","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icucnv58.dll","sha256":"141bdbce2ebb8fe1cd7cfc9c7beb689e62effde9d323d4c3427dfeb508c107e0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icucnv67.dll","sha256":"9d1efc68cf19e22f0f7a97ed71a87686765dd9a7f76cfd037551e0ea195af0da","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icucnv69.dll","sha256":"dc2fe2ae65b43d52b58f576a0d63f0a6b2e69771a1ac23b17ef0c0172323c5e8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icudt58.dll","sha256":"0dab18a1dc69a9322cd1115ac25c7571121bce9eeb96beaa254c82e69bfc4029","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icudt67.dll","sha256":"79eb18e572dc94c3b281ef4f92dd7bd4e9c6cc157261935584a946ee8ced6a17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icudt69.dll","sha256":"374875795caed2f6760b5c1260c2126bd4e5d630d0be399deb6fe1d86b623dab","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icudt71.dll","sha256":"26a4a69a135acc1671055e13b94178c123f59ab73396a2e65b5957a62fcb3d16","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icuuc58.dll","sha256":"7407db59809513e1fbee036904573414ded24b2d976f4eb3717da2a5dc23843f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icuuc67.dll","sha256":"7e28b3598d0c77294228664ff80d0a830c8e8e2490e48266102f4d5fcee04030","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"icuuc69.dll","sha256":"7e98416fd71111ee9997c6373b8b30d0a017e3f7cb0a114d3e39ad251c9972e3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"fab4d.msp","sha256":"c7bcd1643cd1309667bfaf00aef71edfcc5b32c6034ef2d9b9928e08a21c8754","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]}],"files_written":[{"path":"%WINDIR%\\SysWOW64\\Elevation.tmp","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\AcroCEF.exe","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\cef.pak","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\cef_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\cef_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\cef_extensions.pak","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\chrome_elf.dll","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\COPYING.LGPLv2.1.txt","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\libcef.dll","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\LICENSE.txt","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\resources.pak","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\SingleClientServicesUpdater.exe","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\swiftshader\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\swiftshader\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\acrocef_1\\vulkan-1.dll","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\WebInstaller\\JOIKRJXVTBGVXKAT.7z","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\css\\manifest.min.css","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\AdobeCleanUX-Bold.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\AdobeCleanUX-BoldIt.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\AdobeCleanUX-It.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\AdobeCleanUX-Light.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\AdobeCleanUX-LightIt.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\AdobeCleanUX-Medium.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\AdobeCleanUX-MediumIt.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\AdobeCleanUX-Regular.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\KeplerStd-Bold.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\KeplerStd-Regular.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\MyriadPro-Bold.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\MyriadPro-Light.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\MyriadPro-Regular.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\fonts\\MyriadPro-Semibold.otf","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\FAB-blue.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\FAB.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\FAB2.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\GreyToast.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\accordion-chevron.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\alert_icon.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\arrow-back.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\caret-comment.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\checkmark_icon.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\chevron-down.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\chevron-next.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\chevron-prev.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\close-blue.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\close-white.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\close.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\comment-response.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\comments.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\drawing-comment-selected.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\drawing-comment.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\end-of-content.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\end-of-document-checkmark.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\feedback-fab.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\fix-content-icon.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\floating-sticky-note-selected.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\floating-sticky-note.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\free-text-comment-selected.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\free-text-comment.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\insert-text.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\menu.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\menu_collapsed.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\menu_expanded.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\pull-ring.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\share-feedback-icon.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\sort-asc.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\sort-desc.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\spinner.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\stacked-annotation-marker.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\stamp-comment-selected.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\stamp-comment.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\images\\sticky-note.svg","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\js\\manifest.min.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\js\\vendor.min.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\manifest.json","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\OWP\\default\\version.txt","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\WebResourcesFileList.txt","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\connectors.50ad97c73e0966a79c21.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-core.css","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-core.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-discovery-versions.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-discovery.50ad97c73e0966a79c21.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-extras.css","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-extras.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-mobx.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-spectrum-v2-dark.css","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-spectrum-v3-core.css","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\dc-spectrum-v3-core.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\network-api.50ad97c73e0966a79c21.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\private\\dc-core-dev.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\__VERSION__\\private\\dc-sdk-dev-manifest.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\commit.txt","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-app-launcher.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\04ddbdff6396d98807bc0b6a4af1938c.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\054604b583f790db3d88e79d2a46053a.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\071c3429d4900e9a5c0d4e2105ccf1c2.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\0c9bbbe7a01f43c8a2c084d4926a8785.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\10183dbdb7f6ddc14c3d11e23fdcb801.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\113-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1190-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1251-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\13bcd9268e467d26968d08244b33bb75.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1508-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1536-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1688-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\16ad92e4238a34dcad4445d22a37375d.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1708-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1731-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1737-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1740-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\179f135ab98d015965571a3d585f8c8f.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1870-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1964-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1a6230cb67d287167c9d7840a2a93726.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1b4bf50844144c4d25af0802a87bfcc6.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\1d714a210812a273106b42886efe3e7c.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2028-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2054-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2174-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\229192ba6f3c6a8d242464d646d4ad63.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2458-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2470-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2535-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2673-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2759-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2785-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2849-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2872-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\2971-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\305-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3150-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\317-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3210-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3236-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3312-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3410-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3440-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\355f832ee6b21ce50f0d326b48af976f.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\35a7ebfd74ed1cfe52df58045fcabeb7.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\35dbcd895c8f185048e010053cc1453e.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3602-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3649-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3674-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3797-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3997-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\3f4abb393c84a8457c2a851254dc6098.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4006b5ed31eacedf8d8258880b07db5e.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4032-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4087-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4109-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\412f0b8552e4fc91615f8d5826b0a4bb.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4293-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4314-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4382-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\440-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4431-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4439-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4486-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\454-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4589-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4622-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4690-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\472-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4724-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4808-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4870-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\487257616d0f8cc90f526562e22c2212.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4954-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4d84a2986e8cc1a926cb70b7af415b0b.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\4dddbe6058a486f7048673e4b143f7c4.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5038-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5057-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5061-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5093-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5142-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5179ed92ee3747f3e48462272767fad1.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5193-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5251-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\541-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5486-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5555-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5589-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5699-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\57245c79de4d81c5051e03c81ccbfd6e.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5747-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\57686c0e32e1983d524fb6f8d46ca8c7.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5901-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\592-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\5938-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6116-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6223-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6313-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6491-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\663-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6682-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6700-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6710-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6753-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6764-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6811-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6823bdac587ae224bf36689600281a69.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6945-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6b0215ed0a09075330a1c6dd3dbfba1d.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6bb09869a6cfe2a88aae68256d9456e3.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\6f43d8c6da907e34ab2028ef15733412.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7001-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\70d1c517fdc50fc1a8d9d245346cab45.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\70e97e38126b7f50d16492b630f6da39.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7106-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7279-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7363-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7374-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7403-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7407-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7422-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7486-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7555-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7654-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7754-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7953-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7bb91b087a12387438e619aaf1328444.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\7ec969a62598fbfa1ee1eb8827a0f2e5.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8005-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8009-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8210-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8220-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8317-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8343-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8389-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\83bf4cfa63b712c6973a0d510a7b2c99.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8459-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\84a9e9b186d237170b308e2861a92439.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8534-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\862f2d099f44260961f4feebcc7540db.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8750-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\8767-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\889-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9066745ff44b689b5cc89c3d73970f01.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9105-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9216-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9230-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9254-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\92bfb68adb54a6ec950196b4d39ccf3e.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9354-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\94586e68acdb466ee174533182bdd003.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9541-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9544-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9548-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9565-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\963-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9693-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9741-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9764-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9783-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9879-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9887-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\993d5e1182337aea2dc0c7fc02081e4e.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9b1662bee64658ff8dd184737a056510.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9cf312c3c24ca9bd76eef9006093b855.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\9e19407369e483c99423893573b2f900.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_AccessAllTools.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_AddCustomPage.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_ApplyRedactions.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_ConnectCloudStorage.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_FillAndSignYourForm.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_FindAndShare.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_GetOthersToSign.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_GetStartedWithANewFile.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_MakeChanges.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_PrepareAForm.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_RedactPDFContent.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_ReorderPages.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_SaveReadOnlyCopy.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_SeeMenuOptions.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_ToggleNewInterface.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2022_WorkFromAnywhere.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q3_2023_DesignTools.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\Q4_2023_FindAndUnifiedShare.webm","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\a56350ec5a5b310e9f4c7e10e0b6795c.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\ab27b355502b23edc57dcc465635c3f5.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\aeb395721669989da11ef27e12326099.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\af3703f1c09def743af441dcfe427d87.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\b37768e179fcef2033e10c7d3516976a.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\b71127bc670d9b8e7ced6702908c6e93.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\b727905a76d9d3092723209056f3d04b.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\b961cde276c90015f1db51975a470747.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\b99178ba996d2b4a255b0f163dcb88ce.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\bbdf77f7288246bb7e1bf5ea2b535a29.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\bf200d2f5c6028eb692ee8e37c38154c.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\bootstrap.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\c019dd24cfcb24d2a172b44cfb1a3cd7.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\c124efa99176e538252a2ae3cef2137e.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\c5519ac862b35cb47df89e4249300542.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\c6534465ea418b6c252e2b74bc9e4bbb.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\c9633b5c9078c5ddc420a5c1cd0d65f3.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\d39588e1483de570aa44e8688a3029ac.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\d4929c331be8d6c9d6b54e91a6d0501b.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\d53a7981ae278f0198a65e1f56ba6bf1.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\db3460ac8568d0137d4556570169e475.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\dc3b5d449449a5103f90189b239c0bf6.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\de8aa8c5f8b25d655a90ad391e511c51.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-ExpressError-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-RMUpsellCard-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-SignCrossSellCard-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-ccx-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-ccxfeedback-popups-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-editsettings-popups-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-enhance-popups-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-extract-popups-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-filepicker-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-help-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-intentCapture-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-popups-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-readerRhp-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-rsfeedback-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-rsmanagerecipients-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-rspresendreview-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-signsettings-popups-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-split-popups-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-switchtolegacy-modals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-unifiedShare-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-upsellmodals-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-verbs-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-videoplayer-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\desktop-walkthrough-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\e09fe99c378ee2229c1b17bc2c18f1ba.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\e168092f77e2eb633f9cdcf2117fe38c.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\e431c5944271795b3942c436ce94d08f.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\e45cbf834b99fad6932c01af6ac387ba.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\e6471ae32d0fb3010ded38e4e06b1687.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\e992b56b1dc8ca33be3e4952595d5208.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\edit-verb-object-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\edit-verb-text-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\fe948af7682d6afc8b70f200bc83e0d8.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\ffd2c3413726d897af82575d8596acdd.png","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-ca-ES-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-cs-CZ-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-da-DK-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-de-DE-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-en-AE-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-en-GB-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-en-IL-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-en-US-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-en_AE-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-en_IL-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-es-ES-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-eu-ES-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat DC\\Acrobat\\WebResources\\Resource2\\app1\\dc-desktop-app-dropin\\1.0.0_1.0.0\\translations-fi-FI-json-chunk.js","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\INSTALLER\\{AC76BA86-1033-1033-7760-BC15014EA700}\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CITRIX\\WFSHELL\\TWI\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\ACROBAT\\SHELL\\OPEN\\DDEEXEC\\APPLICATION\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\ACROBAT2018\\SHELL\\OPEN\\DDEEXEC\\APPLICATION\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\ACROBAT2019\\SHELL\\OPEN\\DDEEXEC\\APPLICATION\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\ACROBAT2020\\SHELL\\OPEN\\DDEEXEC\\APPLICATION\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\EDGE\\NATIVEMESSAGINGHOSTS\\COM.ADOBE.ACROBAT.CHROME_WEBCAPTURE\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\ADOBE ACROBAT\\DC\\INSTALLER\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\ACROBAT\\SHELL\\OPEN\\COMMAND\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\CLASSES\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\ADOBE ARM\\1.0\\ARM\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\ADOBE ACROBAT\\DC\\WEBRESOURCE\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\ADOBE\\INSTALLER\\{AC76BA86-1033-1033-7760-BC15014EA700}\\","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\ADOBE ARM\\ADOBE ARM","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\ADOBE ARM\\1.0\\ARM\\ILASTSVCFAILURE\\ILASTSVCFAILURE","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\ADOBE ARM\\1.0\\ARM\\ILASTSVCERRORCODE\\ILASTSVCERRORCODE","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\ADOBE\\ADOBE ARM\\1.0\\ARM\\ISVCERRORCOUNT\\ISVCERRORCOUNT","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]}]},"mutex_activity":{"mutex_created":[{"name":"InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Local\\SM0:8164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"Local\\SM0:8164:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"SM0:8164:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8164:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\InternetShortcutMutex","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8164:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8164:120:WilError_03","sources":[{"report_type":"sandbox","report_id":"6592e28a0ec40a5ce90de2bf"}]}]}},"report_ids":{"sandbox_job_ids":["6592e28a0ec40a5ce90de2bf"]}}}]