24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Reconyc Sample 1ad53f5ff0a7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1ad53f5ff0a7…. Malware family: Trojan.Reconyc. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d","keywords":["Malicious","Trojan.Reconyc","malware analysis","sandbox report","threat intelligence","1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d"],"about":{"@type":"SoftwareApplication","name":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.exe","applicationCategory":["peexe","executable"],"identifier":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Reconyc","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T921,"RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00010380-00003776-00000046-41942009251 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALN.TTF" at 00010380-00003776-00000046-42052359492 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ariali.ttf" at 00010380-00003776-00000046-42061628513 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNI.TTF" at 00010380-00003776-00000046-42071318605 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00010380-00003776-00000046-42079976406 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00010380-00003776-00000046-42096603252 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00010380-00003776-00000046-42109148410 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNBI.TTF" at 00010380-00003776-00000046-42118899680 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ariblk.ttf" at 00010380-00003776-00000046-42129149973 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuil.ttf" at 00010380-00003776-00000046-52189406389 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\SEGOEUISL.TTF" at 00010380-00003776-00000046-52200041211 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00010380-00003776-00000046-52208373268 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuii.ttf" at 00010380-00003776-00000046-52217606827 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\seguisb.ttf" at 00010380-00003776-00000046-52227542866 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00010380-00003776-00000046-52235366832 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuiz.ttf" at 00010380-00003776-00000046-52244230736 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\times.ttf" at 00010380-00003776-00000046-52262872634 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesi.ttf" at 00010380-00003776-00000046-52271752077 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00010380-00003776-00000046-52279912969 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesbi.ttf" at 00010380-00003776-00000046-5229065540926:T472,".exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Adobe Acrobat Document" (Path: "HKCU\WOW6432NODE\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "UsersFiles" (Path: "HKCU\WOW6432NODE\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\WOW6432NODE\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") ".exe" touched "Shell File System Folder" (Path: "HKCU\WOW6432NODE\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "RdrCEF.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\WOW6432NODE\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}")27:T512,"RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 2911744) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 2911744) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters" (Filter: 15; Subtree: 4979969) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters" (Filter: 15; Subtree: 4979969) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Dnscache\Parameters" (Filter: 15; Subtree: 1950229505) "RdrCEF.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 49085697) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 49085697) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 49085697) "RdrCEF.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 49079809)28:T557,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "C:\Windows\SysWOW64\shdocvw.dll" ".exe" touched file "C:\Windows\SysWOW64\en-US\shdocvw.dll.mui" ".exe" touched file "C:\Windows\SysWOW64\en-US\setupapi.dll.mui" ".exe" touched file "C:\Windows\SysWOW64\en-US\propsys.dll.mui" ".exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" "AcroRd32.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "AcroRd32.exe" touched file "C:\Windows\SysWOW64\en-US\user32.dll.mui"29:T40e,".exe" wrote 32 bytes to a remote process "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" (Handle: 532) ".exe" wrote 52 bytes to a remote process "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" (Handle: 532) ".exe" wrote 4 bytes to a remote process "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" (Handle: 532) ".exe" wrote 8 bytes to a remote process "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" (Handle: 532) ".exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sysctfmon.exe" (Handle: 212) ".exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sysctfmon.exe" (Handle: 212) ".exe" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sysctfmon.exe" (Handle: 212) ".exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\sysctfmon.exe" (Handle: 212)2a:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==2b:T59c,--type=renderer --primordial-pipe-token=257CA9848491FADACF37A9D1B4F985D9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=257CA9848491FADACF37A9D1B4F985D9 --renderer-client-id=2 --mojo-platform-channel-handle=1260 --allow-no-sandbox-job /prefetch:12c:T59c,--type=renderer --primordial-pipe-token=3C78A7660E8FAE1F14596F70A518F23E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=3C78A7660E8FAE1F14596F70A518F23E --renderer-client-id=3 --mojo-platform-channel-handle=1320 --allow-no-sandbox-job /prefetch:11b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791547078269,"unified_at":"2026-10-09T11:57:58.269Z","metadata":{"hashes":{"sha256":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d","sha1":"7012195c8c6aca88e2d805d632f148f74f0b6e64","md5":"51d0fb0bbd2914e73599e3b8c434d802","sha512":"c019ad697403088986663fdad398a74a0fdc15869ba18965cf74ac14693542d1e5aa13a81003f534879d8d10aefd5f22f8dabfdd8f82784df71c45b6ee38f8ff","ssdeep":"6144:R51Ov0zuiNVwlkhG/zaRmNLpvHNGdTfCMl3EelDdso:zgiHwl8G/zSCL5NGdTKMt","ssdeep_chunks":["6144:R51Ov0z","6144:51Ov0zu","6144:1Ov0zui","6144:Ov0zuiN","6144:v0zuiNV","6144:0zuiNVw","6144:zuiNVwl","6144:uiNVwlk","6144:iNVwlkh","6144:NVwlkhG","6144:VwlkhG/","6144:wlkhG/z","6144:lkhG/za","6144:khG/zaR","6144:hG/zaRm","6144:G/zaRmN","6144:/zaRmNL","6144:zaRmNLp","6144:aRmNLpv","6144:RmNLpvH","6144:mNLpvHN","6144:NLpvHNG","6144:LpvHNGd","6144:pvHNGdT","6144:vHNGdTf","6144:HNGdTfC","6144:NGdTfCM","6144:GdTfCMl","6144:dTfCMl3","6144:TfCMl3E","6144:fCMl3Ee","6144:CMl3Eel","6144:Ml3EelD","6144:l3EelDd","6144:3EelDds","6144:EelDdso","12288:R51Ov0z","12288:51Ov0zu","12288:1Ov0zui","12288:Ov0zuiN","12288:v0zuiNV","12288:0zuiNVw","12288:zuiNVwl","12288:uiNVwlk","12288:iNVwlkh","12288:NVwlkhG","12288:VwlkhG/","12288:wlkhG/z","12288:lkhG/za","12288:khG/zaR","12288:hG/zaRm","12288:G/zaRmN","12288:/zaRmNL","12288:zaRmNLp","12288:aRmNLpv","12288:RmNLpvH","12288:mNLpvHN","12288:NLpvHNG","12288:LpvHNGd","12288:pvHNGdT","12288:vHNGdTf","12288:HNGdTfC","12288:NGdTfCM","12288:GdTfCMl","12288:dTfCMl3","12288:TfCMl3E","12288:fCMl3Ee","12288:CMl3Eel","12288:Ml3EelD","12288:l3EelDd","12288:3EelDds","12288:EelDdso","6144:zgiHwl8","6144:giHwl8G","6144:iHwl8G/","6144:Hwl8G/z","6144:wl8G/zS","6144:l8G/zSC","6144:8G/zSCL","6144:G/zSCL5","6144:/zSCL5N","6144:zSCL5NG","6144:SCL5NGd","6144:CL5NGdT","6144:L5NGdTK","6144:5NGdTKM","6144:NGdTKMt"],"imphash":"5070bc131eaceacf130fad7e64227b5c"},"file_info":{"file_name":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":263680,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1551080161000,"last_seen":1604830824000,"last_multi_scan":1604830824000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["infostealer","kimjongrat","rat"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":22,"suspicious_count":18,"malicious_count":6,"total":46},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Reconyc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.263680.362","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.561039","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.561039 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Generik.BPQAHBJ trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Reconyc.ecwn","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic Dropper.aow","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Reconyc.dtmjwa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Threat-Generic://Malicious-Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"malicious","threat_name":"Trojan.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Reconyc.263680.B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Reconyc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Reconyc","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"suspicious","value":"Scans for the windows taskbar (may be used for explorer injection)"},{"type":"informative","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00009658-00004060-3964-60-010D223A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00009658-00004060-3964-15-010D1B06","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RtlDecompressBuffer@NTDLL.DLL at 00009658-00004060-3964-18-010D15A0","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00009658-00004060-3964-8-010D2428","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\"; Key: \"PATH\"; Value: \"00000000010000006E00000043003A005C00500072006F006700720061006D002000460069006C00650073002000280078003800360029005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\U.S. Nuclear Deterrence.pdf\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R9axihz_1hnxabs_2hc.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9Rajl0o3_1hnxabt_2hc.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R2lhl4e_1hnxabu_2hc.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9Rh63o_1hnxabv_2hc.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R1ijrfux_1hnxabw_2hc.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"DBWinMutex\"\n \"Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC\"\n \"com.adobe.acrobat.rna.RdrCefBrowserLock.DC\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"AcroRd32.exe\" (UID: 00009917-00003216) was launched with new environment variables: \"MEOW=\"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\\"\"\n Process \"AcroRd32.exe\" (UID: 00009917-00003216) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"RdrCEF.exe\" (UID: 00010380-00003776) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins;%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\;%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\test_tools\"\"\n Process \"RdrCEF.exe\" (UID: 00010380-00003776) was launched with modified environment variables: \"CommonProgramFiles, PROCESSOR_ARCHITECTURE, ProgramFiles\"\n Process \"RdrCEF.exe\" (UID: 00010380-00003776) was launched with missing environment variables: \"MEOW\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"\n \"AcroRd32.exe\" searching for class \"ACROSEMAPHORE_R18\"\n \"AcroRd32.exe\" searching for class \"JFWUI2\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AcroRd32.exe\" with commandline \"\"%TEMP%\\U.S. Nuclear Deterrence.pdf\"\" (UID: 00009917-00003216)\n Spawned process \"sysctfmon.exe\" (UID: 00009918-00003152)\n Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00010380-00003776)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=8DE83B6BB3BE3FACC44D9952 ...\" (UID: 00010637-00002296)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=C38AB883CA4180CF0FB444FF ...\" (UID: 00010666-00001056)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AcroRd32.exe\" with commandline \"\"%TEMP%\\U.S. Nuclear Deterrence.pdf\"\" (UID: 00009917-00003216)\n Spawned process \"sysctfmon.exe\" (UID: 00009918-00003152)\n Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00010380-00003776)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=8DE83B6BB3BE3FACC44D9952 ...\" (UID: 00010637-00002296)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=C38AB883CA4180CF0FB444FF ...\" (UID: 00010666-00001056)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"RdrCEF.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"svchost.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"sysctfmon.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"A9R9axihz_1hnxabs_2hc.tmp\" has type \"data\"\n \"A9Rh63o_1hnxabv_2hc.tmp\" has type \"data\"\n \"A9Rajl0o3_1hnxabt_2hc.tmp\" has type \"data\"\n \"A9R2lhl4e_1hnxabu_2hc.tmp\" has type \"data\"\n \"U.S. Nuclear Deterrence.pdf\" has type \"PDF document version 1.5\"\n \"sysprep.ocx\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"data_1\" has type \"data\"\n \"Visited Links\" has type \"data\"\n \"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl\" has type \"data\"\n \"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"level":"informative","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$27","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://schemas.microsoft.com/SMI/2005/WindowsSettings\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"RdrCEF.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"svchost.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"RdrCEF.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"RdrCEF.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc\n .rsrc with unusual entropies 7.99907226194\n 7.91836996304\n 7.84311381228","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to measure performance","description":"rdtsc at 15320-140-004064AE","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-6","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 3996) slept \"504\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RdrCEF.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"AcroRd32.exe\" allocated at least 16972 KB of consecutive memory with 106 calls","origin":"API Call","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00009658-00004060-3964-18-010D15A0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Searches\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Videos\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Pictures\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Contacts\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Favorites\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Music\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Downloads\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Documents\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Links\\desktop.ini\"\n \".exe\" read file \"%USERPROFILE%\\Saved Games\\desktop.ini\"\n \".exe\" read file \"C:\\Users\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\", Handle: 532), \".exe\" is creating a new process (Name: \"%APPDATA%\\sysctfmon.exe\", Handle: 212), \"AcroRd32.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\", Handle: 1068), \"RdrCEF.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\", Handle: 1360), \"RdrCEF.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\"\n Handle: 1444)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"svchost.exe\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"sysctfmon.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"sysprep.ocx\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\".exe\" opened \"\\Device\\MountPointManager\"\n \"AcroRd32.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"level":"suspicious","category":"Network Related","name":"Reads the hosts file","description":"\"RdrCEF.exe\" read 65536 bytes from file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"\n \"RdrCEF.exe\" read 61440 bytes from file \"%WINDIR%\\System32\\drivers\\etc\\hosts\"","origin":"API Call","relevance":10,"id":"api-33","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.exe\" marked \"%APPDATA%\\44444\" for deletion\n \"C:\\1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.exe\" marked \"%APPDATA%\\sysctfmon.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%APPDATA%\\44444\" with delete access\n \".exe\" opened \"%APPDATA%\\sysctfmon.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"svchost.exe\" claimed CRC 39903 while the actual is CRC 301210\n \"sysprep.ocx\" claimed CRC 84910 while the actual is CRC 60813","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryW\n IsDebuggerPresent\n GetTickCount\n VirtualProtect\n LoadLibraryA\n LockResource\n UnhandledExceptionFilter\n GetProcAddress\n GetStartupInfoA\n GetModuleHandleW\n TerminateProcess\n FindResourceW\n Sleep\n VirtualAlloc\n RegCloseKey\n StartServiceCtrlDispatcherA\n RegOpenKeyExA\n CreateThread\n GetModuleFileNameW\n GetTempPathW\n GetTickCount64\n CreateProcessW\n DeleteFileW\n CreateServiceW\n CopyFileW\n CopyFileA\n GetVersionExA\n DeleteFileA\n GetTempPathA\n GetModuleHandleA\n FindFirstFileA\n FindNextFileA","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"711157007a3b5600ab8b02007f950200fc8c0200729602006cc805001ecd53007d265300\" to virtual address \"0x76B507E4\" (part of module \"USER32.DLL\")\n \".exe\" wrote bytes \"f811dd752014dd750c11dd75f516dd75a911dd758548dd75b934dd75a934dd756834dd7500000000a56bbc75e485bc75e04dbc759cc0bc75a3bfbc7592aebc750c7dbc7500000000\" to virtual address \"0x72D91000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"36/69 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"36/69 Antivirus vendors marked sample as malicious (52% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"6/66 Antivirus vendors marked dropped file \"svchost.exe\" as malicious (classified as \"Trojan.Agent.37888\" with 9% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/70 Antivirus vendors marked spawned process \"AcroRd32.exe\" (PID: 3216) as malicious (classified as \"Worm.Kolab\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\explorer\\FileAssociation\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$29","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"sysprep.ocx\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"explorer.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":163,"dropped_files_count":0,"extracted_files_count":24,"files_written_count":292,"files_deleted_count":0,"registry_keys_created_count":14,"registry_keys_modified_count":0,"registry_keys_deleted_count":13,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":27,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["infostealer","kimjongrat","rat"],"sample_flags":["Multi-Process","Extracted Files","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"5c7398f10288380d985b4294","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Reconyc","submit_name":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.exe","analysis_start_time":"2019-02-25T07:19:13+00:00","indicators_count":{"informative":17,"suspicious":23,"malicious":9},"tags":["Multi-Process","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"5c7398f0038838a11725dd6a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Reconyc","submit_name":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.exe","analysis_start_time":"2019-02-25T07:19:14+00:00","indicators_count":{"informative":21,"suspicious":18,"malicious":7},"tags":["Multi-Process","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}],"processes":[{"pid":4416,"ppid":0,"name":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.exe","command_line":"","sha256":"1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d","normalized_path":"C:\\1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d.exe","uid":"00010002-00004416","icon":"$2a"},{"pid":732,"ppid":4416,"name":"AcroRd32.exe","command_line":"\"%TEMP%\\U.S. Nuclear Deterrence.pdf\"","sha256":"2e9b9635469ff056f09023f7d671120d0c0f86f30767b06daa545c01242bcbef","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","parent_uid":"00010002-00004416","uid":"00010308-00000732"},{"pid":3048,"ppid":732,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00010308-00000732","uid":"00010862-00003048"},{"pid":2056,"ppid":3048,"name":"RdrCEF.exe","command_line":"$2b","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00010862-00003048","uid":"00011127-00002056"},{"pid":4464,"ppid":3048,"name":"RdrCEF.exe","command_line":"$2c","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00010862-00003048","uid":"00011166-00004464"},{"pid":3348,"ppid":4416,"name":"rundll32.exe","command_line":"\"%APPDATA%\\sysprep.ocx\" RtlShellDecompress","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00010002-00004416","uid":"00010310-00003348"},{"pid":4148,"ppid":3348,"name":"explorer.exe","command_line":"","sha256":"11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a25a","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00010310-00003348","uid":"00010801-00004148"},{"pid":3480,"ppid":4148,"name":"sysprep.exe","command_line":"\"\"","sha256":"de3dfb3617b3e3fabb9f12088e7d2019510915e0ae2397e7f96fe2575cfbf8fc","normalized_path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","parent_uid":"00010801-00004148","uid":"00010904-00003480"}],"all_imported_dlls":["api-ms-win-downlevel-shell32-l1-1-0.dll","AcroRd32.dll","iertutil.dll","nsi.dll","mscms.dll","comdlg32.dll","d3d11.dll","sqlite.dll","normaliz.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","SensApi.dll","kernel32.dll","secur32.dll","nlaapi.dll","dhcpcsvc6.dll","ccme_asym.dll","advapi32.dll","MFC90ENU.DLL","AGM.dll","netprofm.dll","netapi32.dll","wship6.dll","dxgi.dll","ntmarta.dll","userenv.dll","msvcr100.dll","rasadhlp.dll","ccme_base.dll","wow64cpu.dll","sechost.dll","cryptbase.dll","profapi.dll","AcroRd32Res.dll","cryptsp.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","wevtapi.dll","wow64.dll","wow64win.dll","Wldap32.dll","psapi.dll","wlanutil.dll","shdocvw.dll","cfgmgr32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","webio.dll","AXSLE.dll","chrome_elf.dll","MMDevAPI.dll","duser.dll","gpapi.dll","credui.dll","cryptui.dll","samcli.dll","usp10.dll","WSHTCPIP.DLL","version.dll","CoolType.dll","ACE.dll","cryptocme.dll","rpcrt4.dll","msimg32.dll","ccme_ecc.dll","setupapi.dll","rsaenh.dll","libcef.dll","dhcpcsvc.dll","imm32.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","npmproxy.dll","hid.dll","credssp.dll","clbcatq.dll","wtsapi32.dll","oleaccrc.dll","comctl32.dll","devobj.dll","AXE8SharedExpat.dll","ExplorerFrame.dll","mswsock.dll","urlmon.dll","icudt.dll","ntdll.dll","RpcRtRemote.dll","winhttp.dll","dnsapi.dll","WSDApi.dll","AdobeXMP.dll","oleacc.dll","dbghelp.dll","shell32.dll","apphelp.dll","wininet.dll","netutils.dll","KernelBase.dll","dui70.dll","wshqos.dll","DWrite.dll","AudioSes.dll","msftedit.dll","msctf.dll","BIB.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","crypt32.dll","wintrust.dll","sspicli.dll","winnsi.dll","d3d9.dll","api-ms-win-downlevel-version-l1-1-0.dll","ncrypt.dll","shlwapi.dll","ws2_32.dll","msvcr120.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","FWPUCLNT.DLL","lpk.dll","msvcrt.dll","user32.dll","msvcr90.dll","msasn1.dll","winmm.dll","api-ms-win-core-synch-l1-2-0.dll","bcrypt.dll","BIBUtils.dll","dxva2.dll","mfc90.dll","gdi32.dll","propsys.dll","IPHLPAPI.DLL","wsock32.dll","ccme_base_non_fips.dll","srvcli.dll","wkscli.dll","uxtheme.dll","ole32.dll","msvcp120.dll","tzres.dll","GdiPlus.dll","msls31.dll","d3d8thk.dll","wlanapi.dll","dwmapi.dll","ieframe.dll","oleaut32.dll","api-ms-win-downlevel-user32-l1-1-0.dll","AcLayers.dll","ActionQueue.dll","imagehlp.dll","CRYPTBASE.dll","wdscore.dll","KBDUS.DLL","sfc.dll","comsvcs.dll","mtxoci.dll","mpr.dll","msvcp90.dll","linkinfo.dll","atl.dll","sfc_os.dll","powrprof.dll","actxprxy.dll","rpcss.dll","slc.dll","unattend.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"svchost.exe","sha256":"23b7cbda5dbee772401b19019509ba596fc478a77c207abc6eece5726d43d4d1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"U.S. Nuclear Deterrence.pdf","sha256":"71a1eff012f1abd9d632521b4f04725bfcb19b65d56db0e33415a6a3c92bd841","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"sysctfmon.exe","sha256":"8974e88a950ff99691714924b391ba64cde1500c8ff914241e12c62f6c7080c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"name":"sysprep.ocx","sha256":"9c17f68b1d932d16aa83c2ce121c91e52be9686104678d42da2c7a0a4e42f499","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"data_1","sha256":"8e2476504edc1208063cce0d3a697f0f68c8f169db5f235fb393f32d68ab5365","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Visited Links","sha256":"cdb94563c99017ea9eb34642740794033fb48257f3f06df0ab5af0da5f7cbf6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"A9R2lhl4e_1hnxabu_2hc.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"name":"A9R9axihz_1hnxabs_2hc.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"name":"A9Rajl0o3_1hnxabt_2hc.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"name":"A9Rh63o_1hnxabv_2hc.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"9009ab7605c35a2b5121b8b5c966b3c893edba9966925268c45ad05b348671c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Launch Internet Explorer Browser.lnk","sha256":"e21460e4e5046072ef0606dcec28e4afef43457cee75cfd5b6a40b00489e3e31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Acrobat Reader DC.lnk","sha256":"458a4f15a6061309dc1131d0f75db3c8bb5e0035d5961e7311d714b383f7d4ae","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Internet Explorer.lnk","sha256":"d80eb37f880656f21aae41184be648bf92634b55cefd3a90c2eafa9529df3f75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Windows Explorer.lnk","sha256":"02fd46781527c97a9b6d07460d5a4b8fc14aa26a744bcdd610c225509c61873b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Wireshark.lnk","sha256":"7865285e1e6fa117471e38174ac96c4878255faa22ac354141b8121d8d5e89d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Temp.txt","sha256":"8f3c5eb5224e8d17cba1746553650a86f1356449a5eaa2b02eb000b628475125","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"A9R9pyan1_1potww6_kc.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"A9Rp6jq9x_1potww4_kc.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"A9Ruag49u_1potww5_kc.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"diagerr.xml","sha256":"8ade5e7080e6d5337ca9b4bd31c9963dc556406189b53263dd5b37a9fbbba523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"diagwrn.xml","sha256":"8ade5e7080e6d5337ca9b4bd31c9963dc556406189b53263dd5b37a9fbbba523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"setupact.log","sha256":"66a3e0fe05403b44dab3ac12463bb43924fa2159808181666b649a00cbdd2b17","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]}],"files_written":[{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%APPDATA%\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\sysprep.ocx","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32Res.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%TEMP%\\U.S. Nuclear Deterrence.pdf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\Viewer.aapp","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\EPDF_RHP.aapp","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"pipe\\com.adobe.reader.rna.%OSUSER%.DC.0","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeComFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeCMapFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeSysFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\SysWOW64\\KBDUS.DLL","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\File System\\primary.origin","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\crash_reporter.cfg","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\arialn.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\arialnb.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\arialnbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\arialni.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%TEMP%\\A9R9axihz_1hnxabs_2hc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%TEMP%\\A9Rajl0o3_1hnxabt_2hc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%TEMP%\\A9R2lhl4e_1hnxabu_2hc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%TEMP%\\A9Rh63o_1hnxabv_2hc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\css\\home-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\SEGOEUISL.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\segoeuisl.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%TEMP%\\A9R1ijrfux_1hnxabw_2hc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32Res.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\Viewer.aapp","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\iexplore\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\sdfcsdhh.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\iexplore\\Temp.txt","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\StartMenu\\Acrobat Reader DC.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\acrord32","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\acrord32\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\acrord32\\Temp.txt","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\iexplore","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\explorer","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\explorer\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\explorer\\Temp.txt","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Wireshark.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\wireshark","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Wireshark\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\Wireshark\\Temp.txt","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\EPDF_RHP.aapp","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\sysprep\\en-US\\sysprep.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\diagerr.xml","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagerr.xml","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\diagwrn.xml","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagwrn.xml","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\setuplog.cfg","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\setupact.log","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setupact.log","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%APPDATA%\\ntkernel32.dat","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\sysprep","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\KBDUS.DLL","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\cep-plugins\\PIPViewer\\index.html","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\crash_reporter.cfg","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%TEMP%\\A9R1d6v2ss_1potww3_kc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%TEMP%\\A9Rp6jq9x_1potww4_kc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%TEMP%\\A9Ruag49u_1potww5_kc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%TEMP%\\A9R9pyan1_1potww6_kc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%TEMP%\\A9R1wkct7b_1potww7_kc.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\css\\home-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"key":"HKLM\\SOFTWARE\\WOW6432NODE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"key":"HKCU\\\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\CHROMIUM\\\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\CHROMIUM\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{045FC9BE-2BE9-4F09-8B0C-926D7ADDD8F7}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{82FB4D28-8321-4F13-B69F-BA5BA4AD20F6}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\00-00-5E-00-01-01\\","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"5c7398f0038838a11725dd6a"},{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5c7398f10288380d985b4294"}]}]}},"report_ids":{"sandbox_job_ids":["5c7398f0038838a11725dd6a","5c7398f10288380d985b4294"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Reconyc Sample 1ad53f5ff0a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1ad53f5ff0a7…. Malware family: Trojan.Reconyc. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Reconyc Sample 1ad53f5ff0a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1ad53f5ff0a7…. Malware family: Trojan.Reconyc. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1ad53f5ff0a782fec3bce952035bc856dd940899662f9326e01cb24af4de413d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Reconyc Sample 1ad53f5ff0a7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1ad53f5ff0a7…. Malware family: Trojan.Reconyc. Threat score 100/100. 17/27 AV engines flagged this file. 6 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]