26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 25:T424,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample 1be9ae9f607f… — Score 74/100 — Hybrid Analysis","description":"Suspicious verdict for sample 1be9ae9f607f…. Threat score 74/100. 0/28 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1be9ae9f607f89ea29a32e5991330b285884669107b37b2f7dc83bd8256343b4","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","1be9ae9f607f89ea29a32e5991330b285884669107b37b2f7dc83bd8256343b4"],"about":{"@type":"SoftwareApplication","name":"Acrobat.dll","applicationCategory":["pedll","executable"],"identifier":"1be9ae9f607f89ea29a32e5991330b285884669107b37b2f7dc83bd8256343b4","additionalType":"Suspicious sample"},"threatScore":74,"antivirusDetections":{"malicious":0,"total":28},"behavioralIndicators":{"malicious":1,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T155d,Heuristic match: "t^ItFIt.It" Pattern match: "JJJJJJJJ-J.JJ/0J1JJJJJJJJJJJJJJJJJJ23JJ4567JJ8JJJJJ9:;JJJJJ" Heuristic match: "[t\HtCHt.Ht" Pattern match: "http://mapsterizer.corp.adobe.com/cgi-bin/mapsterize.cgi" Pattern match: "http://www.aiim.org/pdfa/ns/id/" Pattern match: "http://www.npes.org/pdfx/ns/id/" Pattern match: "http://www.aiim.org/pdfe/ns/id/" Pattern match: "http://www.gwg.org/ns/gwg_preflight_v1/" Pattern match: "http://ns.adobe.com/pdfx/1.3/" Pattern match: "http://ns.adobe.com/pdf/1.3/" Pattern match: "http://ns.adobe.com/xap/1.0/mm/" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "http://purl.org/dc/elements/1.1/" Pattern match: "http://www.xfa.org/schema/xfa-data/1.0/APIVersion" Pattern match: "http://www.w3.org/1999/xhtmlbr" Pattern match: "http://www.w3.org/1999/xhtmlbody" Pattern match: "http://www.w3.org/1999/xhtmlp" Pattern match: "http://www.w3.org/1999/xhtmlspan" Pattern match: "http://www.w3.org/1999/xhtmli" Pattern match: "http://www.w3.org/1999/xhtmlb" Pattern match: "http://www.adobe.com/security/partners_cds.html" Pattern match: "http://www.adobe.com/store" Pattern match: "http://www.adobe.com/go/thirdparty" Pattern match: "http://www.adobe.com/go/acrobatThis" Pattern match: "http://www.adobe.com/go/accessibility" Pattern match: "www.adobe.com/go/expert_supporthttp://www.adobe.com/go/acrobatusers_comhttp://www.adobe.com/go/acrobat_supporthttp://www.adobe.com/go/acrreaderPu&rchase" Heuristic match: "..&Save Portfolio&PDF Portfolio...Save &a Copy of Portfolio...&PDF Optimizer...Prefli&ght...Remove Hidden &Information...Untitled.pdfI&nsert PagesFrom &File...A &Blank Page...From &ScannerFrom &Scanner...From &Clipboard...E&xtract Pages...&Replace Pages..." Pattern match: "www.*.example.com&Save" Pattern match: "http://www.adobe.com/go/readerThis" Pattern match: "http://www.adobe.com/go/acroba" Pattern match: "www.adobe.com/go/acrobat_signout_accthttp://www.adobe.com/go/acrobat_manage_accthttp://www.adobe.com/go/acrobat_change_passwdhttp://www.adobe.com/go/reader_signout_accthttp://www.adobe.com/go/reader_manage_accthttp://www.adobe.com/go/reader_change" Pattern match: "http://www.adobe.com/go/pima" Pattern match: "http://www.adobe.com/go/printing_tips&FilePage" Pattern match: "http://www.adobe.com/go/reader_download&Download" Pattern match: "Add...Add/R&eplace...&Remove...Acrobat" Pattern match: "www.adobe.com/go/apipfaqhttp://www.adobe.com/go/privacyThe" Pattern match: "http://www.adobe.com/go/sc_learn_moreThis" Pattern match: "http://www.quicktime.com.Acrobat" Heuristic match: "ving bookmarks...Removing embedded search index...Removing comments and markups...Removing file attachments...Removing hidden text...Removing hidden layers...Removing deleted or cropped content...Removing links, actions and javascripts...Removing overlappi" Pattern match: "http://www.adobe.com/go/acrobat_passwordhttp://www.adobe.com/go/reader_passwordhttp://www.adobe.com/go/acro_com_learn_moreCurrent" Pattern match: "layoutTroubleshooting...bit/skbit/smbit/ssecAUDIENCEAsk" Pattern match: "http://www.adobe.com/go/thirdparty/" Pattern match: "standard.PDF/A-1aPDF/A-1bPDF/X-1aPDF/X-3PDF/X-4PDF/X-4pPDF/X-5gPDF/X-5pgPDF/X-5nPDF/E-1ISO" Pattern match: "www.adobe.com/go/reader9_newdochttp://www.adobe.com/go/acrobat9_newdochttp://www.adobe.com/go/acro_com_acrohttp://www.adobe.com/go/acro_com_rdrUpload" Pattern match: "gle.com/mapshttp://www.mapquest.com/maps/map.adphttp://maps.yahoo.com/No" Pattern match: "www.adobe.com/go/security_checkpointsSome" Pattern match: "www.adobe.comAn" Pattern match: "www.adobe.com/go/ipmreader8?trackingid=GYPPQSend" Pattern match: "www.adobe.com/go/ipmreader1?trackingid=GYPPJFree" Pattern match: "http://www.adobe.com/go/ipmreader2?trackingid=GYPPK" Pattern match: "http://www.adobe.com/go/ipmreader3?trackingid=GYPPL" Pattern match: "http://www.adobe.com/go/ipmreader9?trackingid=GYPPR" Pattern match: "http://www.adobe.com/go/ipmreader10?trackingid=GYPPS" Pattern match: "www.adobe.com/go/ipmacrostd1?trackingid=GYPPXhttp://www.adobe.com/go/ipmacropro1?trackingid=GYPQFhttp://www.adobe.com/go/ipmacrosuite1?trackingid=GYPQSFree" Pattern match: "http://www.adobe.com/go/ipmacrostd2?trackingid=GYPPY" Pattern match: "http://www.adobe.com/go/ipmacropro2?trackingid=GYPQG" Pattern match: "http://www.adobe.com/go/ipmacrosuite2?trackingid=GYPQT" Pattern match: "http://www.adobe.com/go/ipmacrostd3?trackingid=GYPPZ" Pattern match: "http://www.adobe.com/go/ipmacropro3?trackingid=GYPQH" Pattern match: "http://www.adobe.com/go/ipmacrosuite3?trackingid=GYPQU" Pattern match: "www.adobe.com/go/ipmacrotrial8?trackingid=GYPPEhttp://www.adobe.com/go/ipmacrosuitetrial8?trackingid=GYSOBAdd" Pattern match: "www.adobe.com/go/ipmacrotrial1?trackingid=GYPOXhttp://www.adobe.com/go/ipmacrosuitetrial1?trackingid=GYSNUFree" Pattern match: "http://www.adobe.com/go/ipmacrotrial2?trackingid=GYPOY" Pattern match: "http://www.adobe.com/go/ipmacrosuitetrial2?trackingid=GYSNV" Pattern match: "http://www.adobe.com/go/ipmacrotrial3?trackingid=GYPOZ" Pattern match: "http://www.adobe.com/go/ipmacrosuitetrial3?trackingid=GYSNW" Pattern match: "www.example.com" Pattern match: "http://www.adobe.com" Pattern match: "http://www.adobe.com.\You" Pattern match: "http://genuine.microsoft.com/reporting/XmlEvent.ashx?v=3" Pattern match: "http://www.w3.org/2003/05/soap-envelope" Pattern match: "http://www.microsoft.com"28:T6ed,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Acrobat.dll") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Acrobat.dll") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Acrobat.dll") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Acrobat.dll") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "Acrobat.dll") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "Acrobat.dll") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Acrobat.dll") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Acrobat.dll") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp")29:T9f4,"rundll32.exe" queried SystemProcessInformation at 00000000-00001160-00000C15-3291597160 [PID: 1160] "rundll32.exe" queried SystemProcessInformation at 00000000-00001160-00000C15-3291621755 [PID: 1160] "rundll32.exe" queried SystemProcessInformation at 00000000-00001160-00000C15-3291986077 [PID: 1160] "rundll32.exe" queried SystemProcessInformation at 00000000-00001160-00000C15-3291996171 [PID: 1160] "rundll32.exe" queried SystemProcessInformation at 00000000-00006016-00000C15-3291732711 [PID: 6016] "rundll32.exe" queried SystemProcessInformation at 00000000-00006016-00000C15-3291767722 [PID: 6016] "rundll32.exe" queried SystemProcessInformation at 00000000-00006016-00000C15-3292286138 [PID: 6016] "rundll32.exe" queried SystemProcessInformation at 00000000-00006016-00000C15-3292294072 [PID: 6016] "rundll32.exe" queried SystemProcessInformation at 00000000-00005224-00000C15-3291790622 [PID: 5224] "rundll32.exe" queried SystemProcessInformation at 00000000-00005224-00000C15-3291827259 [PID: 5224] "rundll32.exe" queried SystemProcessInformation at 00000000-00005224-00000C15-3292253333 [PID: 5224] "rundll32.exe" queried SystemProcessInformation at 00000000-00005224-00000C15-3292260945 [PID: 5224] "rundll32.exe" queried SystemProcessInformation at 00000000-00001564-00000C15-3291726064 [PID: 1564] "rundll32.exe" queried SystemProcessInformation at 00000000-00001564-00000C15-3291760452 [PID: 1564] "rundll32.exe" queried SystemProcessInformation at 00000000-00001564-00000C15-3292107252 [PID: 1564] "rundll32.exe" queried SystemProcessInformation at 00000000-00001564-00000C15-3292137950 [PID: 1564] "rundll32.exe" queried SystemProcessInformation at 00000000-00002380-00000C15-3299832737 [PID: 2380] "rundll32.exe" queried SystemProcessInformation at 00000000-00002380-00000C15-3299841427 [PID: 2380] "rundll32.exe" queried SystemProcessInformation at 00000000-00002380-00000C15-3300018577 [PID: 2380] "rundll32.exe" queried SystemProcessInformation at 00000000-00002380-00000C15-3300028602 [PID: 2380] "rundll32.exe" queried SystemProcessInformation at 00000000-00006228-00000C15-3303159063 [PID: 6228] "rundll32.exe" queried SystemProcessInformation at 00000000-00006228-00000C15-3303168338 [PID: 6228] "rundll32.exe" queried SystemProcessInformation at 00000000-00006228-00000C15-3303435818 [PID: 6228] "rundll32.exe" queried SystemProcessInformation at 00000000-00006228-00000C15-3303445275 [PID: 6228] "rundll32.exe" queried SystemProcessInformation at 00000000-00003096-00000C15-3306320379 [PID: 3096]2a:T408,"rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00001160) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006016) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00005224) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00001564) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00002380) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006228) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00003096) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00006032) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00001492) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00004472) "rundll32.exe" called "RtlGetNtProductType" with parameter 01000000 (UID: 00000000-00000336)2b:T3db6,"rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001160) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006016) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005224) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001564) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002380) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006228) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003096) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006032) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001492) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004472) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000336) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005100) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007776) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007124) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007980) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006372) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005372) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001372) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001120) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000948) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005692) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007436) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004820) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005128) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006928)2c:T396a,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001160) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001160) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001160) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001160) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006016) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006016) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006016) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006016) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005224) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005224) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005224) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005224) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001564) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002380) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002380) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002380) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002380) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006228) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006228) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006228) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006228) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003096) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003096) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003096) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003096) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006032) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006032) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006032) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006032) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001492) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001492) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001492) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001492) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004472) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004472) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004472) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004472) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000336) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000336) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000336) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000336) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005100) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005100) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005100) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005100) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007776) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007776) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007776) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007776) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007124) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007124) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007124) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007124) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007980) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007980) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006372) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005372) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001372) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001372) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001120) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001120) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001120) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001120) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000948) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000948) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005692) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005692) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005692) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005692) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007436) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007436) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007436) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007436) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004820) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004820) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004820) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004820) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005128) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005128) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005128) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005128) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006928) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006928) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001496) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001496) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001496) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001496) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007464) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007464) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007464) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007464) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001060) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001060) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002688) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006924) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005144) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005144) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005144) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005144) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000576) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000576) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000576) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000576) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005284) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005284) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005284) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005284) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004564) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004564) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004672) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004672) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004672) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004672)2d:T1255,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "Acrobat.dll") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.277605.00AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.277605.00AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.277605.00AF0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000336.00000000.277605.00AF0000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000576.00000000.287487.00D20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000576.00000000.287487.00D20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000576.00000000.287487.00D20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000576.00000000.287487.00D20000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00000948.00000000.281726.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000948.00000000.281726.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000948.00000000.281726.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00000948.00000000.281726.00A60000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001060.00000000.285567.03390000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001060.00000000.285567.03390000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001060.00000000.285567.03390000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001060.00000000.285567.03390000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001120.00000000.281039.00B40000.00000004.mdmp, 00000000-00001120.00000001.282640.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001120.00000000.281039.00B40000.00000004.mdmp, 00000000-00001120.00000001.282640.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001120.00000000.281039.00B40000.00000004.mdmp, 00000000-00001120.00000001.282640.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001120.00000000.281039.00B40000.00000004.mdmp, 00000000-00001120.00000001.282640.00B40000.00000004.mdmp") Found reference to API "levateCreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00001160.00000000.274706.00D00000.00000004.mdmp, 00000000-00001160.00000001.275348.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001160.00000000.274706.00D00000.00000004.mdmp, 00000000-00001160.00000001.275348.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001160.00000000.274706.00D00000.00000004.mdmp, 00000000-00001160.00000001.275348.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateProcess"; Source: "00000000-00001160.00000000.274706.00D00000.00000004.mdmp, 00000000-00001160.00000001.275348.00D00000.00000004.mdmp")2e:Tc4b0,Found reference to API (Indicator: "RegSetValueExW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetLengthSid"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateWellKnownSid"; File: "Acrobat.dll") Found reference to API (Indicator: "RegEnumKeyA"; File: "Acrobat.dll") Found reference to API (Indicator: "CryptAcquireContextA"; File: "Acrobat.dll") Found reference to API (Indicator: "InitializeSecurityDescriptor"; File: "Acrobat.dll") Found reference to API (Indicator: "RegCreateKeyW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSidLengthRequired"; File: "Acrobat.dll") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "Acrobat.dll") Found reference to API (Indicator: "CryptGenRandom"; File: "Acrobat.dll") Found reference to API (Indicator: "RegQueryValueExW"; File: "Acrobat.dll") Found reference to API (Indicator: "CopySid"; File: "Acrobat.dll") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; File: "Acrobat.dll") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; File: "Acrobat.dll") Found reference to API (Indicator: "RegOpenKeyExA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTokenInformation"; File: "Acrobat.dll") Found reference to API (Indicator: "RegOpenKeyA"; File: "Acrobat.dll") Found reference to API (Indicator: "AllocateAndInitializeSid"; File: "Acrobat.dll") Found reference to API (Indicator: "DuplicateToken"; File: "Acrobat.dll") Found reference to API (Indicator: "RegEnumKeyExW"; File: "Acrobat.dll") Found reference to API (Indicator: "RegQueryValueExA"; File: "Acrobat.dll") Found reference to API (Indicator: "FreeSid"; File: "Acrobat.dll") Found reference to API (Indicator: "CheckTokenMembership"; File: "Acrobat.dll") Found reference to API (Indicator: "CryptAcquireContextW"; File: "Acrobat.dll") Found reference to API (Indicator: "RegEnumKeyExA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSidSubAuthority"; File: "Acrobat.dll") Found reference to API (Indicator: "OpenThreadToken"; File: "Acrobat.dll") Found reference to API (Indicator: "OpenProcessToken"; File: "Acrobat.dll") Found reference to API (Indicator: "RegSetValueExA"; File: "Acrobat.dll") Found reference to API (Indicator: "RegCloseKey"; File: "Acrobat.dll") Found reference to API (Indicator: "GetUserNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "RegDeleteKeyW"; File: "Acrobat.dll") Found reference to API (Indicator: "IsValidSid"; File: "Acrobat.dll") Found reference to API (Indicator: "RegDeleteValueW"; File: "Acrobat.dll") Found reference to API (Indicator: "CryptReleaseContext"; File: "Acrobat.dll") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Acrobat.dll") Found reference to API (Indicator: "EqualSid"; File: "Acrobat.dll") Found reference to API (Indicator: "RegCreateKeyExA"; File: "Acrobat.dll") Found reference to API (Indicator: "RegCreateKeyExW"; File: "Acrobat.dll") Found reference to API (Indicator: "InitializeSid"; File: "Acrobat.dll") Found reference to API (Indicator: "RegEnumValueA"; File: "Acrobat.dll") Found reference to API (Indicator: "CreatePatternBrush"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateCompatibleDC"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDeviceCaps"; File: "Acrobat.dll") Found reference to API (Indicator: "SetDIBits"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateSolidBrush"; File: "Acrobat.dll") Found reference to API (Indicator: "DeleteDC"; File: "Acrobat.dll") Found reference to API (Indicator: "BitBlt"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTextColor"; File: "Acrobat.dll") Found reference to API (Indicator: "SetMapMode"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDIBits"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "Acrobat.dll") Found reference to API (Indicator: "SetStretchBltMode"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMapMode"; File: "Acrobat.dll") Found reference to API (Indicator: "DeleteObject"; File: "Acrobat.dll") Found reference to API (Indicator: "GetObjectA"; File: "Acrobat.dll") Found reference to API (Indicator: "StretchBlt"; File: "Acrobat.dll") Found reference to API (Indicator: "GetStockObject"; File: "Acrobat.dll") Found reference to API (Indicator: "SelectObject"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateFontIndirectW"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateFontIndirectA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetObjectW"; File: "Acrobat.dll") Found reference to API (Indicator: "FindResourceExW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetVolumeInformationW"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateDirectoryA"; File: "Acrobat.dll") Found reference to API (Indicator: "CompareStringW"; File: "Acrobat.dll") Found reference to API (Indicator: "DeleteFileW"; File: "Acrobat.dll") Found reference to API (Indicator: "TerminateProcess"; File: "Acrobat.dll") Found reference to API (Indicator: "FreeResource"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "Acrobat.dll") Found reference to API (Indicator: "ReadFile"; File: "Acrobat.dll") Found reference to API (Indicator: "EnterCriticalSection"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateMutexW"; File: "Acrobat.dll") Found reference to API (Indicator: "VirtualAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadLibraryW"; File: "Acrobat.dll") Found reference to API (Indicator: "FindNextChangeNotification"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "GetLogicalDriveStringsW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCurrentProcess"; File: "Acrobat.dll") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetModuleHandleA"; File: "Acrobat.dll") Found reference to API (Indicator: "FlushFileBuffers"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFileAttributesA"; File: "Acrobat.dll") Found reference to API (Indicator: "WaitForSingleObject"; File: "Acrobat.dll") Found reference to API (Indicator: "FindNextFileA"; File: "Acrobat.dll") Found reference to API (Indicator: "BeginUpdateResourceW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetLastError"; File: "Acrobat.dll") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDateFormatA"; File: "Acrobat.dll") Found reference to API (Indicator: "TlsAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "InterlockedIncrement"; File: "Acrobat.dll") Found reference to API (Indicator: "UnmapViewOfFile"; File: "Acrobat.dll") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTempFileNameA"; File: "Acrobat.dll") Found reference to API (Indicator: "HeapSize"; File: "Acrobat.dll") Found reference to API (Indicator: "UpdateResourceW"; File: "Acrobat.dll") Found reference to API (Indicator: "InterlockedCompareExchange"; File: "Acrobat.dll") Found reference to API (Indicator: "LocalLock"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTimeFormatW"; File: "Acrobat.dll") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Acrobat.dll") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "Acrobat.dll") Found reference to API (Indicator: "ResetEvent"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrlenA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetLocaleInfoW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "Acrobat.dll") Found reference to API (Indicator: "OpenProcess"; File: "Acrobat.dll") Found reference to API (Indicator: "RemoveDirectoryA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetProfileStringW"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalFindAtomW"; File: "Acrobat.dll") Found reference to API (Indicator: "IsValidCodePage"; File: "Acrobat.dll") Found reference to API (Indicator: "Process32NextW"; File: "Acrobat.dll") Found reference to API (Indicator: "ReleaseMutex"; File: "Acrobat.dll") Found reference to API (Indicator: "FindFirstFileW"; File: "Acrobat.dll") Found reference to API (Indicator: "ResumeThread"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateSemaphoreA"; File: "Acrobat.dll") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Acrobat.dll") Found reference to API (Indicator: "DisableThreadLibraryCalls"; File: "Acrobat.dll") Found reference to API (Indicator: "VirtualFree"; File: "Acrobat.dll") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateDirectoryW"; File: "Acrobat.dll") Found reference to API (Indicator: "TlsGetValue"; File: "Acrobat.dll") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFullPathNameA"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalFlags"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalGetAtomNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Acrobat.dll") Found reference to API (Indicator: "HeapReAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDateFormatW"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalGetAtomNameA"; File: "Acrobat.dll") Found reference to API (Indicator: "LocalReAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "UnlockFile"; File: "Acrobat.dll") Found reference to API (Indicator: "FreeLibrary"; File: "Acrobat.dll") Found reference to API (Indicator: "MoveFileExW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "Acrobat.dll") Found reference to API (Indicator: "LockResource"; File: "Acrobat.dll") Found reference to API (Indicator: "FindNextFileW"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalAddAtomA"; File: "Acrobat.dll") Found reference to API (Indicator: "SetFilePointer"; File: "Acrobat.dll") Found reference to API (Indicator: "GetProcAddress"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcmpiW"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadLibraryA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetACP"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFullPathNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetProfileIntW"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcpyA"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateThread"; File: "Acrobat.dll") Found reference to API (Indicator: "OpenFile"; File: "Acrobat.dll") Found reference to API (Indicator: "WriteFile"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTempPathA"; File: "Acrobat.dll") Found reference to API (Indicator: "OpenFileMappingW"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalAddAtomW"; File: "Acrobat.dll") Found reference to API (Indicator: "OpenSemaphoreW"; File: "Acrobat.dll") Found reference to API (Indicator: "ReleaseSemaphore"; File: "Acrobat.dll") Found reference to API (Indicator: "LockFile"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCurrentProcessId"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFileAttributesExW"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcatW"; File: "Acrobat.dll") Found reference to API (Indicator: "OpenFileMappingA"; File: "Acrobat.dll") Found reference to API (Indicator: "CompareFileTime"; File: "Acrobat.dll") Found reference to API (Indicator: "GetModuleHandleW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "InitializeCriticalSection"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Acrobat.dll") Found reference to API (Indicator: "Sleep"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcpyW"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrlenW"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcatA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCommandLineW"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadResource"; File: "Acrobat.dll") Found reference to API (Indicator: "GetComputerNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcmpW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetVersionExW"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalFree"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFileAttributesW"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalMemoryStatus"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSystemInfo"; File: "Acrobat.dll") Found reference to API (Indicator: "SetThreadPriority"; File: "Acrobat.dll") Found reference to API (Indicator: "CloseHandle"; File: "Acrobat.dll") Found reference to API (Indicator: "FindResourceA"; File: "Acrobat.dll") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDriveTypeW"; File: "Acrobat.dll") Found reference to API (Indicator: "HeapDestroy"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateFileW"; File: "Acrobat.dll") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFileSize"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTempPathW"; File: "Acrobat.dll") Found reference to API (Indicator: "VirtualQuery"; File: "Acrobat.dll") Found reference to API (Indicator: "GetProcessHeap"; File: "Acrobat.dll") Found reference to API (Indicator: "MulDiv"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDiskFreeSpaceExA"; File: "Acrobat.dll") Found reference to API (Indicator: "OutputDebugStringA"; File: "Acrobat.dll") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcmpiA"; File: "Acrobat.dll") Found reference to API (Indicator: "Process32FirstW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "Acrobat.dll") Found reference to API (Indicator: "SetFileAttributesA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFileSizeEx"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDriveTypeA"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalReAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "DeleteFileA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetShortPathNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "SetCurrentDirectoryW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "Acrobat.dll") Found reference to API (Indicator: "LocalAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcpynW"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateEventW"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcpynA"; File: "Acrobat.dll") Found reference to API (Indicator: "MapViewOfFile"; File: "Acrobat.dll") Found reference to API (Indicator: "SetFileAttributesW"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateFileA"; File: "Acrobat.dll") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Acrobat.dll") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "Acrobat.dll") Found reference to API (Indicator: "EnumResourceNamesA"; File: "Acrobat.dll") Found reference to API (Indicator: "TlsSetValue"; File: "Acrobat.dll") Found reference to API (Indicator: "CopyFileW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCurrentThread"; File: "Acrobat.dll") Found reference to API (Indicator: "FileTimeToLocalFileTime"; File: "Acrobat.dll") Found reference to API (Indicator: "FormatMessageW"; File: "Acrobat.dll") Found reference to API (Indicator: "IsBadReadPtr"; File: "Acrobat.dll") Found reference to API (Indicator: "FindClose"; File: "Acrobat.dll") Found reference to API (Indicator: "FindCloseChangeNotification"; File: "Acrobat.dll") Found reference to API (Indicator: "SetEvent"; File: "Acrobat.dll") Found reference to API (Indicator: "SwitchToThread"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Acrobat.dll") Found reference to API (Indicator: "FormatMessageA"; File: "Acrobat.dll") Found reference to API (Indicator: "EnumResourceNamesW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetStringTypeExW"; File: "Acrobat.dll") Found reference to API (Indicator: "HeapFree"; File: "Acrobat.dll") Found reference to API (Indicator: "RaiseException"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadLibraryExW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetPrivateProfileIntA"; File: "Acrobat.dll") Found reference to API (Indicator: "FindResourceW"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalFindAtomA"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalHandle"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "Acrobat.dll") Found reference to API (Indicator: "SetHandleCount"; File: "Acrobat.dll") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "Acrobat.dll") Found reference to API (Indicator: "GetLongPathNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "Acrobat.dll") Found reference to API (Indicator: "EnumResourceTypesW"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateFileMappingA"; File: "Acrobat.dll") Found reference to API (Indicator: "LocalUnlock"; File: "Acrobat.dll") Found reference to API (Indicator: "FlushInstructionCache"; File: "Acrobat.dll") Found reference to API (Indicator: "InterlockedExchange"; File: "Acrobat.dll") Found reference to API (Indicator: "SetThreadLocale"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalSize"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalUnlock"; File: "Acrobat.dll") Found reference to API (Indicator: "LocalFileTimeToFileTime"; File: "Acrobat.dll") Found reference to API (Indicator: "WinExec"; File: "Acrobat.dll") Found reference to API (Indicator: "DuplicateHandle"; File: "Acrobat.dll") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "Acrobat.dll") Found reference to API (Indicator: "InterlockedDecrement"; File: "Acrobat.dll") Found reference to API (Indicator: "SizeofResource"; File: "Acrobat.dll") Found reference to API (Indicator: "EndUpdateResourceW"; File: "Acrobat.dll") Found reference to API (Indicator: "HeapAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSystemTime"; File: "Acrobat.dll") Found reference to API (Indicator: "GetLocaleInfoA"; File: "Acrobat.dll") Found reference to API (Indicator: "SetEndOfFile"; File: "Acrobat.dll") Found reference to API (Indicator: "IsDBCSLeadByte"; File: "Acrobat.dll") Found reference to API (Indicator: "GetVersionExA"; File: "Acrobat.dll") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "Acrobat.dll") Found reference to API (Indicator: "TlsFree"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFileTime"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTickCount"; File: "Acrobat.dll") Found reference to API (Indicator: "LocalFree"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalLock"; File: "Acrobat.dll") Found reference to API (Indicator: "FindFirstFileA"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateSemaphoreW"; File: "Acrobat.dll") Found reference to API (Indicator: "ExitThread"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetVersion"; File: "Acrobat.dll") Found reference to API (Indicator: "GlobalDeleteAtom"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadLibraryExA"; File: "Acrobat.dll") Found reference to API (Indicator: "SetLastError"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateEventA"; File: "Acrobat.dll") Found reference to API (Indicator: "lstrcmpA"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateProcessW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTempFileNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateFileMappingW"; File: "Acrobat.dll") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "Acrobat.dll") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Acrobat.dll") Found reference to API (Indicator: "CommandLineToArgvW"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetFileInfoW"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetPathFromIDListA"; File: "Acrobat.dll") Found reference to API (Indicator: "ExtractAssociatedIconW"; File: "Acrobat.dll") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetFolderPathW"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetMalloc"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetDesktopFolder"; File: "Acrobat.dll") Found reference to API (Indicator: "SHFileOperationA"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "Acrobat.dll") Found reference to API (Indicator: "ShellExecuteW"; File: "Acrobat.dll") Found reference to API (Indicator: "ShellExecuteExW"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Acrobat.dll") Found reference to API (Indicator: "SHGetFileInfoA"; File: "Acrobat.dll") Found reference to API (Indicator: "SHFileOperationW"; File: "Acrobat.dll") Found reference to API (Indicator: "AssocQueryStringW"; File: "Acrobat.dll") Found reference to API (Indicator: "PathFindFileNameW"; File: "Acrobat.dll") Found reference to API (Indicator: "PathFindExtensionW"; File: "Acrobat.dll") Found reference to API (Indicator: "CallNextHookEx"; File: "Acrobat.dll") Found reference to API (Indicator: "CreatePopupMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "DrawTextExA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCapture"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "PostQuitMessage"; File: "Acrobat.dll") Found reference to API (Indicator: "IsWindowVisible"; File: "Acrobat.dll") Found reference to API (Indicator: "SystemParametersInfoA"; File: "Acrobat.dll") Found reference to API (Indicator: "SetMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "DestroyWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "GetKeyState"; File: "Acrobat.dll") Found reference to API (Indicator: "MessageBoxW"; File: "Acrobat.dll") Found reference to API (Indicator: "SetClipboardData"; File: "Acrobat.dll") Found reference to API (Indicator: "CharUpperBuffA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSystemMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "SetActiveWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "RemoveMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMessageTime"; File: "Acrobat.dll") Found reference to API (Indicator: "KillTimer"; File: "Acrobat.dll") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "Acrobat.dll") Found reference to API (Indicator: "TrackPopupMenuEx"; File: "Acrobat.dll") Found reference to API (Indicator: "DrawFocusRect"; File: "Acrobat.dll") Found reference to API (Indicator: "EnableMenuItem"; File: "Acrobat.dll") Found reference to API (Indicator: "ShowWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMenuItemCount"; File: "Acrobat.dll") Found reference to API (Indicator: "RegisterClipboardFormatA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFocus"; File: "Acrobat.dll") Found reference to API (Indicator: "ReleaseCapture"; File: "Acrobat.dll") Found reference to API (Indicator: "SetWindowPos"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSysColor"; File: "Acrobat.dll") Found reference to API (Indicator: "EqualRect"; File: "Acrobat.dll") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadImageW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetParent"; File: "Acrobat.dll") Found reference to API (Indicator: "EnumChildWindows"; File: "Acrobat.dll") Found reference to API (Indicator: "CharUpperW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetKeyNameTextW"; File: "Acrobat.dll") Found reference to API (Indicator: "CharNextW"; File: "Acrobat.dll") Found reference to API (Indicator: "SetFocus"; File: "Acrobat.dll") Found reference to API (Indicator: "OemToCharBuffA"; File: "Acrobat.dll") Found reference to API (Indicator: "SetWindowTextA"; File: "Acrobat.dll") Found reference to API (Indicator: "InsertMenuW"; File: "Acrobat.dll") Found reference to API (Indicator: "BeginPaint"; File: "Acrobat.dll") Found reference to API (Indicator: "MsgWaitForMultipleObjectsEx"; File: "Acrobat.dll") Found reference to API (Indicator: "GetForegroundWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "SetCapture"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDC"; File: "Acrobat.dll") Found reference to API (Indicator: "RedrawWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "DefMDIChildProcA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSubMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadAcceleratorsW"; File: "Acrobat.dll") Found reference to API (Indicator: "SetMenuItemBitmaps"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateWindowExW"; File: "Acrobat.dll") Found reference to API (Indicator: "DeleteMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "DefWindowProcW"; File: "Acrobat.dll") Found reference to API (Indicator: "CharToOemBuffA"; File: "Acrobat.dll") Found reference to API (Indicator: "SetWindowRgn"; File: "Acrobat.dll") Found reference to API (Indicator: "SetForegroundWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSysColorBrush"; File: "Acrobat.dll") Found reference to API (Indicator: "TranslateMessage"; File: "Acrobat.dll") Found reference to API (Indicator: "SendMessageA"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadStringA"; File: "Acrobat.dll") Found reference to API (Indicator: "AttachThreadInput"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindowRect"; File: "Acrobat.dll") Found reference to API (Indicator: "GetClientRect"; File: "Acrobat.dll") Found reference to API (Indicator: "ModifyMenuW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetKeyboardLayoutList"; File: "Acrobat.dll") Found reference to API (Indicator: "EnumThreadWindows"; File: "Acrobat.dll") Found reference to API (Indicator: "IsWindowEnabled"; File: "Acrobat.dll") Found reference to API (Indicator: "SetMenuInfo"; File: "Acrobat.dll") Found reference to API (Indicator: "DrawMenuBar"; File: "Acrobat.dll") Found reference to API (Indicator: "CheckMenuItem"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "Acrobat.dll") Found reference to API (Indicator: "PostMessageA"; File: "Acrobat.dll") Found reference to API (Indicator: "IsWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "CopyRect"; File: "Acrobat.dll") Found reference to API (Indicator: "SetParent"; File: "Acrobat.dll") Found reference to API (Indicator: "SetWindowLongA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetAsyncKeyState"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindowPlacement"; File: "Acrobat.dll") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "Acrobat.dll") Found reference to API (Indicator: "GetKeyboardState"; File: "Acrobat.dll") Found reference to API (Indicator: "IntersectRect"; File: "Acrobat.dll") Found reference to API (Indicator: "GetScrollInfo"; File: "Acrobat.dll") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "Acrobat.dll") Found reference to API (Indicator: "ScrollWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "BringWindowToTop"; File: "Acrobat.dll") Found reference to API (Indicator: "DispatchMessageA"; File: "Acrobat.dll") Found reference to API (Indicator: "ScreenToClient"; File: "Acrobat.dll") Found reference to API (Indicator: "DrawIconEx"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; File: "Acrobat.dll") Found reference to API (Indicator: "OpenClipboard"; File: "Acrobat.dll") Found reference to API (Indicator: "DestroyMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "EnableScrollBar"; File: "Acrobat.dll") Found reference to API (Indicator: "ClientToScreen"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "Acrobat.dll") Found reference to API (Indicator: "SetRect"; File: "Acrobat.dll") Found reference to API (Indicator: "InflateRect"; File: "Acrobat.dll") Found reference to API (Indicator: "ShowOwnedPopups"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindowDC"; File: "Acrobat.dll") Found reference to API (Indicator: "GetSystemMetrics"; File: "Acrobat.dll") Found reference to API (Indicator: "GetLastActivePopup"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMessageA"; File: "Acrobat.dll") Found reference to API (Indicator: "EmptyClipboard"; File: "Acrobat.dll") Found reference to API (Indicator: "RegisterClassW"; File: "Acrobat.dll") Found reference to API (Indicator: "UpdateWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "FillRect"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMenuItemID"; File: "Acrobat.dll") Found reference to API (Indicator: "FindWindowA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMenuItemRect"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCursorPos"; File: "Acrobat.dll") Found reference to API (Indicator: "IsChild"; File: "Acrobat.dll") Found reference to API (Indicator: "EnableWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindowLongA"; File: "Acrobat.dll") Found reference to API (Indicator: "DrawEdge"; File: "Acrobat.dll") Found reference to API (Indicator: "MapWindowPoints"; File: "Acrobat.dll") Found reference to API (Indicator: "GetActiveWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "IsZoomed"; File: "Acrobat.dll") Found reference to API (Indicator: "GetTopWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "GetIconInfo"; File: "Acrobat.dll") Found reference to API (Indicator: "MoveWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "GetCursor"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMenuInfo"; File: "Acrobat.dll") Found reference to API (Indicator: "UnregisterClassA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetKeyboardLayout"; File: "Acrobat.dll") Found reference to API (Indicator: "GetPropA"; File: "Acrobat.dll") Found reference to API (Indicator: "CharUpperA"; File: "Acrobat.dll") Found reference to API (Indicator: "DestroyIcon"; File: "Acrobat.dll") Found reference to API (Indicator: "InsertMenuItemW"; File: "Acrobat.dll") Found reference to API (Indicator: "FrameRect"; File: "Acrobat.dll") Found reference to API (Indicator: "SetPropA"; File: "Acrobat.dll") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "Acrobat.dll") Found reference to API (Indicator: "MessageBeep"; File: "Acrobat.dll") Found reference to API (Indicator: "RemovePropA"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDesktopWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "TranslateAcceleratorW"; File: "Acrobat.dll") Found reference to API (Indicator: "CloseClipboard"; File: "Acrobat.dll") Found reference to API (Indicator: "OffsetRect"; File: "Acrobat.dll") Found reference to API (Indicator: "EnumWindows"; File: "Acrobat.dll") Found reference to API (Indicator: "WindowFromPoint"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindow"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMenuState"; File: "Acrobat.dll") Found reference to API (Indicator: "AppendMenuW"; File: "Acrobat.dll") Found reference to API (Indicator: "SetWindowTextW"; File: "Acrobat.dll") Found reference to API (Indicator: "ActivateKeyboardLayout"; File: "Acrobat.dll") Found reference to API (Indicator: "PtInRect"; File: "Acrobat.dll") Found reference to API (Indicator: "SetScrollInfo"; File: "Acrobat.dll") Found reference to API (Indicator: "SetWindowPlacement"; File: "Acrobat.dll") Found reference to API (Indicator: "PeekMessageW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "Acrobat.dll") Found reference to API (Indicator: "InvalidateRect"; File: "Acrobat.dll") Found reference to API (Indicator: "ReleaseDC"; File: "Acrobat.dll") Found reference to API (Indicator: "GetClipboardData"; File: "Acrobat.dll") Found reference to API (Indicator: "DispatchMessageW"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadIconW"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateIconIndirect"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadStringW"; File: "Acrobat.dll") Found reference to API (Indicator: "SetTimer"; File: "Acrobat.dll") Found reference to API (Indicator: "IsRectEmpty"; File: "Acrobat.dll") Found reference to API (Indicator: "wsprintfW"; File: "Acrobat.dll") Found reference to API (Indicator: "LoadCursorW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetWindowTextW"; File: "Acrobat.dll") Found reference to API (Indicator: "IsIconic"; File: "Acrobat.dll") Found reference to API (Indicator: "UnregisterClassW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetDCEx"; File: "Acrobat.dll") Found reference to API (Indicator: "wsprintfA"; File: "Acrobat.dll") Found reference to API (Indicator: "SetCursor"; File: "Acrobat.dll") Found reference to API (Indicator: "GetMenu"; File: "Acrobat.dll") Found reference to API (Indicator: "VerQueryValueW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFileVersionInfoW"; File: "Acrobat.dll") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; File: "Acrobat.dll") Found reference to API (Indicator: "CoCreateInstance"; File: "Acrobat.dll") Found reference to API (Indicator: "CoDisconnectObject"; File: "Acrobat.dll") Found reference to API (Indicator: "CoGetClassObject"; File: "Acrobat.dll") Found reference to API (Indicator: "CLSIDFromString"; File: "Acrobat.dll") Found reference to API (Indicator: "CoInitialize"; File: "Acrobat.dll") Found reference to API (Indicator: "CoUninitialize"; File: "Acrobat.dll") Found reference to API (Indicator: "CoTaskMemFree"; File: "Acrobat.dll") Found reference to API (Indicator: "OleInitialize"; File: "Acrobat.dll") Found reference to API (Indicator: "CoCreateGuid"; File: "Acrobat.dll") Found reference to API (Indicator: "ProgIDFromCLSID"; File: "Acrobat.dll") Found reference to API (Indicator: "StringFromGUID2"; File: "Acrobat.dll") Found reference to API (Indicator: "CoTaskMemRealloc"; File: "Acrobat.dll") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "Acrobat.dll") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "Acrobat.dll") Found reference to API (Indicator: "OleUninitialize"; File: "Acrobat.dll") Found reference to API (Indicator: "CoInitializeEx"; File: "Acrobat.dll") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00002380.00000001.276862.01081000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "SetProcessMitigationPolicy"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "NtSetInformationProcess"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API (Indicator: "CryptExportKey"; Source: "00000000-00005692.00000000.281735.00920000.00000004.mdmp")2f:T11c2,Found reference to API "WinExec" (Indicator: "WinExec"; File: "Acrobat.dll") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "Acrobat.dll") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "Acrobat.dll") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000336.00000000.277605.00AF0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000576.00000000.287487.00D20000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00000948.00000000.281726.00A60000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001060.00000000.285567.03390000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001120.00000000.281039.00B40000.00000004.mdmp, 00000000-00001120.00000001.282640.00B40000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001160.00000000.274706.00D00000.00000004.mdmp, 00000000-00001160.00000001.275348.00D00000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001372.00000000.280495.00950000.00000004.mdmp, 00000000-00001372.00000001.281400.00950000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001492.00000000.277187.03200000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001496.00000000.283677.031D0000.00000004.mdmp, 00000000-00001496.00000001.285242.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00001564.00000000.274707.00EA0000.00000004.mdmp, 00000000-00001564.00000001.276312.00EA0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002380.00000000.275261.008D0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00002688.00000001.287193.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00003096.00000000.275675.009F0000.00000004.mdmp, 00000000-00003096.00000001.277280.009F0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004472.00000000.277399.033A0000.00000004.mdmp, 00000000-00004472.00000001.279000.033A0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004564.00000000.287523.00EE0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004672.00000000.287540.03220000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00004820.00000000.282966.00720000.00000004.mdmp, 00000000-00004820.00000001.284570.00720000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005100.00000000.277930.036B0000.00000004.mdmp, 00000000-00005100.00000001.279531.036B0000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005128.00000000.283648.03180000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005144.00000000.286821.03460000.00000004.mdmp, 00000000-00005144.00000001.287162.03460000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005224.00000000.274707.03450000.00000004.mdmp, 00000000-00005224.00000001.275148.03450000.00000004.mdmp") Found reference to API "" (Indicator: "WinExec"; Source: "00000000-00005284.00000000.287495.00610000.00000004.mdmp")30:T97e,"Acrobat.dll" contains export function called "??4CTJPEGData@@QAEAAU0@ABU0@@Z" at ordinal 1 "Acrobat.dll" contains export function called "??4CTJPEGDecodeOptions@@QAEAAU0@ABU0@@Z" at ordinal 2 "Acrobat.dll" contains export function called "??4CTJPEGEncodeOptions@@QAEAAU0@ABU0@@Z" at ordinal 3 "Acrobat.dll" contains export function called "??4CTJPEGEncodedParams@@QAEAAU0@ABU0@@Z" at ordinal 4 "Acrobat.dll" contains export function called "??4CTJPEGHeader@@QAEAAU0@ABU0@@Z" at ordinal 5 "Acrobat.dll" contains export function called "??4CTJPEGImageContent@@QAEAAU0@ABU0@@Z" at ordinal 6 "Acrobat.dll" contains export function called "??4CTJPEGMemoryManager@@QAEAAU0@ABU0@@Z" at ordinal 7 "Acrobat.dll" contains export function called "??4CTJPEGMetaData@@QAEAAU0@ABU0@@Z" at ordinal 8 "Acrobat.dll" contains export function called "??4CTJPEGMetaDataHandler@@QAEAAU0@ABU0@@Z" at ordinal 9 "Acrobat.dll" contains export function called "??4CTJPEGQualityParams@@QAEAAU0@ABU0@@Z" at ordinal 10 "Acrobat.dll" contains export function called "??4CTJPEGReader@@QAEAAU0@ABU0@@Z" at ordinal 11 "Acrobat.dll" contains export function called "??4CTJPEGRect@@QAEAAU0@ABU0@@Z" at ordinal 12 "Acrobat.dll" contains export function called "??4CTJPEGRotateOptions@@QAEAAU0@ABU0@@Z" at ordinal 13 "Acrobat.dll" contains export function called "??4CTJPEGTask@@QAEAAU0@ABU0@@Z" at ordinal 14 "Acrobat.dll" contains export function called "??4CTJPEGTaskManager@@QAEAAU0@ABU0@@Z" at ordinal 15 "Acrobat.dll" contains export function called "??4CTJPEGTaskManagerBuilder@@QAEAAU0@ABU0@@Z" at ordinal 16 "Acrobat.dll" contains export function called "??4CTJPEGTiledContentReader@@QAEAAU0@ABU0@@Z" at ordinal 17 "Acrobat.dll" contains export function called "??4CTJPEGTiledContentWriter@@QAEAAU0@ABU0@@Z" at ordinal 18 "Acrobat.dll" contains export function called "??4CTJPEGWarningHandler@@QAEAAU0@ABU0@@Z" at ordinal 19 "Acrobat.dll" contains export function called "??4CTJPEGWriter@@QAEAAU0@ABU0@@Z" at ordinal 20 "Acrobat.dll" contains export function called "AVAcroALM_Destroy" at ordinal 82 "Acrobat.dll" contains export function called "AVAcroALM_IsFeatureEnabled" at ordinal 83 "Acrobat.dll" contains export function called "AVAcroAMT_GetAcrobatCode" at ordinal 84 "Acrobat.dll" contains export function called "AXSetInitViaPDFL" at ordinal 21 "Acrobat.dll" contains export function called "AXWasInitViaPDFL" at ordinal 2231:T2e78,"Software\Adobe\Adobe Acrobat\Debug" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\10.0" in Source: Acrobat.dll "HKCU\" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\10.0\Language" in Source: Acrobat.dll "Software\Adobe" in Source: Acrobat.dll "Software\Microsoft\Windows\CurrentVersion\Installer\InProgress" in Source: Acrobat.dll "Software\Adobe\Acrobat Reader\10.0\Privileged" in Source: Acrobat.dll "sSoftware\Adobe\Adobe ARM\1.0" in Source: Acrobat.dll "SOFTWARE\Policies\Adobe\Adobe Acrobat\10.0" in Source: Acrobat.dll "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\10.0\Installer" in Source: Acrobat.dll "HARDWARE\DESCRIPTION\System" in Source: Acrobat.dll "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: Acrobat.dll "Software\Adobe\Acrobat Reader\" in Source: Acrobat.dll "Software\Adobe\Acrobat Reader" in Source: Acrobat.dll "software\Microsoft\Windows\CurrentVersion\App Paths\AcroRd32.exe" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat" in Source: Acrobat.dll "software\Microsoft\Windows\CurrentVersion\App Paths\Acrobat.exe" in Source: Acrobat.dll "SOFTWARE\Clients\Mail" in Source: Acrobat.dll "SOFTWARE\Adobe\Adobe Acrobat\" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\10.0\Installer\IOD" in Source: Acrobat.dll "Software\Adobe\Repair\Adobe Acrobat\10.0\IOD" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\10.0\Installer\Migrated" in Source: Acrobat.dll "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IExplore.exe" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\10.0\AdobeViewer" in Source: Acrobat.dll "Software\Adobe\Registration" in Source: Acrobat.dll "System\CurrentControlSet\Control\Session Manager\Environment" in Source: Acrobat.dll "Software\Classes\" in Source: Acrobat.dll "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: Acrobat.dll "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: Acrobat.dll "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: Acrobat.dll "Software\" in Source: Acrobat.dll "Software\Adobe\Acrobat\Exe" in Source: Acrobat.dll "System\CurrentControlSet\Control" in Source: Acrobat.dll "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Acrobat.exe" in Source: Acrobat.dll "SOFTWARE\Microsoft\Windows\CurrentVersion" in Source: Acrobat.dll "SOFTWARE\Adobe\Acrobat Reader\10.0\InstallPath" in Source: Acrobat.dll "SOFTWARE\Adobe\Adobe Acrobat\10.0\InstallPath" in Source: Acrobat.dll "Software\Adobe\Designer\8.2" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\10.0\Activation" in Source: Acrobat.dll "Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" in Source: Acrobat.dll "Software\Adobe\Adobe Acrobat\10.0\OEM" in Source: Acrobat.dll "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: Acrobat.dll "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf" in Source: Acrobat.dll "Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\UserChoice" in Source: Acrobat.dll "SOFTWARE\Wow6432Node\Adobe\Adobe Acrobat\" in Source: Acrobat.dll "SOFTWARE\Wow6432Node\Adobe\Acrobat Reader\" in Source: Acrobat.dll "SOFTWARE\Adobe\Acrobat Reader\" in Source: Acrobat.dll "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000336.00000000.277605.00AF0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000576.00000000.287487.00D20000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000576.00000000.287487.00D20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001060.00000000.285567.03390000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001060.00000000.285567.03390000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001120.00000000.281039.00B40000.00000004.mdmp 00000000-00001120.00000001.282640.00B40000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001120.00000000.281039.00B40000.00000004.mdmp 00000000-00001120.00000001.282640.00B40000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001160.00000000.274706.00D00000.00000004.mdmp 00000000-00001160.00000001.275348.00D00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001372.00000000.280495.00950000.00000004.mdmp 00000000-00001372.00000001.281400.00950000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001372.00000000.280495.00950000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001492.00000000.277187.03200000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001492.00000000.277187.03200000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001496.00000000.283677.031D0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001496.00000000.283677.031D0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001564.00000000.274707.00EA0000.00000004.mdmp 00000000-00001564.00000001.276312.00EA0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002380.00000000.275261.008D0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002380.00000000.275261.008D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002688.00000001.287193.00BC0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002688.00000001.287193.00BC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003096.00000000.275675.009F0000.00000004.mdmp 00000000-00003096.00000001.277280.009F0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003096.00000000.275675.009F0000.00000004.mdmp 00000000-00003096.00000001.277280.009F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004472.00000000.277399.033A0000.00000004.mdmp 00000000-00004472.00000001.279000.033A0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.277399.033A0000.00000004.mdmp 00000000-00004472.00000001.279000.033A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004564.00000000.287523.00EE0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004564.00000000.287523.00EE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004672.00000000.287540.03220000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004672.00000000.287540.03220000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004820.00000001.284570.00720000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004820.00000001.284570.00720000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005100.00000000.277930.036B0000.00000004.mdmp 00000000-00005100.00000001.279531.036B0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005100.00000000.277930.036B0000.00000004.mdmp 00000000-00005100.00000001.279531.036B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005128.00000000.283648.03180000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005128.00000000.283648.03180000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005144.00000000.286821.03460000.00000004.mdmp 00000000-00005144.00000001.287162.03460000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005144.00000000.286821.03460000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005224.00000000.274707.03450000.00000004.mdmp 00000000-00005224.00000001.275148.03450000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005224.00000000.274707.03450000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005284.00000000.287495.00610000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005284.00000000.287495.00610000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005372.00000000.279857.004B0000.00000004.mdmp 00000000-00005372.00000001.281462.004B0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005372.00000000.279857.004B0000.00000004.mdmp 00000000-00005372.00000001.281462.004B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006016.00000000.274706.030E0000.00000004.mdmp 00000000-00006016.00000001.274936.030E0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006016.00000000.274706.030E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006032.00000000.276638.00860000.00000004.mdmp 00000000-00006032.00000001.278239.00860000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006032.00000000.276638.00860000.00000004.mdmp 00000000-00006032.00000001.278239.00860000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006228.00000000.275473.00C70000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006228.00000000.275473.00C70000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006372.00000001.281408.00C30000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006372.00000001.281408.00C30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006924.00000000.285603.00AD0000.00000004.mdmp 00000000-00006924.00000001.287212.00AD0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006924.00000000.285603.00AD0000.00000004.mdmp 00000000-00006924.00000001.287212.00AD0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006928.00000000.283662.00E50000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006928.00000000.283662.00E50000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007124.00000000.279113.00710000.00000004.mdmp 00000000-00007124.00000001.280714.00710000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007124.00000000.279113.00710000.00000004.mdmp 00000000-00007124.00000001.280714.00710000.00000004.mdmp32:T977,Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1160:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:1160:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6016:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:6016:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5224:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:5224:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1564:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:1564:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2380:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:2380:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6228:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:6228:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3096:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:3096:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6032:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:6032:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1492:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:1492:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4472:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:4472:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:336:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:336:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5100:168:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:5100:168:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7776:168:WilStaging_02"33:T8bf,Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#1" (UID: 00000000-00001160) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#2" (UID: 00000000-00006016) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#4" (UID: 00000000-00005224) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#3" (UID: 00000000-00001564) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#5" (UID: 00000000-00002380) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#6" (UID: 00000000-00006228) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#7" (UID: 00000000-00003096) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#8" (UID: 00000000-00006032) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#9" (UID: 00000000-00001492) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#10" (UID: 00000000-00004472) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#11" (UID: 00000000-00000336) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#12" (UID: 00000000-00005100) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#13" (UID: 00000000-00007776) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#14" (UID: 00000000-00007124) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#15" (UID: 00000000-00007980) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#16" (UID: 00000000-00006372) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#17" (UID: 00000000-00005372) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#18" (UID: 00000000-00001372) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#19" (UID: 00000000-00001120) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#20" (UID: 00000000-00000948) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#21" (UID: 00000000-00005692) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#22" (UID: 00000000-00007436) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#23" (UID: 00000000-00004820) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#24" (UID: 00000000-00005128) Process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#25" (UID: 00000000-00006928)34:T2d0a,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000336.00000000.277605.00AF0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000576.00000000.287487.00D20000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000576.00000000.287487.00D20000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001060.00000000.285567.03390000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001060.00000000.285567.03390000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001120.00000000.281039.00B40000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001120.00000000.281039.00B40000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001120.00000001.282640.00B40000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001120.00000001.282640.00B40000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001160.00000000.274706.00D00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001160.00000001.275348.00D00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001372.00000000.280495.00950000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001372.00000000.280495.00950000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001372.00000001.281400.00950000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001492.00000000.277187.03200000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001492.00000000.277187.03200000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00001496.00000000.283677.031D0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001496.00000000.283677.031D0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001564.00000000.274707.00EA0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001564.00000001.276312.00EA0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002380.00000000.275261.008D0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002380.00000000.275261.008D0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00002688.00000001.287193.00BC0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00002688.00000001.287193.00BC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003096.00000000.275675.009F0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003096.00000000.275675.009F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003096.00000001.277280.009F0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003096.00000001.277280.009F0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004472.00000000.277399.033A0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000000.277399.033A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004472.00000001.279000.033A0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004472.00000001.279000.033A0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004564.00000000.287523.00EE0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004564.00000000.287523.00EE0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004672.00000000.287540.03220000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004672.00000000.287540.03220000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004820.00000001.284570.00720000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00004820.00000001.284570.00720000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005100.00000000.277930.036B0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005100.00000000.277930.036B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005100.00000001.279531.036B0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005100.00000001.279531.036B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005128.00000000.283648.03180000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005128.00000000.283648.03180000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005144.00000000.286821.03460000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005144.00000000.286821.03460000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005144.00000001.287162.03460000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005224.00000000.274707.03450000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005224.00000000.274707.03450000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005224.00000001.275148.03450000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005284.00000000.287495.00610000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005284.00000000.287495.00610000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005372.00000000.279857.004B0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005372.00000000.279857.004B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005372.00000001.281462.004B0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00005372.00000001.281462.004B0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006016.00000000.274706.030E0000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006016.00000000.274706.030E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006016.00000001.274936.030E0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006032.00000000.276638.00860000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006032.00000000.276638.00860000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006032.00000001.278239.00860000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006032.00000001.278239.00860000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006228.00000000.275473.00C70000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006228.00000000.275473.00C70000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006372.00000001.281408.00C30000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006372.00000001.281408.00C30000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006924.00000000.285603.00AD0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006924.00000000.285603.00AD0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006924.00000001.287212.00AD0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006924.00000001.287212.00AD0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006928.00000000.283662.00E50000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00006928.00000000.283662.00E50000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007124.00000000.279113.00710000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007124.00000000.279113.00710000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007124.00000001.280714.00710000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007124.00000001.280714.00710000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007436.00000001.283323.01100000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007464.00000000.284895.00800000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007464.00000001.286496.00800000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007464.00000001.286496.00800000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007776.00000000.278565.00680000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007776.00000000.278565.00680000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007776.00000001.280170.00680000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007776.00000001.280170.00680000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007980.00000000.279325.00BC0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00007980.00000000.279325.00BC0000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007980.00000001.279478.00BC0000.00000004.mdmp35:T415,"rundll32.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 775d0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 775d0000 "rundll32.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 775d0000 "rundll32.exe" loaded module "KERNEL32" at base 77500000 "rundll32.exe" loaded module "C:\ACROBAT.DLL" at base 0 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73c90000 "rundll32.exe" loaded module "KERNEL32.DLL" at base 77500000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74f10000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 748a0000 "rundll32.exe" loaded module "OLEAUT32.DLL" at base 74210000 "rundll32.exe" loaded module "RPCRT4.DLL" at base 75780000 "rundll32.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75060000 "rundll32.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75060000 "rundll32.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76da000036:T988,Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#2" (UID: 00000000-00006016) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#4" (UID: 00000000-00005224) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#3" (UID: 00000000-00001564) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#5" (UID: 00000000-00002380) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#6" (UID: 00000000-00006228) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#7" (UID: 00000000-00003096) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#8" (UID: 00000000-00006032) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#9" (UID: 00000000-00001492) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#10" (UID: 00000000-00004472) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#11" (UID: 00000000-00000336) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#12" (UID: 00000000-00005100) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#13" (UID: 00000000-00007776) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#14" (UID: 00000000-00007124) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#15" (UID: 00000000-00007980) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#16" (UID: 00000000-00006372) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#17" (UID: 00000000-00005372) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#18" (UID: 00000000-00001372) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#19" (UID: 00000000-00001120) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#20" (UID: 00000000-00000948) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#21" (UID: 00000000-00005692) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#22" (UID: 00000000-00007436) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#23" (UID: 00000000-00004820) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#24" (UID: 00000000-00005128) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#25" (UID: 00000000-00006928) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#26" (UID: 00000000-00001496)37:T988,Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#2" (UID: 00000000-00006016) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#4" (UID: 00000000-00005224) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#3" (UID: 00000000-00001564) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#5" (UID: 00000000-00002380) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#6" (UID: 00000000-00006228) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#7" (UID: 00000000-00003096) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#8" (UID: 00000000-00006032) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#9" (UID: 00000000-00001492) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#10" (UID: 00000000-00004472) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#11" (UID: 00000000-00000336) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#12" (UID: 00000000-00005100) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#13" (UID: 00000000-00007776) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#14" (UID: 00000000-00007124) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#15" (UID: 00000000-00007980) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#16" (UID: 00000000-00006372) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#17" (UID: 00000000-00005372) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#18" (UID: 00000000-00001372) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#19" (UID: 00000000-00001120) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#20" (UID: 00000000-00000948) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#21" (UID: 00000000-00005692) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#22" (UID: 00000000-00007436) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#23" (UID: 00000000-00004820) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#24" (UID: 00000000-00005128) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#25" (UID: 00000000-00006928) Spawned process "rundll32.exe" with commandline ""C:\\Acrobat.dll",#26" (UID: 00000000-00001496)38:T402,The input sample is signed with a certificate issued by "CN=VeriSign Time Stamping Services CA, O="VeriSign Inc.", C=US" (SHA1: AD:A8:AA:A6:43:FF:7D:C3:8D:D4:0F:A4:C9:7A:D5:59:FF:48:46:DE; see report for more information) The input sample is signed with a certificate issued by "CN=Thawte Timestamping CA, OU=Thawte Certification, O=Thawte, L=Durbanville, ST=Western Cape, C=ZA" (SHA1: F4:6A:C0:C6:EF:BB:8C:6A:14:F5:5F:09:E2:D3:7D:F4:C0:DE:01:2D; see report for more information) The input sample is signed with a certificate issued by "OU=Class 3 Public Primary Certification Authority, O="VeriSign Inc.", C=US" (SHA1: 12:D4:87:2B:C3:EF:01:9E:7E:0B:6F:13:24:80:AE:29:DB:5B:1C:A3; see report for more information) The input sample is signed with a certificate issued by "CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa c09, OU=VeriSign Trust Network, O="VeriSign Inc.", C=US" (SHA1: 91:63:23:36:16:93:7D:32:6C:8C:45:B9:66:D9:8B:6B:0E:73:93:66; see report for more information)39:T574,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "")3a:Td8a,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DISABLEHEAPLOOKASIDE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "FRONTENDHEAPDEBUGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "SHUTDOWNFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "UNLOADEVENTTRACEDEPTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXLOADERTHREADS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "USEIMPERSONATEDDEVICEMAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACINGFLAGS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CFGOPTIONS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MINIMUMSTACKCOMMITINBYTES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "BREAKONINITIALIZEPROCESSFAILURE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "KEEPACTIVATIONCONTEXTSALIVE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "TRACKACTIVATIONCONTEXTRELEASES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "MAXDEADACTIVATIONCONTEXTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "GLOBALFLAG"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNDLL32.EXE"; Key: "DEBUGPROCESSHEAPONLY"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "RUNDLL32.EXE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "")3b:T4ec,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "Acrobat.dll") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "Acrobat.dll") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "Acrobat.dll") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "Acrobat.dll") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "Acrobat.dll") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "Acrobat.dll") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "Acrobat.dll") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp")3c:T811,Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "Acrobat.dll") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Acrobat.dll") Found reference to API "GetTempFileNameA" (Indicator: "GetTempFileName"; File: "Acrobat.dll") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "Acrobat.dll") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "Acrobat.dll") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Acrobat.dll") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "Acrobat.dll") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "Acrobat.dll") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "Acrobat.dll") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "Acrobat.dll") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "Acrobat.dll") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Acrobat.dll") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "Acrobat.dll") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "Acrobat.dll") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; File: "Acrobat.dll") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "Acrobat.dll") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "Acrobat.dll") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "Acrobat.dll") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00005224.00000001.275148.01089000.00000002.mdmp")3d:T1022,Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000336.00000000.277605.00AF0000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000336.00000000.277605.00AF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000336.00000000.277605.00AF0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000576.00000000.287487.00D20000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000576.00000000.287487.00D20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000576.00000000.287487.00D20000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000948.00000000.281726.00A60000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000948.00000000.281726.00A60000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00000948.00000000.281726.00A60000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001060.00000000.285567.03390000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001060.00000000.285567.03390000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001120.00000000.281039.00B40000.00000004.mdmp, 00000000-00001120.00000001.282640.00B40000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001120.00000000.281039.00B40000.00000004.mdmp, 00000000-00001120.00000001.282640.00B40000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001120.00000000.281039.00B40000.00000004.mdmp, 00000000-00001120.00000001.282640.00B40000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001160.00000000.274706.00D00000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001160.00000000.274706.00D00000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001160.00000000.274706.00D00000.00000004.mdmp, 00000000-00001160.00000001.275348.00D00000.00000004.mdmp") Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001160.00000001.275348.00D00000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001160.00000001.275348.00D00000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000000.280495.00950000.00000004.mdmp") Found string ":\WINDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000000.280495.00950000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00001372.00000000.280495.00950000.00000004.mdmp, 00000000-00001372.00000001.281400.00950000.00000004.mdmp") Found string "INDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000001.281400.00950000.00000004.mdmp") Found string "INDOWS\system32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001372.00000001.281400.00950000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001492.00000000.277187.03200000.00000004.mdmp")3e:T5a1,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "Acrobat.dll") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; File: "Acrobat.dll") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "Acrobat.dll") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "Acrobat.dll") Found reference to API "CopySid" (Indicator: "CopySid"; File: "Acrobat.dll") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "Acrobat.dll") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "Acrobat.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "Acrobat.dll") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "Acrobat.dll") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; File: "Acrobat.dll") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "Acrobat.dll") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "Acrobat.dll") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "Acrobat.dll") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "Acrobat.dll") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "Acrobat.dll")3f:T895,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: Acrobat.dll] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: Acrobat.dll] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: Acrobat.dll] Observed import api "CreateWellKnownSid" which can "create a SID for predefined aliases" [Source: Acrobat.dll] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: Acrobat.dll] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: Acrobat.dll] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: Acrobat.dll] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: Acrobat.dll] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: Acrobat.dll] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: Acrobat.dll] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: Acrobat.dll] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: Acrobat.dll] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: Acrobat.dll] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: Acrobat.dll] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: Acrobat.dll]40:T74f,"Acrobat.dll" has resource with unusual entropy "ASWF:7.998922909044123" "Acrobat.dll" has resource with unusual entropy "ASWF:7.999068080877135" "Acrobat.dll" has resource with unusual entropy "ASWF:7.9990121572861765" "Acrobat.dll" has resource with unusual entropy "ASWF:7.998457237412249" "Acrobat.dll" has resource with unusual entropy "ASWF:7.998889979893719" "Acrobat.dll" has resource with unusual entropy "ASWF:7.9953272290007815" "Acrobat.dll" has resource with unusual entropy "ASWF:7.995645651621822" "Acrobat.dll" has resource with unusual entropy "PNGF:7.94447423176106" "Acrobat.dll" has resource with unusual entropy "PNGF:7.960556502369176" "Acrobat.dll" has resource with unusual entropy "PNGF:7.710346715461216" "Acrobat.dll" has resource with unusual entropy "PNGF:7.520700946750314" "Acrobat.dll" has resource with unusual entropy "PNGF:7.599096816835622" "Acrobat.dll" has resource with unusual entropy "PNGI:7.913012789544511" "Acrobat.dll" has resource with unusual entropy "PNGI:7.890986347704976" "Acrobat.dll" has resource with unusual entropy "PNGI:7.143298909660381" "Acrobat.dll" has resource with unusual entropy "PNGI:7.132445453152893" "Acrobat.dll" has resource with unusual entropy "PNGI:7.58156680651488" "Acrobat.dll" has resource with unusual entropy "PNGI:7.282066416420062" "Acrobat.dll" has resource with unusual entropy "PNGI:7.715034013295981" "Acrobat.dll" has resource with unusual entropy "PNGI:7.58532987839415" "Acrobat.dll" has resource with unusual entropy "PNGI:7.74514924489618" "Acrobat.dll" has resource with unusual entropy "PNGI:7.593231128362225" "Acrobat.dll" has resource with unusual entropy "PNGI:7.478116003989463" "Acrobat.dll" has resource with unusual entropy "PNGI:7.069035269806866" "Acrobat.dll" has resource with unusual entropy "PNGI:7.670128771199081"41:T5d6,RegEnumKeyA RegCreateKeyW SetSecurityDescriptorDacl RegOpenKeyExA RegOpenKeyA RegEnumKeyExW RegEnumKeyExA OpenProcessToken RegCloseKey GetUserNameW RegDeleteKeyW RegDeleteValueW RegOpenKeyExW RegOpenKeyW RegCreateKeyExA RegCreateKeyExW FindResourceExW CreateDirectoryA DeleteFileW TerminateProcess VirtualAlloc LoadLibraryW GetModuleHandleA GetFileAttributesA FindNextFileA GetTempFileNameA OpenProcess Process32NextW FindFirstFileW IsDebuggerPresent CreateDirectoryW GetModuleFileNameA LockResource FindNextFileW GetProcAddress LoadLibraryA CreateThread WriteFile GetTempPathA OpenFileMappingW GetFileAttributesExW OpenFileMappingA GetModuleHandleW GetModuleFileNameW Sleep GetCommandLineW GetComputerNameW GetVersionExW GetFileAttributesW GetSystemInfo FindResourceA GetDriveTypeW CreateFileW GetFileSize GetTempPathW OutputDebugStringA Process32FirstW GetFileSizeEx GetDriveTypeA DeleteFileA MapViewOfFile CreateFileA CopyFileW LoadLibraryExW FindResourceW GetSystemDirectoryW GetSystemDirectoryA CreateFileMappingA WinExec UnhandledExceptionFilter CreateToolhelp32Snapshot GetVersionExA GetTickCount FindFirstFileA ExitThread LoadLibraryExA CreateProcessW GetTempFileNameW CreateFileMappingW ShellExecuteW ShellExecuteExW SetKeyboardState FindWindowExW GetWindowThreadProcessId GetLastActivePopup FindWindowW FindWindowA GetCursorPos GetUpdateRgn SetWindowsHookExW GetClipboardData CreateFileMoniker1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1be9ae9f607f89ea29a32e5991330b285884669107b37b2f7dc83bd8256343b4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":74,"unified_at_epoch_ms":1790276644409,"unified_at":"2026-09-24T19:04:04.409Z","metadata":{"hashes":{"sha256":"1be9ae9f607f89ea29a32e5991330b285884669107b37b2f7dc83bd8256343b4","sha1":"5d73dbf1ffcf704d322fcb33201cbe50fb1d7304","md5":"7f82409a051db6fb948caee86415fb12","sha512":"33f12f109de22b20d6c4a28e5a3bb05d50f00ae415f7ce442ada9698c5a981cf9a5223eb11af76dddb18861dd526cf679631859f306d54d27f4fd576d77b5213","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"Acrobat.dll","file_type":["pedll","executable"],"file_type_id":"dll","file_size":28406160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1524132111000,"last_seen":1762740956000,"last_multi_scan":1762740956000}},"detections":{"summary":{"verdict":"suspicious","score":74,"tags":["ainslot","banker","carberp","crypt","downloader","genasom","hacktool","icloader","metasploit","meterpreter","ramnit","sivis","swrort","vobfus","wanacrypt0r","wannacry","wannacrypt","wcry"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":160,"suspicious_count":13,"malicious_count":1,"total":174},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve class object from a DLL object handler"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - Medium entropy File"},{"type":"informative","value":"YARA signature match - High entropy file"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Credential Access","technique":"Securityd Memory","attack_id":"T1555.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/002","identifiers":[{"type":"informative","value":"Able to retrieve credentials from memory"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Calls APIs used for find file/directory path"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an APIs used to retrieve process information"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Attempts to call internet-related API for network communication"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1116","attack_id_wiki":"https://attack.mitre.org/techniques/T1116","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/64 Antivirus vendors marked sample as malicious (0% detection rate)\n 0/14 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5ad8690f7ca3e1069f267877"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$27","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ad8690f7ca3e1069f267877"},{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"},{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"1/67 reputation engines marked \"http://www.aiim.org/pdfa/ns/id/\" as malicious (1% detection rate)\n 1/67 reputation engines marked \"http://www.npes.org/pdfx/ns/id/\" as malicious (1% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5ad8690f7ca3e1069f267877"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"9e@t.f9\"","origin":"File/Memory","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"5ad8690f7ca3e1069f267877"},{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"POST /6b06490d-f9fd-424c-8b6d-83edc4369e89/ HTTP/1.1Cache-Control: no-cacheConnection: ClosePragma: no-cacheContent-Type: application/soap+xmlUser-Agent: WSDAPIContent-Length: 733Host: 192.168.56.152:5357\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ad8690f7ca3e1069f267877"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains a remote desktop related string","description":"\"F Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"Explorer.exe\" (Indicator: \"explorer.exe\"; File: \"Acrobat.dll\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"Acrobat.dll\" has section name .text with entropy \"6.770735123187225\"\n \"Acrobat.dll\" has section name .rsrc with entropy \"7.627397234786366\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"$40","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"rundll32.exe\" called \"NtConnectPort\" with parameters (UID: 00000000-00001160)\n \"rundll32.exe\" called \"NtRequestWaitReplyPort\" with parameters (UID: 00000000-00001160)\n \"rundll32.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00001160)\n \"rundll32.exe\" called \"NtAlpcConnectPortEx\" with parameters (UID: 00000000-00001160)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"3010953\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"90107c4\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"19010751\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"rundll32.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"1c010769\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"rundll32.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"CoCreateGuid@COMBASE.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"System Security","name":"Writes registry keys","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NOTIFICATIONS\\DATA\"; Key: \"418A073AA3BC1C75\"; Value: \"501F0000000000000400040001001C00020000000D7879000DA1810016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A8500726E4A0075A37E00799C39008106950087DE83009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CF74AA00D3E88D00E1C97700E7997F00F1FC6000F7D36F0006000600000019C398001C4452007140A30091508A00A522A400C45F7F00\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NOTIFICATIONS\\DATA\"; Key: \"418A073AA3BC1C75\"; Value: \"531F0000000000000400040001002200020000000D7879000DA1810016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A8500726E4A0075A37E00799C39008106950087DE83008E78A200938661009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CA23B700CC495600CF74AA00D3826100D3E88D00E1C97700E7997F00F1FC6000F7125E00F7D36F0006000600000019C398001C4452007140A30091508A00A522A400C45F7F00\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"Acrobat.dll\" claimed CRC 28406213 while the actual is CRC 28431942","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$41","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"rundll32.exe\" touched file \"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui\"\n \"rundll32.exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"rundll32.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"rundll32.exe\" touched file \"%WINDIR%\\System32\\rundll32.exe\"\n \"rundll32.exe\" touched file \"%WINDIR%\\AppPatch\\AcLayers.dll\"\n \"rundll32.exe\" touched file \"%WINDIR%\\System32\\en-US\\rundll32.exe.mui\"\n \"rundll32.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"rundll32.exe\" touched file \"%WINDIR%\\System32\\en-US\\msctf.dll.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/69 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains a remote desktop related string"}],"sources":[{"report_type":"sandbox","report_id":"5ad8690f7ca3e1069f267877"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]}]},"activity":{"stats":{"process_count":116,"spawned_processes_count":116,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":66,"imported_dlls_count":59,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":10,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["ainslot","banker","carberp","crypt","downloader","genasom","hacktool","icloader","metasploit","meterpreter","ramnit","sivis","swrort","vobfus","wanacrypt0r","wannacry","wannacrypt","wcry"],"sample_flags":["Sample not shared","Multi-Process","Network Traffic"],"sandbox_reports":[{"id":"69114adb8c5a89ade2000258","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":74,"submit_name":"Acrobat.dll","analysis_start_time":"2025-11-10T02:15:58+00:00","indicators_count":{"informative":158,"suspicious":22,"malicious":0},"tags":["Multi-Process","Network Traffic"],"is_in_unified_schema":true},{"id":"5fbcdb74a64d3f31464e1e80","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"no specific threat","malware_family":"PE.Heur","submit_name":"Acrobat.dll","analysis_start_time":"2020-11-24T10:07:55+00:00","indicators_count":{"informative":5,"suspicious":2,"malicious":1},"tags":["Multi-Process"],"is_in_unified_schema":true},{"id":"5ad8690f7ca3e1069f267877","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"no specific threat","submit_name":"Acrobat.dll","analysis_start_time":"2018-04-19T12:02:46+00:00","indicators_count":{"informative":2,"suspicious":4,"malicious":0},"tags":["Sample not shared"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"testmycdn.azureedge.net","country":"-","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}],"processes":[{"pid":3632,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00064148-00003632"},{"pid":3664,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#1","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00064322-00003664"},{"pid":3592,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#2","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00064452-00003592"},{"pid":2472,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#3","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00064581-00002472"},{"pid":3752,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#4","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00064710-00003752"},{"pid":3844,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#5","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00064840-00003844"},{"pid":3500,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#6","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00064973-00003500"},{"pid":3676,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#7","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00065105-00003676"},{"pid":1736,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#8","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00065234-00001736"},{"pid":3812,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#9","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00065364-00003812"},{"pid":2280,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#10","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00065494-00002280"},{"pid":3076,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#11","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00065623-00003076"},{"pid":3628,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#12","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00065753-00003628"},{"pid":1256,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#13","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00065882-00001256"},{"pid":2100,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#14","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00066011-00002100"},{"pid":2824,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#15","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00066140-00002824"},{"pid":2196,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#16","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00066270-00002196"},{"pid":1144,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#17","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00066400-00001144"},{"pid":3476,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#18","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00066529-00003476"},{"pid":2508,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#19","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00066658-00002508"},{"pid":2856,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#20","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00066787-00002856"},{"pid":4004,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#21","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00066917-00004004"},{"pid":3716,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#22","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00067046-00003716"},{"pid":2984,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#23","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00067176-00002984"},{"pid":3532,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#24","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00067305-00003532"},{"pid":2884,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#25","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00067436-00002884"},{"pid":3012,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#26","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00067565-00003012"},{"pid":964,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#27","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00067694-00000964"},{"pid":1920,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#28","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00067824-00001920"},{"pid":3604,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#29","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00067953-00003604"},{"pid":1540,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#30","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00068082-00001540"},{"pid":3072,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#31","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00068211-00003072"},{"pid":3372,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#32","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00068341-00003372"},{"pid":3068,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#33","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00068470-00003068"},{"pid":2276,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#34","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00068599-00002276"},{"pid":460,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#35","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00068729-00000460"},{"pid":1320,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#36","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00068859-00001320"},{"pid":640,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#37","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00068989-00000640"},{"pid":2432,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#38","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00069119-00002432"},{"pid":796,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#39","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00069249-00000796"},{"pid":2184,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#40","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00069379-00002184"},{"pid":320,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#41","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00069508-00000320"},{"pid":3768,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#42","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00069638-00003768"},{"pid":1212,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#43","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00069769-00001212"},{"pid":500,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#44","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00069898-00000500"},{"pid":2468,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#45","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00070028-00002468"},{"pid":1808,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#46","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00070157-00001808"},{"pid":3144,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#47","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00070286-00003144"},{"pid":2592,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#48","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00070416-00002592"},{"pid":756,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#49","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00070545-00000756"},{"pid":2292,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#50","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00070883-00002292"},{"pid":3428,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#51","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00071014-00003428"},{"pid":3636,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#52","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00071143-00003636"},{"pid":2728,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#53","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00071272-00002728"},{"pid":4020,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#54","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00071402-00004020"},{"pid":856,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#55","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00071531-00000856"},{"pid":2920,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#56","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00071661-00002920"},{"pid":3468,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#57","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00071792-00003468"},{"pid":3780,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#58","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00071921-00003780"},{"pid":2600,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#59","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00072053-00002600"},{"pid":2504,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#60","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00072183-00002504"},{"pid":2668,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#61","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00072312-00002668"},{"pid":940,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#62","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00072442-00000940"},{"pid":3804,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#63","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00072571-00003804"},{"pid":2168,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#64","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00072701-00002168"},{"pid":3612,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#65","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00072830-00003612"},{"pid":3392,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#66","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00072960-00003392"},{"pid":1832,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#67","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00073090-00001832"},{"pid":3544,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#68","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00073220-00003544"},{"pid":2996,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#69","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00073349-00002996"},{"pid":3304,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#70","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00073479-00003304"},{"pid":1196,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#71","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00073609-00001196"},{"pid":560,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#72","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00073740-00000560"},{"pid":4088,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#73","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00073869-00004088"},{"pid":1692,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#74","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00073999-00001692"},{"pid":3892,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#75","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00074130-00003892"},{"pid":2392,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#76","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00074259-00002392"},{"pid":3984,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#77","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00074388-00003984"},{"pid":3332,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#78","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00074519-00003332"},{"pid":1324,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#79","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00074649-00001324"},{"pid":3580,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#80","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00074779-00003580"},{"pid":2424,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#81","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00074909-00002424"},{"pid":1980,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#82","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00075039-00001980"},{"pid":2800,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#83","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00075168-00002800"},{"pid":3544,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#84","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00075298-00003544"},{"pid":1452,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#85","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00075428-00001452"},{"pid":2808,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#86","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00075558-00002808"},{"pid":3800,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#87","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00075689-00003800"},{"pid":1728,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#88","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00075819-00001728"},{"pid":2752,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#89","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00075950-00002752"},{"pid":2972,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#90","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00076080-00002972"},{"pid":1356,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#91","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00076210-00001356"},{"pid":2524,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#92","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00076341-00002524"},{"pid":3296,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#93","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00076481-00003296"},{"pid":1932,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#94","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00076612-00001932"},{"pid":1392,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#95","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00076742-00001392"},{"pid":3264,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#96","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00076875-00003264"},{"pid":4052,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#97","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00077005-00004052"},{"pid":1224,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#98","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00077135-00001224"},{"pid":2604,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#99","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00077265-00002604"},{"pid":2404,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#100","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00077401-00002404"},{"pid":3432,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#101","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00077531-00003432"},{"pid":3352,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#102","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00077661-00003352"},{"pid":2992,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#103","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00077792-00002992"},{"pid":2192,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#104","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00077922-00002192"},{"pid":2076,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#105","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00078053-00002076"},{"pid":2924,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#106","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00078183-00002924"},{"pid":3680,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#107","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00078313-00003680"},{"pid":4064,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#108","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00078444-00004064"},{"pid":2408,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#109","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00078575-00002408"},{"pid":2560,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#111","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00078836-00002560"},{"pid":3996,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#112","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00078965-00003996"},{"pid":2120,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#113","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00079096-00002120"},{"pid":2244,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#114","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00079226-00002244"},{"pid":3140,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#115","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00079356-00003140"},{"pid":3360,"ppid":3632,"name":"rundll32.exe","command_line":"\"C:\\Acrobat.dll\",#116","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064148-00003632","uid":"00079488-00003360"}],"all_imported_dlls":["ntdll.dll","apphelp.dll","ucrtbase.dll","profapi.dll","mpr.dll","IPHLPAPI.DLL","ws2_32.dll","clbcatq.dll","msvcp_win.dll","cfgmgr32.dll","cryptbase.dll","oleaut32.dll","sfc_os.dll","cryptsp.dll","WinTypes.dll","shlwapi.dll","wow64win.dll","shell32.dll","SHCore.dll","sspicli.dll","imm32.dll","VxSSL32.dll","dwmapi.dll","user32.dll","sechost.dll","bcrypt.dll","wow64cpu.dll","KernelBase.dll","rpcrt4.dll","advapi32.dll","kernel.appcore.dll","powrprof.dll","sfc.dll","fltLib.dll","wow64.dll","msvcrt.dll","gdi32.dll","windows.storage.dll","uxtheme.dll","msctf.dll","TextInputFramework.dll","CoreMessaging.dll","combase.dll","gdi32full.dll","kernel32.dll","AcLayers.dll","win32u.dll","setupapi.dll","Acrobat.dll","CoreUIComponents.dll","bcryptprimitives.dll","imagehlp.dll","ole32.dll","ntmarta.dll","lpk.dll","rpcss.dll","userenv.dll","api-ms-win-core-synch-l1-2-0.dll","usp10.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]},{"path":"C:\\Acrobat.dll","sources":[{"report_type":"sandbox","report_id":"5fbcdb74a64d3f31464e1e80"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1160:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:1160:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:6016:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:5224:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:1564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2380:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:2380:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6228:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:6228:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:3096:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:6032:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1492:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:1492:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4472:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:4472:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:336:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:5100:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7776:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:7776:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7124:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:7124:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:7980:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:6372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:5372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:1372:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:1120:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7436:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:7436:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4820:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:4820:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:5128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:6928:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1496:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:1496:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:7464:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:1060:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:2688:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:6924:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5144:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:5144:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:576:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:576:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5284:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:5284:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:4564:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]},{"name":"Local\\SM0:4672:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69114adb8c5a89ade2000258"}]}]}},"report_ids":{"sandbox_job_ids":["69114adb8c5a89ade2000258","5fbcdb74a64d3f31464e1e80","5ad8690f7ca3e1069f267877"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Suspicious Sample 1be9ae9f607f… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 1be9ae9f607f…. Threat score 74/100. 0/28 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1be9ae9f607f89ea29a32e5991330b285884669107b37b2f7dc83bd8256343b4"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample 1be9ae9f607f… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 1be9ae9f607f…. Threat score 74/100. 0/28 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1be9ae9f607f89ea29a32e5991330b285884669107b37b2f7dc83bd8256343b4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample 1be9ae9f607f… — Score 74/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 1be9ae9f607f…. Threat score 74/100. 0/28 AV engines flagged this file. 1 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]