26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T47a,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Agent Sample a30afeea0bb7… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample a30afeea0bb7…. Malware family: Trojan.Agent. Threat score 100/100. 5/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a30afeea0bb774b975c0f80273200272e0bc34e3d93caed70dc7356fc156ffc3","keywords":["Malicious","Trojan.Agent","malware analysis","sandbox report","threat intelligence","a30afeea0bb774b975c0f80273200272e0bc34e3d93caed70dc7356fc156ffc3"],"about":{"@type":"SoftwareApplication","name":"test.jse","applicationCategory":["script","javascript"],"identifier":"a30afeea0bb774b975c0f80273200272e0bc34e3d93caed70dc7356fc156ffc3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Agent","antivirusDetections":{"malicious":5,"total":27},"behavioralIndicators":{"malicious":8,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8e4,"RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNBI.TTF" at 00065995-00002676-0000010C-5668260 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00065995-00002676-0000010C-14230030 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALN.TTF" at 00065995-00002676-0000010C-14284057 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ariali.ttf" at 00065995-00002676-0000010C-14295969 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNI.TTF" at 00065995-00002676-0000010C-14308025 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00065995-00002676-0000010C-14316742 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00065995-00002676-0000010C-14327858 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00065995-00002676-0000010C-14345923 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ariblk.ttf" at 00065995-00002676-0000010C-14389382 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\SEGOEUISL.TTF" at 00065995-00002676-0000010C-15243860 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuii.ttf" at 00065995-00002676-0000010C-15417357 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\seguisb.ttf" at 00065995-00002676-0000010C-15472440 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuiz.ttf" at 00065995-00002676-0000010C-15839197 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\times.ttf" at 00065995-00002676-0000010C-15923707 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesi.ttf" at 00065995-00002676-0000010C-15952847 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuil.ttf" at 00065995-00002676-0000010C-23730492 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00065995-00002676-0000010C-24185524 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00065995-00002676-0000010C-24428179 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00065995-00002676-0000010C-24901524 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesbi.ttf" at 00065995-00002676-0000010C-2520428328:T43b,"AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\47BEABC922EAE80E78783462A79F45C254FDE68B"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\3E2BF7F2031B96F38CE6C4D8A85D3E2D58476A0F"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\F18B538D1BE903B6A6F056435B171589CAF36BF2"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\E12DFB4B41D7D9C32B30514BAC1D81D8385E2D46"; Key: "BLOB") "AcroRd32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CERTIFICATES\DE28F4A4FFE5B92FA3C503D1A349A7F9962A8212"; Key: "BLOB") "AcroRd32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "AcroRd32.exe" (Path: "SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "")29:T51f,Spawned process "AcroRd32.exe" with commandline ""%ALLUSERSPROFILE%\ 2021-05-07.pdf"" (UID: 00065039-00003820) Spawned process "powershell.exe" with commandline "-windowstyle hidden certutil -decode %WINDIR%\..\ProgramData\efV ..." (UID: 00065068-00003348) Spawned process "certutil.exe" with commandline "-decode %WINDIR%\..\ProgramData\efVo8cq.sIhn %WINDIR%\..\Program ..." (UID: 00065610-00003716) Spawned process "RdrCEF.exe" with commandline "--backgroundcolor=16448250" (UID: 00065995-00002676) Spawned process "RdrCEF.exe" with commandline "--type=renderer --primordial-pipe-token=DF71D3BA2E424EBD95C4C7D5 ..." (UID: 00066175-00000332) Spawned process "RdrCEF.exe" with commandline "--type=renderer --primordial-pipe-token=F740113F545AA828DB051B9A ..." (UID: 00066211-00001888) Spawned process "powershell.exe" with commandline "-windowstyle hidden regsvr32.exe /s %WINDIR%\..\ProgramData\glK7 ..." (UID: 00066311-00000492) Spawned process "regsvr32.exe" with commandline "/s %WINDIR%\..\ProgramData\glK7UwV.pR9a" (UID: 00066640-00000904) Spawned process "iexplore.exe" with commandline "http://cgi1.adobe.com/special/acrobat/pluginfinder/pluginfinder. ..." (UID: 00069015-00000560) Spawned process "iexplore.exe" with commandline "SCODEF:560 CREDAT:275457 /prefetch:2" (UID: 00069101-00001472)2a:T4c4,"wscript.exe" touched file "C:\Windows\System32\en-US\wscript.exe.mui" "wscript.exe" touched file "C:\Windows\System32\wscript.exe" "wscript.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "wscript.exe" touched file "C:\Windows\System32\rsaenh.dll" "wscript.exe" touched file "C:\Windows\System32\en-US\KernelBase.dll.mui" "wscript.exe" touched file "C:\Windows\System32\msxml3r.dll" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db" "wscript.exe" touched file "C:\Windows\System32" "wscript.exe" touched file "C:\Windows\System32\WindowsPowerShell" "wscript.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0" "wscript.exe" touched file "C:\Windows\System32\scrrun.dll" "wscript.exe" touched file "C:\Windows\System32\wshom.ocx" "wscript.exe" touched file "C:\Users\nAO5BeY\AppData\Local\Microsoft\Windows\Caches" "wscript.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "wscript.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "wscript.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"2b:T830,"AcroRd32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "AcroRd32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "AcroRd32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "AcroRd32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "AcroRd32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "AcroRd32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "AcroRd32.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "iexplore.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT")2c:T889,"wscript.exe" wrote 32 bytes to a remote process "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" (Handle: 720) "wscript.exe" wrote 4 bytes to a remote process "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" (Handle: 720) "wscript.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 832) "wscript.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 832) "wscript.exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 832) "wscript.exe" wrote 52 bytes to a remote process "C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" (Handle: 720) "wscript.exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 812) "wscript.exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 812) "wscript.exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 812) "powershell.exe" wrote 32 bytes to a remote process "C:\Windows\System32\certutil.exe" (Handle: 1064) "powershell.exe" wrote 52 bytes to a remote process "C:\Windows\System32\certutil.exe" (Handle: 1064) "powershell.exe" wrote 4 bytes to a remote process "C:\Windows\System32\certutil.exe" (Handle: 1064) "powershell.exe" wrote 1500 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 1076) "powershell.exe" wrote 4 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 1076) "powershell.exe" wrote 32 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 1076) "powershell.exe" wrote 52 bytes to a remote process "C:\Windows\System32\regsvr32.exe" (Handle: 1076) "iexplore.exe" wrote 32 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 900) "iexplore.exe" wrote 52 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 900) "iexplore.exe" wrote 4 bytes to a remote process "C:\Program Files\Internet Explorer\iexplore.exe" (Handle: 900)2d:T13fc,Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "1.6.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "12.0.4.0" found in string "" Potential IP "11.161.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IP "10.171.0.0" found in string "" Potential IPs "0.0.0.0" "0.0.0.0" found in string ""2e:Tc0c,"wscript.exe" wrote bytes "c04ecb772054cc77e065cc77b538cd770000000000d0847700000000c5ea84770000000088ea847700000000e968e3758228cd77ee29cd7700000000d269e375000000007dbb84770000000009bee37500000000ba18847700000000" to virtual address "0x76701000" (part of module "NSI.DLL") "powershell.exe" wrote bytes "c04ecb772054cc77e065cc77b538cd770000000000d0847700000000c5ea84770000000088ea847700000000e968e3758228cd77ee29cd7700000000d269e375000000007dbb84770000000009bee37500000000ba18847700000000" to virtual address "0x76701000" (part of module "NSI.DLL") "powershell.exe" wrote bytes "d055847664738d760000000051c1477794984777ee9c477775dc4977273e49770fb34d7700000000acdc84771bf78477c1088677c0d98477152e847736da8477d5d9847730c68477e0c2847742c684771bc6847786c4847772c6847700000000" to virtual address "0x72581000" (part of module "SHFOLDER.DLL") "powershell.exe" wrote bytes "e9b9e0d0" to virtual address "0x68B31FFC" (part of module "MSCORWKS.DLL") "certutil.exe" wrote bytes "c04ecb772054cc77e065cc77b538cd770000000000d0847700000000c5ea84770000000088ea847700000000e968e3758228cd77ee29cd7700000000d269e375000000007dbb84770000000009bee37500000000ba18847700000000" to virtual address "0x76701000" (part of module "NSI.DLL") "powershell.exe" wrote bytes "85098acc" to virtual address "0x67571FFC" (part of module "MSCORWKS.DLL") "powershell.exe" wrote bytes "d055847664738d760000000051c1477794984777ee9c477775dc4977273e49770fb34d7700000000acdc84771bf78477c1088677c0d98477152e847736da8477d5d9847730c68477e0c2847742c684771bc6847786c4847772c6847700000000" to virtual address "0x714B1000" (part of module "SHFOLDER.DLL") "regsvr32.exe" wrote bytes "c04ecb772054cc77e065cc77b538cd770000000000d0847700000000c5ea84770000000088ea847700000000e968e3758228cd77ee29cd7700000000d269e375000000007dbb84770000000009bee37500000000ba18847700000000" to virtual address "0x76701000" (part of module "NSI.DLL") "iexplore.exe" wrote bytes "60d2956d" to virtual address "0x767C1D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033926d" to virtual address "0x767212B0" (part of module "OLEAUT32.DLL") "iexplore.exe" wrote bytes "c03a926d" to virtual address "0x75EC1768" (part of module "OLE32.DLL") "iexplore.exe" wrote bytes "3030926d" to virtual address "0x76471380" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60cd956d" to virtual address "0x7647130C" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "80320d0070320d0000320d0060320d0050320d0040320d0030320d00000000002cc98c76c0210d000000000090170d0050230d0000180d00601f0d0020360d000000000040360d0000000000" to virtual address "0x000D8000" "iexplore.exe" wrote bytes "b033926d" to virtual address "0x000D70C0" "iexplore.exe" wrote bytes "b033926d" to virtual address "0x777211BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "b033926d" to virtual address "0x77B3917C" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "b033926d" to virtual address "0x77C21210" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "a035926d" to virtual address "0x76721520" (part of module "OLEAUT32.DLL")2f:T6ae,"wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "AcroRd32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "AcroRd32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "AcroRd32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "certutil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "certutil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "certutil.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "RdrCEF.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FR-CA") "RdrCEF.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FR-CA") "RdrCEF.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES") "RdrCEF.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES") "RdrCEF.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "PT-PT") "RdrCEF.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "PT-PT") "RdrCEF.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-MX")30:T5c2,--type=renderer --primordial-pipe-token=DF71D3BA2E424EBD95C4C7D564B7CEA1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=DF71D3BA2E424EBD95C4C7D564B7CEA1 --renderer-client-id=2 --mojo-platform-channel-handle=1280 --allow-no-sandbox-job /prefetch:131:T5c2,--type=renderer --primordial-pipe-token=F740113F545AA828DB051B9A2930C81E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=F740113F545AA828DB051B9A2930C81E --renderer-client-id=3 --mojo-platform-channel-handle=1316 --allow-no-sandbox-job /prefetch:11d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"a30afeea0bb774b975c0f80273200272e0bc34e3d93caed70dc7356fc156ffc3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790802177361,"unified_at":"2026-09-30T21:02:57.361Z","metadata":{"hashes":{"sha256":"a30afeea0bb774b975c0f80273200272e0bc34e3d93caed70dc7356fc156ffc3","sha1":"bc74f9124872569b17a07add9cab82efb7eea843","md5":"609f8450e024ed88b130f13d6d7b213f","sha512":"1bb88c0bd6cc40775738656d6130598b9e62a1d94f53c69e2bbcc5521aabf1c233bb652a446c0814a1f522c2dce0be7db704e2ab3d936fc17858eb7ba1a87e5e","ssdeep":"49152:i0ivhMr3KWDux3B2PfsN7B0eP3GBxGwJzMvY+DHEAh7BeE3bt3FK6/Zas9gthH/9:L","ssdeep_chunks":["49152:i0ivhMr","49152:0ivhMr3","49152:ivhMr3K","49152:vhMr3KW","49152:hMr3KWD","49152:Mr3KWDu","49152:r3KWDux","49152:3KWDux3","49152:KWDux3B","49152:WDux3B2","49152:Dux3B2P","49152:ux3B2Pf","49152:x3B2Pfs","49152:3B2PfsN","49152:B2PfsN7","49152:2PfsN7B","49152:PfsN7B0","49152:fsN7B0e","49152:sN7B0eP","49152:N7B0eP3","49152:7B0eP3G","49152:B0eP3GB","49152:0eP3GBx","49152:eP3GBxG","49152:P3GBxGw","49152:3GBxGwJ","49152:GBxGwJz","49152:BxGwJzM","49152:xGwJzMv","49152:GwJzMvY","49152:wJzMvY+","49152:JzMvY+D","49152:zMvY+DH","49152:MvY+DHE","49152:vY+DHEA","49152:Y+DHEAh","49152:+DHEAh7","49152:DHEAh7B","49152:HEAh7Be","49152:EAh7BeE","49152:Ah7BeE3","49152:h7BeE3b","49152:7BeE3bt","49152:BeE3bt3","49152:eE3bt3F","49152:E3bt3FK","49152:3bt3FK6","49152:bt3FK6/","49152:t3FK6/Z","49152:3FK6/Za","49152:FK6/Zas","49152:K6/Zas9","49152:6/Zas9g","49152:/Zas9gt","49152:Zas9gth","49152:as9gthH","49152:s9gthH/","49152:9gthH/9","98304:i0ivhMr","98304:0ivhMr3","98304:ivhMr3K","98304:vhMr3KW","98304:hMr3KWD","98304:Mr3KWDu","98304:r3KWDux","98304:3KWDux3","98304:KWDux3B","98304:WDux3B2","98304:Dux3B2P","98304:ux3B2Pf","98304:x3B2Pfs","98304:3B2PfsN","98304:B2PfsN7","98304:2PfsN7B","98304:PfsN7B0","98304:fsN7B0e","98304:sN7B0eP","98304:N7B0eP3","98304:7B0eP3G","98304:B0eP3GB","98304:0eP3GBx","98304:eP3GBxG","98304:P3GBxGw","98304:3GBxGwJ","98304:GBxGwJz","98304:BxGwJzM","98304:xGwJzMv","98304:GwJzMvY","98304:wJzMvY+","98304:JzMvY+D","98304:zMvY+DH","98304:MvY+DHE","98304:vY+DHEA","98304:Y+DHEAh","98304:+DHEAh7","98304:DHEAh7B","98304:HEAh7Be","98304:EAh7BeE","98304:Ah7BeE3","98304:h7BeE3b","98304:7BeE3bt","98304:BeE3bt3","98304:eE3bt3F","98304:E3bt3FK","98304:3bt3FK6","98304:bt3FK6/","98304:t3FK6/Z","98304:3FK6/Za","98304:FK6/Zas","98304:K6/Zas9","98304:6/Zas9g","98304:/Zas9gt","98304:Zas9gth","98304:as9gthH","98304:s9gthH/","98304:9gthH/9"],"imphash":"Unknown"},"file_info":{"file_name":"test.jse","file_type":["script","javascript"],"file_type_id":"jse","file_size":28634007,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1628731459000,"last_seen":1683731694000,"last_multi_scan":1683731694000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["apt","nemucod","ransomware"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":14},"sandbox_signatures":{"informative_count":29,"suspicious_count":15,"malicious_count":8,"total":52},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"JS/Agent.bnq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.FMYR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"JS/Agent.AYZ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.FMYR (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.VBS.Agent.awx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Agent","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"PowerShell","attack_id":"T1086","attack_id_wiki":"https://attack.mitre.org/techniques/T1086","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"},{"type":"suspicious","value":"Uses powershell with a windows hidden commandline param"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Execution","technique":"Regsvr32","attack_id":"T1117","attack_id_wiki":"https://attack.mitre.org/techniques/T1117","identifiers":[{"type":"malicious","value":"Detected regsvr32 execution"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"malicious","value":"Uses certutil to decode a file (seen on targeted attacks)"},{"type":"informative","value":"Uses certutil from the Windows Certificate Services"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/techniques/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads the windows installation date"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"powershell.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$27","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\"; Key: \"PATH\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\"; Key: \"APPENDPATH\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\"; Key: \"USESHORTNAME\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\UNINSTALL\\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\"; Key: \"VERSION\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")\n \"iexplore.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"\"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\"; Key: \"\")\n \"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\"; Key: \"\")\n \"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\"; Key: \"\")\n \"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"iexplore.exe\" (Path: \"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\"; Key: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$28","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"cacerts.digicert.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.18.10.39:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\"AcroRd32.exe\" created file \"%TEMP%\\A9Rke3o57_1qm1fky_2y4.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9Rd8uyj4_1qm1fkz_2y4.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9Rcxuncw_1qm1fl0_2y4.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9Rhyulm8_1qm1fl1_2y4.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R1nrs79g_1qm1fl2_2y4.tmp\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF17D96DCFA331B29E.TMP\"\n \"iexplore.exe\" created file \"%TEMP%\\~DF1F34C802556B8C82.TMP\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"Local\\Acrobat Instance Mutex\"\n \"DBWinMutex\"\n \"_SHuassist.mtx\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00069015-00000560)\n Launches browser \"iexplore.exe\" (UID: 00069101-00001472)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 679E0000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 669D0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"AcroRd32.exe\" (UID: 00065039-00003820) was launched with modified environment variables: \"MEOW\"\n Process \"powershell.exe\" (UID: 00065068-00003348) was launched with new environment variables: \"MEOW=\"%SystemRoot%\\system32\\WindowsPowerShell\\v1.0\\\"\"\n Process \"certutil.exe\" (UID: 00065610-00003716) was launched with modified environment variables: \"MEOW, PSModulePath\"\n Process \"RdrCEF.exe\" (UID: 00065995-00002676) was launched with modified environment variables: \"Path, MEOW, PSModulePath\"\n Process \"powershell.exe\" (UID: 00066311-00000492) was launched with modified environment variables: \"Path, MEOW\"\n Process \"regsvr32.exe\" (UID: 00066640-00000904) was launched with modified environment variables: \"PSModulePath\"\n Process \"iexplore.exe\" (UID: 00069015-00000560) was launched with modified environment variables: \"Path, MEOW, PSModulePath\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"AdobeAcrobat\"\n \"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"\n \"AcroRd32.exe\" searching for class \"ACROSEMAPHORE_R18\"\n \"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"\n \"AcroRd32.exe\" searching for class \"JFWUI2\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$29","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AcroRd32.exe\" with commandline \"\"%ALLUSERSPROFILE%\\ 2021-05-07.pdf\"\" (UID: 00065039-00003820)\n Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden certutil -decode %WINDIR%\\..\\ProgramData\\efV ...\" (UID: 00065068-00003348)\n Spawned process \"certutil.exe\" with commandline \"-decode %WINDIR%\\..\\ProgramData\\efVo8cq.sIhn %WINDIR%\\..\\Program ...\" (UID: 00065610-00003716)\n Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden regsvr32.exe /s %WINDIR%\\..\\ProgramData\\glK7 ...\" (UID: 00066311-00000492)\n Spawned process \"regsvr32.exe\" with commandline \"/s %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00066640-00000904)\n Spawned process \"iexplore.exe\" with commandline \"http://cgi1.adobe.com/special/acrobat/pluginfinder/pluginfinder. ...\" (UID: 00069015-00000560)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:560 CREDAT:275457 /prefetch:2\" (UID: 00069101-00001472)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"certutil.exe\" connecting to \"\\ThemeApiPort\"\n \"RdrCEF.exe\" connecting to \"\\ThemeApiPort\"\n \"regsvr32.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates new processes","description":"\"wscript.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\", Handle: 720)\n \"powershell.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\certutil.exe\", Handle: 1064)\n \"powershell.exe\" is creating a new process (Name: \"%WINDIR%\\System32\\regsvr32.exe\", Handle: 1076)\n \"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 900)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"urlblockindex_1_.bin\" has type \"data\"\n \"6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442\" has type \"data\"\n \"12LBIJ11.txt\" has type \"ASCII text\"\n \"3C428B1A3E5F57D887EC4B864FAC5DCC\" has type \"data\"\n \"LQ27L2KB.txt\" has type \"ASCII text\"\n \"~DF17D96DCFA331B29E.TMP\" has type \"data\"\n \"WVT3PHNJ.txt\" has type \"ASCII text\"\n \"1G8CMA9H.txt\" has type \"ASCII text\"\n \"FZS5P4GRSAOW5AX130NP.temp\" has type \"data\"\n \"53H4Y9FU.txt\" has type \"ASCII text\"\n \"en-US.3\" has type \"data\"\n \"efVo8cq.sIhn\" has type \"ASCII text with very long lines with no line terminators\"\n \"ver443.tmp\" has type \"XML 1.0 document UTF-8 Unicode (with BOM) text with CRLF line terminators\"\n \"7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776\" has type \"data\"\n \"_3_I _ 2021-05-07.pdf\" has type \"PDF document version 1.4\"\n \"A9Rke3o57_1qm1fky_2y4.tmp\" has type \"data\"\n \"A9Rhyulm8_1qm1fl1_2y4.tmp\" has type \"data\"\n \"data_1\" has type \"data\"\n \"Visited Links\" has type \"data\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$2a","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"cacerts.digicert.com\"\n Heuristic match: \"GET /DigiCertGlobalRootG2.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: cacerts.digicert.com\"\n Pattern match: \"http://cgi1.adobe.com/special/acrobat/pluginfinder/pluginfinder.cgi?type=LangPkg&name=Extd&os=Win&vers=18.0&\"\n Pattern match: \"https://go.microsoft.com/fwlink/?LinkID=401352\"\n Pattern match: \"https://go.microsoft.com/fwlink/?LinkID=513071\"\n Pattern match: \"https://aka.ms/FlashEOLUpdate\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"System Security","name":"Modifies proxy settings","description":"\"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"wscript.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"certutil.exe\" opened \"\\Device\\KsecDD\"\n \"RdrCEF.exe\" opened \"\\Device\\KsecDD\"\n \"regsvr32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"System Security","name":"Queries sensitive IE security settings","description":"\"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"powershell.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.LNK\"; Key: \"ALWAYSSHOWEXT\")\n \"iexplore.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"iexplore.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"informative","category":"Unusual Characteristics","name":"Uses certutil from the Windows Certificate Services","description":"Process \"certutil.exe\" (UID: 00065610-00003716)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-60","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Uses powershell with a windows hidden commandline param","description":"Process \"powershell.exe\" with commandline \"-windowstyle hidden certutil -decode %WINDIR%\\..\\ProgramData\\efVo8cq.sIhn %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00065068-00003348)\n Process \"powershell.exe\" with commandline \"-windowstyle hidden regsvr32.exe /s %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00066311-00000492)","origin":"Monitored Target","mitre_attack_id":"T1086","relevance":7,"id":"target-114","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"certutil.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RdrCEF.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"iexplore.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"AcroRd32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"RdrCEF.exe\" issued more than 3000 memory allocations","origin":"API Call","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"-windowstyle hidden certutil -decode %WINDIR%\\..\\ProgramData\\efVo8cq.sIhn %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00065068-00003348)\n Process \"powershell.exe\" with commandline \"-windowstyle hidden regsvr32.exe /s %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00066311-00000492)","origin":"Monitored Target","mitre_attack_id":"T1086","relevance":10,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"glK7UwV.pR9a\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$2c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$2d","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.18.10.39 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"AcroRd32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")\n \"iexplore.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"%WINDIR%\\System32\\certutil.exe\" marked \"%WINDIR%\\cerA53F.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"certutil.exe\" opened \"%WINDIR%\\cerA53F.tmp\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2e","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Detected regsvr32 execution","description":"Process \"regsvr32.exe\" with commandline \"/s %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00066640-00000904)","origin":"Monitored Target","mitre_attack_id":"T1117","relevance":10,"id":"target-112","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Uses certutil to decode a file (seen on targeted attacks)","description":"Process \"certutil.exe\" with commandline \"-decode %WINDIR%\\..\\ProgramData\\efVo8cq.sIhn %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00065610-00003716)","origin":"Monitored Target","mitre_attack_id":"T1140","relevance":10,"id":"target-59","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":5,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/35 Antivirus vendors marked sample as malicious (14% detection rate)\n 8/57 Antivirus vendors marked sample as malicious (14% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"48/88 Antivirus vendors marked dropped file \"glK7UwV.pR9a\" as malicious (classified as \"TrojanSpy.Xegumumune\" with 54% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\" was dropped at \"%ALLUSERSPROFILE%\\glK7UwV.pR9a\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behavior","description":"The script produces internet activity\n is obfuscated and drops files","origin":"Indicator Combinations","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"wscript.exe\" with commandline \"\"C:\\test.jse\"\" (UID: 00064545-00002488)\n Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden certutil -decode %WINDIR%\\..\\ProgramData\\efVo8cq.sIhn %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00065068-00003348)\n Spawned process \"certutil.exe\" with commandline \"-decode %WINDIR%\\..\\ProgramData\\efVo8cq.sIhn %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00065610-00003716)\n Spawned process \"powershell.exe\" with commandline \"-windowstyle hidden regsvr32.exe /s %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00066311-00000492)\n Spawned process \"regsvr32.exe\" with commandline \"/s %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a\" (UID: 00066640-00000904)","origin":"Monitored Target","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}]},"activity":{"stats":{"process_count":11,"spawned_processes_count":11,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":29,"imported_dlls_count":201,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":316,"files_deleted_count":0,"registry_keys_created_count":31,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":38,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["apt","nemucod","ransomware"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"611478d693cc0d6a1f6b3e51","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.VBS.Agent","contacted_countries":["USA"],"submit_name":"test.jse","analysis_start_time":"2021-08-12T01:27:00+00:00","indicators_count":{"informative":29,"suspicious":20,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.18.10.39","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}],"dns_resolutions":[{"domain":"cacerts.digicert.com","address":"104.18.10.39","ttl":703,"country":"United States","registrar_name":"GODADDY.COM, LLC","registrar_organization":"DigiCert, Inc.","registrar_name_servers":"NS1.P03.DYNECT.NET","registrar_creation_date":"1996-12-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}],"http_requests":[{"host":"cacerts.digicert.com","host_ip":"104.18.10.39:80","url":"/DigiCertGlobalRootG2.crt","method":"GET","header":"GET /DigiCertGlobalRootG2.crt HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: cacerts.digicert.com","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}],"processes":[{"pid":2488,"ppid":0,"name":"wscript.exe","command_line":"\"C:\\test.jse\"","sha256":"2160ba6829909eeb1d272ac4a5f43588750c0b4743477bf2b46952033b5d4b3b","normalized_path":"%WINDIR%\\System32\\wscript.exe","uid":"00064545-00002488","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAA6ElEQVR42s2WgQrFIAhF/fQ+rT/biIfQelo3u0KCjMVW55paIp2VUh62y461H5h2BcAWRAZArRWHyABoBkNkAcAQM4CdzKcn4W9chtH/96ZS5/KE9N9AADpWipg+Lt5n/jGArfxxlWvWq1sQAYC5em9xDyIEEFFPBUAjYM1J2QJL+RgBtDcEq0CgKCQCfFVbTxRiGwDLBRwiBMCMRBiAFYkjAEYkSAAShjjKAeQCuuoRR1XgNaSxG1IjsDoR+8WRLklvRF+AhBxAks6CoFaBd9T2rvs/u4wcVYFsWkonZNj9AKu9ZrjcZC9vbgLxkdYVYgAAAABJRU5ErkJggg=="},{"pid":3820,"ppid":2488,"name":"AcroRd32.exe","command_line":"\"%ALLUSERSPROFILE%\\¿Ü±³ºÎ °¡ÆÇ 2021-05-07.pdf\"","sha256":"2e9b9635469ff056f09023f7d671120d0c0f86f30767b06daa545c01242bcbef","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","parent_uid":"00064545-00002488","uid":"00065039-00003820"},{"pid":2676,"ppid":3820,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00065039-00003820","uid":"00065995-00002676"},{"pid":332,"ppid":2676,"name":"RdrCEF.exe","command_line":"$30","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00065995-00002676","uid":"00066175-00000332"},{"pid":1888,"ppid":2676,"name":"RdrCEF.exe","command_line":"$31","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00065995-00002676","uid":"00066211-00001888"},{"pid":560,"ppid":3820,"name":"iexplore.exe","command_line":"http://cgi1.adobe.com/special/acrobat/pluginfinder/pluginfinder.cgi?type=LangPkg&name=Extd&os=Win&vers=18.0&","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00065039-00003820","uid":"00069015-00000560"},{"pid":1472,"ppid":560,"name":"iexplore.exe","command_line":"SCODEF:560 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00069015-00000560","uid":"00069101-00001472"},{"pid":3348,"ppid":2488,"name":"powershell.exe","command_line":"-windowstyle hidden certutil -decode %WINDIR%\\..\\ProgramData\\efVo8cq.sIhn %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00064545-00002488","uid":"00065068-00003348"},{"pid":3716,"ppid":3348,"name":"certutil.exe","command_line":"-decode %WINDIR%\\..\\ProgramData\\efVo8cq.sIhn %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a","sha256":"48850fb7229d99e48c3a749556684e962587058d612c659c58f8b8db2d00abee","normalized_path":"%WINDIR%\\System32\\certutil.exe","parent_uid":"00065068-00003348","uid":"00065610-00003716"},{"pid":492,"ppid":2488,"name":"powershell.exe","command_line":"-windowstyle hidden regsvr32.exe /s %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00064545-00002488","uid":"00066311-00000492"},{"pid":904,"ppid":492,"name":"regsvr32.exe","command_line":"/s %WINDIR%\\..\\ProgramData\\glK7UwV.pR9a","sha256":"890c1734ed1ef6b2422a9b21d6205cf91e014add8a7f41aa5a294fcf60631a7b","normalized_path":"%WINDIR%\\System32\\regsvr32.exe","parent_uid":"00066311-00000492","uid":"00066640-00000904"}],"all_imported_dlls":["msftedit.dll","msimg32.dll","hid.dll","System.Configuration.Install.ni.dll","Microsoft.PowerShell.Security.ni.dll","cryptsp.dll","imm32.dll","winmm.dll","ntmarta.dll","oleacc.dll","netapi32.dll","wintrust.dll","profapi.dll","srvcli.dll","ntshrui.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","msxml3r.dll","cfgmgr32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","version.dll","shdocvw.dll","tzres.dll","WSHTCPIP.DLL","comdlg32.dll","sxs.dll","jscript.dll","wshext.dll","AcroRd32.dll","d3d9.dll","sqmapi.dll","shfolder.dll","certcli.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","AXSLE.dll","schannel.dll","mscorjit.dll","sechost.dll","rsaenh.dll","comctl32.dll","MMDevAPI.dll","sfc.dll","setupapi.dll","cryptbase.dll","msisip.dll","scrobj.dll","sspicli.dll","dui70.dll","dhcpcsvc.dll","FWPUCLNT.DLL","api-ms-win-core-synch-l1-2-0.dll","advapi32.dll","webio.dll","ccme_ecc.dll","gpapi.dll","ieui.dll","linkinfo.dll","Microsoft.PowerShell.Commands.Management.ni.dll","AGM.dll","mswsock.dll","IEShims.dll","atl.dll","propsys.dll","xmllite.dll","msvcr80.dll","Microsoft.WSMan.Runtime.dll","System.Management.ni.dll","oleaut32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","netprofm.dll","WSDApi.dll","cryptui.dll","iertutil.dll","msvcp120.dll","wsock32.dll","msvcr120.dll","CoolType.dll","bcrypt.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","ws2_32.dll","SensApi.dll","chrome_elf.dll","ieproxy.dll","System.Data.dll","normaliz.dll","clbcatq.dll","rasadhlp.dll","mscoree.dll","GdiPlus.dll","BIB.dll","DWrite.dll","samcli.dll","wlanutil.dll","ntdsapi.dll","kernel32.dll","rpcrt4.dll","urlmon.dll","wininet.dll","oleaccrc.dll","wevtapi.dll","d2d1.dll","System.Xml.ni.dll","RpcRtRemote.dll","duser.dll","nlaapi.dll","ccme_base.dll","gdi32.dll","winhttp.dll","ncrypt.dll","d3d8thk.dll","WindowsCodecs.dll","System.Data.ni.dll","msxml3.dll","userenv.dll","AcroRd32Res.dll","wshqos.dll","wtsapi32.dll","wlanapi.dll","mscorlib.ni.dll","System.Management.Automation.dll","Wldap32.dll","npmproxy.dll","wkscli.dll","mshtml.dll","System.ni.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","System.Transactions.ni.dll","ntdll.dll","rpcss.dll","nsi.dll","secur32.dll","BIBUtils.dll","wship6.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","sfc_os.dll","ole32.dll","msado15.dll","ACE.dll","psapi.dll","ccme_asym.dll","cryptnet.dll","mscorwks.dll","mscorrc.dll","msctf.dll","devobj.dll","msasn1.dll","IPHLPAPI.DLL","cryptocme.dll","d3d11.dll","Microsoft.WSMan.Management.ni.dll","System.DirectoryServices.ni.dll","KernelBase.dll","lpk.dll","netutils.dll","icudt.dll","bcryptprimitives.dll","dsrole.dll","dwmapi.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","sqlite.dll","dbghelp.dll","credssp.dll","slc.dll","System.Core.ni.dll","cabinet.dll","scrrun.dll","shell32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","mscoreei.dll","AcGenral.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","msvcrt.dll","AudioSes.dll","credui.dll","usp10.dll","ExplorerFrame.dll","dnsapi.dll","ccme_base_non_fips.dll","libcef.dll","KBDUS.DLL","dxgi.dll","mscms.dll","cscapi.dll","System.Management.Automation.ni.dll","logoncli.dll","msacm32.dll","uxtheme.dll","apphelp.dll","dxva2.dll","System.Transactions.dll","wpdshext.dll","api-ms-win-downlevel-user32-l1-1-0.dll","user32.dll","crypt32.dll","mpr.dll","msdart.dll","ieframe.dll","AXE8SharedExpat.dll","winnsi.dll","dhcpcsvc6.dll","shlwapi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"glK7UwV.pR9a","sha256":"0a4f2cff4d4613c08b39c9f18253af0fd356697368eecddf7c0fa560386377e6","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"efVo8cq.sIhn","sha256":"cf605e3bb8181ed066b3750917a6244b599b5350f758afccb77ef244948a4ff0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"0MO336FE.txt","sha256":"2a445ef98cb09047f60394357092e26de00f723e43c5a3fa9e0b406cac6aee5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"12LBIJ11.txt","sha256":"64e0fc9ded060a19caf1e92ec5aac07a73e3c6ecf616d2dd5851701fcbbb0914","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"1G8CMA9H.txt","sha256":"42f6cfb7cafe62a20b0f260ce541af50ad7eb7a38116056fe5be3b4e883bc52c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"20DN3VKH.txt","sha256":"ae35fc56ff574c5701871b7ea37148edde4a4a07c470af56020ee754f29cce0c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"2R9PEXZB.txt","sha256":"09d5261ca8ad4c76ade72f0ae5719ff2f4bf09ea856b2f54705f443427be7e4f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"2RMNFQBX.txt","sha256":"c182aabec9149e2ae2ec52137fe23ed573f597c30e9b7a8eb7ae548bf6d0376f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"53H4Y9FU.txt","sha256":"1306ed867aabb95678c28fd809c3fd0874598a76f091b52867109e97d9a3378d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"GL240N0O.txt","sha256":"fd44b7ab7ab6fbaff09e8dbe7f20d562d64798a712df619980c86929defa9975","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"K01OWJ41.txt","sha256":"9571218e1976512fecbc317f2a6754603d604692b21acc02a5ad9ca7ceaac80d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"LQ27L2KB.txt","sha256":"7ed498e846bdbdb8f4c17c7232e661e80e25354640aa68734dd273a57e3e472a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"WVT3PHNJ.txt","sha256":"d61f8ed468f9036c4f87cd80a9b4a2800996cb614d039fb7a75f6a78f648310b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"6YWU3MODFXQ4RLLJ9DQX.temp","sha256":"d74e8bd8b1da6e3551449d5341346abc76f7211857eac9857d87ec1e3a87ece9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"FZS5P4GRSAOW5AX130NP.temp","sha256":"a725d451bac78523fcf603e2e654994a1182e9be9e6e958694729b084f12c0b6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"data_1","sha256":"87be090bfa95f9e7258642b9b1b3a55ded2b504ef99e0810a42096e9ffadcb6a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Visited Links","sha256":"9d1c9dc432b2e97f7a54b4da2724e4ff96dc719e60cb89c9f82dbec9226856c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"en-US.3","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"ver443.tmp","sha256":"159bd4343f344a08f6af3b716b6fa679859c1bd1d7030d26ff5ef0255b86e1d9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sha256":"0081210b9a737e9b3923267c8be03fdeabfb3c536f8d798f936596f06b028263","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}],"files_written":[{"path":"%WINDIR%\\System32\\en-US\\certutil.exe.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\efVo8cq.sIhn","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\crash_reporter.cfg","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\KBDUS.DLL","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%TEMP%\\Low","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\File System\\primary.origin","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%TEMP%\\~DF17D96DCFA331B29E.TMP","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\en-US\\wscript.exe.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\test.jse","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\arialn.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\arialnb.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\arialnbi.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\arialni.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\msxml3r.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32Res.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\¿Ü±³ºÎ °¡ÆÇ 2021-05-07.pdf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\Viewer.aapp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\cep-plugins\\PIPViewer\\index.html","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\scrrun.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Resource\\CMap\\Identity-H","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Resource\\CMap\\Identity-V","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\EPDF_RHP.aapp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\wshom.ocx","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"pipe\\com.adobe.reader.rna.nAO5BeY.DC.0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\css\\home-selector.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\segoeuisl.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeComFnt18.lst","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeCMapFnt18.lst","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeSysFnt18.lst","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt18.lst","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{0B769D9B-FAFC-11EB-94C0-080027DA30DC}.dat","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%TEMP%\\~DF1F34C802556B8C82.TMP","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{0B769D99-FAFC-11EB-94C0-080027DA30DC}.dat","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\SEGOEUISL.TTF","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%TEMP%\\A9Rke3o57_1qm1fky_2y4.tmp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%TEMP%\\A9Rd8uyj4_1qm1fkz_2y4.tmp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%TEMP%\\A9Rcxuncw_1qm1fl0_2y4.tmp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%TEMP%\\A9Rhyulm8_1qm1fl1_2y4.tmp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%TEMP%\\A9R1nrs79g_1qm1fl2_2y4.tmp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_137095CCA1922136C4B9E18EE962B463","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\VersionManager\\ver443.tmp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\urlblockindex[1].bin","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_8FB29C35032AE1827A2754ED35D7F2E8","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\0MO336FE.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_182DAED95AA6F1285FE339A5B91AB604","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\12LBIJ11.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3C428B1A3E5F57D887EC4B864FAC5DCC","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\80237EE4964FC9C409AAF55BF996A292_289911146CA8EA5846A770DE7BCA5AF4","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8A7891822FCFF127E4EADADE9757112B","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\0AB67BD4882FB0E09822529CFEB33A58","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\suggestions[1].en-US","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\K01OWJ41.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\WVT3PHNJ.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\GL240N0O.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\1G8CMA9H.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\53H4Y9FU.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\20DN3VKH.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2R9PEXZB.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.3","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_711ED44619924BA6DC33E69F97E7FF63","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\2RMNFQBX.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\LQ27L2KB.txt","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3C428B1A3E5F57D887EC4B864FAC5DCC","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\search[1].json","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\en-US\\powershell.exe.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\regsvr32.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\AppPatch\\AcGenral.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\en-US\\regsvr32.exe.mui","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PUBLIC%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\Users\\Public","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%PUBLIC%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\glK7UwV.pR9a","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\FZS5P4GRSAOW5AX130NP.temp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Windows PowerShell\\Windows PowerShell.lnk","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell_ise.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\hh.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\6YWU3MODFXQ4RLLJ9DQX.temp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\d93f411851d7c929.customDestinations-ms~RFfd99e.TMP","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe.config","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\machine.config","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\config\\enterprisesec.config.cch","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%APPDATA%\\Microsoft\\CLR Security Config\\v2.0.50727.312\\security.config.cch","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\index357.dat","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\assembly\\pubpol247.dat","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\System.Management.Automation\\1.0.0.0__31bf3856ad364e35\\System.Management.Automation.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\l_intl.nls","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sorttbls.nlp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\mscorlib\\2.0.0.0__b77a5c561934e089\\sortkey.nlp","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\assembly\\GAC_MSIL\\Microsoft.WSMan.Runtime\\1.0.0.0__31bf3856ad364e35\\Microsoft.WSMan.Runtime.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Transactions\\2.0.0.0__b77a5c561934e089\\System.Transactions.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorrc.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\getevent.types.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\types.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Diagnostics.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\WSMan.Format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Certificate.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\DotNetTypes.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\FileSystem.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Help.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellCore.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PowerShellTrace.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\Registry.format.ps1xml","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\assembly\\GAC_32\\System.Data\\2.0.0.0__b77a5c561934e089\\System.Data.dll","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"path":"%WINDIR%\\System32\\certutil.exe","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\ADOBE\\ACROBAT READER\\DC\\EXITSECTION\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKCU\\SOFTWARE\\CHROMIUM\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKCU\\SOFTWARE\\CHROMIUM\\\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKCU\\\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"DIRECT3D\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"CTLS\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"CRLS\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUST\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\TRUSTEDPEOPLE\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\SMARTCARDROOT\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\\AUTOENROLLMENT\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"USERASSIST\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_560","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_230_IE_EarlyTabStart_0x7a4_Mutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_230_ConnHashTable<560>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_560","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"IsoScope_230_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"IsoScope_230_ConnHashTable<560>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"IsoScope_230_IE_EarlyTabStart_0x7a4_Mutex","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_230_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"611478d693cc0d6a1f6b3e51"}]}]}},"report_ids":{"sandbox_job_ids":["611478d693cc0d6a1f6b3e51"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Agent Sample a30afeea0bb7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample a30afeea0bb7…. Malware family: Trojan.Agent. Threat score 100/100. 5/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a30afeea0bb774b975c0f80273200272e0bc34e3d93caed70dc7356fc156ffc3"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Agent Sample a30afeea0bb7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample a30afeea0bb7…. Malware family: Trojan.Agent. Threat score 100/100. 5/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a30afeea0bb774b975c0f80273200272e0bc34e3d93caed70dc7356fc156ffc3"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Agent Sample a30afeea0bb7… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample a30afeea0bb7…. Malware family: Trojan.Agent. Threat score 100/100. 5/27 AV engines flagged this file. 8 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]