24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T460,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample b1da7e1963dc… — Score 79/100 — Hybrid Analysis","description":"Malicious verdict for sample b1da7e1963dc…. Malware family: Malware. Threat score 79/100. 23/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8","additionalType":"Malicious sample"},"threatScore":79,"malwareFamily":"Malware","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":4,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta78,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKCU\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKCU\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKCU\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER")26:T50a,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" ".exe" touched file "C:\Windows\Temp\pvcu.dll" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db" "cmd.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "cmd.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "rundll32.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "rundll32.exe" touched file "C:\Windows\System32\rundll32.exe" "rundll32.exe" touched file "C:\Windows\AppPatch\AcLayers.dll" "rundll32.exe" touched file "C:\Windows\System32\tzres.dll" "rundll32.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "rundll32.exe" touched file "C:\Windows\System32\rsaenh.dll" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "rundll32.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "rundll32.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"27:T28c6,"2017-12-06 22:51:39, Info DISM API: PID=3692 TID=3748 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_x86_neutral_194f6963f2c52026\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-06 22:51:39, Info DISM DISM Driver Manager: PID=4052 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2017-12-06 22:51:39, Info DISM DISM Driver Manager: PID=4052 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2017-12-06 22:51:39, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\VBoxGuest.cat]" (Indicator: "vbox") "2017-12-06 22:51:39, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\VBoxGuest.cat]" (Indicator: "vboxguest") "2017-12-06 22:51:39, Info DISM DISM Driver Manager: PID=4052 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2017-12-06 22:51:39, Info DISM DISM Driver Manager: PID=4052 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2017-12-06 22:51:39, Info DISM API: PID=3692 TID=3748 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-06 22:51:39, Info DISM API: PID=3692 TID=3748 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_5a6838e85c9947b0\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-12-21 18:26:02, Info DISM API: PID=2904 TID=1308 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_x86_neutral_fa6902d06b336357\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-12-21 18:26:02, Info DISM DISM Driver Manager: PID=2784 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-12-21 18:26:02, Info DISM DISM Driver Manager: PID=2784 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-12-21 18:26:02, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\VBoxGuest.cat]" (Indicator: "vbox") "2018-12-21 18:26:02, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-12-21 18:26:02, Info DISM DISM Driver Manager: PID=2784 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-12-21 18:26:02, Info DISM DISM Driver Manager: PID=2784 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-12-21 18:26:02, Info DISM API: PID=2904 TID=1308 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-12-21 18:26:02, Info DISM API: PID=2904 TID=1308 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-12-28 13:06:08, Info DISM API: PID=1552 TID=2416 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_x86_neutral_fa6902d06b336357\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-12-28 13:06:08, Info DISM DISM Driver Manager: PID=3368 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-12-28 13:06:08, Info DISM DISM Driver Manager: PID=3368 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-12-28 13:06:08, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\VBoxGuest.cat]" (Indicator: "vbox") "2018-12-28 13:06:08, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-12-28 13:06:08, Info DISM DISM Driver Manager: PID=3368 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-12-28 13:06:08, Info DISM DISM Driver Manager: PID=3368 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-12-28 13:06:08, Info DISM API: PID=1552 TID=2416 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-12-28 13:06:08, Info DISM API: PID=1552 TID=2416 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_55bec8a7ffe19fc1\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-03-20 21:46:18, Info DISM API: PID=1644 TID=2120 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_x86_neutral_ecf53092b172f4a2\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-03-20 21:46:18, Info DISM DISM Driver Manager: PID=3316 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-03-20 21:46:18, Info DISM DISM Driver Manager: PID=3316 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-03-20 21:46:18, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\VBoxGuest.cat]" (Indicator: "vbox") "2019-03-20 21:46:18, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-03-20 21:46:18, Info DISM DISM Driver Manager: PID=3316 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-03-20 21:46:18, Info DISM DISM Driver Manager: PID=3316 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2019-03-20 21:46:18, Info DISM API: PID=1644 TID=2120 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-03-20 21:46:18, Info DISM API: PID=1644 TID=2120 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_x86_neutral_4724fcf083c0266e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest")28:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAD///////////////AAAAAA/////4h4d3eHeHjwAAAAAP////+HB4d3d3d48AAAAAD/if//93d3d3d3ePAAAAAA/5if//d4d4eHj3/wAAAAAP+Iif/3j/f/iP//8AAAAAD//4eP//////////AAAAAA////mP/////4iI/wAAAAAP///4eIiP/4l4j/8AAAAAD////5/4h5mYiI//AAAAAA////+I//mP+I///wAAAAAP////+f+Y//////8AAAAAD/////iIf///////AAAAAA//////mf///////wAAAAAP/////3j///////8AAAAAD/////+Y////////AAAAAA//////mP///////wAAAAAP////+Hj///////8AAAAAD/////h/////////AAAAAA/////4eP///////wAAAAAIiIiIiHeIiP////gAERERERERERERERj///iAABEREXEXcRcREREY//iIgAAZkRdxH38fERERGPiIiAAAmZmX+J8Yf4ERERj/+IAAAJmZl4d/GH9xEREY/4gAAACZmZf/n/gfhxERGIiAAAAAmZmZmZmZmZERERiIAAAAAIiIiHd3d3d3d3d4gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAAB/wAAAf8AAAH/AAABgAAAA4AAAAOAAAAHgAAAD4AAAB+AAAA/gAAAf4AAAP///////////w==29:T5c2,--type=renderer --primordial-pipe-token=6753BF2A09AD644515A15BD732792F8C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=6753BF2A09AD644515A15BD732792F8C --renderer-client-id=2 --mojo-platform-channel-handle=1260 --allow-no-sandbox-job /prefetch:12a:T5c2,--type=renderer --primordial-pipe-token=1D911656BDEA7DE3DF6E9CA743962281 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=1D911656BDEA7DE3DF6E9CA743962281 --renderer-client-id=3 --mojo-platform-channel-handle=1312 --allow-no-sandbox-job /prefetch:11b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":79,"unified_at_epoch_ms":1790270727749,"unified_at":"2026-09-24T17:25:27.749Z","metadata":{"hashes":{"sha256":"b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8","sha1":"4e20e8a7ccca8eceb7b4d093029d3fe6e8f842e7","md5":"71ced11505965c104377e934fcb1e30b","sha512":"217685e89821b3bf778be049c434059ff9df7b5e389565023e098e9db2cea5ac93b63508f84fe02d46031e7770300b554421c11a766c9ffe6ad648019986f04a","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":235363,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1603783075000,"last_seen":1698224121000,"last_multi_scan":1698224121000}},"detections":{"summary":{"verdict":"malicious","score":79,"tags":["bisonal","targeted"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":11},"sandbox_signatures":{"informative_count":17,"suspicious_count":13,"malicious_count":4,"total":34},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.TSGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.Bisonal.apiln","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Crypt.19","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Trojan.Agent-6631988-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Crypt.19 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik.GQNG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 0053013b1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Agent.bjvscd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic trojan.qh","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Crypt.faxaoj","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_97","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Mdrop-IGO","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Trojan.2B8FE279","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Trojan.2B8FE279","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.BTU","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Dropper.Agent.Win32.382442","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Command-Line Interface","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Runs shell commands"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1060","attack_id_wiki":"https://attack.mitre.org/techniques/T1060","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\CMD.EXE\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\"; Key: \"PATH\"; Value: \"00000000010000006200000043003A005C00500072006F006700720061006D002000460069006C00650073005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"euiro8966.organiccrap.com\"\n \"kted56erhg.dynssl.com\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%WINDIR%\\Temp\\pvcu.dll\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R1aq5us1_13xrjby_1uo.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex\"\n \"Local\\Acrobat Instance Mutex\"\n \"DBWinMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"DISMHOST.EXE.5FBC24C2.bin\" as clean (type is \"PE32 executable (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$25","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00064619-00003896) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"AcroRd32.exe\" (UID: 00064631-00002400) was launched with modified environment variables: \"Path\"\n Process \"AcroRd32.exe\" (UID: 00064631-00002400) was launched with missing environment variables: \"PROMPT\"\n Process \"RdrCEF.exe\" (UID: 00065131-00004020) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"/c rundll32.exe %WINDIR%\\temp\\pvcu.dll,Qszdez\" on 2020-11-23.20:54:19.938","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"\n \"AcroRd32.exe\" searching for class \"ACROSEMAPHORE_R18\"\n \"AcroRd32.exe\" searching for class \"JFWUI2\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"/c rundll32.exe %WINDIR%\\temp\\pvcu.dll,Qszdez\" (UID: 00064616-00002404)\n Spawned process \"rundll32.exe\" with commandline \"%WINDIR%\\temp\\pvcu.dll,Qszdez\" (UID: 00064619-00003896)\n Spawned process \"AcroRd32.exe\" with commandline \"\"%WINDIR%\\temp\\ - ...\" (UID: 00064631-00002400), Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00065131-00004020), Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=6753BF2A09AD644515A15BD7 ...\" (UID: 00065239-00002912), Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=1D911656BDEA7DE3DF6E9CA7 ...\" (UID: 00065277-00001688)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"/c rundll32.exe %WINDIR%\\temp\\pvcu.dll,Qszdez\" (UID: 00064616-00002404)\n Spawned process \"rundll32.exe\" with commandline \"%WINDIR%\\temp\\pvcu.dll,Qszdez\" (UID: 00064619-00003896)\n Spawned process \"AcroRd32.exe\" with commandline \"\"%WINDIR%\\temp\\ - ...\" (UID: 00064631-00002400)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"rundll32.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"DISMHOST.EXE.5FBC24C2.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"pvcu.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"A9R6dalzz_13xrjbu_1uo.tmp\" has type \"data\"\n \"A9R8n06jz_13xrjbx_1uo.tmp\" has type \"data\"\n \"data_1\" has type \"data\"\n \"Visited Links\" has type \"data\"\n \"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl\" has type \"data\"\n \"A9R3kz6pl_13xrjbv_1uo.tmp\" has type \"data\"\n \"dism.log\" has type \"UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators\"\n \"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl\" has type \"data\"\n \"desktop.ini\" has type \"empty\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$26","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"euiro8966.organiccrap.com\"\n Heuristic match: \"kted56erhg.dynssl.com\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"rundll32.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"rundll32.exe\" opened \"\\Device\\KsecDD\"\n \"RdrCEF.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"rundll32.exe\" at 00064619-00003896-00000105-2450391","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"rundll32.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"7/82 reputation engines marked \"http://kted56erhg.dynssl.com\" as malicious (8% detection rate)\n 7/80 reputation engines marked \"http://euiro8966.organiccrap.com\" as malicious (8% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"DISMHOST.EXE.5FBC24C2.bin\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\"\n \"pvcu.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"VERT\"; Value: \"rundll32.exe %WINDIR%\\temp\\pvcu.dll,Qszdez\")","origin":"Registry Access","mitre_attack_id":"T1060","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"cmd.exe\" wrote 1500 bytes to a remote process \"%WINDIR%\\System32\\rundll32.exe\" (Handle: 80)\n \"cmd.exe\" wrote 4 bytes to a remote process \"%WINDIR%\\System32\\rundll32.exe\" (Handle: 80)\n \"cmd.exe\" wrote 32 bytes to a remote process \"%WINDIR%\\System32\\rundll32.exe\" (Handle: 80)\n \"cmd.exe\" wrote 52 bytes to a remote process \"%WINDIR%\\System32\\rundll32.exe\" (Handle: 80)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"rundll32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"rundll32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"rundll32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"rundll32.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"rundll32.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"rundll32.exe\" wrote bytes \"e7394877e1a64c772e714c77ee294c7785e247776da04c7790644b773ad5527726e44777d16d4c77003d4a77804b4a7700000000ad37e6758b2de675b641e67500000000\" to virtual address \"0x74D31000\" (part of module \"WSHIP6.DLL\")\n \"rundll32.exe\" wrote bytes \"c04e4a7720544b77e0654b77b5384c770000000000d0ae7500000000c5eaae750000000088eaae7500000000e9683b7582284c77ee294c7700000000d2693b75000000007dbbae750000000009be3b7500000000ba18ae7500000000\" to virtual address \"0x75A91000\" (part of module \"NSI.DLL\")\n \"rundll32.exe\" wrote bytes \"fae64777e1a64c772e714c77ee294c7785e247776da04c7726e44777d16d4c77003d4a77804b4a7700000000ad37e6758b2de675b641e67500000000\" to virtual address \"0x747F1000\" (part of module \"WSHTCPIP.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"RdrCEF.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"RdrCEF.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"58/71 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"58/71 Antivirus vendors marked sample as malicious (81% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"56/70 Antivirus vendors marked dropped file \"pvcu.dll\" as malicious (classified as \"Backdoor.Bisonal\" with 80% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\" was dropped at \"%WINDIR%\\temp\\pvcu.dll\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":146,"dropped_files_count":0,"extracted_files_count":10,"files_written_count":169,"files_deleted_count":0,"registry_keys_created_count":17,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":24,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":2,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["bisonal","targeted"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"5fbc2140fdacc717263f70fe","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":79,"malware_family":"Gen:Variant.Crypt","contacted_countries":["ZZZ"],"submit_name":"b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8","analysis_start_time":"2020-11-23T20:53:32+00:00","indicators_count":{"informative":17,"suspicious":17,"malicious":5},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"euiro8966.organiccrap.com","address":"127.0.0.1","ttl":29,"country":"Reserved","registrar_name":"Rethem Hosting, LLC Specializing in DDoS mitigation and attack resilience","registrar_organization":"Network OperationsZZZ ChangeIP","registrar_name_servers":"NS1.CHANGEIP.COM","registrar_creation_date":"2001-02-03T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"domain":"kted56erhg.dynssl.com","address":"127.0.0.1","ttl":29,"country":"Reserved","registrar_name":"Rethem Hosting, LLC Specializing in DDoS mitigation and attack resilience","registrar_organization":"Network OperationsZZZ ChangeIP","registrar_name_servers":"NS1.CHANGEIP.COM","registrar_creation_date":"2005-05-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}],"processes":[{"pid":2452,"ppid":0,"name":"b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8.exe","command_line":"","sha256":"b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8","normalized_path":"C:\\b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8.exe","uid":"00064418-00002452","icon":"$28"},{"pid":2404,"ppid":2452,"name":"cmd.exe","command_line":"/c rundll32.exe %WINDIR%\\temp\\pvcu.dll,Qszdez","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00064418-00002452","uid":"00064616-00002404"},{"pid":3896,"ppid":2404,"name":"rundll32.exe","command_line":"%WINDIR%\\temp\\pvcu.dll,Qszdez","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00064616-00002404","uid":"00064619-00003896"},{"pid":2400,"ppid":2452,"name":"AcroRd32.exe","command_line":"\"%WINDIR%\\temp\\Комплексный проект по созданию жилищно-строительных кооперативов для работников оборонки.pdf\"","sha256":"2e9b9635469ff056f09023f7d671120d0c0f86f30767b06daa545c01242bcbef","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","parent_uid":"00064418-00002452","uid":"00064631-00002400"},{"pid":4020,"ppid":2400,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00064631-00002400","uid":"00065131-00004020"},{"pid":2912,"ppid":4020,"name":"RdrCEF.exe","command_line":"$29","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00065131-00004020","uid":"00065239-00002912"},{"pid":1688,"ppid":4020,"name":"RdrCEF.exe","command_line":"$2a","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00065131-00004020","uid":"00065277-00001688"}],"all_imported_dlls":["api-ms-win-downlevel-user32-l1-1-0.dll","msimg32.dll","MMDevAPI.dll","devobj.dll","wshqos.dll","ccme_base.dll","KBDUS.DLL","gdi32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","winrnr.dll","BIBUtils.dll","dxgi.dll","user32.dll","version.dll","npmproxy.dll","NapiNSP.dll","CoolType.dll","psapi.dll","wlanutil.dll","uxtheme.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","iertutil.dll","lpk.dll","setupapi.dll","winbrand.dll","wship6.dll","mpr.dll","comctl32.dll","usp10.dll","rpcrt4.dll","winhttp.dll","WSHTCPIP.DLL","d3d9.dll","wevtapi.dll","wlanapi.dll","shlwapi.dll","propsys.dll","normaliz.dll","dwmapi.dll","nsi.dll","srvcli.dll","dxva2.dll","ntdll.dll","msctf.dll","sechost.dll","BIB.dll","ExplorerFrame.dll","credui.dll","KernelBase.dll","mfc42u.dll","clbcatq.dll","AXE8SharedExpat.dll","ccme_asym.dll","cryptui.dll","netutils.dll","FWPUCLNT.DLL","apphelp.dll","pnrpnsp.dll","AGM.dll","AXSLE.dll","ccme_base_non_fips.dll","credssp.dll","dbghelp.dll","d3d8thk.dll","ieframe.dll","cfgmgr32.dll","urlmon.dll","rsaenh.dll","msvcr120.dll","oleacc.dll","wsock32.dll","libcef.dll","wkscli.dll","DWrite.dll","oleaccrc.dll","AcLayers.dll","tzres.dll","ole32.dll","ccme_ecc.dll","crypt32.dll","msasn1.dll","hid.dll","wtsapi32.dll","mswsock.dll","msvcrt.dll","advapi32.dll","Wldap32.dll","sqlite.dll","icudt.dll","AudioSes.dll","oleaut32.dll","webio.dll","mscms.dll","api-ms-win-core-synch-l1-2-0.dll","secur32.dll","ws2_32.dll","nlaapi.dll","d3d11.dll","imm32.dll","rpcss.dll","pvcu.dll","msvcp120.dll","odbcint.dll","dhcpcsvc6.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rasadhlp.dll","ACE.dll","comdlg32.dll","wintrust.dll","duser.dll","dui70.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","cryptsp.dll","IPHLPAPI.DLL","api-ms-win-downlevel-shlwapi-l2-1-0.dll","chrome_elf.dll","netapi32.dll","ncrypt.dll","ntmarta.dll","AcroRd32.dll","sspicli.dll","kernel32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","winnsi.dll","dhcpcsvc.dll","gpapi.dll","samcli.dll","cryptocme.dll","WSDApi.dll","cryptbase.dll","odbc32.dll","dnsapi.dll","winmm.dll","profapi.dll","imagehlp.dll","netprofm.dll","wininet.dll","RpcRtRemote.dll","AcroRd32Res.dll","SensApi.dll","bcrypt.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","userenv.dll","shell32.dll","GdiPlus.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"pvcu.dll","sha256":"1128d10347dd602ecd3228faa389add11415bf6936e2328101311264547afa75","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"DISMHOST.EXE.5FBC24C2.bin","sha256":"ecb636b278261eade712e68ec7d805d20e802628248da872d3d0ada1432ffc11","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"data_1","sha256":"042ba46ac2a32c166661dd3812939e8b40a1c4abbb822900809200b8ced7b9eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"Visited Links","sha256":"9d1c9dc432b2e97f7a54b4da2724e4ff96dc719e60cb89c9f82dbec9226856c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"A9R3kz6pl_13xrjbv_1uo.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"A9R6dalzz_13xrjbu_1uo.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"A9R8n06jz_13xrjbx_1uo.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"dism.log","sha256":"ceb0580f0f174bb27a01d12cc4844c56a21ef4734e2c271a7c7081ce1de59092","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"9009ab7605c35a2b5121b8b5c966b3c893edba9966925268c45ad05b348671c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}],"files_written":[{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\crash_reporter.cfg","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\File System\\primary.origin","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"C:\\b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8.exe","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Temp\\pvcu.dll","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\cmd.exe","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\arialn.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\arialnb.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\arialnbi.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\arialni.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32Res.dll","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\segoeuisl.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\css\\home-selector.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%TEMP%\\A9R1aq5us1_13xrjby_1uo.tmp","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\en-US\\odbcint.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\en-US\\MFC42u.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\KBDUS.DLL","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\cep-plugins\\PIPViewer\\index.html","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\SEGOEUISL.TTF","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\Temp\\Комплексный проект по созданию жилищно-строительных кооперативов для работников оборонки.pdf","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\Viewer.aapp","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\EPDF_RHP.aapp","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"pipe\\com.adobe.reader.rna.8tDRGsG.DC.0","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000027.db","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeComFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeCMapFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeSysFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%TEMP%\\A9R6dalzz_13xrjbu_1uo.tmp","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%TEMP%\\A9R3kz6pl_13xrjbv_1uo.tmp","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%TEMP%\\A9R1de3fgp_13xrjbw_1uo.tmp","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%TEMP%\\A9R8n06jz_13xrjbx_1uo.tmp","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\CHROMIUM\\\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\CHROMIUM\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]},{"name":"com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"5fbc2140fdacc717263f70fe"}]}]}},"report_ids":{"sandbox_job_ids":["5fbc2140fdacc717263f70fe"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Malware Sample b1da7e1963dc… — Score 79/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b1da7e1963dc…. Malware family: Malware. Threat score 79/100. 23/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample b1da7e1963dc… — Score 79/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b1da7e1963dc…. Malware family: Malware. Threat score 79/100. 23/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b1da7e1963dc09c325ba3ea2442a54afea02929ec26477a1b120ae44368082f8"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample b1da7e1963dc… — Score 79/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b1da7e1963dc…. Malware family: Malware. Threat score 79/100. 23/28 AV engines flagged this file. 4 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]