24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T484,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Reconyc Sample b3e85c569e89… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b3e85c569e89…. Malware family: Trojan.Reconyc. Threat score 100/100. 15/28 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b","keywords":["Malicious","Trojan.Reconyc","malware analysis","sandbox report","threat intelligence","b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b"],"about":{"@type":"SoftwareApplication","name":"bad.scr","applicationCategory":["peexe","executable"],"identifier":"b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Reconyc","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T921,"RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arial.ttf" at 00011476-00003492-0000010C-51041117914 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALN.TTF" at 00011476-00003492-0000010C-51694743567 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ariali.ttf" at 00011476-00003492-0000010C-51725634150 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNI.TTF" at 00011476-00003492-0000010C-51734963045 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arialbd.ttf" at 00011476-00003492-0000010C-51745110617 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNB.TTF" at 00011476-00003492-0000010C-51754106605 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\arialbi.ttf" at 00011476-00003492-0000010C-51758453027 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ARIALNBI.TTF" at 00011476-00003492-0000010C-51781164536 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\ariblk.ttf" at 00011476-00003492-0000010C-51798922440 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuil.ttf" at 00011476-00003492-0000010C-64463923110 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\SEGOEUISL.TTF" at 00011476-00003492-0000010C-64498726479 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeui.ttf" at 00011476-00003492-0000010C-64511897522 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuii.ttf" at 00011476-00003492-0000010C-64547945831 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\seguisb.ttf" at 00011476-00003492-0000010C-64561185229 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuib.ttf" at 00011476-00003492-0000010C-64575835955 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\segoeuiz.ttf" at 00011476-00003492-0000010C-64597331624 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\times.ttf" at 00011476-00003492-0000010C-64842053664 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesi.ttf" at 00011476-00003492-0000010C-64856085034 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesbd.ttf" at 00011476-00003492-0000010C-64869096707 "RdrCEF.exe" queries volume information of "C:\Windows\Fonts\timesbi.ttf" at 00011476-00003492-0000010C-6488035136026:T412,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Adobe Acrobat Document" (Path: "HKCU\CLSID\{B801CA65-A1FC-11D0-85AD-444553540000}\IMPLEMENTED CATEGORIES\{00021490-0000-0000-C000-000000000046}") ".exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") ".exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") ".exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "RdrCEF.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}")27:T4a0,Process "AcroRd32.exe" (UID: 00010895-00001680) was launched with new environment variables: "MEOW="C:\Program Files\Adobe\Acrobat Reader DC\Reader\"" Process "AcroRd32.exe" (UID: 00010895-00001680) was launched with modified environment variables: "Path" Process "rundll32.exe" (UID: 00010896-00001572) was launched with modified environment variables: "Path" Process "rundll32.exe" (UID: 00010896-00001572) was launched with missing environment variables: "MEOW" Process "RdrCEF.exe" (UID: 00011476-00003492) was launched with new environment variables: "MEOW="C:\Program Files\Adobe\Acrobat Reader DC\Reader\"" Process "RdrCEF.exe" (UID: 00011476-00003492) was launched with modified environment variables: "Path" Process "sysprep.exe" (UID: 00011585-00001836) was launched with modified environment variables: "Path" Process "sysprep.exe" (UID: 00011585-00001836) was launched with missing environment variables: "MEOW" Process "RdrCEF.exe" (UID: 00011761-00003048) was launched with new environment variables: "MEOW="C:\Program Files\Adobe\Acrobat Reader DC\Reader\"" Process "RdrCEF.exe" (UID: 00011761-00003048) was launched with modified environment variables: "Path"28:T65e,".exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" ".exe" touched file "C:\Windows\AppPatch\sysmain.sdb" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "AcroRd32.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "AcroRd32.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "AcroRd32.exe" touched file "C:\Windows\System32\rsaenh.dll" "AcroRd32.exe" touched file "C:\Windows\System32\tzres.dll" "AcroRd32.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "AcroRd32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "AcroRd32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "AcroRd32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db" "AcroRd32.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat"29:T5c1,"RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 4877824) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 4877824) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Tcpip\Parameters" (Filter: 15; Subtree: 12385537) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TCPIP6\Parameters" (Filter: 15; Subtree: 12385537) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Dnscache\Parameters" (Filter: 15; Subtree: 1963009025) "RdrCEF.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 64945409) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 64945409) "RdrCEF.exe" monitors "\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 64945409) "RdrCEF.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 1) "RdrCEF.exe" monitors "\REGISTRY\USER\S-1-5-21-686412048-2446563785-1323799475-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings" (Filter: 15; Subtree: 1963009025)2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAB4iIiIiIiIiIiIiIcAAAAAeIiIiIiIiIiIiIiHAAAAAH//////////////9wAAAAB//////3h3d3d3ePcAAAAAf/////9weHd393f3AAAAAH//iP//d4d3d3d39wAAAAB/+IeP/4f4f/eP//cAAAAAf/+In//4/4/4///3AAAAAH//+In///////h/9wAAAAB////4iP///4iIj/cAAAAAf////3+JiImY+P/3AAAAAH////+I/4mIiIj/9wAAAAB/////+f+Y//////cAAAAAf/////iHj//////3AAAAAH//////mf//////9wAAAAB//////5j///////cAAAAAf/////+Y///////3AAAAAH/////4eP//////9wAAAAB/////+I////////cAAAAAf/////iI///////3AAAAABd3d3d3d3d/////9wARERERERERERERH/////cAEREfkZ+IGJERER//+IiHABmZn3mfmHiREREY+IiIhwCZmZ+If5iIiJkRGIh3hwAAmZmff4+YeJmZkRiI/4AAAJmZn4h4iJiImZkYj/gAAACZmZmZmZmZmZmZGI+AAAAAmZmZmZmZmZmRERiIAAAAAAAAAH////+IiIiIAAAAAAAAAAB///iIiIiIhwAAAAAAAAAAAAAAAAAAAAAAAAAAD+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAf4AAAH+AAAB/gAAAYAAAAGAAAABgAAAAYAAAAGAAAADgAAAD4AAAA+AAAA/gAAAP/4AAP/+AAD//////w==2b:T59c,--type=renderer --primordial-pipe-token=7AA38A529D389207E43ACC18A2EC1FBE --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=7AA38A529D389207E43ACC18A2EC1FBE --renderer-client-id=2 --mojo-platform-channel-handle=1260 --allow-no-sandbox-job /prefetch:12c:T59c,--type=renderer --primordial-pipe-token=7B55BD281831F67BCFF197A703AE915C --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.11.20036 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=7B55BD281831F67BCFF197A703AE915C --renderer-client-id=3 --mojo-platform-channel-handle=1316 --allow-no-sandbox-job /prefetch:11b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791526616918,"unified_at":"2026-10-09T06:16:56.918Z","metadata":{"hashes":{"sha256":"b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b","sha1":"89d599fe7a3025cd8d285dc044799c1054fb5f00","md5":"291089c6d8a6f33f4478397fb72992fe","sha512":"d0595a73f1ce1b306dc14ff80f09acf63154fc611e8d91556d1926f4ccabb05fdeac180d0342dcd34185f12b3053568358510814cbfcb365055221d5aa33819a","ssdeep":"6144:boOKzuSmsI3sZkXAXd//pxB/r2KzxDHXSWyaAC5BbPW5UKQWlIEXWEkGVQUqZDOm:gu/sI8ZkXAXd/BxB/KcoZQ9uWDWuJmq5","ssdeep_chunks":["6144:boOKzuS","6144:oOKzuSm","6144:OKzuSms","6144:KzuSmsI","6144:zuSmsI3","6144:uSmsI3s","6144:SmsI3sZ","6144:msI3sZk","6144:sI3sZkX","6144:I3sZkXA","6144:3sZkXAX","6144:sZkXAXd","6144:ZkXAXd/","6144:kXAXd//","6144:XAXd//p","6144:AXd//px","6144:Xd//pxB","6144:d//pxB/","6144://pxB/r","6144:/pxB/r2","6144:pxB/r2K","6144:xB/r2Kz","6144:B/r2Kzx","6144:/r2KzxD","6144:r2KzxDH","6144:2KzxDHX","6144:KzxDHXS","6144:zxDHXSW","6144:xDHXSWy","6144:DHXSWya","6144:HXSWyaA","6144:XSWyaAC","6144:SWyaAC5","6144:WyaAC5B","6144:yaAC5Bb","6144:aAC5BbP","6144:AC5BbPW","6144:C5BbPW5","6144:5BbPW5U","6144:BbPW5UK","6144:bPW5UKQ","6144:PW5UKQW","6144:W5UKQWl","6144:5UKQWlI","6144:UKQWlIE","6144:KQWlIEX","6144:QWlIEXW","6144:WlIEXWE","6144:lIEXWEk","6144:IEXWEkG","6144:EXWEkGV","6144:XWEkGVQ","6144:WEkGVQU","6144:EkGVQUq","6144:kGVQUqZ","6144:GVQUqZD","6144:VQUqZDO","6144:QUqZDOm","12288:boOKzuS","12288:oOKzuSm","12288:OKzuSms","12288:KzuSmsI","12288:zuSmsI3","12288:uSmsI3s","12288:SmsI3sZ","12288:msI3sZk","12288:sI3sZkX","12288:I3sZkXA","12288:3sZkXAX","12288:sZkXAXd","12288:ZkXAXd/","12288:kXAXd//","12288:XAXd//p","12288:AXd//px","12288:Xd//pxB","12288:d//pxB/","12288://pxB/r","12288:/pxB/r2","12288:pxB/r2K","12288:xB/r2Kz","12288:B/r2Kzx","12288:/r2KzxD","12288:r2KzxDH","12288:2KzxDHX","12288:KzxDHXS","12288:zxDHXSW","12288:xDHXSWy","12288:DHXSWya","12288:HXSWyaA","12288:XSWyaAC","12288:SWyaAC5","12288:WyaAC5B","12288:yaAC5Bb","12288:aAC5BbP","12288:AC5BbPW","12288:C5BbPW5","12288:5BbPW5U","12288:BbPW5UK","12288:bPW5UKQ","12288:PW5UKQW","12288:W5UKQWl","12288:5UKQWlI","12288:UKQWlIE","12288:KQWlIEX","12288:QWlIEXW","12288:WlIEXWE","12288:lIEXWEk","12288:IEXWEkG","12288:EXWEkGV","12288:XWEkGVQ","12288:WEkGVQU","12288:EkGVQUq","12288:kGVQUqZ","12288:GVQUqZD","12288:VQUqZDO","12288:QUqZDOm","6144:gu/sI8Z","6144:u/sI8Zk","6144:/sI8ZkX","6144:sI8ZkXA","6144:I8ZkXAX","6144:8ZkXAXd","6144:kXAXd/B","6144:XAXd/Bx","6144:AXd/BxB","6144:Xd/BxB/","6144:d/BxB/K","6144:/BxB/Kc","6144:BxB/Kco","6144:xB/KcoZ","6144:B/KcoZQ","6144:/KcoZQ9","6144:KcoZQ9u","6144:coZQ9uW","6144:oZQ9uWD","6144:ZQ9uWDW","6144:Q9uWDWu","6144:9uWDWuJ","6144:uWDWuJm","6144:WDWuJmq","6144:DWuJmq5"],"imphash":"db9e45f8f9cc81de40777488c9a5c8f7"},"file_info":{"file_name":"bad.scr","file_type":["peexe","executable"],"file_type_id":"exe","file_size":366080,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1522257594000,"last_seen":1677837556000,"last_multi_scan":1677837556000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["infostealer","kimjongrat","rat"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":12},"sandbox_signatures":{"informative_count":24,"suspicious_count":18,"malicious_count":12,"total":54},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Reconyc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.366080.61","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.560865","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Downloader.Cigamve-1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Graftor.560865 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Reconyc.eohd","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Generic Dropper.aow","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Reconyc.dudcdi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MulDrop5.DPON","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Reconyc","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Reconyc.Win32.13722","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Reconyc","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Service Execution","attack_id":"T1035","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1035","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"informative","value":"Found a string that may be used as part of an injection method"},{"type":"suspicious","value":"Scans for the windows taskbar (may be used for explorer injection)"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1107","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1107","identifiers":[{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the registry for installed applications"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1063","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RtlDecompressBuffer@NTDLL.DLL at 00533453-00000764-52676-9-012115A0\n Found reference to API RtlDecompressBuffer@NTDLL.DLL at 00533453-00000764-58593-14-012115A0\n Found reference to API RtlSetThreadErrorMode@NTDLL.DLL at 00543468-00002472-64209-129-0028AD54\n Found reference to API DllGetClassObject@OLEAUT32.DLL at 00543468-00002472-64209-120-0028F31E","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00533453-00000764-52676-40-0121252A\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00533453-00000764-58593-8-01212528\n GetLocalTime@KERNEL32.DLL at 00543468-00002472-64209-149-00288346\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00543468-00002472-64209-199-0028A851","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"sysprep.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"IESQMMUTEX_0_208\"\n \"Local\\Acrobat Instance Mutex\"\n \"DBWinMutex\"\n \"Local\\WininetStartupMutex\"\n \"Local\\WininetConnectionMutex\"\n \"Local\\WininetProxyRegistryMutex\"\n \"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCGJIGMGLAAAAA\"\n \"Local\\ZonesCounterMutex\"\n \"Local\\ZoneAttributeCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"\" loaded module \"OLEAUT32.DLL\" at base 77220000","origin":"API Call","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"RtlDllShutdownInProgress@ntdll.dll\"","origin":"API Call","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"informative","category":"General","name":"Sample was identified as clean by Antivirus engines","description":"0/55 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"magic5555.tmp\" has type \"JPEG image data, JFIF standard 1.02\"\n \"magic99999.tmp\" has type \"data\"\n \"magic44444.tmp\" has type \"data\"\n \"30 ENKO_Update.pdf\" has type \"PDF document, version 1.5\"\n \"svchost.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"\n \"sysprep.ocx\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00533453-00000764-52676-61-01212336\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00533453-00000764-52676-50-0121221A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00533453-00000764-58593-15-01211C06\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00533453-00000764-58593-62-01212336\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00543468-00002472-64209-11-0028A4C9","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc with unusual entropies 7.99476514293","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersionExW@KERNEL32.DLL at 00543468-00002472-64209-217-0028891C\n GetVersionExW@KERNEL32.DLL at 00543468-00002472-64209-350-00290A5D\n GetVersionExW@KERNEL32.DLL at 00543468-00002472-64209-343-00288A8C","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-15-0028E550\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-20-0028AAD4\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-24-0028C12F\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-25-0028B46F\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-4-002890D8\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-70-00292FB5\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-96-0028E5C6\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-66-00293593\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-46-00291278\n GetProcessHeap@KERNEL32.DLL at 00543468-00002472-64209-131-0028857B","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceW@KERNEL32.DLL at 00533453-00000764-52676-9-012115A0\n FindResourceW@KERNEL32.DLL at 00533453-00000764-58593-14-012115A0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"\" read file \"C:\\Users\\PSPUBWS\\Desktop\\desktop.ini\"\n \"\" read file \"C:\\Users\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Searches\\desktop.ini\"\n \"\" read file \"C:\\Users\\PSPUBWS\\Videos\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"svchost.exe\" has type \"PE32 executable (GUI) Intel 80386, for MS Windows\"\n \"sysprep.ocx\" has type \"PE32 executable (DLL) (GUI) Intel 80386, for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Network Related","name":"Found potential URL in binary/memory","description":"\"___.ni\"","origin":"File/Memory","relevance":2,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n VirtualProtect\n FindResourceW\n GetTickCount\n IsDebuggerPresent\n UnhandledExceptionFilter\n TerminateProcess\n GetStartupInfoA\n GetProcAddress\n Sleep\n VirtualAlloc\n LockResource\n GetTempPathW\n LoadLibraryW\n GetModuleHandleW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00543468-00002472-64209-161-0028C01E","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in foreign process","description":"\"\" allocated 00001500 bytes of memory in \"rundll32.exe\" (Protection: \"read/write\")\n \"\" allocated 00000088 bytes of memory in \"rundll32.exe\" (Protection: \"read/write\")","origin":"API Call","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Injects into explorer","description":"Injected into \"explorer.exe\" (UID: 00540312-00000176)","origin":"Monitored Target","relevance":5,"id":"target-20","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes a PE file header to disc","description":"\"\" wrote 36864 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\svchost.exe\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...\n \"\" wrote 36864 bytes starting with PE header signature to file \"C:\\Users\\PSPUBWS\\AppData\\Roaming\\sysprep.ocx\": 4d5a90000300000004000000ffff0000b8000000000000004000000000000000000000000000000000000000000000000000 ...","origin":"API Call","relevance":1,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\"\" wrote 32 bytes to a foreign process \"AcroRd32.exe\" (PID: 00002924)\n \"\" wrote 52 bytes to a foreign process \"AcroRd32.exe\" (PID: 00002924)\n \"\" wrote 4 bytes to a foreign process \"AcroRd32.exe\" (PID: 00002924)\n \"\" wrote 1500 bytes to a foreign process \"rundll32.exe\" (PID: 00003072)\n \"\" wrote 4 bytes to a foreign process \"rundll32.exe\" (PID: 00003072)\n \"\" wrote 32 bytes to a foreign process \"rundll32.exe\" (PID: 00003072)\n \"\" wrote 52 bytes to a foreign process \"rundll32.exe\" (PID: 00003072)","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"malicious","category":"System Security","name":"Modifies proxy settings","description":"\"explorer.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\USER\\S-1-5-21-4162757579-3804539371-4239455898-1000\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")\n \"explorer.exe\" (Access type: \"DELETEVAL\", Path: \"\\REGISTRY\\MACHINE\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\", Key: \"PROXYBYPASS\")","origin":"Registry Access","relevance":8,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"ZwSetInformationFile@NTDLL.DLL at 00543468-00002472-64209-103-0028BD39","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$25","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\ACRORD32.EXE\"; Key: \"PATH\"; Value: \"00000000010000006200000043003A005C00500072006F006700720061006D002000460069006C00650073005C00410064006F00620065005C004100630072006F0062006100740020005200650061006400650072002000440043005C005200650061006400650072005C000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"\".exe\" created file \"%TEMP%\\magic5555.tmp\"\n \".exe\" created file \"%TEMP%\\magic99999.tmp\"\n \".exe\" created file \"%TEMP%\\magic44444.tmp\"\n \".exe\" created file \"%TEMP%\\30 ENKO_Update.pdf\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9Rlxdza2_11o03aa_1ao.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9Rcspa6c_11o03ab_1ao.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R1weqmkj_11o03ac_1ao.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9Rryekox_11o03ad_1ao.tmp\"\n \"AcroRd32.exe\" created file \"%TEMP%\\A9R154plvf_11o03ae_1ao.tmp\"","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"#Uc81c30#Ucc28#Ud55c#Ubbf8#Uc548#Ubcf4 #Uc548#Ub0b4#Uc7a5 ENKO_Update.pdf\" as clean (type is \"PDF document version 1.5\")\n Antivirus vendors marked dropped file \"sysprep.ocx\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$27","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"\n \"AcroRd32.exe\" searching for class \"ACROSEMAPHORE_R18\"\n \"AcroRd32.exe\" searching for class \"JFWUI2\"\n \"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"AcroRd32.exe\" with commandline \"\"%TEMP%\\30 ENKO_Update.pdf\"\" (UID: 00010895-00001680)\n Spawned process \"rundll32.exe\" with commandline \"\"%APPDATA%\\sysprep.ocx\" RtlShellDecompress\" (UID: 00010896-00001572)\n Spawned process \"explorer.exe\" (UID: 00011427-00000996)\n Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00011476-00003492)\n Spawned process \"sysprep.exe\" with commandline \"\"\"\" (UID: 00011585-00001836)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=7AA38A529D389207E43ACC18 ...\" (UID: 00011761-00003048)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=7B55BD281831F67BCFF197A7 ...\" (UID: 00011795-00003004)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"AcroRd32.exe\" with commandline \"\"%TEMP%\\30 ENKO_Update.pdf\"\" (UID: 00010895-00001680)\n Spawned process \"rundll32.exe\" with commandline \"\"%APPDATA%\\sysprep.ocx\" RtlShellDecompress\" (UID: 00010896-00001572)\n Spawned process \"explorer.exe\" (UID: 00011427-00000996)\n Spawned process \"sysprep.exe\" with commandline \"\"\"\" (UID: 00011585-00001836)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"\n \"rundll32.exe\" connecting to \"\\ThemeApiPort\"\n \"RdrCEF.exe\" connecting to \"\\ThemeApiPort\"\n \"sysprep.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","mitre_attack_id":"T1055","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$28","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"RdrCEF.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"svchost.exe\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"sysprep.ocx\" was detected as \"Visual C++ 2005 DLL -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"RdrCEF.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"RdrCEF.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"LOCALENAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"RdrCEF.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"sysprep.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"RdrCEF.exe\" issued more than 3000 memory allocations","origin":"API Call","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"C:\\b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.exe\" marked \"%APPDATA%\\44444\" for deletion\n \"%WINDIR%\\System32\\rundll32.exe\" marked \"%APPDATA%\\44444\" for deletion\n \"%WINDIR%\\System32\\sysprep\\sysprep.exe\" marked \"%APPDATA%\\44444\" for deletion\n \"%WINDIR%\\System32\\sysprep\\sysprep.exe\" marked \"C:\\b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1107","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%APPDATA%\\44444\" with delete access\n \"rundll32.exe\" opened \"%APPDATA%\\44444\" with delete access\n \"sysprep.exe\" opened \"%APPDATA%\\44444\" with delete access\n \"sysprep.exe\" opened \"C:\\b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.exe\" with delete access","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"svchost.exe\" claimed CRC 85704 while the actual is CRC 401386\n \"sysprep.ocx\" claimed CRC 97407 while the actual is CRC 85704","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"d5d9277630c62776e0c2277642c6277610c62776acdc2776a0df277636da277687f12776000000009177f676c090f6767f6ff6761ffaf676def4f676f282f676857df67600000000\" to virtual address \"0x6E7D1000\" (part of module \"MSIMG32.DLL\")\n \"rundll32.exe\" wrote bytes \"d5d9277630c62776a0c4277642c6277610c62776acdc2776a0df277636da277687f12776000000009177f676c090f6767f6ff6761ffaf676def4f676f282f676857df67600000000\" to virtual address \"0x6E3D1000\" (part of module \"MSIMG32.DLL\")\n \"explorer.exe\" wrote bytes \"d5d9277630c62776a0c4277642c6277610c62776acdc2776a0df277636da277687f12776000000009177f676c090f6767f6ff6761ffaf676def4f676f282f676857df67600000000\" to virtual address \"0x6E3D1000\" (part of module \"MSIMG32.DLL\")\n \"sysprep.exe\" wrote bytes \"d5d9277630c62776a0c4277642c6277610c62776acdc2776a0df277636da277687f12776000000009177f676c090f6767f6ff6761ffaf676def4f676f282f676857df67600000000\" to virtual address \"0x6E3D1000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/65 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"42/65 Antivirus vendors marked sample as malicious (64% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"2/57 Antivirus vendors marked dropped file \"svchost.exe\" as malicious (classified as \"Downloader.Cigamve\" with 3% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/71 Antivirus vendors marked spawned process \"RdrCEF.exe\" (PID: 3492) as malicious (classified as \"Worm.Kolab\" with 1% detection rate)\n 1/71 Antivirus vendors marked spawned process \"RdrCEF.exe\" (PID: 3048) as malicious (classified as \"Worm.Kolab\" with 1% detection rate)\n 1/71 Antivirus vendors marked spawned process \"RdrCEF.exe\" (PID: 3004) as malicious (classified as \"Worm.Kolab\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\FileAssociation\"\n \"explorer.exe\" allocated memory in \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"level":"informative","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"$29","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 3336) slept \"505\" times (threshold: 500)","origin":"API Call","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe\", Handle: 532), \".exe\" is creating a new process (Name: \"%APPDATA%\\sysctfmon.exe\", Handle: 212), \"AcroRd32.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\", Handle: 788), \"AcroRd32.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\", Handle: 816), \"RdrCEF.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\", Handle: 1336), \"RdrCEF.exe\" is creating a new process (Name: \"C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\"\n Handle: 1468)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"AcroRd32.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]}]},"activity":{"stats":{"process_count":8,"spawned_processes_count":8,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":23,"imported_dlls_count":220,"dropped_files_count":0,"extracted_files_count":23,"files_written_count":422,"files_deleted_count":0,"registry_keys_created_count":34,"registry_keys_modified_count":0,"registry_keys_deleted_count":15,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":49,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["infostealer","kimjongrat","rat"],"sample_flags":["Extracted Files","Multi-Process","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"5c7398f80288381a055b4289","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Reconyc","submit_name":"b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.exe","analysis_start_time":"2019-02-25T07:22:44+00:00","indicators_count":{"informative":19,"suspicious":19,"malicious":9},"tags":["Multi-Process","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"5c7398f70388386e2825dd5e","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Reconyc","submit_name":"b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.exe","analysis_start_time":"2019-02-25T07:19:24+00:00","indicators_count":{"informative":22,"suspicious":15,"malicious":6},"tags":["Multi-Process","Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"55a915be0e316d7213b7a76a","environment_id":1,"environment_description":"Windows 7 32 bit (EN)","state":"SUCCESS","verdict":"suspicious","threat_score":57,"submit_name":"bad.scr","analysis_start_time":"2015-07-17T09:48:49+00:00","indicators_count":{"informative":8,"suspicious":9,"malicious":7},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}],"processes":[{"pid":1748,"ppid":0,"name":"b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.exe","command_line":"","sha256":"b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b","normalized_path":"C:\\b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.exe","uid":"00010583-00001748","icon":"$2a"},{"pid":1680,"ppid":1748,"name":"AcroRd32.exe","command_line":"\"%TEMP%\\제30차한미안보 안내장 ENKO_Update.pdf\"","sha256":"2e9b9635469ff056f09023f7d671120d0c0f86f30767b06daa545c01242bcbef","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","parent_uid":"00010583-00001748","uid":"00010895-00001680"},{"pid":3492,"ppid":1680,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00010895-00001680","uid":"00011476-00003492"},{"pid":3048,"ppid":3492,"name":"RdrCEF.exe","command_line":"$2b","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00011476-00003492","uid":"00011761-00003048"},{"pid":3004,"ppid":3492,"name":"RdrCEF.exe","command_line":"$2c","sha256":"9ed4787850281a1a549c623cd05a8f7fc01b25a5185f1e7b17d4cdb50fcf1f26","normalized_path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00011476-00003492","uid":"00011795-00003004"},{"pid":1572,"ppid":1748,"name":"rundll32.exe","command_line":"\"%APPDATA%\\sysprep.ocx\" RtlShellDecompress","sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","normalized_path":"%WINDIR%\\System32\\rundll32.exe","parent_uid":"00010583-00001748","uid":"00010896-00001572"},{"pid":996,"ppid":1572,"name":"explorer.exe","command_line":"","sha256":"11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a25a","normalized_path":"%WINDIR%\\explorer.exe","parent_uid":"00010896-00001572","uid":"00011427-00000996"},{"pid":1836,"ppid":996,"name":"sysprep.exe","command_line":"\"\"","sha256":"de3dfb3617b3e3fabb9f12088e7d2019510915e0ae2397e7f96fe2575cfbf8fc","normalized_path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","parent_uid":"00011427-00000996","uid":"00011585-00001836"}],"all_imported_dlls":["CRYPTSP.dll","ccme_base.dll","ccme_ecdrbg.dll","imagehlp.dll","SHLWAPI.dll","kernel32.dll","rsaenh.dll","GPAPI.dll","MSIMG32.dll","iphlpapi.DLL","cryptocme.dll","SSPICLI.DLL","gdiplus.dll","DUser.dll","RPCRT4.dll","LPK.dll","UxTheme.dll","BIB.dll","NLAapi.dll","fwpuclnt.dll","USP10.dll","msvcrt.dll","AXE8SharedExpat.dll","pnrpnsp.dll","AcLayers.DLL","dwmapi.dll","CFGMGR32.dll","RASAPI32.dll","msimg32.dll","ActionQueue.dll","sqlite.dll","DEVOBJ.dll","COMCTL32.dll","PSAPI.DLL","CLBCatQ.DLL","wship6.dll","MPR.dll","MSVCP90.dll","MSCTF.dll","USER32.dll","MSVCR90.dll","mfc90.dll","CRYPTBASE.dll","SETUPAPI.dll","POWRPROF.dll","Secur32.dll","IMM32.DLL","KERNELBASE.dll","mswsock.dll","winrnr.dll","sfc.dll","ntdll.dll","GDI32.dll","uxtheme.dll","BIBUtils.dll","dnsapi.DLL","napinsp.dll","ccme_base_non_fips.dll","comsvcs.dll","shdocvw.dll","ccme_asym.dll","slc.dll","UNATTEND.DLL","dbghelp.dll","SHELL32.dll","PROPSYS.dll","apphelp.dll","WININET.dll","ieframe.dll","Comctl32.dll","EXPLORERFRAME.dll","comctl32.dll","AdobeXMP.dll","propsys.dll","rtutils.dll","sensapi.dll","rasadhlp.dll","VERSION.dll","AcroRd32.dll","CRYPT32.dll","IMM32.dll","WDSCORE.dll","wshtcpip.dll","SspiCli.dll","ntmarta.dll","profapi.dll","RpcRtRemote.dll","mscms.dll","ccme_ecc.dll","USERENV.dll","ole32.dll","OLEAUT32.dll","rasman.dll","WS2_32.dll","DUI70.dll","actxprxy.dll","urlmon.dll","MFC90ENU.DLL","ADVAPI32.dll","sechost.dll","oleaccrc.dll","KernelBase.dll","version.dll","mpr.dll","mtxoci.dll","IPHLPAPI.DLL","GdiPlus.dll","WSDApi.dll","credssp.dll","rpcrt4.dll","dnsapi.dll","crypt32.dll","SensApi.dll","AcLayers.dll","api-ms-win-downlevel-version-l1-1-0.dll","icudt.dll","oleacc.dll","msctf.dll","devobj.dll","d3d11.dll","wintrust.dll","cfgmgr32.dll","chrome_elf.dll","dxgi.dll","gdi32.dll","AcroRd32Res.dll","AXSLE.dll","cryptui.dll","shlwapi.dll","ExplorerFrame.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","duser.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","credui.dll","samcli.dll","dxva2.dll","msvcr120.dll","wshqos.dll","KBDUS.DLL","wdscore.dll","oleaut32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","winmm.dll","CoolType.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","AudioSes.dll","MMDevAPI.dll","npmproxy.dll","linkinfo.dll","Wldap32.dll","ACE.dll","dui70.dll","normaliz.dll","userenv.dll","gpapi.dll","bcrypt.dll","sspicli.dll","wevtapi.dll","nlaapi.dll","msvcp120.dll","AGM.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wtsapi32.dll","wlanutil.dll","psapi.dll","winhttp.dll","libcef.dll","atl.dll","sfc_os.dll","advapi32.dll","shell32.dll","winnsi.dll","d3d8thk.dll","cryptbase.dll","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","FWPUCLNT.DLL","wininet.dll","wlanapi.dll","user32.dll","usp10.dll","setupapi.dll","nsi.dll","dhcpcsvc6.dll","DWrite.dll","wkscli.dll","d3d9.dll","unattend.dll","netapi32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","srvcli.dll","msvcp90.dll","netprofm.dll","comdlg32.dll","msvcr90.dll","lpk.dll","ws2_32.dll","dhcpcsvc.dll","msasn1.dll","netutils.dll","cryptsp.dll","WSHTCPIP.DLL","hid.dll","ncrypt.dll","secur32.dll","powrprof.dll","imm32.dll","iertutil.dll","webio.dll","wsock32.dll","clbcatq.dll","tzres.dll","wow64.dll","msls31.dll","msvcr100.dll","wow64win.dll","msftedit.dll","wow64cpu.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"svchost.exe","sha256":"c21fc0de3bad37144b0ddf8a7104eb4703613d78400f4046c753c62bdb3b7de3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"sysprep.ocx","sha256":"a8a34321ff62418a72b7102ac6fcdc160c3c5e91b6c56f71cf9677efc8bf7181","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"magic44444.tmp","sha256":"1850cf6ce6e7203109a9d38c678f986404b947b3261a360b8772c76fb2c9d56d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"magic99999.tmp","sha256":"58f01652393e030953b97a4bca5063db826f961d04095a9011c8983e60757450","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"30 ENKO_Update.pdf","sha256":"5c9d3d90ee40b0a074f754e656fcf1192b2a4afa50409790f6ea013d4784828d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"name":"#Uc81c30#Ucc28#Ud55c#Ubbf8#Uc548#Ubcf4 #Uc548#Ub0b4#Uc7a5 ENKO_Update.pdf","sha256":"5c9d3d90ee40b0a074f754e656fcf1192b2a4afa50409790f6ea013d4784828d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"Launch Internet Explorer Browser.lnk","sha256":"e21460e4e5046072ef0606dcec28e4afef43457cee75cfd5b6a40b00489e3e31","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"Internet Explorer.lnk","sha256":"d80eb37f880656f21aae41184be648bf92634b55cefd3a90c2eafa9529df3f75","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"Windows Explorer.lnk","sha256":"02fd46781527c97a9b6d07460d5a4b8fc14aa26a744bcdd610c225509c61873b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"Wireshark.lnk","sha256":"7865285e1e6fa117471e38174ac96c4878255faa22ac354141b8121d8d5e89d5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"Temp.txt","sha256":"2307f099cac5d3a3ec32892c6a6e323beca9d57f40f09a786c14c0dd32605126","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"data_1","sha256":"a1f0920223404877b2d2cc7522c6c39d37b6872e8be750dd8588e6c8a5586041","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"Visited Links","sha256":"9d1c9dc432b2e97f7a54b4da2724e4ff96dc719e60cb89c9f82dbec9226856c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"A9Rcspa6c_11o03ab_1ao.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"A9Rlxdza2_11o03aa_1ao.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"A9Rryekox_11o03ad_1ao.tmp","sha256":"96a296d224f285c67bee93c30f8a309157f0daa35dc5b87e410b78630a09cfc7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"magic5555.tmp","sha256":"2aceb1e04b865c10f86adf4b18c26e71dcc6eafa36db9b08e6918be63c580a49","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"diagerr.xml","sha256":"8ade5e7080e6d5337ca9b4bd31c9963dc556406189b53263dd5b37a9fbbba523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"diagwrn.xml","sha256":"8ade5e7080e6d5337ca9b4bd31c9963dc556406189b53263dd5b37a9fbbba523","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"setupact.log","sha256":"c9ff349c732843313f2d72848da96c910058216644d46e3173028b929b2d1c0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"0FDED5CEB68C302B1CDB2BDDD9D0000E76539CB0.crl","sha256":"d1bb4b163fe01acc368a92b385bb0bd3a9fc2340b6d485b77a20553a713166d3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"sysctfmon.exe","sha256":"8974e88a950ff99691714924b391ba64cde1500c8ff914241e12c62f6c7080c6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"CE338828149963DCEA4CD26BB86F0363B4CA0BA5.crl","sha256":"9009ab7605c35a2b5121b8b5c966b3c893edba9966925268c45ad05b348671c8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]}],"files_written":[{"path":"%TEMP%\\magic5555.tmp","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\magic99999.tmp","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%TEMP%\\magic44444.tmp","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\30 ENKO_Update.pdf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\sortdefault.nls","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"MountPointManager","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"C:\\Users\\PSPUBWS","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%USERPROFILE%\\Documents\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%USERPROFILE%\\Links\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"C:\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%APPDATA%\\sysprep.ocx","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"\\SystemRoot\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\rdlang32.deu","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\Services.cfg","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXEchoSign.spi","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\DEXShare.spi","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Services\\files.acx","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXEchoSign.asfx","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\files.asfx","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\DEXShare.asfx","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\Locale\\de_DE\\Services\\Services.asfx","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%WINDIR%\\Fonts\\staticcache.dat","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%WINDIR%\\system32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\weblink.lpk.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\weblink.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_weblink.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_EScript.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\EScript.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_Annots.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\Annots.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"C:\\Program Files","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\AdobePiStd.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\CourierStd-Bold.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\CourierStd-BoldOblique.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\CourierStd-Oblique.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\CourierStd.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MinionPro-Bold.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MinionPro-BoldIt.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MinionPro-It.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MinionPro-Regular.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MyriadPro-Bold.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MyriadPro-BoldIt.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MyriadPro-It.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\MyriadPro-Regular.otf","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\SY______.PFB","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\pfm\\SY______.PFM","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\SY______.PFM","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\zx______.pfm","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\ZX______.PFB","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\ZY______.PFB","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\Font\\PFM\\zy______.pfm","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\AcroExt\\libcef.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdr.dat","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdri.dat","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\services_rdrk.dat","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\EScript.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Annots.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\weblink.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeCMapFnt11.lst","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\AdobeComFnt11.lst","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\Identity-H","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Resource\\CMap\\Identity-V","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\History.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\index.dat","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"\\Device\\Afd\\Endpoint","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"Nsi","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"\\Device\\Afd\\AsyncConnectHlp","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%WINDIR%\\system32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"\\Device\\NetBT_Tcpip6_{72D885C2-0AEC-4510-95D5-BF120A963535}","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"\\Device\\NetBT_Tcpip6_{9C9C1D9A-E45A-41F9-8D98-D3B6EA5D768D}","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"\\Device\\NetBT_Tcpip6_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"\\Device\\NetBT_Tcpip_{D0B53124-E232-49FC-9EA9-75FA32C7C6C3}","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"\\Device\\RasAcd","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_AcroForm.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\AcroForm.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_DigSig.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\DigSig.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_PPKLite.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\PPKLite.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\JavaScripts\\JSByteCodeWin.bin","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.sig","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\cryptocme.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_base.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_base_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_asym.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"entropy","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecdrbg.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_accel_fips.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_ecc_accel_non_fips.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\ccme_error_info.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%WINDIR%\\system32\\en-US\\wsdapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%WINDIR%\\system32\\wsdapi.dll","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%USERPROFILE%\\Documents","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\AcroForm.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\DigSig.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-150717145106Z-17909","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-150717145106Z-17923","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\A9B8213768ADC68AF64FCC6409E8BE414726687F.crl","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\CRLCache\\48B76449F3D5FEFA1133AA805E420F0FCA643651.crl","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\11.0\\Security\\addressbook.acrodata","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\assets\\assets-150717145107Z-17934","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\11.0\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\adobe\\reader 11.0\\reader\\locale\\de_de\\Updater.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\11.0\\Cache\\RdLang_Updater.DEU","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%PROGRAMFILES%\\Adobe\\Reader 11.0\\Reader\\plug_ins\\Updater.api","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"C:\\ProgramData","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagerr.xml","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\diagerr.xml","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\diagwrn.xml","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\diagwrn.xml","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setupact.log","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\setupact.log","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\system32\\sysprep\\Panther\\setuplog.cfg","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32Res.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\제30차한미안보 안내장 ENKO_Update.pdf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\Viewer.aapp","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeComFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeCMapFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeSysFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\en-US\\explorer.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Launch Internet Explorer Browser.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001d.db","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\iexplore\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\sdfcsdhh.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\iexplore\\Temp.txt","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\EPDF_RHP.aapp","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Shows Desktop.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Internet Explorer.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\iexplore","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\User Pinned\\TaskBar\\Windows Explorer.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\explorer","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\explorer\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\explorer\\Temp.txt","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Window Switcher.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\Quick Launch\\Wireshark.lnk","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\wireshark","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\Wireshark\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\Wireshark\\Temp.txt","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"pipe\\com.adobe.reader.rna.%OSUSER%.DC.0","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\EScript.api","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\weblink.api","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%USERPROFILE%\\Searches\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%USERPROFILE%\\Pictures\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%USERPROFILE%\\Contacts\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%USERPROFILE%\\Music\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%USERPROFILE%\\Saved Games\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\System32\\sysprep\\sysprep.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\System32\\sysprep\\en-US\\sysprep.exe.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\sysprep\\Panther\\setuperr.log","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%COMMONPROGRAMFILES%\\microsoft shared\\svchost.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\ntkernel32.dat","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\KBDUS.DLL","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"C:\\b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\File System\\primary.origin","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\cep-plugins\\PIPViewer\\index.html","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"C:\\제30차한미안보 안내장 ENKO_Update.pdf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\crash_reporter.cfg","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9Rlxdza2_11o03aa_1ao.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9Rcspa6c_11o03ab_1ao.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9R1weqmkj_11o03ac_1ao.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9Rryekox_11o03ad_1ao.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\arialn.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\arialnb.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\arialnbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\arialni.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%TEMP%\\A9R154plvf_11o03ae_1ao.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\css\\home-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\SEGOEUISL.TTF","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\segoeuisl.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\seguisym.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\cambria.ttc","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\cambria.ttc","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\Fonts\\malgunbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\malgun.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\fonts\\malgunbd.ttf","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%USERPROFILE%\\Videos\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%USERPROFILE%\\Downloads\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\shdocvw.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shdocvw.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\propsys.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32Res.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\Viewer.aapp","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\EPDF_RHP.aapp","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\EScript.api","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\weblink.api","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\KBDUS.DLL","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\setupapi.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\crash_reporter.cfg","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9R1y62ymh_bi6260_32c.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9R1eu1jro_bi6261_32c.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshtcpip.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wship6.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\wshqos.dll.mui","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9R1jturm6_bi6262_32c.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9R13gp8ci_bi6263_32c.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%TEMP%\\A9R1jqe0th_bi6264_32c.tmp","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\css\\home-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-left.png","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\hscroll-thumb.png","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-right.png","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\LOCATION AWARENESS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKLM\\SOFTWARE\\ADOBE\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\ADOBE\\ACROBAT READER\\11.0\\EXITSECTION\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\ADOBE\\ADOBE ACROBAT\\11.0\\DISKCABS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\MAIN\\FEATURECONTROL\\FEATURE_BROWSER_EMULATION\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\MY\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ADDRESSBOOK\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ADDRESSBOOK\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ADDRESSBOOK\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ADDRESSBOOK\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKLM\\SYSTEM\\WSZXSGANXFJVAYSXYQGNXKQY\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKCU\\\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\CHROMIUM\\\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\CHROMIUM\\BLBEACON\\\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\MOSTRECENTAPPLICATION\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\DIRECT3D\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP477\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKLM\\SYSTEM\\WSZXSGANXFJVAYSXYQGNXKQY\\","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{13F080AF-F1FB-4739-A74F-58503BBF7381}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{FD4316C2-FF33-42BF-BE78-39051EB67EC2}\\00-00-5E-00-01-01\\","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-00-5E-00-01-01\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{DEFFABEE-F5F8-4E15-A854-B844D8245BC5}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]}]},"mutex_activity":{"mutex_created":[{"name":"IESQMMUTEX_0_208","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"name":"Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"Local\\WininetStartupMutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"name":"Local\\WininetConnectionMutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"name":"Local\\WininetProxyRegistryMutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"name":"{C15730E2-145C-4c5e-B005-3BC753F42475}-once-flagEJHCGJIGMGLAAAAA","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"name":"Local\\ZonesCounterMutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"name":"Local\\ZoneAttributeCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"55a915be0e316d7213b7a76a"},{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"},{"report_type":"sandbox","report_id":"5c7398f70388386e2825dd5e"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SYSPREP-APP-5c9fbbd0-ee0e-11d2-9a21-0000f81edacc","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"5c7398f80288381a055b4289"}]}]}},"report_ids":{"sandbox_job_ids":["5c7398f80288381a055b4289","5c7398f70388386e2825dd5e","55a915be0e316d7213b7a76a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Reconyc Sample b3e85c569e89… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b3e85c569e89…. Malware family: Trojan.Reconyc. Threat score 100/100. 15/28 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Reconyc Sample b3e85c569e89… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b3e85c569e89…. Malware family: Trojan.Reconyc. Threat score 100/100. 15/28 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b3e85c569e89b6d409841463acb311839356c950d9eb64b9687ddc6a71d1b01b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Reconyc Sample b3e85c569e89… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b3e85c569e89…. Malware family: Trojan.Reconyc. Threat score 100/100. 15/28 AV engines flagged this file. 12 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]