24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4bf,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.PoorWeb Sample d057088d0de3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d057088d0de3…. Malware family: Trojan.PoorWeb. Threat score 100/100. 23/28 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09","keywords":["Malicious","Trojan.PoorWeb","malware analysis","sandbox report","threat intelligence","d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09"],"about":{"@type":"SoftwareApplication","name":"d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09.exe","applicationCategory":["peexe","executable"],"identifier":"d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.PoorWeb","antivirusDetections":{"malicious":23,"total":28},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T61e,"POST /skin15/include/bin/forlab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------000741d004ecc Content-Length: 1057" with no payload "POST /skin15/include/bin/forlab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0003e1e00509b Content-Length: 1057" with no payload "POST /skin15/include/bin/forlab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0006ab8005af7 Content-Length: 1057" with no payload "POST /skin15/include/bin/forlab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------00039e0006a46 Content-Length: 1057" with no payload "POST /skin15/include/bin/forlab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0006030007a58 Content-Length: 1057" with no payload "POST /skin15/include/bin/forlab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------0002f580009a7 Content-Length: 1057" with no payload "POST /skin15/include/bin/forlab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------00055a80019ba Content-Length: 1057" with no payload "POST /skin15/include/bin/forlab.php HTTP/1.1 Host: youngs.dgweb.kr:80 Content-type: multipart/form-data;boundary=-----------------------------00024d0002908 Content-Length: 1057" with no payload26:Ta1a,".exe" wrote bytes "f8110000" to virtual address "0x75A91408" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b840131b70ffe0" to virtual address "0x75A91248" (part of module "SSPICLI.DLL") ".exe" wrote bytes "60121b70" to virtual address "0x7625E324" (part of module "WININET.DLL") ".exe" wrote bytes "4812a975" to virtual address "0x75AA8348" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811a975" to virtual address "0x75AA8368" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f8110000" to virtual address "0x75A912CC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811a975" to virtual address "0x75AA834C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "c04ed3772054d477e065d477b538d5770000000000d0487600000000c5ea48760000000088ea487600000000e968d6758228d577ee29d57700000000d269d675000000007dbb48760000000009bed67500000000ba18487600000000" to virtual address "0x77E71000" (part of module "NSI.DLL") ".exe" wrote bytes "fae6d077e1a6d5772e71d577ee29d57785e2d0776da0d57726e4d077d16dd577003dd377804bd37700000000ad37fb758b2dfb75b641fb7500000000" to virtual address "0x75091000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "4812a975" to virtual address "0x75AA83C0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811a975" to virtual address "0x75AA83E0" (part of module "SSPICLI.DLL") ".exe" wrote bytes "f811a975" to virtual address "0x75AA83C4" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812a975" to virtual address "0x75AA8364" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b8c0151b70ffe0" to virtual address "0x75A911F8" (part of module "SSPICLI.DLL") ".exe" wrote bytes "b830121b70ffe0" to virtual address "0x75FB1368" (part of module "WS2_32.DLL") ".exe" wrote bytes "48120000" to virtual address "0x75A9139C" (part of module "SSPICLI.DLL") ".exe" wrote bytes "48120000" to virtual address "0x75A912DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "4812a975" to virtual address "0x75AA83DC" (part of module "SSPICLI.DLL") ".exe" wrote bytes "68130000" to virtual address "0x75FB1680" (part of module "WS2_32.DLL") ".exe" wrote bytes "e739d177e1a6d5772e71d577ee29d57785e2d0776da0d5779064d4773ad5db7726e4d077d16dd577003dd377804bd37700000000ad37fb758b2dfb75b641fb7500000000" to virtual address "0x755C1000" (part of module "WSHIP6.DLL")27:T6ac,Found malicious artifacts related to "119.207.79.31": ... URL: http://asheater.co.kr/ (AV positives: 1/71 scanned on 08/03/2019 10:54:15) URL: http://www.asheater.co.kr/skin15/css/caret.php (AV positives: 2/71 scanned on 08/02/2019 22:28:24) URL: http://youngs.dgweb.kr/ (AV positives: 3/70 scanned on 06/09/2019 16:57:13) URL: http://youngs.dgweb.kr/skin15/ (AV positives: 4/70 scanned on 05/14/2019 13:56:32) URL: http://youngs.dgweb.kr/skin15/index.php (AV positives: 3/69 scanned on 05/06/2019 07:35:18) File SHA256: 90f0582453f49d3b38da03b289d0ffcad4f691ab89f6acb922511e081d472667 (Date: 08/03/2019 22:01:17) File SHA256: 9a316c168e3bc0f27a6884e44f5beff0587debcdcea5a662783a856d4a244437 (Date: 08/03/2019 08:38:30) File SHA256: b5453db394ce8c22330fe620ab62a8a40ab491992e93d7f495d0370b93bf9688 (AV positives: 54/70 scanned on 08/02/2019 23:39:35) File SHA256: 1958b75e2ef787fdb9938053f117da9ba9866509000af547e700dfb6a806d721 (AV positives: 19/67 scanned on 08/02/2019 15:04:54) File SHA256: fa7c09036e545cb4898df21e284d81aded9d1d86e85af899bfb14d16a19b625c (AV positives: 52/69 scanned on 07/03/2019 08:26:22) File SHA256: 73d65cd0b513cadaaa76b559ada28996eb06b68954538fc628e03893f5ff85e8 (AV positives: 54/71 scanned on 05/22/2019 04:10:25) File SHA256: 5ffb2fdf98077d172d9ce3e6f7b92f0a52d92bfefeeb0ad6dd559fd037febc76 (Date: 05/17/2019 00:31:47) File SHA256: ad3fada660f40b5d3ce2c6187dffc07507e7461a3d3ac249fbb6850e6028d517 (Date: 05/17/2019 00:21:36) File SHA256: 3d4c14db6a6126ecbe8cdd1eea6337b2f3766579062cec6e8331f47f028211ce (Date: 05/02/2019 16:22:31) File SHA256: d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09 (AV positives: 46/70 scanned on 02/19/2019 14:16:55)28:T4d0,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAADY0lEQVR42u2VS08TURiG+ytceVmYGI260gUmaNzJRuMlaBQXYlgYNTEhxI3RmGBwwQJj3BjcqISF8YIYTIyXyKVCBRQskrZaCr1QCvQy05ne4XW+AzOcGaY4rZK48CRPmtOe0+c93/k6tdn+9REMBkEEAgEN9b1QKITp6WmEw2HMzMwwIpEIZmdnMTc3x3A6nfjjAKrY7/drAUhuDEByPsD8/DzcbjdcLlfxEPEtNqwHFIgCTE5OsqBer9c8RFRZLO7d8Feh76RKUQB6TSaT2jWuChDZbIORvFLWdF8vYg1XlubhaWS+jSJaW8PmBaXMGecopJcvYLafoJNHo1EmzWQyEASBVcLn8+lDhJXFRrITXkSOVSH92bE0900gXLET8od3K3OTfTxqACq92kP0nsfj0YcIbrLBSF5pIqn7IyIX6tichPSa+flj6XOltGmqyN0WmO0nSBaLxRCPx5FIJBhUBVEUGVqAKWWxkYxSAd1cCRA4WAH5y7A2N9unY2qqqJx6Qgvg3WiDkdT4d908q/SANPIV/ppqNk+7XTDbx0M/2WJySZJWAniUxesB3XkxuS6AS1m8HtDPzkwuyzLD8pOwp6cH3d3dGr29vYy+vj7Y7Xb09/djYGCA4XA4MDg4iLGxMfZEVMVGeSqVsh6AmskI3a+K2X8EyakB+ZLz8nQ6bT0AfZERtbkI8X0XkpdOQnxwR1dus1Or8pIC8DK+q1WS95ogesYhnq3SiYvJ6alIWA7Ay/im0k7b0Y7kszaI54+vKVbl2WyWYTnAKuHyKbXThkMQDmxH8n7LmmJensvlrAfQyZZPyENCYf8OyCPDlsREPp+3HsAo4yGZPDIE4XAlxJsNlsREoVCwHsAo5CGZeL0e0qNWyJ1PIT1p+62YWFhYsB7AWFYdoQBie7YiNeSA9LAViboaxE8dgdjcBOHWDYi3G1eJicXFResBjGVVkd++RryqEolz1ZDfdCEnS+y0cudzCNeuQmp/jNld23RyEhM0LAfgS0pkgn4IF2uRbG5EdN9uZEVBV2Z2Ygr9yY6cf0onVuUlBVDvUSVRe5qFiB09hLS9Z9X9GkvNS/lhOQB/MiJRfxnxMyeQetWxprSYuOQAvMRMWIq0rAC8yExYirSsAEZZucKyA2Cdhu3/WB6/ADuvDu+77R/qAAAAAElFTkSuQmCC29:T5a1,--type=renderer --primordial-pipe-token=668F43C39AD7394876D73A9C605137FC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.9.20044 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=668F43C39AD7394876D73A9C605137FC --renderer-client-id=2 --mojo-platform-channel-handle=1296 --allow-no-sandbox-job /prefetch:12a:T5a1,--type=renderer --primordial-pipe-token=F8B4A157CA990608FB046C8170218803 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/18.9.20044 Chrome/59.0.3071.15" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553 --disable-accelerated-video-decode --disable-webrtc-hw-vp8-encoding --disable-gpu-compositing --service-request-channel-token=F8B4A157CA990608FB046C8170218803 --renderer-client-id=3 --mojo-platform-channel-handle=1344 --allow-no-sandbox-job /prefetch:11b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790305687523,"unified_at":"2026-09-25T03:08:07.523Z","metadata":{"hashes":{"sha256":"d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09","sha1":"43630a9bc54ff36e1de8ace53c233063c78dea17","md5":"6900bbd0b505126c4461ae21bb4cf85d","sha512":"b3d1a11193634447fc7666562bef1a35dae96c12bdac505773306f623a499ba73b2d2a314e478b13972e888760195fa9fb691cdd68fcfb997a078c422d970974","ssdeep":"768:m1sRvrxglenqJjXaup5Q+fPVYkbbK89j72XQuyBxRVs4b:mORvrxDqJLzQ+1Hb513BvVhb","ssdeep_chunks":["768:m1sRvrx","768:1sRvrxg","768:sRvrxgl","768:Rvrxgle","768:vrxglen","768:rxglenq","768:xglenqJ","768:glenqJj","768:lenqJjX","768:enqJjXa","768:nqJjXau","768:qJjXaup","768:JjXaup5","768:jXaup5Q","768:Xaup5Q+","768:aup5Q+f","768:up5Q+fP","768:p5Q+fPV","768:5Q+fPVY","768:Q+fPVYk","768:+fPVYkb","768:fPVYkbb","768:PVYkbbK","768:VYkbbK8","768:YkbbK89","768:kbbK89j","768:bbK89j7","768:bK89j72","768:K89j72X","768:89j72XQ","768:9j72XQu","768:j72XQuy","768:72XQuyB","768:2XQuyBx","768:XQuyBxR","768:QuyBxRV","768:uyBxRVs","768:yBxRVs4","768:BxRVs4b","1536:m1sRvrx","1536:1sRvrxg","1536:sRvrxgl","1536:Rvrxgle","1536:vrxglen","1536:rxglenq","1536:xglenqJ","1536:glenqJj","1536:lenqJjX","1536:enqJjXa","1536:nqJjXau","1536:qJjXaup","1536:JjXaup5","1536:jXaup5Q","1536:Xaup5Q+","1536:aup5Q+f","1536:up5Q+fP","1536:p5Q+fPV","1536:5Q+fPVY","1536:Q+fPVYk","1536:+fPVYkb","1536:fPVYkbb","1536:PVYkbbK","1536:VYkbbK8","1536:YkbbK89","1536:kbbK89j","1536:bbK89j7","1536:bK89j72","1536:K89j72X","1536:89j72XQ","1536:9j72XQu","1536:j72XQuy","1536:72XQuyB","1536:2XQuyBx","1536:XQuyBxR","1536:QuyBxRV","1536:uyBxRVs","1536:yBxRVs4","1536:BxRVs4b","768:mORvrxD","768:ORvrxDq","768:RvrxDqJ","768:vrxDqJL","768:rxDqJLz","768:xDqJLzQ","768:DqJLzQ+","768:qJLzQ+1","768:JLzQ+1H","768:LzQ+1Hb","768:zQ+1Hb5","768:Q+1Hb51","768:+1Hb513","768:1Hb513B","768:Hb513Bv","768:b513BvV","768:513BvVh","768:13BvVhb"],"imphash":"552532bbd2c975f5919a2bd38a7cbeda"},"file_info":{"file_name":"d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":39936,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1539617281000,"last_seen":1695576911000,"last_multi_scan":1695576911000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":6},"sandbox_signatures":{"informative_count":13,"suspicious_count":12,"malicious_count":5,"total":30},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.PoorWeb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Agent.higqs","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Trojan.Heur.RP.cmKfbePUuZji","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Trojan.Heur.RP.cmKfbePUuZji (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.RQD trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"Trojan/Generic!963133556BDF939E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004db40a1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PoorWeb.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"Trojan-FQEK!6900BBD0B505","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.PoorWeb.fiqipp","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.InfoStealer.81920","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"BKDR_PO.032D04C3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"BKDR_PO.032D04C3","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.BXUW-0342","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Trojan.PoorWeb","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.PoorWeb.Win32.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.PoorWeb","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1112","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"malicious","value":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines"}],"sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \"930j\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"youngs.dgweb.kr\"\n \"youngs.dgweb.kr:80\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"119.207.79.31:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\9g8u4_55559y(ihgiserh5)\"\n \"9g8u4_55559y(ihgiserh5)\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"youngs.dgweb.kr\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09.bin\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\"; Value: \"00000000040000000400000000000000\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":"G5Mh with unusual entropies 7.64125721279","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"3/70 reputation engines marked \"http://youngs.dgweb.kr\" as malicious (4% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$25","origin":"Network Traffic","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"4.4.4.4\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 119.207.79.31 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09.bin\" has an entrypoint in section \"G5Mh\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetUserNameW\n VirtualProtect\n GetProcAddress\n VirtualAlloc\n LoadLibraryA\n InternetOpenW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"malicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by a significant amount of reputation engines","description":"3/70 reputation engines marked \"http://youngs.dgweb.kr\" as malicious (4% detection rate)","origin":"External System","mitre_attack_id":"T1120","relevance":10,"id":"avtest-7","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"46/66 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"46/66 Antivirus vendors marked sample as malicious (69% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$27","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"RdrCEF.exe\" (UID: 00011153-00003944) was launched with modified environment variables: \"PATH\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"AcroRd32.exe\" searching for class \"Acrobat Instance Window Class\"\n \"AcroRd32.exe\" searching for window \"_AcroAppTimer\"\n \"AcroRd32.exe\" searching for class \"AdobeAcrobatSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"AdobeReaderSpeedLaunchCmdWnd\"\n \"AcroRd32.exe\" searching for class \"JFWUI2\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00011153-00003944)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=668F43C39AD7394876D73A9C ...\" (UID: 00011207-00002828)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=F8B4A157CA990608FB046C81 ...\" (UID: 00011234-00003920)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"RdrCEF.exe\" with commandline \"--backgroundcolor=16448250\" (UID: 00011153-00003944)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=668F43C39AD7394876D73A9C ...\" (UID: 00011207-00002828)\n Spawned process \"RdrCEF.exe\" with commandline \"--type=renderer --primordial-pipe-token=F8B4A157CA990608FB046C81 ...\" (UID: 00011234-00003920)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"informative","category":"Installation/Persistance","name":"Creates new processes","description":"\"AcroRd32.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\", Handle: 752), \"RdrCEF.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\", Handle: 1360), \"RdrCEF.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe\"\n Handle: 1440)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"level":"suspicious","category":"Exploit/Shellcode","name":"Possible heap spraying attempt detected","description":"\"RdrCEF.exe\" issued more than 3000 memory allocations","origin":"API Call","relevance":10,"id":"api-88","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":5,"imported_dlls_count":140,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":152,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":9,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":null,"sample_flags":["Network Traffic","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"5d4831fc038838fc16929b03","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.PoorWeb","contacted_countries":["KOR"],"submit_name":"d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09.exe","analysis_start_time":"2019-08-05T13:39:05+00:00","indicators_count":{"informative":8,"suspicious":15,"malicious":6},"tags":["Network Traffic","Sample not shared"],"is_in_unified_schema":true},{"id":"5bc4ae157ca3e1340818b0b7","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","submit_name":"OTX_d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09","analysis_start_time":"2018-10-15T17:11:49+00:00","indicators_count":{"informative":9,"suspicious":6,"malicious":3},"tags":["TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"119.207.79.31","port":80,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]}],"dns_resolutions":[{"domain":"youngs.dgweb.kr","address":"119.207.79.31","ttl":599,"country":"Korea, Republic of","registrar_name":"KSHOSTING inc(http://www.ksdom.kr)","registrar_name_servers":"ns1.nccj.co.kr","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"domain":"youngs.dgweb.kr:80","address":"119.207.79.31","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]}],"http_requests":[{"host":"youngs.dgweb.kr","host_ip":"119.207.79.31:80","url":"/skin15/include/bin/forlab.php","method":"POST","header":"POST /skin15/include/bin/forlab.php HTTP/1.1\nHost: youngs.dgweb.kr:80\nContent-type: multipart/form-data;boundary=-----------------------------000741d004ecc\nContent-Length: 1057","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}],"processes":[{"pid":3180,"ppid":0,"name":"AcroRd32.exe","command_line":"\"C:\\27b58709a6f7a11f2ed6ffda693c831279722ff46f01f604dc1dc53f5a7c3e61.pdf\"","sha256":"08282d73af4eb97578ae8c7a341ca926e25910520b19f5531b8fbd77206c5ed2","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32.exe","uid":"00010691-00003180","icon":"$28"},{"pid":3944,"ppid":3180,"name":"RdrCEF.exe","command_line":"--backgroundcolor=16448250","sha256":"dd617e1f4e2102399e96bdfed412227453b4c71d84b891cf772e212762574e3f","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00010691-00003180","uid":"00011153-00003944"},{"pid":2828,"ppid":3944,"name":"RdrCEF.exe","command_line":"$29","sha256":"dd617e1f4e2102399e96bdfed412227453b4c71d84b891cf772e212762574e3f","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00011153-00003944","uid":"00011207-00002828"},{"pid":3920,"ppid":3944,"name":"RdrCEF.exe","command_line":"$2a","sha256":"dd617e1f4e2102399e96bdfed412227453b4c71d84b891cf772e212762574e3f","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","parent_uid":"00011153-00003944","uid":"00011234-00003920"}],"all_imported_dlls":["winnsi.dll","psapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","msvcr100.dll","normaliz.dll","msvcrt.dll","winhttp.dll","rpcrt4.dll","nsi.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","pnrpnsp.dll","IPHLPAPI.DLL","api-ms-win-downlevel-shlwapi-l1-1-0.dll","shlwapi.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","iertutil.dll","profapi.dll","dhcpcsvc.dll","nlaapi.dll","lpk.dll","sspicli.dll","NapiNSP.dll","dnsapi.dll","ole32.dll","FWPUCLNT.DLL","wship6.dll","imm32.dll","mswsock.dll","shell32.dll","webio.dll","WSHTCPIP.DLL","kernel32.dll","advapi32.dll","user32.dll","ws2_32.dll","rasadhlp.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","sechost.dll","gdi32.dll","userenv.dll","msctf.dll","winrnr.dll","ntdll.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","usp10.dll","wininet.dll","version.dll","secur32.dll","KernelBase.dll","GdiPlus.dll","cryptocme.dll","d3d8thk.dll","wshqos.dll","crypt32.dll","winmm.dll","wevtapi.dll","wlanapi.dll","AGM.dll","apphelp.dll","cfgmgr32.dll","clbcatq.dll","BIBUtils.dll","oleacc.dll","MMDevAPI.dll","oleaut32.dll","credssp.dll","d3d9.dll","Wldap32.dll","CoolType.dll","AdobeXMP.dll","libcef.dll","DWrite.dll","ntmarta.dll","dhcpcsvc6.dll","ieframe.dll","wow64cpu.dll","SensApi.dll","wintrust.dll","RpcRtRemote.dll","AcroRd32Res.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","ccme_asym.dll","msvcr120.dll","tzres.dll","AXSLE.dll","dxva2.dll","bcrypt.dll","cryptsp.dll","cryptbase.dll","comdlg32.dll","comctl32.dll","setupapi.dll","msasn1.dll","wsock32.dll","ExplorerFrame.dll","duser.dll","d3d11.dll","devobj.dll","api-ms-win-core-synch-l1-2-0.dll","icudt.dll","credui.dll","cryptui.dll","ccme_ecc.dll","msimg32.dll","wlanutil.dll","srvcli.dll","msvcp120.dll","netprofm.dll","samcli.dll","ncrypt.dll","rsaenh.dll","wow64.dll","ACE.dll","dxgi.dll","hid.dll","wkscli.dll","dwmapi.dll","uxtheme.dll","npmproxy.dll","wtsapi32.dll","AcroRd32.dll","AXE8SharedExpat.dll","oleaccrc.dll","AudioSes.dll","propsys.dll","urlmon.dll","ccme_base.dll","dbghelp.dll","sqlite.dll","wow64win.dll","netapi32.dll","dui70.dll","ccme_base_non_fips.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","netutils.dll","BIB.dll","gpapi.dll","mscms.dll","chrome_elf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"},{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000005.db","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"C:\\Users\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeComFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeCMapFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\AdobeSysFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\Cache\\AcroFnt18.lst","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd32Res.dll","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\UserCache.bin","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"C:\\27b58709a6f7a11f2ed6ffda693c831279722ff46f01f604dc1dc53f5a7c3e61.pdf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\Viewer.aapp","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\IconCacheRdr65536.dat","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"pipe\\com.adobe.reader.rna.lupmpiF.DC.0","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\SysWOW64\\KBDUS.DLL","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\SysWOW64\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\RdrCEF.exe","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroCEF\\crash_reporter.cfg","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\SysWOW64\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroApp\\ENU\\EPDF_RHP.aapp","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_1","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_2","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_3","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\ARIALN.TTF","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\ARIALNI.TTF","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\ARIALNB.TTF","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\ARIALNBI.TTF","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\arial.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\arialbd.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\arialbi.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\ariali.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\arialn.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\arialnb.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\arialnbi.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\arialni.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\ariblk.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\version.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\variant.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\Acrobat\\DC\\SharedDataEvents","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\ow\\Adobe\\Acrobat\\DC\\ReaderMessages-journal","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\System32\\drivers\\etc\\hosts","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Visited Links","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\File System\\primary.origin","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\System32\\spool\\drivers\\color\\sRGB Color Space Profile.icm","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\shell32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\desktop.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\plugin-selectors.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\css\\home-selector.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\SEGOEUISL.TTF","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\Fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\times.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\timesbd.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\timesbi.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\timesi.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\index.html","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cookie\\Cookies","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\init.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\plugins.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\base_uris.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\libs\\require\\2.1.15\\require.min.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\adobe_spinner.gif","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\index","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%LOCALAPPDATA%\\Adobe\\AcroCef\\DC\\Acrobat\\Cache\\Cache\\data_0","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\rna-main.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-ui-theme.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\css\\main-cef-win.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-up.png","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\vscroll-thumb.png","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\win-scrollbar\\arrow-down.png","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\config.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\desktop-connector-files-select\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\home\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\css\\main-selector.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\tracked-send\\js\\plugins\\tracked-send\\js\\home-view\\selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\add-account\\js\\selector.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\scan-files\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\my-computer\\js\\plugin.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\css\\main.css","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\segoeui.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\segoeuib.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\segoeuii.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\segoeuil.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\segoeuisl.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\segoeuiz.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\fonts\\seguisb.ttf","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\js\\plugins\\rhp\\exportpdf-rna-tool-view.js","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\images\\core_icons.png","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\static\\js\\plugins\\aicuc\\images\\rhp_world_icon.png","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%TEMP%\\A9R1e5h3t7_1i8dhif_2gc.tmp","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%TEMP%\\A9Rlh6mjh_1i8dhig_2gc.tmp","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%TEMP%\\A9Rvvz36t_1i8dhih_2gc.tmp","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\KernelBase.dll.mui","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%TEMP%\\A9R1krb00v_1i8dhii_2gc.tmp","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%WINDIR%\\SysWOW64\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\IA32.api","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%TEMP%\\A9R1eix541_1i8dhij_2gc.tmp","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\Acrobat Reader DC\\Reader\\plug_ins\\PPKLite.api","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobData","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"path":"%APPDATA%\\Adobe\\Acrobat\\DC\\JSCache\\GlobSettings","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLM\\SYSTEM\\ACROBATVIEWERCPP473\\","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{33AAD629-D83F-4FBC-8D2F-FD1B2305E4FB}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\0A-00-27-00-00-00\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\9g8u4_55559y(ihgiserh5)","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"name":"9g8u4_55559y(ihgiserh5)","sources":[{"report_type":"sandbox","report_id":"5d4831fc038838fc16929b03"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\Acrobat Instance Mutex","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\com.adobe.acrobat.rna.RdrCefBrowserLock.DC","sources":[{"report_type":"sandbox","report_id":"5bc4ae157ca3e1340818b0b7"}]}]}},"report_ids":{"sandbox_job_ids":["5d4831fc038838fc16929b03","5bc4ae157ca3e1340818b0b7"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.PoorWeb Sample d057088d0de3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d057088d0de3…. Malware family: Trojan.PoorWeb. Threat score 100/100. 23/28 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.PoorWeb Sample d057088d0de3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d057088d0de3…. Malware family: Trojan.PoorWeb. Threat score 100/100. 23/28 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d057088d0de3d920ea0939217c756274018b6e89cbfc74f66f50a9d27a384b09"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.PoorWeb Sample d057088d0de3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d057088d0de3…. Malware family: Trojan.PoorWeb. Threat score 100/100. 23/28 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]