Windows Analysis Report https://bms.kaseya.com/Common/GetFile.ashx?enc=iAIF3krAhFnrzr2%2fdZEndh%2foMj7qNe0PshuhX7KBbHtbR9vpsvc9XqhjBxH0y6QoOe1BdU1OcYCSw%2fCxijoaHl0%2faUv%2fJAurw9NEQN2A5zE%3d

Overview

General Information

Sample URL:	https://bms.kaseya.com/Common/GetFile.ashx?enc=iAIF3krAhFnrzr2%2fdZEndh%2foMj7qNe0PshuhX7KBbHtbR9vpsvc9XqhjBxH0y6QoOe1BdU1OcYCSw%2fCxijoaHl0%2faUv%2fJAurw9NEQN2A5zE%3d
Analysis ID:	441424
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Signatures

There are no high impact signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown

DNS traffic detected: queries for: bms.kaseya.com

Source: GetFile[1].htm.3.dr

String found in binary or memory: https://bms.kaseya.com/media/GetFile.ashx?enc=iAIF3krAhFnrzr2%2fdZEndh%2foMj7qNe0PshuhX7KBbHtbR9vpsv

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443

Source: classification engine

Classification label: clean0.win@17/61@1/2

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3B83DA5F-D84F-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF87D44F45FD4D4F92.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe

File opened: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\crash_reporter.cfg

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

File opened: C:\Windows\SysWOW64\Msftedit.dll

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe

Process information queried: ProcessInformation

Jump to behavior

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
52.144.52.222	origin-bms.kaseya.com	United States		50292	STRATOGENGB	false

Private

IP
192.168.2.1

Contacted Domains

Name	IP	Active
origin-bms.kaseya.com	52.144.52.222	true
bms.kaseya.com	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
0	false	1%, Virustotal, Browse	low

ID:	441424
Product:	CloudBasic
Start time:	22:26:34
Start date:	28.06.2021
Cookbook:	browseurl.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS

Name	Type	MD5	SHA1	SHA256
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\05349744be1ad4ad_0	data	A290CCFD836DF13697F726CA3E0C6191	7E69BB315157C2CFE0BFEF5999F6AEB1137FED91	E33536D46BB01976BF864C907B4968D06CABCE5CF06F55A3D4DB694522867294
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0	data	510671D92800292E52F41811532D6CAA	6159D6232B16D29A7083C876F48DCB697D9E1226	2CBD365C2A6135AF675A7B8C495CD7B814BF8CB7EE9E5B86A112B67A8DA05D60
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0998db3a32ab3f41_0	data	C81E8CB59F45D18E7D428A50D6F2FD9A	D0F9CC56E490BBE427870F6AF2E2E9A33D2740BC	7FC404D23BF6CB0C069795E14B01FBEC383569652743C0A5F285B16DFAD1A9B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0ace9ee3d914a5c0_0	data	33FD974542857726A68D15980C33159E	DD8A9CEDE266ED85681F77557BDA0920CE7667DB	8DDAF39870EA80C049BA4E9F5ACCADD5D436248783D53AFEA13D5F5F3C061BEE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0f25049d69125b1e_0	data	E179A603644A30D959FDB0CA41933DF0	6EC683634BCA836A7AB517CAFB013A276DA761B1	913AFAF101EFF8EE64E2A38F34F21E0B59BDA20AEAB4395C97256F335C4494DF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\230e5fe3e6f82b2c_0	data	7AD6D9CBA079B8658A24153584E93A51	0DBB4C2AC9812651302E836D7EF347262A1CA42D	6F84FD5A769103C66D2FE927D0A000FE517B7F651B2704A3D044BFF33E6DDCB2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2798067b152b83c7_0	data	F82C2EB61356B583C4BA6B72C438D7D0	FA35399CA3611DD224D0FDFFEBC409CCAA6D0B2C	B57257C8D4C33FE9342082403F3FFC45A61C1F756C36A0EC194563D2F087D9D9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0	data	E07300244E488D1F1D525867EB8FF635	82F360BB7C6FB9DA3C7808C244605E3AB28018E4	A9CE3909A44D6BB7E2922B31FCA7432FC65838DC6B5EA1891A2ACEAE52CA0F2B
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\3a4ae3940784292a_0	data	15B525F619A84499021453FCF0240C3E	7086AAE283AB76436B60D927B0D5D8EB49612CD2	0B1B9926E28624A1062E33C3DFC9A8FB6A5800AC2603AF5493E50E9FFEB6F15D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0	data	079F67B62965A4E9B04C0D4CF797E3B9	060E832B366426FCF84DAC9E02F5C641A14B1847	92543001184908C5EC6EA245E8B0AF2FC717128E0626754146015D94053C228F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\560e9c8bff5008d8_0	data	A1A1C84E253B0A28808AAB45F7E656BE	4002120FC3BF08790A9EE566E9E7C3E637DE89BF	636FF4EA829FDFA68A1687C0B9BC3648C9D575F9FA4167C11D0FD3854E84498D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\56c4cd218555ae2b_0	data	0C58C758F97961292D56411AB46AE3C2	8E8E7C8DA6DD8B1F1B4C5BB53145BF1598245E22	726762A8AB3003997452553CA13EF4BB04D0BF07CDA6FEAF739BD7F0B08C4AF0
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\6fb6d030c4ebbc21_0	data	4889E3F8858D1FD305ABC1AD3ED2B002	55CBDECE0822801C9E8029ACE57788A9F4654C97	01685239C76F8BEC4AB8E55F7B947C2C24CC7C7E1444EF8D31B8618954A40E1D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\7120c35b509b0fae_0	data	5189BDDB4AF244D007552B9883B84B8A	AC07CBF838F4BFD1EE970DD72E27FF865F3B26A6	ED0677F5ACD00893BE00BD144CC509EC75F44DF1915B4C01DEB14D7E42CDCF25
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\71febec55d5c75cd_0	data	FD5D8860611F93BED3353A692BD0A7D5	0C55A2CEE9F1200B2353BA072727ABDD9B6EEC81	CC73EDCE6F10D66A392C5042CA4B8613893A487D8BCD1DECD4EF71B1CBAE6317
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\86b8040b7132b608_0	data	4950592581BE2383DEC139C117C4496E	2234DAD6B55ACEE48D2AE13F2A1E5FF214E56DF3	1396B125237750C2FD1644D5AEF43842F0DFACC64C22FF8CCB0FD209FDA7DCCE
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c159cc5880890bc_0	data	E12C6403B5B3DBE385478E34453EEC12	CB7C3A7B3F0D2E5D64B1B222E2FD508D4C848A68	28FA8742224E3A22DC06FED30746882538F6D0024A5BE0F3A7CEF5461D09A7F4
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8c84d92a9dbce3e0_0	data	5036D5D957557E886A93EA2350E88EFE	4E055DE7ADB8B36B23BF0D37D4EDE0D08B2E4EDB	8B46B1DBEA36F612C2C9BF18D4A9A68C6456E2C82EAB00729A32B255344546B9
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\8e417e79df3bf0e9_0	data	0553DA8FD4F7DE2E3F9BAA9829F7782E	8127F9552690250E7DC4EA9C8875AE832329341F	C22344F0627A301F18496B91458E5B38EE7D94BFF2DD775D581F8A39C0496AAF
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\91cec06bb2836fa5_0	data	923BFD208C809D0B9A54B7D5C08A8E36	D036D97919567A67942057E87DCACE15D0DDE1DB	50541B1F07946A881A7122FAF5F4CC94511A90AABC10AD4BC44CA7FD51CA569C
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\927a1596c37ebe5e_0	data	B63CB56DA539B376FC5A6ABEBDAFC8A3	B93B6A4740808A948B0CDE3A0A4B2919026825FD	20411B13B0FC52BCDFEB2A4FB30CB90EA413DC3320D50CD52EDC6F75DC31067F
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\92c56fa2a6c4d5ba_0	data	B13631B00D44B3A978BA4E6BCEA9103F	0DD625E59983A1207D2CB77EC87616DC1D8CB2AC	713B6F07587739E3C75D37A69C4C00237DD96603972BC3F814171232FA377595
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\946896ee27df7947_0	data	DC4FFDE3C1884A8745515784B56CC011	F728E26E245C631F470BC5CB403EC81BE6062E6B	399ECACECD10D68419096A2B2973A23E384BA37276E299A66657CFA061096044
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\983b7a3da8f39a46_0	data	5927163763A45A94379336026A11086D	43E30417CD62E3C1CA9E814CD13D96C1ADCC9BFC	C303BE46A05E03B8D79FB6A2A1B6266F16CF4CE237F676A2B94C55BF4D38FBED
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0	data	633A6A7007C48416BB07687AA0538E39	9FEAE4A1F27260EE3305A5AA791607543188C8AC	3A88361A2FABD3D63FE3D1B706B68969D68333336491FA4900400227BE3AC6DD
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\b6d5deb4812ac6e9_0	data	60A71E0BF54C3A8958294D2619772F2D	F930F9372B288A8646C02DB0B556DD6C4F2F72B5	9CA83D40B8074FD6B502C5874E407DFAF4F6883E8FCFD7885E46DA102F5D6813
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0	data	15D6A962603048F5A0E9E7D78F94C9B5	0DE5FEC404F2BB89659E14021BF6FBA222BCDFD5	77D9977B0CB3499EBCC90F5A9437B07D42C25E450CD3475C90A35DE45C10A1A5
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bf0ac66ae1eb4a7f_0	data	DE28044E53608C441BC2BAFE1E637E88	9AC8484A8E9F359ED8F2EDE4675B572AC3980EE9	5AA8BB12D5B9B17E989000968E1D6C1CCA860A95DCB44FAE0B6C0FB2FB5708E2
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\cf3e34002cde7e9c_0	data	3C2FE741EAC123075B6F0D522B08797F	3CB625F39F327919B1E545E059EDC046FFE6FB21	608CD1FDF11DC6BCF864DA17E1C8809B4615B8CB6C7DC65B13101B600DEFCDF3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d449e58cb15daaf1_0	data	0BFE781FBE4464047A6C77A422580FD7	A2C5263CFA9F81CB205CE9665DCB3B5FCC87A88C	381419A533AF19B2A4193F413DEC74A255038BA13FF73560B25616FC152F1669
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\d88192ac53852604_0	data	5EB4832D242E7CAAE57DA0A7C2930314	2F9E9ADAD0E6E250AB1968A3EC45A17E7D89BB8A	553F20CE61C87DCCCEFE077DA221FD6312F0289C70870EAC73A121461E64A872
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\de789e80edd740d6_0	data	3053C9937930DF389238ACBB5F82081B	F3A21983CEF0829F2D248E9E44E531C2D9D136BF	48FA9025565E540132E711D6B459E7284BEDAFCF5A5ED2353AD44D8797643B58
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f0cf6dfa8a1afa3d_0	data	F58B6B0906DC7EC7B64794F9F048D28B	22EC9220867D32F811ADD5799E82F56F3DAEEA20	9AF4D39AB7C32A8055D5AAC939C8AC6A9D9B56D27539174D7A4C34270DF0C06D
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f4a0d4ca2f3b95da_0	data	701C6D852A8FBDB3710775F3ABEDBADF	3F1089DC4CD64CC1CF83E53215F37C902A67D7A7	D33D1D5BE548F4CDFB4AC76BC6CBC6DB4FA9EA954D812C5E6476FBC551BAA704
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f941376b2efdd6e6_0	data	CC8E4E58E38A5FE9C6CD0729A5D43946	FC97B4509B833D3AC34B8306F208C38DAEF7D22F	087D892B2422F630B66017C91C125DDD232F9F725E6B1D6A497F24780BACA276
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\f971b7eda7fa05c3_0	data	36E475D858F910E8E190298451D5EAA1	48BBB9DB50C8CA55C1C1A47C02F80D6D953D5A5D	E08055827733EC427E75575F1EF9927B45175DCE1B4C77AC903495B50ACB2760
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fd17b2d8331c91e8_0	data	CD78523D761E019C47D9D0ABC1A1A7EF	EDBB8BBCBF3D47BA3CF4BF7A8CA665D65057D3E0	29ABDF48D4BADDC86574C0115A159421DA82B95138E9C8CC3B5E2C8213687EA3
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\fdd733564de6fbcb_0	data	5EC19779C6E4BB06112392C021E54AD3	A91E6E4760E30DA4495374E366EA997F5D447B14	79BF4EAF1A24649E24BB735E327613B860A0CBC15D413ED5F62C0D62F647D863
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\febb41df4ea2b63a_0	data	E640F6D0A129D81E477DEC6DEF751925	DD5BF4DE76C6CDD3982127517870D9024C22090E	FC17213A1721D072CB604AE3C1F7AA4502F2DE77D1E4C26D3DBB787E38B35FD7
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\index-dir\temp-index	Maple help database	C59DD3B8872482BAF6E2AAD197EDA13F	DCD67AB0B1A7C794F08B41BCAB20F9FC88063E6D	EF6E1AB3F63CB8750E8EE4C5870AD7A0E79F856CE68CCBE73832B3F19C162734
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG	ASCII text	E1DB42FCF89CE83A498517A602CDD489	8304A89BB901BF44BE5B36E690B7A100511C20F9	2FC3C9386755DF8354CD13FBE0635F51316D9E9693F0FDBCF3C9D93F63416A04
C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Visited Links	data	05C31564F5D129E37A363E150A042D4D	FA62CA0C75E503D2C5E83FE48A9846CD48FFF480	64044EF0EAA6C2CCA1F6D5E32B8C1AD305D642A8AF7F91C89CACC2BF8642C5D1
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ConnectorIcons\icon-210628213639Z-225.bmp	PC bitmap, Windows 3.x format, 117 x -152 x 32	1055D11813EFE9205962259949194741	B07665F4649A0131B066CE12B88E878FEFA50596	52A51394AF040A43F3FE0C82C5677F32EF289F93543C31D221686E7C7264B5DA
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages	SQLite 3.x database, last written using SQLite version 3024000	442A3392FA25BFF1EC9087C57F006979	F8B6A8F188ED0DB74215A56179A25C626F8D7937	0F439BD4C67B194EB562DB972BB0F0132E9181846BFF8700CDBFE93C13BF0E7B
C:\Users\user\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages-journal	data	C31FD5AB5CFADF1EDA275408FCA9F2B1	4602D9F5CEA0D32FDF46FC04D73039BD92B2921E	ABF41A25F961556D3CB5378E1D187BB9451EC272A6BB2F77B688CB814C23DB88
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeFnt16.lst.4244	PostScript document text	159ACCAFBA209FBC642499809CE2B513	6D94F57B63CE3BE71EDFB081ECB848B7D06EB2BE	ACE286E29DFDB19080E514F3447F46E0E4ED658263AC209A9B4BBCECC36139D3
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\Cache\AdobeFnt16.lst.4244	PostScript document text	63B24EA3A13EAC476D6309BB202EF459	89502C393549C20C933E4553F51F74F3DBE085EF	2B4BE0BED267BBD4E4FFFC912A6C7ED6A8D4735DCF9B69FF90F37CDDEF4110EA
C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache.bin	data	AED51F94F257BDA3834B6861C33A1C9E	90A26B1890E98554F317E3781D24ACEAC3896CFA	657F858BE441E2D2605B359C3F1B95051EEC188FDD3E5B6D4137C103ACD891EC
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3B83DA5F-D84F-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	6BC1D6985D3D907EFA14297EED6ED007	D8660D72CB52D087DB9ACFD96F89325A78621072	28FD89A25DE8009E0E24A206ED710FC571A1210FE4583DFEC9632F1D70D229CE
C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3B83DA61-D84F-11EB-90EB-ECF4BBEA1588}.dat	Microsoft Word Document	6C36C806B9F4601FE1D5F7C98F26F521	BAC6461A8054229EB489064FC9E69B18E21CD680	6B4B5D40E88A79FF93D971CAB30A3921270DCEC04819AD0EBC72861811EA98E3
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\GetFile[1].htm	HTML document, ASCII text	993DBD09D125CD5C7FA6AA21A16386BD	6078DA6DE6C544C35BD32FFFCB0558AC88B44068	589A1603A7DBB984C34E7BDB167F0262AEC72BB2E0B05328EA75410F997F98A5
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dffa983a-7248-493b-8e1c-28fd79d790ab.pdf.mqkffie.partial	PDF document, version 1.4	BB9E07B1314958DB05E28E57CDAFB3EA	94B4051C8B557D875A5DDA4C6865B3C043F884CA	5F544F5E6A1F6855DC058DBF566442A7538F71CC6DAF422F53B2C69FC533D586
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dffa983a-7248-493b-8e1c-28fd79d790ab.pdf.mqkffie.partial:Zone.Identifier	ASCII text, with CRLF line terminators	FBCCF14D504B7B2DBCB5A5BDA75BD93B	D59FC84CDD5217C6CF74785703655F78DA6B582B	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dffa983a-7248-493b-8e1c-28fd79d790ab.pdf:Zone.Identifier	very short file (no magic)	ECCBC87E4B5CE2FE28308FD9F2A7BAF3	77DE68DAECD823BABBB58EDB1C8E14D7106E83BB	4E07408562BEDB8B60CE05C1DECFE3AD16B72230967DE01F640B7E4729B49FCE
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\dffa983a-7248-493b-8e1c-28fd79d790ab[1].pdf	PDF document, version 1.4	BB9E07B1314958DB05E28E57CDAFB3EA	94B4051C8B557D875A5DDA4C6865B3C043F884CA	5F544F5E6A1F6855DC058DBF566442A7538F71CC6DAF422F53B2C69FC533D586
C:\Users\user\AppData\Local\Temp\JavaDeployReg.log	ASCII text, with CRLF line terminators	3A54D7E87934C2AC399DEF4E1F7F5A34	4154E3ADC7E5BCF8FA8E9E3A44D916D97359D769	66F2D8D151D90806337437CD5781A2CDADEA43A0D2B12C7443718479266F5B35
C:\Users\user\AppData\Local\Temp\~DF50DFDE34EA9244B9.TMP	data	9BE3E1922A9765523BDB110097BCEAA0	95C4500327265479ECFB4A4486BFF065C343D3B0	38A833C9318E09823401CE0124CE9AD3333E5B8055F7E1263BB6234927893E73
C:\Users\user\AppData\Local\Temp\~DF87D44F45FD4D4F92.TMP	data	0289F667939CBC2F55B26007E6949AD6	A88BB77C96C9657035C8FD45ECAB8E0CC4B8BF7F	96A084C3EC86E17C34CFBEA0BAA46A821E61CDC1348415AAC2E88127209558DC
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\JSCache\GlobSettings	ASCII text	DD4A3BD8B9FF61628346391EA9987E1D	474076C122CACAAF112469FC62976BB69187AA2B	7C22C759CA704106556BBC4FC10B7F53404CA1F8B40F01038D3F7C4B8183F486
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_store	data	5899D998731A4A9337869D49C04FD8DB	15859C86F73A4F8DFEF2C64F4A9833F02242D893	A0127D63E20482835F839E787AC3B684BD65EF1FDD1D381810240E3F94876AB6
C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\ES_session_storei	MS Windows COFF PA-RISC object file	F4DA58794E43BC05D7FBFB49300A3D25	A089EB6F634C19B95A804EBBDDB8854316DD87AF	B81A2359D689BF6611E529F93A285E3E1827D07E8953DFA92CDE0F85646136C0

Windows Analysis Report https://bms.kaseya.com/Common/GetFile.ashx?enc=iAIF3krAhFnrzr2%2fdZEndh%2foMj7qNe0PshuhX7KBbHtbR9vpsvc9XqhjBxH0y6QoOe1BdU1OcYCSw%2fCxijoaHl0%2faUv%2fJAurw9NEQN2A5zE%3d

Overview

General Information

Detection

Signatures

Classification

Signatures

Compliance:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Private

Contacted Domains

Contacted URLs

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6776 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dffa983a-7248-493b-8e1c-28fd79d790ab.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dffa983a-7248-493b-8e1c-28fd79d790ab.pdf'
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,13757733991334525867,7786359997496625938,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=5642234162136683367 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5642234162136683367 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1676,13757733991334525867,7786359997496625938,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=6949978120898280864 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,13757733991334525867,7786359997496625938,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=348665043263964070 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=348665043263964070 --renderer-client-id=4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,13757733991334525867,7786359997496625938,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=12973235889727847520 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12973235889727847520 --renderer-client-id=5 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6776 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dffa983a-7248-493b-8e1c-28fd79d790ab.pdf'	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe' --type=renderer /prefetch:1 'C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\dffa983a-7248-493b-8e1c-28fd79d790ab.pdf'	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --backgroundcolor=16514043	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,13757733991334525867,7786359997496625938,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=5642234162136683367 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=5642234162136683367 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=gpu-process --field-trial-handle=1676,13757733991334525867,7786359997496625938,131072 --disable-features=VizDisplayCompositor --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --lang=en-US --gpu-preferences=KAAAAAAAAACAAwABAQAAAAAAAAAAAGAAAAAAAAEAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --service-request-channel-token=6949978120898280864 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=' --type=renderer ' /prefetch:2	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,13757733991334525867,7786359997496625938,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=348665043263964070 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=348665043263964070 --renderer-client-id=4 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job /prefetch:1	Jump to behavior
Source: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe	Process created: C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe 'C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe' --type=renderer --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --touch-events=enabled --field-trial-handle=1676,13757733991334525867,7786359997496625938,131072 --disable-features=VizDisplayCompositor --disable-gpu-compositing --service-pipe-token=12973235889727847520 --lang=en-US --disable-pack-loading --log-file='C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log' --log-severity=disable --product-version='ReaderServices/19.12.20035 Chrome/80.0.0.0' --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=12973235889727847520 --renderer-client-id=5 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1	Jump to behavior