File name:

478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092

Full analysis: https://app.any.run/tasks/d0b6891c-1ac3-4961-a0df-1c01c0e63696
Verdict: Malicious activity
Threats:

DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 00:57:47
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
stealer
evasion
purecrypter
netreactor
ims-api
generic
darkcloud
crypto-regex
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

20D5CAC4E4CABDF284EEA97FECFB8FDC

SHA1:

A8F7A1DF77C1257545D63E6549D8775680F686A7

SHA256:

478EDFC78C7E29970989A6F9B1463ED0B72E366B6DA9FF24D468449EF1403092

SSDEEP:

49152:Puo7pU17fPK9PzQkrxmBw7Cvs/DuPBFsvSR+qAN6wT3E4plctDmv8p2HMyfWOnBs:PuoYmrZ7Cvs/SPBFs1q+6wT3E4plczht

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PURECRYPTER has been detected (YARA)

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)

    • Executing a file with an untrusted certificate

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)
      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • oiqlere.exe (PID: 2320)
      • oiqlere.exe (PID: 7752)

    • Create files in the Startup directory

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)

    • Stealers network behavior

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)

    • DARKCLOUD has been detected (YARA)

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)
      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • oiqlere.exe (PID: 7752)

    • Executable content was dropped or overwritten

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)

    • Checks for external IP

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • oiqlere.exe (PID: 7752)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)

    • Found regular expressions for crypto-addresses (YARA)

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 8164)

  • INFO

    • Manual execution by a user

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • wscript.exe (PID: 8164)
      • oiqlere.exe (PID: 7752)

    • Create files in a temporary directory

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)

    • .NET Reactor protector has been detected

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)

    • Reads the machine GUID from the registry

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)
      • oiqlere.exe (PID: 2320)
      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • oiqlere.exe (PID: 7752)

    • Auto-launch of the file from Startup directory

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)

    • Reads the computer name

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)
      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • oiqlere.exe (PID: 7752)
      • oiqlere.exe (PID: 2320)

    • Process checks computer location settings

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)

    • Checks supported languages

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)
      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • oiqlere.exe (PID: 2320)
      • oiqlere.exe (PID: 7752)

    • Creates files or folders in the user directory

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 7368)
      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • oiqlere.exe (PID: 7752)

    • Application launched itself

      • Acrobat.exe (PID: 7960)
      • AcroCEF.exe (PID: 7312)

    • Checks proxy server information

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)
      • oiqlere.exe (PID: 7752)

    • UPX packer has been detected

      • 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe (PID: 8076)

    • Reads the software policy settings

      • slui.exe (PID: 7476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:28 11:23:31+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 1407488
InitializedDataSize: 70144
UninitializedDataSize: -
EntryPoint: 0x1597fe
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 135.0.7049.115
ProductVersionNumber: 135.0.7049.115
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Google Chrome
CompanyName: Google LLC
FileDescription: Google Chrome
FileVersion: 135.0.7049.115
InternalName: mt-sg50.exe
LegalCopyright: Copyright 2025 Google LLC. All rights reserved.
LegalTrademarks: -
OriginalFileName: mt-sg50.exe
ProductName: Google Chrome
ProductVersion: 135.0.7049.115
AssemblyVersion: 135.0.7049.115
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
20
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #PURECRYPTER 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe sppextcomobj.exe no specs slui.exe acrobat.exe acrobat.exe no specs #DARKCLOUD 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe wscript.exe no specs oiqlere.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs oiqlere.exe acrocef.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
812"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1548 --field-trial-handle=1568,i,3299560791425750407,10316160995859249765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
2320"C:\Users\admin\AppData\Roaming\oiqlere.exe" C:\Users\admin\AppData\Roaming\oiqlere.exe—wscript.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
135.0.7049.115
Modules
Images
c:\users\admin\appdata\roaming\oiqlere.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4040"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2176 --field-trial-handle=1568,i,3299560791425750407,10316160995859249765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe
AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4188"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2944 --field-trial-handle=1568,i,3299560791425750407,10316160995859249765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4756"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=2080 --field-trial-handle=1568,i,3299560791425750407,10316160995859249765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:8C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5204"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1816 --field-trial-handle=1568,i,3299560791425750407,10316160995859249765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5212C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6712"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1548 --field-trial-handle=1568,i,3299560791425750407,10316160995859249765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6872"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --first-renderer-process --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1568,i,3299560791425750407,10316160995859249765,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
7312"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --backgroundcolor=16514043C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—Acrobat.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
18 286
Read events
18 177
Write events
107
Delete events
2

Modification events

(PID) Process:(7368) 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
Operation:writeName:Acrobat.Document.DC
Value:
(PID) Process:(7960) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(8064) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(8076) 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(8076) 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(8076) 478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(8064) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:bSynchronizeOPL
Value:
0
(PID) Process:(8064) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:uLastAppLaunchTimeStamp
Value:
(PID) Process:(8064) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:iNumAcrobatLaunches
Value:
7
(PID) Process:(8064) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ToolsSearch
Operation:writeName:iSearchHintIndex
Value:
3
Executable files
1
Suspicious files
199
Text files
10
Unknown types
1

Dropped files

PID
Process
Filename
Type
7368478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeC:\Users\admin\AppData\Local\Temp\Best_Ways_to_Safeguard_Your_Email.pdfpdf
MD5:F220908566ECF72B1A18A14D8B32A10E
SHA256:F3D17A5A93DC3A62B97F14A38ACB1521F8A5BC5927AF32A0F157CBF8B1032790
8076478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\keyDBPath.dbbinary
MD5:0FF3BCDD0BE077B9EB8194B5C09F453C
SHA256:225D669E47EB14D8C969799C92AAEF27B66CD984872EA09284E48DB46521E651
8064Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTINGmp3
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
7312AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.oldtext
MD5:8412AEEF2309E13FC954061D9BCEFFF4
SHA256:D062D7B5DF5F3BCB753E97AB5D1DCD9CF62058D9103DA383DBE1F482FC1D4644
7368478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oiqlere.vbstext
MD5:A5B60EBD41481210801C63CA737660DF
SHA256:39FD448FA0B15043A3FB4DBB7E3F4A4DF859134BD692C54B0CD4D4BC588D5CCE
7312AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF110099.TMPtext
MD5:ED7D8AAE48211E2BFAF557130572C62A
SHA256:A5CF8D8ADC86DCA357396AF7E3A24A116072D5C1E5552EEB76601AE2673DED6E
8064Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeFnt23.lst.8064binary
MD5:366B140BAFC863B7E366AA1E51604759
SHA256:CBC8B288DBD2C72432081CF33CEF431572A94C7FB89DBCD59973B99E3871814E
7368478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeC:\Users\admin\AppData\Roaming\oiqlere.exeexecutable
MD5:20D5CAC4E4CABDF284EEA97FECFB8FDC
SHA256:478EDFC78C7E29970989A6F9B1463ED0B72E366B6DA9FF24D468449EF1403092
8064Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.jsonbinary
MD5:837C1211E392A24D64C670DC10E8DA1B
SHA256:8013AC030684B86D754BBFBAB8A9CEC20CAA4DD9C03022715FF353DC10E14031
8076478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\LoginDatabinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
28
DNS requests
21
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8076
478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
7752
oiqlere.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
7896
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7896
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7960
Acrobat.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.22:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.140
  • 20.190.160.20
  • 40.126.32.68
  • 20.190.160.2
  • 20.190.160.67
  • 40.126.32.74
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
showip.net
  • 162.55.60.2
shared
geo2.adobe.com
  • 95.100.184.205
whitelisted
p13n.adobe.io
  • 54.227.187.23
  • 52.202.204.11
  • 23.22.254.206
  • 52.5.13.197
whitelisted

Threats

PID
Process
Class
Message
—
—
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
—
—
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
—
—
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
—
—
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
—
—
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
—
—
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
478edfc78c7e29970989a6f9b1463ed0b72e366b6da9ff24d468449ef1403092