File name:

dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc

Full analysis: https://app.any.run/tasks/dac2c850-414d-4d0a-aa5d-2d0f6a11f5f0
Verdict: Malicious activity
Threats:

First identified in March 2021, PureCrypter is a .NET-based loader that employs obfuscation techniques, such as SmartAssembly, to evade detection. It has been used to distribute malware families including AgentTesla, RedLine Stealer, and SnakeKeylogger. The malware is typically delivered through phishing campaigns and malicious downloads, often masquerading as legitimate files with extensions like .mp4 or .pdf. PureCrypter utilizes encryption and compression to conceal its payloads and can inject malicious code into legitimate processes to maintain persistence on the infected system.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 01:17:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-startup
purecrypter
netreactor
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

45FCE171FF383553153EB9669D2960AB

SHA1:

9F886A085BEE90CAEBE5B3E7D2E59150433D7486

SHA256:

DC7A3CDE0F236D89B09856B4E5F0232C3C613B791C75433992D557C6489DDCBC

SSDEEP:

49152:xU8rcJfbcwa2z6nqk+/gndjbte+1G2galVGIk4+Or3Pf6LcXlitJV54N3EIFFRa6:xBwf4tQ6qdgndjM+3galRk4+Or3PfNXf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)
      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 5124)
      • oiqlere.exe (PID: 1388)
      • oiqlere.exe (PID: 7684)

    • PURECRYPTER has been detected (YARA)

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • Create files in the Startup directory

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • XWORM has been detected (YARA)

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 5124)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • Executable content was dropped or overwritten

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 2096)

    • Connects to unusual port

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 5124)

  • INFO

    • Reads the computer name

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)
      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 5124)
      • oiqlere.exe (PID: 1388)
      • oiqlere.exe (PID: 7684)

    • Create files in a temporary directory

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • .NET Reactor protector has been detected

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • Checks supported languages

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)
      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 5124)
      • oiqlere.exe (PID: 7684)
      • oiqlere.exe (PID: 1388)

    • Process checks computer location settings

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • Reads the machine GUID from the registry

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)
      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 5124)
      • oiqlere.exe (PID: 1388)
      • oiqlere.exe (PID: 7684)

    • Creates files or folders in the user directory

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • Auto-launch of the file from Startup directory

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 4172)

    • Application launched itself

      • Acrobat.exe (PID: 5608)
      • AcroCEF.exe (PID: 5392)

    • Manual execution by a user

      • dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe (PID: 5124)
      • wscript.exe (PID: 2096)
      • oiqlere.exe (PID: 7684)

    • Reads the software policy settings

      • slui.exe (PID: 4208)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(5124) dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe
C245.154.98.109:3232
Keys
AES3232
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameclients
Mutex8IKK5XKKraHSE4gs
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:28 08:10:35+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 1197056
InitializedDataSize: 18944
UninitializedDataSize: -
EntryPoint: 0x1262be
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 135.0.7049.115
ProductVersionNumber: 135.0.7049.115
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: Google Chrome
CompanyName: Google LLC
FileDescription: Google Chrome
FileVersion: 135.0.7049.115
InternalName: ref60.exe
LegalCopyright: Copyright 2025 Google LLC. All rights reserved.
LegalTrademarks: -
OriginalFileName: ref60.exe
ProductName: Google Chrome
ProductVersion: 135.0.7049.115
AssemblyVersion: 135.0.7049.115
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
149
Monitored processes
20
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #PURECRYPTER dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe sppextcomobj.exe no specs slui.exe acrobat.exe acrobat.exe no specs #XWORM dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe acrocef.exe no specs wscript.exe no specs oiqlere.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs acrocef.exe no specs oiqlere.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
744C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
1388"C:\Users\admin\AppData\Roaming\oiqlere.exe" C:\Users\admin\AppData\Roaming\oiqlere.exe—wscript.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
135.0.7049.115
Modules
Images
c:\users\admin\appdata\roaming\oiqlere.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
2096wscript "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oiqlere.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2236"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe" --type=renderer /prefetch:1 "C:\Users\admin\AppData\Local\Temp\Best_Ways_to_Safeguard_Your_Email.pdf"C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe—Acrobat.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrobat.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4172"C:\Users\admin\AppData\Local\Temp\dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe" C:\Users\admin\AppData\Local\Temp\dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
4294967295
Version:
135.0.7049.115
Modules
Images
c:\users\admin\appdata\local\temp\dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4208"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4896"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=renderer --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --first-renderer-process --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --touch-events=enabled --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2300 --field-trial-handle=1628,i,3896500094428328736,13778715353308394790,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:1C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
4932"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=disabled --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1796 --field-trial-handle=1628,i,3896500094428328736,13778715353308394790,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
5124"C:\Users\admin\AppData\Local\Temp\dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe"C:\Users\admin\AppData\Local\Temp\dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe
explorer.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
135.0.7049.115
Modules
Images
c:\users\admin\appdata\local\temp\dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
XWorm
(PID) Process(5124) dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exe
C245.154.98.109:3232
Keys
AES3232
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameclients
Mutex8IKK5XKKraHSE4gs
5228"C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe" --type=gpu-process --log-severity=disable --user-agent-product="ReaderServices/23.1.20093 Chrome/105.0.0.0" --lang=en-US --gpu-preferences=UAAAAAAAAADgACAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --log-file="C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\debug.log" --mojo-platform-channel-handle=1564 --field-trial-handle=1628,i,3896500094428328736,13778715353308394790,131072 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,WinUseBrowserSpellChecker /prefetch:2C:\Program Files\Adobe\Acrobat DC\Acrobat\acrocef_1\AcroCEF.exe—AcroCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe AcroCEF
Exit code:
0
Version:
23.1.20093.0
Modules
Images
c:\program files\adobe\acrobat dc\acrobat\acrocef_1\acrocef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
17 226
Read events
17 123
Write events
101
Delete events
2

Modification events

(PID) Process:(4172) dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithProgids
Operation:writeName:Acrobat.Document.DC
Value:
(PID) Process:(5608) Acrobat.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2034283098-2252572593-1072577386-2659511007-3245387615-27016815-3920691934
Operation:writeName:DisplayName
Value:
Adobe Acrobat Reader Protected Mode
(PID) Process:(2236) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
0
(PID) Process:(2236) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:bSynchronizeOPL
Value:
0
(PID) Process:(2236) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:uLastAppLaunchTimeStamp
Value:
(PID) Process:(2236) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVGeneral
Operation:writeName:iNumAcrobatLaunches
Value:
7
(PID) Process:(2236) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\ToolsSearch
Operation:writeName:iSearchHintIndex
Value:
3
(PID) Process:(2236) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:sProductGUID
Value:
4143524F4241545F475549445F4E474C5F44554D4D5900
(PID) Process:(2236) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AVEntitlement
Operation:writeName:sProductGUID
Value:
4143524F5F5245534944554500
(PID) Process:(5608) Acrobat.exeKey:HKEY_CURRENT_USER\SOFTWARE\Adobe\Adobe Acrobat\DC\AdobeViewer
Operation:delete valueName:ProductInfoCache
Value:
Executable files
1
Suspicious files
179
Text files
10
Unknown types
1

Dropped files

PID
Process
Filename
Type
4172dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exeC:\Users\admin\AppData\Local\Temp\Best_Ways_to_Safeguard_Your_Email.pdfpdf
MD5:F220908566ECF72B1A18A14D8B32A10E
SHA256:F3D17A5A93DC3A62B97F14A38ACB1521F8A5BC5927AF32A0F157CBF8B1032790
4172dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc.exeC:\Users\admin\AppData\Roaming\oiqlere.exeexecutable
MD5:45FCE171FF383553153EB9669D2960AB
SHA256:DC7A3CDE0F236D89B09856B4E5F0232C3C613B791C75433992D557C6489DDCBC
2236Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.jsonbinary
MD5:837C1211E392A24D64C670DC10E8DA1B
SHA256:8013AC030684B86D754BBFBAB8A9CEC20CAA4DD9C03022715FF353DC10E14031
2236Acrobat.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\NGL\NGLClient_AcrobatReader123.1.20093.6 2025-05-10 01-18-14-760.logtext
MD5:460C6041966002D8384A18C895A65EB0
SHA256:C83EC6E8FB3EC62481289C033238C1D9B08DB8076EAAD304099FD7A7F594F1B9
2236Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\Files\TESTINGmp3
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
5392AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF11050e.TMPtext
MD5:D012E5B4EB91B61F6E8AE2F8EC3C623E
SHA256:1BDA750084F20306722008016420E1912BA608CA8EFB9C661F7E7EFCF5E89673
5608Acrobat.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lstbinary
MD5:366B140BAFC863B7E366AA1E51604759
SHA256:CBC8B288DBD2C72432081CF33CEF431572A94C7FB89DBCD59973B99E3871814E
2236Acrobat.exeC:\Users\admin\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txttext
MD5:AAA04F09646AA94AAFA986853A605AC8
SHA256:3BD836EA81FEAB23077FA1CAE6D3FE63B8A1856D78A7C448D9D3B54C0F8D494E
5392AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old~RF11076f.TMPtext
MD5:ED7D8AAE48211E2BFAF557130572C62A
SHA256:A5CF8D8ADC86DCA357396AF7E3A24A116072D5C1E5552EEB76601AE2673DED6E
5392AcroCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0binary
MD5:3FEF2C67D94F7FABC79EA42681D63EA2
SHA256:A2823CAA27432DDD47FAB3308C158A091094C21687F0FB7EF22704D0E1924205
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
30
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7448
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7448
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5608
Acrobat.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAfy81yHqHeveu%2FpR5k1Jb0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.3:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6388
AcroCEF.exe
95.100.184.205:443
geo2.adobe.com
AKAMAI-AS
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 23.48.23.166
whitelisted
google.com
  • 216.58.206.46
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.31.3
  • 20.190.159.68
  • 20.190.159.131
  • 40.126.31.2
  • 20.190.159.130
  • 20.190.159.129
  • 20.190.159.0
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
geo2.adobe.com
  • 95.100.184.205
whitelisted
p13n.adobe.io
  • 23.22.254.206
  • 52.5.13.197
  • 52.202.204.11
  • 54.227.187.23
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
dc7a3cde0f236d89b09856b4e5f0232c3c613b791c75433992d557c6489ddcbc