File name:

acer.exe

Full analysis: https://app.any.run/tasks/0cc0dc4b-7a1b-474d-86c6-2ed58d5c08f0
Verdict: Malicious activity
Threats:

DarkSide ransomware is a novel ransomware strain involved in high-profile incidents. Its attacks lead to data theft and encryption, causing significant damage to victims.

Malware Trends Tracker     >>>
Analysis date: June 21, 2025, 21:08:24
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ransomware
darkside
delphi
inno
installer
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

979692CD7FC638BEEA6E9D68C752F360

SHA1:

C511AE4D80AAA281C610190AA13630DE61CA714C

SHA256:

0A0C225F0E5EE941A79F2B7701F1285E4975A2859EB4D025D96D9E366E81ABB9

SSDEEP:

768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLd9kvAx0m:g4HHerjZX7pLjJKjSO5im

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Known privilege escalation attack

      • dllhost.exe (PID: 4664)

    • DARKSIDE has been detected (SURICATA)

      • acer.exe (PID: 3884)

    • DARKSIDE mutex has been found

      • acer.exe (PID: 3884)
      • acer.exe (PID: 1932)

    • RANSOMWARE has been detected

      • acer.exe (PID: 1932)

    • Darkside ransom note is found

      • acer.exe (PID: 1932)

    • Renames files like ransomware

      • acer.exe (PID: 1932)

  • SUSPICIOUS

    • Executes as Windows Service

      • acer.exe (PID: 1296)
      • VSSVC.exe (PID: 2232)

    • Application launched itself

      • acer.exe (PID: 1296)
      • acer.exe (PID: 3884)

    • Reads security settings of Internet Explorer

      • acer.exe (PID: 3884)
      • ResTuner_setup.tmp (PID: 328)
      • restuner.exe (PID: 6896)

    • Contacting a server suspected of hosting an CnC

      • acer.exe (PID: 3884)

    • Creates file in the systems drive root

      • acer.exe (PID: 1932)
      • restuner.exe (PID: 6896)

    • Changes the desktop background image

      • acer.exe (PID: 3884)

    • Executable content was dropped or overwritten

      • ResTuner_setup.exe (PID: 4476)
      • ResTuner_setup.tmp (PID: 2732)
      • ResTuner_setup.exe (PID: 5600)

    • Reads the Windows owner or organization settings

      • ResTuner_setup.tmp (PID: 2732)

    • Reads Microsoft Outlook installation path

      • hh.exe (PID: 4664)

    • Reads Internet Explorer settings

      • hh.exe (PID: 4664)

    • There is functionality for taking screenshot (YARA)

      • restuner.exe (PID: 6896)

  • INFO

    • Checks supported languages

      • acer.exe (PID: 1512)
      • acer.exe (PID: 6684)
      • acer.exe (PID: 1296)
      • acer.exe (PID: 3884)
      • acer.exe (PID: 1932)
      • ResTuner_setup.tmp (PID: 328)
      • ResTuner_setup.exe (PID: 4476)
      • ResTuner_setup.tmp (PID: 2732)
      • ResTuner_setup.exe (PID: 5600)
      • restuner.exe (PID: 6896)

    • Reads the computer name

      • acer.exe (PID: 6684)
      • acer.exe (PID: 1512)
      • acer.exe (PID: 1296)
      • acer.exe (PID: 3884)
      • acer.exe (PID: 1932)
      • ResTuner_setup.tmp (PID: 328)
      • ResTuner_setup.exe (PID: 4476)
      • ResTuner_setup.tmp (PID: 2732)
      • restuner.exe (PID: 6896)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 4664)
      • hh.exe (PID: 4664)

    • Reads the machine GUID from the registry

      • acer.exe (PID: 1512)
      • acer.exe (PID: 6684)
      • acer.exe (PID: 1296)
      • acer.exe (PID: 3884)
      • acer.exe (PID: 1932)

    • Reads product name

      • acer.exe (PID: 3884)

    • Reads Environment values

      • acer.exe (PID: 3884)

    • Reads Windows Product ID

      • acer.exe (PID: 3884)

    • Reads the software policy settings

      • acer.exe (PID: 3884)
      • hh.exe (PID: 4664)

    • Creates files in the program directory

      • acer.exe (PID: 3884)
      • ResTuner_setup.tmp (PID: 2732)

    • Create files in a temporary directory

      • ResTuner_setup.exe (PID: 4476)
      • ResTuner_setup.tmp (PID: 2732)
      • ResTuner_setup.exe (PID: 5600)
      • hh.exe (PID: 4664)

    • Process checks computer location settings

      • ResTuner_setup.tmp (PID: 328)

    • Detects InnoSetup installer (YARA)

      • ResTuner_setup.tmp (PID: 328)
      • ResTuner_setup.tmp (PID: 2732)

    • Compiled with Borland Delphi (YARA)

      • ResTuner_setup.exe (PID: 5600)
      • ResTuner_setup.tmp (PID: 2732)
      • ResTuner_setup.tmp (PID: 328)
      • ResTuner_setup.exe (PID: 4476)
      • restuner.exe (PID: 6896)

    • Manual execution by a user

      • ResTuner_setup.exe (PID: 5600)

    • Creates files or folders in the user directory

      • ResTuner_setup.tmp (PID: 2732)
      • restuner.exe (PID: 6896)
      • hh.exe (PID: 4664)

    • The sample compiled with russian language support

      • ResTuner_setup.tmp (PID: 2732)

    • Creates a software uninstall entry

      • ResTuner_setup.tmp (PID: 2732)

    • Checks proxy server information

      • hh.exe (PID: 4664)

    • UPX packer has been detected

      • restuner.exe (PID: 6896)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 3624)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (61.6)
.dll | Win32 Dynamic Link Library (generic) (14.6)
.exe | Win32 Executable (generic) (10)
.exe | Win16/32 Executable Delphi generic (4.6)
.exe | Generic Win/DOS Executable (4.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:04:05 22:09:09+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.12
CodeSize: 38912
InitializedDataSize: 81920
UninitializedDataSize: -
EntryPoint: 0xb2bd
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
15
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start acer.exe no specs CMSTPLUA acer.exe no specs acer.exe no specs #DARKSIDE acer.exe vssvc.exe no specs THREAT acer.exe no specs restuner_setup.exe restuner_setup.tmp no specs restuner_setup.exe restuner_setup.tmp restuner.exe no specs hh.exe slui.exe no specs openwith.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
328"C:\Users\admin\AppData\Local\Temp\is-D2FDJ.tmp\ResTuner_setup.tmp" /SL5="$902F8,6341884,862720,C:\Users\admin\Desktop\ResTuner_setup.exe" C:\Users\admin\AppData\Local\Temp\is-D2FDJ.tmp\ResTuner_setup.tmp—ResTuner_setup.exe
User:
admin
Company:
Heaventools Software
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-d2fdj.tmp\restuner_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
1296"C:\Users\admin\Desktop\acer.exe" C:\Users\admin\Desktop\acer.exe—services.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\desktop\acer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1512"C:\Users\admin\Desktop\acer.exe" C:\Users\admin\Desktop\acer.exe—dllhost.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\acer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
1932C:\Users\admin\Desktop\acer.exe -work worker0 job0-3884C:\Users\admin\Desktop\acer.exe
acer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\acer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2232C:\WINDOWS\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2732"C:\Users\admin\AppData\Local\Temp\is-DCOMT.tmp\ResTuner_setup.tmp" /SL5="$70374,6341884,862720,C:\Users\admin\Desktop\ResTuner_setup.exe" /SPAWNWND=$40252 /NOTIFYWND=$902F8 C:\Users\admin\AppData\Local\Temp\is-DCOMT.tmp\ResTuner_setup.tmp
ResTuner_setup.exe
User:
admin
Company:
Heaventools Software
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-dcomt.tmp\restuner_setup.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3624C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3884"C:\Users\admin\Desktop\acer.exe" C:\Users\admin\Desktop\acer.exe
acer.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\users\admin\desktop\acer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
4476"C:\Users\admin\Desktop\ResTuner_setup.exe" /SPAWNWND=$40252 /NOTIFYWND=$902F8 C:\Users\admin\Desktop\ResTuner_setup.exe
ResTuner_setup.tmp
User:
admin
Company:
Heaventools Software
Integrity Level:
HIGH
Description:
Resource Tuner Installation Package
Exit code:
0
Version:
2.25.0.0
Modules
Images
c:\users\admin\desktop\restuner_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
4664C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
Total events
7 892
Read events
7 598
Write events
262
Delete events
32

Modification events

(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
8C07000067A27AA4F0E2DB01
(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
3AE941C04770B9D7D09F8D4E995450DDD3A0430F71BB7CCF33671F13E0276D7C
(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFiles0000
Value:
\\?\C:\Users\admin\ntuser.dat.LOG1
(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:writeName:RegFilesHash
Value:
7588886F551CD0598D60395EBCA43E970CB33458FD59070A130C5AD17D3A9F69
(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFilesHash
Value:
숣䶴泒䍲⍨�ॷ㸱㽣혿뭖狘⏀塛㺒솺
(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:RegFiles0000
Value:
\\?\C:\Users\admin\ntuser.dat.LOG2
(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Sequence
Value:

(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:SessionHash
Value:
ꭞᑀ঺ꕰẻ᫯졐슂쎈덴낾痑ﴥ톂魇
(PID) Process:(1932) acer.exeKey:HKEY_USERS\.DEFAULT\Software\Microsoft\RestartManager\Session0000
Operation:delete valueName:Owner
Value:
ތ
Executable files
16
Suspicious files
114
Text files
124
Unknown types
0

Dropped files

PID
Process
Filename
Type
1932acer.exeC:\$WinREAgent\Backup\Winre.wim.d2776a2f —
MD5:—
SHA256:—
1932acer.exeC:\$WinREAgent\Scratch\update.wim.d2776a2f —
MD5:—
SHA256:—
1932acer.exeC:\$WinREAgent\Backup\ReAgent.xml.d2776a2fxml
MD5:CC8F4479ACCDAD829F622369C1C91BB2
SHA256:2B50529F157707DE79A76B39344CD2526EB015B3CDA5727CC010537AA3CBF084
3884acer.exeC:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1C2F0B6DDE95681C3F0E67D5A282C289binary
MD5:FB548A790C04DB176CA1E83AF36C79FA
SHA256:60EE8F8CD5D9DB3EDE6C6E0639E80053E750105A479F3C3612099A57078C40B7
3884acer.exeC:\ProgramData\d2776a2f.icoimage
MD5:4F57D54D01CCBDAF3EBFAC3EC0AC3FD7
SHA256:28B6841AA125225CD01BE09FBD2F1D7B3C2102D9FFC7DC8546700E67C2A6E3BC
1932acer.exeC:\$WinREAgent\Backup\README.d2776a2f.TXTtext
MD5:164AA420BE8E0C2BCDEF574355EDAA32
SHA256:B326D11DD90C2E4EFB0A384981F71C2BD1A6FAA0553D6389ACB08945B699F73D
1932acer.exeC:\$WinREAgent\README.d2776a2f.TXTtext
MD5:164AA420BE8E0C2BCDEF574355EDAA32
SHA256:B326D11DD90C2E4EFB0A384981F71C2BD1A6FAA0553D6389ACB08945B699F73D
1932acer.exeC:\$WinREAgent\Backup\location.txt.d2776a2ftext
MD5:F09B8CA2E0F41BA2270F6EF5062BB1A8
SHA256:E4C22462C0619D55326E12995176E7A5D14C16E1F6791F0F8C7E55034AAB1D35
1932acer.exeC:\README.d2776a2f.TXTtext
MD5:164AA420BE8E0C2BCDEF574355EDAA32
SHA256:B326D11DD90C2E4EFB0A384981F71C2BD1A6FAA0553D6389ACB08945B699F73D
1932acer.exeC:\$WinREAgent\Rollback.xml.d2776a2ftext
MD5:DD7327DF2C5DFA8E5FCD520169E98059
SHA256:68B961E182957866BD6BBFB92AAF163FFD7D9AF40765CE0D390E5EF9F8C0E794
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
34
DNS requests
25
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3884
acer.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3884
acer.exe
GET
200
104.18.20.213:80
http://r11.c.lencr.org/97.crl
unknown
—
—
whitelisted
3884
acer.exe
GET
200
199.59.243.228:80
http://survey-smiles.com/
unknown
—
—
whitelisted
3884
acer.exe
GET
200
199.59.243.228:80
http://survey-smiles.com/
unknown
—
—
whitelisted
7008
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.55.104.172:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4664
hh.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
4664
hh.exe
GET
200
142.250.184.195:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
4688
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1508
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3884
acer.exe
77.247.179.87:443
baroquetees.com
NForce Entertainment B.V.
NL
malicious
3884
acer.exe
23.209.209.135:80
x1.c.lencr.org
PT. Telekomunikasi Selular
ID
whitelisted
3884
acer.exe
104.18.20.213:80
r11.c.lencr.org
CLOUDFLARENET
—
whitelisted
3884
acer.exe
199.59.243.228:80
survey-smiles.com
AMAZON-02
US
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
google.com
  • 142.250.186.142
whitelisted
baroquetees.com
  • 77.247.179.87
malicious
x1.c.lencr.org
  • 23.209.209.135
whitelisted
r11.c.lencr.org
  • 104.18.20.213
  • 104.18.21.213
whitelisted
survey-smiles.com
  • 199.59.243.228
whitelisted
rumahsia.com
  • —
malicious
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.2
  • 20.190.159.4
  • 40.126.31.3
  • 40.126.31.71
  • 20.190.159.68
  • 40.126.31.130
  • 20.190.159.73
  • 20.190.159.75
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted

Threats

PID
Process
Class
Message
3884
acer.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed DarkSide Ransomware Domain (baroquetees .com in TLS SNI)
3884
acer.exe
Domain Observed Used for C2 Detected
ET MALWARE Observed DarkSide Ransomware Domain (baroquetees .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
acer.exe