File name:

ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe

Full analysis: https://app.any.run/tasks/9f8abb99-012f-414f-82b1-c5c8df2a40a7
Verdict: Malicious activity
Threats:

DarkCloud is an infostealer that focuses on collecting and exfiltrating browser data from the infected device. The malware is also capable of keylogging and crypto address swapping. DarkCloud is typically delivered to victims’ computers via phishing emails.

Malware Trends Tracker     >>>
Analysis date: May 10, 2025, 04:09:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
purecrypter
netreactor
auto-startup
stealer
evasion
darkcloud
upx
ims-api
generic
crypto-regex
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

8A8C7BDB9785B9ABF5F27913EC4D5F39

SHA1:

C6B3FB377BDDB7C06175CF653C10EA8154679AF7

SHA256:

1A48DF1E1F580CBC913148D82D4F522DC236A856B34021BDBF1645328571B573

SSDEEP:

49152:19DMYq9KITgZHqPMFfSJLj0ZsMfhoTNZh5w2jI5FDIaP3Isx0TqhkmX+sZklgGhk:3DMYqQugZKkFfQ0yKANZh5U5lp3vx0en

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PURECRYPTER has been detected (YARA)

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

    • DARKCLOUD has been detected (YARA)

      • InstallUtil.exe (PID: 1388)

    • Create files in the Startup directory

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

  • SUSPICIOUS

    • Process uses IPCONFIG to renew DHCP configuration

      • cmd.exe (PID: 5984)

    • Reads security settings of Internet Explorer

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)
      • InstallUtil.exe (PID: 1388)

    • Starts CMD.EXE for commands execution

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

    • BASE64 encoded PowerShell command has been detected

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

    • Process uses IPCONFIG to discard the IP address configuration

      • cmd.exe (PID: 6640)

    • Starts POWERSHELL.EXE for commands execution

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5260)

    • Checks for external IP

      • InstallUtil.exe (PID: 1388)

    • Found regular expressions for crypto-addresses (YARA)

      • InstallUtil.exe (PID: 1388)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • InstallUtil.exe (PID: 1388)

    • Base64-obfuscated command line is found

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

  • INFO

    • Reads the computer name

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)
      • InstallUtil.exe (PID: 1388)

    • Reads the machine GUID from the registry

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)
      • InstallUtil.exe (PID: 1388)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2108)

    • Process checks computer location settings

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

    • Checks supported languages

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)
      • InstallUtil.exe (PID: 1388)

    • .NET Reactor protector has been detected

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • powershell.exe (PID: 2108)

    • Manual execution by a user

      • wscript.exe (PID: 5260)
      • InstallUtil.exe (PID: 1388)

    • Checks proxy server information

      • InstallUtil.exe (PID: 1388)

    • Creates files or folders in the user directory

      • InstallUtil.exe (PID: 1388)
      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)

    • UPX packer has been detected

      • InstallUtil.exe (PID: 1388)

    • Reads the software policy settings

      • slui.exe (PID: 4200)

    • Auto-launch of the file from Startup directory

      • ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe (PID: 1276)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:05:08 23:56:02+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 1256448
InitializedDataSize: 2048
UninitializedDataSize: -
EntryPoint: 0x134a6e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.6799.16074
ProductVersionNumber: 1.0.6799.16074
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: brrrrr
FileVersion: 1.0.6799.16074
InternalName: brrrrr.exe
LegalCopyright: Copyright © 2011
LegalTrademarks: -
OriginalFileName: brrrrr.exe
ProductName: brrrrr
ProductVersion: 1.0.6799.16074
AssemblyVersion: 1.0.3330.10026
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
14
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start #PURECRYPTER äæ n hã€ng a 2500533 - sun print (order a 2500533 - sun print).exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs sppextcomobj.exe no specs slui.exe powershell.exe conhost.exe no specs #DARKCLOUD installutil.exe cmd.exe no specs conhost.exe no specs ipconfig.exe no specs wscript.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1276"C:\Users\admin\AppData\Local\Temp\ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe" C:\Users\admin\AppData\Local\Temp\ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
brrrrr
Exit code:
4294967295
Version:
1.0.6799.16074
Modules
Images
c:\users\admin\appdata\local\temp\äæ n hã€ng a 2500533 - sun print (order a 2500533 - sun print).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1388"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
.NET Framework installation utility
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\installutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1660\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2108"C:\WINDOWS\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAxACQAMYAoABOACAASADDAIAATgBHACAAQQAgADIANQAwADAANQAzADMAIAAtACAAUwBVAE4AIABQAFIASQBOAFQAIAAoAE8AUgBEAEUAUgAgAEEAIAAyADUAMAAwADUAMwAzACAALQAgAFMAVQBOACAAUABSAEkATgBUACkALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAEMAOgBcAFUAcwBlAHIAcwBcAGEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAxACQAMYAoABOACAASADDAIAATgBHACAAQQAgADIANQAwADAANQAzADMAIAAtACAAUwBVAE4AIABQAFIASQBOAFQAIAAoAE8AUgBEAEUAUgAgAEEAIAAyADUAMAAwADUAMwAzACAALQAgAFMAVQBOACAAUABSAEkATgBUACkALgBlAHgAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIABDADoAXABVAHMAZQByAHMAXABhAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAGIAZgBkAGYAZwBoAC4AZQB4AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAcgBvAGMAZQBzAHMAIABDADoAXABVAHMAZQByAHMAXABhAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAGIAZgBkAGYAZwBoAC4AZQB4AGUAC:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4068\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4200"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4812C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5124C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5260wscript "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bfdfgh.vbs"C:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5512ipconfig /releaseC:\Windows\SysWOW64\ipconfig.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
IP Configuration Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ipconfig.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
9 922
Read events
9 919
Write events
3
Delete events
0

Modification events

(PID) Process:(1388) InstallUtil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1388) InstallUtil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1388) InstallUtil.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
0
Suspicious files
4
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
2108powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_p43sq10m.dux.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2108powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ievyleyd.xn1.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2108powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_254gkaj3.gjm.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2108powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_eblqdnnt.25u.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
1388InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\keyDBPath.dbbinary
MD5:0FF3BCDD0BE077B9EB8194B5C09F453C
SHA256:225D669E47EB14D8C969799C92AAEF27B66CD984872EA09284E48DB46521E651
2108powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:66D6C7BC6A966B1F197DE0815A792AA7
SHA256:5912DE4ABA8AA1CA0EDE93007DD4D05AEE4B0C0B5EBF02E5F75CE4E2CF780FA5
1388InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\LoginDatabinary
MD5:A45465CDCDC6CB30C8906F3DA4EC114C
SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209
1388InstallUtil.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\DESKTOP-JGLLJLD-admin\WebDatabinary
MD5:F6C33AC5E1032A0873BE7BFC65169287
SHA256:D97895CEDED32E33D57BDCACCDBE144E58AA87AF4D2F8855D630286CE30A8D83
1276ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bfdfgh.vbstext
MD5:A8372858E2EE67CACC82E912E4D47C6E
SHA256:8B44BF1D18E101667B38B74042AE98862144B0C1172FD3414EFFFB1E4F6FBD4A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
22
DNS requests
16
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2136
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1388
InstallUtil.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2136
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.216.77.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.238
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.19
  • 23.216.77.6
  • 23.216.77.42
  • 23.216.77.37
  • 23.216.77.8
  • 23.216.77.41
  • 23.216.77.4
  • 23.216.77.39
  • 23.216.77.5
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.1
  • 20.190.159.23
  • 40.126.31.67
  • 20.190.159.73
  • 20.190.159.64
  • 40.126.31.0
  • 40.126.31.71
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
showip.net
  • 162.55.60.2
shared

Threats

PID
Process
Class
Message
—
—
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
—
—
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
—
—
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
ĐƠN HÀNG A 2500533 - SUN PRINT (ORDER A 2500533 - SUN PRINT).exe