File name:

NVIDIA Share.exe

Full analysis: https://app.any.run/tasks/dc0d30b3-82de-4bc0-8f1a-db59310ec2ce
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: September 07, 2024, 16:18:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
dcrat
remote
darkcrystal
netreactor
wmi-base64
stealer
exfiltration
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C1F0C5AAFA36AB9E85E33D4810640A55

SHA1:

E3001BB5EA45B02349850F34D44531E28AF9CC85

SHA256:

51A5E5E3E680A3CAB1F9EA4D705037FF4EE8301FC1DCA8AFAE3B5714749BA07B

SSDEEP:

98304:wyi3eXRJwbFMjSgVe/hE02ABuNlCN7LnN6nUori3h2pt5c73FFhhmeU4azPKpWCw:INSl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 5088)

    • DARKCRYSTAL has been detected (SURICATA)

      • MoUsoCoreWorker.exe (PID: 4976)

    • DCRAT has been detected (YARA)

      • MoUsoCoreWorker.exe (PID: 4976)

    • Steals credentials from Web Browsers

      • MoUsoCoreWorker.exe (PID: 4976)

    • Actions looks like stealing of personal data

      • MoUsoCoreWorker.exe (PID: 4976)

    • Connects to the CnC server

      • MoUsoCoreWorker.exe (PID: 4976)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)

    • Executable content was dropped or overwritten

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 5088)
      • NVIDIA Share.exe (PID: 6824)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 5088)
      • NVIDIA Share.exe (PID: 6824)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5088)

    • The executable file from the user directory is run by the CMD process

      • NVIDIA Share.exe (PID: 6824)

    • The process creates files with name similar to system file names

      • NVIDIA Share.exe (PID: 6824)

    • Executed via WMI

      • schtasks.exe (PID: 2224)
      • schtasks.exe (PID: 4824)
      • schtasks.exe (PID: 2128)
      • schtasks.exe (PID: 6740)
      • schtasks.exe (PID: 6288)
      • schtasks.exe (PID: 7028)
      • schtasks.exe (PID: 6864)
      • schtasks.exe (PID: 4076)
      • schtasks.exe (PID: 2816)
      • schtasks.exe (PID: 6664)
      • schtasks.exe (PID: 360)
      • schtasks.exe (PID: 2720)
      • schtasks.exe (PID: 5796)
      • schtasks.exe (PID: 4164)
      • schtasks.exe (PID: 6848)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 2720)
      • schtasks.exe (PID: 6848)
      • schtasks.exe (PID: 4824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Reads the date of Windows installation

      • NVIDIA Share.exe (PID: 6824)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4344)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 4344)

    • Loads DLL from Mozilla Firefox

      • MoUsoCoreWorker.exe (PID: 4976)

    • Connects to the server without a host name

      • MoUsoCoreWorker.exe (PID: 4976)

  • INFO

    • Creates files or folders in the user directory

      • NVIDIA Share.exe (PID: 2208)

    • Reads the computer name

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Checks supported languages

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)
      • chcp.com (PID: 6140)

    • Process checks computer location settings

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)

    • The process uses the downloaded file

      • NVIDIA Share.exe (PID: 2208)
      • wscript.exe (PID: 5088)
      • NVIDIA Share.exe (PID: 6824)

    • Reads the machine GUID from the registry

      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Reads Environment values

      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Creates files in the program directory

      • NVIDIA Share.exe (PID: 6824)

    • Create files in a temporary directory

      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4344)

    • Checks proxy server information

      • MoUsoCoreWorker.exe (PID: 4976)

    • Disables trace logs

      • MoUsoCoreWorker.exe (PID: 4976)

    • Found Base64 encoded reference to WMI classes (YARA)

      • MoUsoCoreWorker.exe (PID: 4976)

    • .NET Reactor protector has been detected

      • MoUsoCoreWorker.exe (PID: 4976)

    • Found Base64 encoded reference to AntiVirus WMI classes (YARA)

      • MoUsoCoreWorker.exe (PID: 4976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(4976) MoUsoCoreWorker.exe
C2 (1)http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate
Options
Version5.0.4
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2false
3true
4true
5true
6true
7true
8true
9true
10true
11true
12true
13true
14true
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 101376
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
27
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start nvidia share.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs nvidia share.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DARKCRYSTAL mousocoreworker.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128schtasks.exe /create /tn "Memory Compression" /sc ONLOGON /tr "'C:\Users\admin\Downloads\Memory Compression.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2208"C:\Users\admin\AppData\Local\Temp\NVIDIA Share.exe" C:\Users\admin\AppData\Local\Temp\NVIDIA Share.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nvidia share.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2224schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 13 /tr "'C:\Users\admin\Downloads\Memory Compression.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2720schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 6 /tr "'C:\Users\Public\MoUsoCoreWorker.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2816schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Idle.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4076schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Windows\Tasks\sihost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4164schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Pictures\dllhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 840
Read events
4 824
Write events
16
Delete events
0

Modification events

(PID) Process:(2208) NVIDIA Share.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
19
Suspicious files
25
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
6824NVIDIA Share.exeC:\Users\admin\Desktop\DGyIaEjj.logexecutable
MD5:F4B38D0F95B7E844DD288B441EBC9AAF
SHA256:AAB95596475CA74CEDE5BA50F642D92FA029F6F74F6FAEAE82A9A07285A5FB97
6824NVIDIA Share.exeC:\Users\admin\Desktop\jsjUkzJY.logexecutable
MD5:D8BF2A0481C0A17A634D066A711C12E9
SHA256:2B93377EA087225820A9F8E4F331005A0C600D557242366F06E0C1EAE003D669
6824NVIDIA Share.exeC:\Users\admin\Desktop\CBmhaVti.logexecutable
MD5:E84DCD8370FAC91DE71DEF8DCF09BFEC
SHA256:DD7AC164E789CAD96D30930EFE9BBA99698473EDEA38252C2C0EA44043FB1DB5
2208NVIDIA Share.exeC:\Users\admin\AppData\Roaming\NVIDIA\MjDgJCX1b5kbsHkeSp5vS8ADlws6j58rPgjvfDs.battext
MD5:821A53C99B822F905D8FA87B76A4B715
SHA256:38D8D0F3719027B875D54AC465AE47EB63C866EC88DC6929F102E06DE1D9635A
6824NVIDIA Share.exeC:\Users\admin\Desktop\ELJiaoZj.logexecutable
MD5:E9CE850DB4350471A62CC24ACB83E859
SHA256:7C95D3B38114E7E4126CB63AADAF80085ED5461AB0868D2365DD6A18C946EA3A
6824NVIDIA Share.exeC:\Users\admin\Desktop\vdpSqLTB.logexecutable
MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
6824NVIDIA Share.exeC:\Users\admin\Desktop\mzhdGSEU.logexecutable
MD5:2D6975FD1CC3774916D8FF75C449EE7B
SHA256:75CE6EB6CDDD67D47FB7C5782F45FDC497232F87A883650BA98679F92708A986
6824NVIDIA Share.exeC:\Users\admin\Downloads\1a5d5b8dcee3d8text
MD5:2EDEBB67514BC390033089EAC040BA2F
SHA256:F1F8BF4C274D5A2E5138CF7300DEA2F6FD7640BF754A7B7E1FACDC01F2CA467A
6824NVIDIA Share.exeC:\Windows\Tasks\sihost.exeexecutable
MD5:8AA4EE38B9AB7ECB03EE7F86ED3AFC12
SHA256:8EE79B27F13623F27FAE4B057DA0862DCAF4F5249E51C58B0B113FACD99B5E63
2208NVIDIA Share.exeC:\Users\admin\AppData\Roaming\NVIDIA\NVIDIA Share.exeexecutable
MD5:8AA4EE38B9AB7ECB03EE7F86ED3AFC12
SHA256:8EE79B27F13623F27FAE4B057DA0862DCAF4F5249E51C58B0B113FACD99B5E63
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
30
DNS requests
14
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6876
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1332
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
1432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4316
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6876
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6876
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6876
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1332
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1332
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 4.231.128.59
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
4976
MoUsoCoreWorker.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
4976
MoUsoCoreWorker.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
4976
MoUsoCoreWorker.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible DarkCrystal Rat Encrypted Connection
4976
MoUsoCoreWorker.exe
A suspicious string was detected
SUSPICIOUS [ANY.RUN] Sending an HTTP request body with a Base64 encoded ZIP file
4976
MoUsoCoreWorker.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
4976
MoUsoCoreWorker.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NVIDIA Share.exe