File name:

NVIDIA Share.exe

Full analysis: https://app.any.run/tasks/dc0d30b3-82de-4bc0-8f1a-db59310ec2ce
Verdict: Malicious activity
Threats:

DCrat, also known as Dark Crystal RAT, is a remote access trojan (RAT), which was first introduced in 2018. It is a modular malware that can be customized to perform different tasks. For instance, it can steal passwords, crypto wallet information, hijack Telegram and Steam accounts, and more. Attackers may use a variety of methods to distribute DCrat, but phishing email campaigns are the most common.

Malware Trends Tracker     >>>
Analysis date: September 07, 2024, 16:18:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
rat
dcrat
remote
darkcrystal
netreactor
wmi-base64
stealer
exfiltration
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C1F0C5AAFA36AB9E85E33D4810640A55

SHA1:

E3001BB5EA45B02349850F34D44531E28AF9CC85

SHA256:

51A5E5E3E680A3CAB1F9EA4D705037FF4EE8301FC1DCA8AFAE3B5714749BA07B

SSDEEP:

98304:wyi3eXRJwbFMjSgVe/hE02ABuNlCN7LnN6nUori3h2pt5c73FFhhmeU4azPKpWCw:INSl

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 5088)

    • DARKCRYSTAL has been detected (SURICATA)

      • MoUsoCoreWorker.exe (PID: 4976)

    • Steals credentials from Web Browsers

      • MoUsoCoreWorker.exe (PID: 4976)

    • DCRAT has been detected (YARA)

      • MoUsoCoreWorker.exe (PID: 4976)

    • Actions looks like stealing of personal data

      • MoUsoCoreWorker.exe (PID: 4976)

    • Connects to the CnC server

      • MoUsoCoreWorker.exe (PID: 4976)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)

    • Executable content was dropped or overwritten

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5088)

    • The executable file from the user directory is run by the CMD process

      • NVIDIA Share.exe (PID: 6824)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 5088)
      • NVIDIA Share.exe (PID: 6824)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 5088)
      • NVIDIA Share.exe (PID: 6824)

    • The process creates files with name similar to system file names

      • NVIDIA Share.exe (PID: 6824)

    • Executed via WMI

      • schtasks.exe (PID: 7028)
      • schtasks.exe (PID: 2128)
      • schtasks.exe (PID: 2720)
      • schtasks.exe (PID: 6740)
      • schtasks.exe (PID: 6864)
      • schtasks.exe (PID: 6288)
      • schtasks.exe (PID: 4076)
      • schtasks.exe (PID: 2816)
      • schtasks.exe (PID: 6664)
      • schtasks.exe (PID: 360)
      • schtasks.exe (PID: 5796)
      • schtasks.exe (PID: 4164)
      • schtasks.exe (PID: 4824)
      • schtasks.exe (PID: 2224)
      • schtasks.exe (PID: 6848)

    • Likely accesses (executes) a file from the Public directory

      • schtasks.exe (PID: 2720)
      • MoUsoCoreWorker.exe (PID: 4976)
      • schtasks.exe (PID: 4824)
      • schtasks.exe (PID: 6848)

    • Reads the date of Windows installation

      • NVIDIA Share.exe (PID: 6824)

    • Starts application with an unusual extension

      • cmd.exe (PID: 4344)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 4344)

    • Loads DLL from Mozilla Firefox

      • MoUsoCoreWorker.exe (PID: 4976)

    • Connects to the server without a host name

      • MoUsoCoreWorker.exe (PID: 4976)

  • INFO

    • Creates files or folders in the user directory

      • NVIDIA Share.exe (PID: 2208)

    • Reads the computer name

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Checks supported languages

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)
      • chcp.com (PID: 6140)
      • MoUsoCoreWorker.exe (PID: 4976)

    • The process uses the downloaded file

      • NVIDIA Share.exe (PID: 2208)
      • wscript.exe (PID: 5088)
      • NVIDIA Share.exe (PID: 6824)

    • Process checks computer location settings

      • NVIDIA Share.exe (PID: 2208)
      • NVIDIA Share.exe (PID: 6824)

    • Reads the machine GUID from the registry

      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Reads Environment values

      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Creates files in the program directory

      • NVIDIA Share.exe (PID: 6824)

    • Create files in a temporary directory

      • NVIDIA Share.exe (PID: 6824)
      • MoUsoCoreWorker.exe (PID: 4976)

    • Changes the display of characters in the console

      • cmd.exe (PID: 4344)

    • Checks proxy server information

      • MoUsoCoreWorker.exe (PID: 4976)

    • Disables trace logs

      • MoUsoCoreWorker.exe (PID: 4976)

    • .NET Reactor protector has been detected

      • MoUsoCoreWorker.exe (PID: 4976)

    • Found Base64 encoded reference to AntiVirus WMI classes (YARA)

      • MoUsoCoreWorker.exe (PID: 4976)

    • Found Base64 encoded reference to WMI classes (YARA)

      • MoUsoCoreWorker.exe (PID: 4976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

DcRat

(PID) Process(4976) MoUsoCoreWorker.exe
C2 (1)http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate
Options
Version5.0.4
PluginConfigs
0{SYSTEMDRIVE}/Users/
1false
2false
3true
4true
5true
6true
7true
8true
9true
10true
11true
12true
13true
14true
Plugins (2)TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAAKX/2QAAAAAAAAAAOAAIiALAQgAAEYBAAAGAAAAAAAA7mUBAAAgAAAAgAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAADAAQAAAgAAm0ACAAMAQIUA...
TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4gaW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDALI7+mQAAAAAAAAAAOAAIiALAQgAAAgBAAAGAAAAAAAAricBAAAgAAAAQAEAAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACAAQAAAgAArNABAAMAQIUA...
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:03:03 13:15:57+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.3
CodeSize: 203776
InitializedDataSize: 101376
UninitializedDataSize: -
EntryPoint: 0x1f530
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
155
Monitored processes
27
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start nvidia share.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs nvidia share.exe schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs chcp.com no specs ping.exe no specs #DARKCRYSTAL mousocoreworker.exe sppextcomobj.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
360schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 11 /tr "'C:\Users\All Users\Idle.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1496\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128schtasks.exe /create /tn "Memory Compression" /sc ONLOGON /tr "'C:\Users\admin\Downloads\Memory Compression.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2208"C:\Users\admin\AppData\Local\Temp\NVIDIA Share.exe" C:\Users\admin\AppData\Local\Temp\NVIDIA Share.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nvidia share.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
2224schtasks.exe /create /tn "Memory CompressionM" /sc MINUTE /mo 13 /tr "'C:\Users\admin\Downloads\Memory Compression.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2464\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2720schtasks.exe /create /tn "MoUsoCoreWorkerM" /sc MINUTE /mo 6 /tr "'C:\Users\Public\MoUsoCoreWorker.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2816schtasks.exe /create /tn "IdleI" /sc MINUTE /mo 8 /tr "'C:\Users\All Users\Idle.exe'" /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4076schtasks.exe /create /tn "sihosts" /sc MINUTE /mo 10 /tr "'C:\Windows\Tasks\sihost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4164schtasks.exe /create /tn "dllhostd" /sc MINUTE /mo 9 /tr "'C:\Users\Default\Pictures\dllhost.exe'" /rl HIGHEST /fC:\Windows\System32\schtasks.exe—WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
4 840
Read events
4 824
Write events
16
Delete events
0

Modification events

(PID) Process:(2208) NVIDIA Share.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbe\OpenWithProgids
Operation:writeName:VBEFile
Value:
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(4976) MoUsoCoreWorker.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\MoUsoCoreWorker_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
19
Suspicious files
25
Text files
10
Unknown types
0

Dropped files

PID
Process
Filename
Type
2208NVIDIA Share.exeC:\Users\admin\AppData\Roaming\NVIDIA\cM3I0Acfi6vfQZMwt.vbevbe
MD5:02FD07EDD00E6CAC4197B169D409A893
SHA256:5AA739C9F35D4E7762C17CB83B9E90F46124B7B12FAB3707E0E5FB39B294A101
2208NVIDIA Share.exeC:\Users\admin\AppData\Roaming\NVIDIA\MjDgJCX1b5kbsHkeSp5vS8ADlws6j58rPgjvfDs.battext
MD5:821A53C99B822F905D8FA87B76A4B715
SHA256:38D8D0F3719027B875D54AC465AE47EB63C866EC88DC6929F102E06DE1D9635A
2208NVIDIA Share.exeC:\Users\admin\AppData\Roaming\NVIDIA\NVIDIA Share.exeexecutable
MD5:8AA4EE38B9AB7ECB03EE7F86ED3AFC12
SHA256:8EE79B27F13623F27FAE4B057DA0862DCAF4F5249E51C58B0B113FACD99B5E63
6824NVIDIA Share.exeC:\ProgramData\Idle.exeexecutable
MD5:8AA4EE38B9AB7ECB03EE7F86ED3AFC12
SHA256:8EE79B27F13623F27FAE4B057DA0862DCAF4F5249E51C58B0B113FACD99B5E63
6824NVIDIA Share.exeC:\Users\Default\Pictures\dllhost.exeexecutable
MD5:8AA4EE38B9AB7ECB03EE7F86ED3AFC12
SHA256:8EE79B27F13623F27FAE4B057DA0862DCAF4F5249E51C58B0B113FACD99B5E63
6824NVIDIA Share.exeC:\Windows\Tasks\66fc9ff0ee96c2text
MD5:613F274DAAC4710F42B8C79339964C85
SHA256:0C3E20D04BA8E7ACB65663AF928892FAFB33651AD9969C8CDBD8454EA67E842D
6824NVIDIA Share.exeC:\Users\Default\Pictures\5940a34987c991text
MD5:C91FAD561E0592E7675719A74415BB40
SHA256:B4045D108DE749E844BF437A068D8C4399C6F4556192F2C04FFB2B8AA1474FBD
6824NVIDIA Share.exeC:\ProgramData\6ccacd8608530ftext
MD5:8A2849CD9DEA9F214C36D54CF6A58377
SHA256:DC55386392866F61F0E0B3D355BFBD1EAA9DBC33ADA15CE857E5A7CDD6AF3E71
6824NVIDIA Share.exeC:\Users\admin\Desktop\vdpSqLTB.logexecutable
MD5:D478E398EFCD2BD9BDBFEA958F7BEE4F
SHA256:32E821193BE1D81BB3BE97F2719D28A0C7DD2E5BD94DC581D79A1497462EAC9B
6824NVIDIA Share.exeC:\Users\admin\AppData\Local\Temp\d84029cc8b7dbf74b187233303eefdd21883bb6ftext
MD5:4A6A30132B22F4CBCEDBF534AC2799CF
SHA256:9488A6C9477DF87C1EE35F94FFE9A3F9C4FAB56B8B5A4EB8E8F9AAA83D74A53B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
52
TCP/UDP connections
30
DNS requests
14
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1332
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6876
svchost.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
1432
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
4976
MoUsoCoreWorker.exe
POST
200
91.214.78.75:80
http://91.214.78.75/wp/91apiProtect/Pipe/Better/Base/flowerPythonSqlBase/private6/LineLinuxcdn/DbPrivate.php
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4316
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2120
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6876
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6876
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6876
svchost.exe
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1332
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1332
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 216.58.206.46
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 20.73.194.208
  • 4.231.128.59
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.159.75
  • 40.126.31.73
  • 40.126.31.71
  • 20.190.159.4
  • 20.190.159.23
  • 40.126.31.69
  • 20.190.159.68
  • 20.190.159.0
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
4976
MoUsoCoreWorker.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Check-in (POST)
4976
MoUsoCoreWorker.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Check-in (POST)
4976
MoUsoCoreWorker.exe
Misc activity
SUSPICIOUS [ANY.RUN] Possible DarkCrystal Rat Encrypted Connection
4976
MoUsoCoreWorker.exe
A suspicious string was detected
SUSPICIOUS [ANY.RUN] Sending an HTTP request body with a Base64 encoded ZIP file
4976
MoUsoCoreWorker.exe
A Network Trojan was detected
ET MALWARE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
4976
MoUsoCoreWorker.exe
A Network Trojan was detected
REMOTE [ANY.RUN] DarkCrystal Rat Exfiltration (POST)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
NVIDIA Share.exe