File name:

PJL.exe

Full analysis: https://app.any.run/tasks/bc579c2d-8547-44f2-ae6e-3a5056f0f4b5
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Analysis date: June 21, 2025, 10:02:37
OS: Windows 11 Professional (build: 22000, 64 bit)
Tags:
havoc
backdoor
framework
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows, 7 sections
MD5:

FA0A1F2ECFD5E6896EEE02F6034D75AF

SHA1:

FB4558993A59CD32FF91663C1719C2928584EDFC

SHA256:

1045F5137B6F1DAE238194BCF8BA9AFCB3B196C25824B89E963F98D68CBB2D91

SSDEEP:

12288:MeD+84KqJ2FhqhghXJG3yYEquAYoSs8vi06WIHZDztO4HAE4tFU+fo9qJKRiznd1:Me74KqJ2P/G3yY1uAYoSs8vi06WIHZDs

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Connects to unusual port

      • PJL.exe (PID: 6996)
    • Reads the Internet Settings

      • PJL.exe (PID: 6996)
    • Reads settings of System Certificates

      • PJL.exe (PID: 6996)
    • Executable content was dropped or overwritten

      • PJL.exe (PID: 6996)
  • INFO

    • The sample compiled with english language support

      • PJL.exe (PID: 6996)
    • Checks supported languages

      • PJL.exe (PID: 6996)
      • MiniSearchHost.exe (PID: 6440)
    • Reads the computer name

      • PJL.exe (PID: 6996)
      • MiniSearchHost.exe (PID: 6440)
    • Checks proxy server information

      • PJL.exe (PID: 6996)
    • Reads the software policy settings

      • PJL.exe (PID: 6996)
    • Creates files or folders in the user directory

      • MiniSearchHost.exe (PID: 6440)
    • Reads the machine GUID from the registry

      • PJL.exe (PID: 6996)
    • Create files in a temporary directory

      • PJL.exe (PID: 6996)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2025:06:20 13:56:19+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.32
CodeSize: 176128
InitializedDataSize: 156160
UninitializedDataSize: -
EntryPoint: 0x2b3c9
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.1.0.0
ProductVersionNumber: 1.1.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Raytheon Technologies
FileDescription: CONFIDENTIAL: INTERNAL USE ONLY.
FileVersion: 1.1.0.0
ProductName: PhantomJIT
ProductVersion: 1.1.0.0
OriginalFileName: PJL.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
123
Monitored processes
6
Malicious processes
0
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pjl.exe dllhost.exe no specs dllhost.exe no specs minisearchhost.exe no specs dllhost.exe no specs dllhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
88"C:\Windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155}C:\Windows\System32\dllhost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
2868"C:\Windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155}C:\Windows\System32\dllhost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
3124"C:\Windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155}C:\Windows\System32\dllhost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
6312"C:\Windows\system32\DllHost.exe" /Processid:{9F156763-7844-4DC4-B2B1-901F640F5155}C:\Windows\System32\dllhost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.22000.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
6440"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mcaC:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Version:
421.22500.3595.0
Modules
Images
c:\windows\systemapps\microsoftwindows.client.cbs_cw5n1h2txyewy\minisearchhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\program files\windowsapps\microsoft.vclibs.140.00_14.0.30704.0_x64__8wekyb3d8bbwe\vcruntime140_app.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
6996"C:\Users\admin\Desktop\PJL.exe" C:\Users\admin\Desktop\PJL.exe
explorer.exe
User:
admin
Company:
Raytheon Technologies
Integrity Level:
MEDIUM
Description:
CONFIDENTIAL: INTERNAL USE ONLY.
Version:
1.1.0.0
Modules
Images
c:\users\admin\desktop\pjl.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
Total events
8 289
Read events
7 802
Write events
1
Delete events
486

Modification events

(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{00020802-0000-0000-C000-000000000046}\1.3
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.2
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{00020813-0000-0000-C000-000000000046}\1.6
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{00020905-0000-0000-C000-000000000046}\9
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{00062FFF-0000-0000-C000-000000000046}\9.6
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{0006F062-0000-0000-C000-000000000046}\1.2
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{000C1092-0000-0000-C000-000000000046}\1.0
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{00f25ae8-3625-4e34-92d4-f0918cf010ee}\1.0
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{B0EDF154-910A-11D2-B632-00C04F79498E}\1.0
Operation:delete keyName:(default)
Value:
(PID) Process:(6996) PJL.exeKey:HKEY_CLASSES_ROOT\TypeLib\{0D452EE1-E08F-101A-852E-02608C4D0BB4}\2.0
Operation:delete keyName:(default)
Value:
Executable files
3
Suspicious files
1
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
6440MiniSearchHost.exeC:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt~RF164480.TMP
MD5:
SHA256:
6440MiniSearchHost.exeC:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txt.~tmptext
MD5:0920EC84A13CD92053328B518FB1E443
SHA256:C1C0C1512391FFB7E63BD60A0DB09FB24AEA95ACF6066B9E25EFF9376E9EF677
6996PJL.exeC:\Users\admin\AppData\Local\Temp\e8jv1shudbi2.datbinary
MD5:AE99E9A4A7CA95321275E2C784EFF274
SHA256:6E04C96C767D2EF90FDCBBFC504FFAB88D2F410EA118343236E7AF93CA6EB523
6996PJL.exeC:\Users\admin\AppData\Local\Temp\srjmbs86v6r2.screxecutable
MD5:FA0A1F2ECFD5E6896EEE02F6034D75AF
SHA256:1045F5137B6F1DAE238194BCF8BA9AFCB3B196C25824B89E963F98D68CBB2D91
6996PJL.exeC:\Users\admin\AppData\Local\Temp\vbktlvpujena.sctxml
MD5:806F252DC7082EF2F7D40DECB6152A13
SHA256:7DA77138BF5DFFE6BB7BD4470789E3AD2B7383266EEFCAFB1AED40789FCF34A9
6440MiniSearchHost.exeC:\Users\admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SettingsCache.txttext
MD5:0920EC84A13CD92053328B518FB1E443
SHA256:C1C0C1512391FFB7E63BD60A0DB09FB24AEA95ACF6066B9E25EFF9376E9EF677
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
198
TCP/UDP connections
50
DNS requests
21
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2840
svchost.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?45659ff28ebcce25
unknown
whitelisted
6996
PJL.exe
GET
200
147.45.45.156:51000
http://147.45.45.156:51000/challenge
unknown
unknown
2860
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7f3766ba4aa80e38
unknown
whitelisted
1524
svchost.exe
GET
200
23.55.104.138:80
http://www.msftconnecttest.com/connecttest.txt
unknown
whitelisted
GET
200
13.107.6.156:443
https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api/v1/C2RTargetAudienceData?omid=97560490bafb0d49bca6f8f0df91025d&susid=c408ee57-2103-4c34-9e6f-30bdf6c87e50&audienceFFN=492350f6-3a01-4f97-b9c0-c7c6ddf67d60&tid=&osver=Client%7C10.0.22000&offver=16.0.16626.20134&ring=Production&aud=Production&ch=CC&osarch=x64&manstate=6
unknown
POST
200
20.190.160.2:443
https://login.live.com/RST2.srf
unknown
xml
10.3 Kb
whitelisted
POST
20.189.173.14:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
whitelisted
POST
200
147.45.45.156:443
https://147.45.45.156/
unknown
binary
12 b
2840
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6e89692cca504d0f
unknown
whitelisted
2840
svchost.exe
GET
200
199.232.210.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?242c32f45d9b2ec7
unknown
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
52.109.32.97:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
4
System
192.168.100.255:137
whitelisted
4444
OfficeC2RClient.exe
52.109.32.97:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
3400
firefox.exe
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
1036
pingsender.exe
34.120.208.123:443
incoming.telemetry.mozilla.org
GOOGLE-CLOUD-PLATFORM
US
whitelisted
1524
svchost.exe
23.55.104.146:80
Akamai International B.V.
US
unknown
1580
rundll32.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
51.116.246.106:443
v10.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
DE
whitelisted
6996
PJL.exe
147.45.45.156:51000
OOO FREEnet Group
RU
unknown
2860
svchost.exe
20.42.73.26:443
v10.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
officeclient.microsoft.com
  • 52.109.32.97
  • 52.109.89.18
whitelisted
incoming.telemetry.mozilla.org
  • 34.120.208.123
whitelisted
telemetry-incoming.r53-2.services.mozilla.com
  • 34.120.208.123
whitelisted
v10.events.data.microsoft.com
  • 51.116.246.106
  • 20.42.73.26
whitelisted
google.com
  • 216.58.212.174
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
mrodevicemgr.officeapps.live.com
  • 52.110.17.63
  • 52.110.17.46
  • 52.110.17.21
  • 52.110.17.26
  • 52.110.17.69
  • 52.110.17.61
  • 52.110.17.34
  • 52.110.17.28
whitelisted
dns.msftncsi.com
  • 131.107.255.255
whitelisted

Threats

PID
Process
Class
Message
1524
svchost.exe
Misc activity
ET INFO Microsoft Connection Test
Malware Command and Control Activity Detected
ET MALWARE Havoc Demon CnC Request
No debug info