URL:

https://github.com/baugulfbad/walls021/raw/refs/heads/main/documentation_bnk_details0052025026jpeg.zip

Full analysis: https://app.any.run/tasks/da5e906b-223c-4e7f-8a68-6226b89bf21d
Verdict: Malicious activity
Threats:

NetSupport RAT is a malicious adaptation of the legitimate NetSupport Manager, a remote access tool used for IT support, which cybercriminals exploit to gain unauthorized control over systems. It has gained significant traction due to its sophisticated evasion techniques, widespread distribution campaigns, and the challenge it poses to security professionals who must distinguish between legitimate and malicious uses of the underlying software.

Malware Trends Tracker     >>>
Analysis date: May 28, 2025, 02:56:29
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
github
arch-exec
netsupport
remote
rmm-tool
python
tool
pyinstaller
Indicators:
MD5:

200CD03BC2791CB6D11CA688F2441189

SHA1:

E1BE56CD141C28AA03AF2D3F47A221D72A38A586

SHA256:

1784B276717E6378050AEFDE6334BF4CCF464FF19538C0689362B6ED37DB6014

SSDEEP:

3:N8tEd35FbEBJgJq6LNKAIuRBp2vJSVvDtACLkV:2uAgJvLNKYmmrtAIc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)

    • NETSUPPORT mutex has been found

      • MoUsoBr.exe (PID: 9028)

    • NETSUPPORT has been detected (SURICATA)

      • MoUsoBr.exe (PID: 9028)

    • NetSupport is detected

      • MoUsoBr.exe (PID: 9028)

    • NETSUPPORT has been detected (YARA)

      • MoUsoBr.exe (PID: 9028)

    • Connects to the CnC server

      • MoUsoBr.exe (PID: 9028)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 8884)
      • MoUsoBr.exe (PID: 9028)

    • Executable content was dropped or overwritten

      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • Process drops legitimate windows executable

      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • The process drops C-runtime libraries

      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • Process drops python dynamic module

      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • Drop NetSupport executable file

      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • Loads Python modules

      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8632)

    • Application launched itself

      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • Potential Corporate Privacy Violation

      • MoUsoBr.exe (PID: 9028)

    • Connects to the server without a host name

      • MoUsoBr.exe (PID: 9028)

    • Connects to unusual port

      • MoUsoBr.exe (PID: 9028)

    • There is functionality for taking screenshot (YARA)

      • MoUsoBr.exe (PID: 9028)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • There is functionality for communication over UDP network (YARA)

      • MoUsoBr.exe (PID: 9028)

  • INFO

    • Launch of the file from Downloads directory

      • msedge.exe (PID: 7488)
      • msedge.exe (PID: 6728)

    • Checks supported languages

      • identity_helper.exe (PID: 8440)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • MoUsoBr.exe (PID: 9028)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8632)

    • Reads Environment values

      • identity_helper.exe (PID: 8440)

    • Reads the computer name

      • identity_helper.exe (PID: 8440)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • MoUsoBr.exe (PID: 9028)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8632)

    • Application launched itself

      • msedge.exe (PID: 7488)

    • Reads Microsoft Office registry keys

      • msedge.exe (PID: 7488)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 8884)

    • Create files in a temporary directory

      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • The sample compiled with english language support

      • documentation_bnk_details0052025026jpeg.exe (PID: 8956)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • Launch of the file from Startup directory

      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)

    • Creates files or folders in the user directory

      • documentation_bnk_details0052025026jpeg.exe (PID: 8976)
      • MoUsoBr.exe (PID: 9028)

    • Checks proxy server information

      • MoUsoBr.exe (PID: 9028)

    • PyInstaller has been detected (YARA)

      • documentation_bnk_details0052025026jpeg.exe (PID: 8672)

    • Reads the software policy settings

      • slui.exe (PID: 8336)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
173
Monitored processes
41
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start iexplore.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs sppextcomobj.exe no specs slui.exe identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe documentation_bnk_details0052025026jpeg.exe documentation_bnk_details0052025026jpeg.exe #NETSUPPORT mousobr.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs documentation_bnk_details0052025026jpeg.exe documentation_bnk_details0052025026jpeg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
632"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5512 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2064"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5520 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2240"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=7520 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2568"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6460 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2692"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5420 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2904C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4784"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=5188 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5048"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5972 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5400"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6164 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5452"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6180 --field-trial-handle=2232,i,11660908393354986942,734790550002815408,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
9 592
Read events
9 560
Write events
32
Delete events
0

Modification events

(PID) Process:(7344) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7344) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7344) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7344) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(7344) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
Operation:writeName:SecuritySafe
Value:
1
(PID) Process:(7344) iexplore.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main
Operation:writeName:DisableFirstRunCustomize
Value:
1
(PID) Process:(7488) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
CAFABA9CBF942F00
(PID) Process:(7488) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328332
Operation:writeName:WindowTabManagerFileMappingId
Value:
{C2608DD1-47B9-4F9D-806B-1E8758EC7658}
(PID) Process:(7488) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\328332
Operation:writeName:WindowTabManagerFileMappingId
Value:
{A49E7E09-C6BD-4C25-8F9D-360EB0A76FC3}
(PID) Process:(7488) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
Executable files
157
Suspicious files
90
Text files
52
Unknown types
0

Dropped files

PID
Process
Filename
Type
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10a809.TMP —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10a809.TMP —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10a809.TMP —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10a819.TMP —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10a857.TMP —
MD5:—
SHA256:—
7488msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
26
TCP/UDP connections
46
DNS requests
49
Threats
15

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.20.245.137:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
9028
MoUsoBr.exe
GET
200
104.26.0.231:80
http://geo.netsupportsoftware.com/location/loca.asp
unknown
—
—
malicious
9028
MoUsoBr.exe
POST
200
45.155.250.139:3121
http://45.155.250.139/fakeurl.htm
unknown
—
—
unknown
9028
MoUsoBr.exe
POST
—
45.155.250.139:3121
http://45.155.250.139/fakeurl.htm
unknown
—
—
unknown
9028
MoUsoBr.exe
POST
200
45.155.250.139:3121
http://45.155.250.139/fakeurl.htm
unknown
—
—
unknown
9028
MoUsoBr.exe
POST
—
45.155.250.139:3121
http://45.155.250.139/fakeurl.htm
unknown
—
—
unknown
9192
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
9192
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5796
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6592
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.20.245.137:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7736
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7488
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
7736
msedge.exe
140.82.121.4:443
github.com
GITHUB
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 2.20.245.137
  • 2.20.245.139
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 184.30.21.171
whitelisted
google.com
  • 216.58.206.78
whitelisted
github.com
  • 140.82.121.4
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted
edge-mobile-static.azureedge.net
  • 13.107.246.45
whitelisted
business.bing.com
  • 13.107.6.158
whitelisted
raw.githubusercontent.com
  • 185.199.111.133
  • 185.199.108.133
  • 185.199.109.133
  • 185.199.110.133
whitelisted

Threats

PID
Process
Class
Message
7736
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
7736
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
9028
MoUsoBr.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
9028
MoUsoBr.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Checkin
9028
MoUsoBr.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Response
9028
MoUsoBr.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Checkin
9028
MoUsoBr.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
9028
MoUsoBr.exe
Potential Corporate Privacy Violation
ET REMOTE_ACCESS NetSupport GeoLocation Lookup Request
9028
MoUsoBr.exe
Misc activity
ET REMOTE_ACCESS NetSupport Remote Admin Response
9028
MoUsoBr.exe
A Network Trojan was detected
REMOTE [ANY.RUN] NetSupport RAT
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://github.com/baugulfbad/walls021/raw/refs/heads/main/documentation_bnk_details0052025026jpeg.zip