File name:

Crocodile Hack Version 3.2.6.exe

Full analysis: https://app.any.run/tasks/2877d53c-3795-4236-a6c9-6bb9f7f2b8bc
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: November 29, 2023, 14:21:11
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
njrat
bladabindi
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5:

5A6AB52D4B9C2014E48C1B149E3C44F3

SHA1:

DA0A2128CCBF975DBE358122D31F7EDC9E0BCA2B

SHA256:

32E15B10DF790D0A882153C06A4A95274BD661F8E78EB13D1648C8CBBA3EF38F

SSDEEP:

98304:HBX+wqAKaYmGmcnFnw5QtW15K7S8omoyr3pxPDa6Gx53xcPuZN0KNz/avpNAAJuv:nuFE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • windowspowrfree.exe (PID: 3068)
      • abc3.exe (PID: 1420)
      • abc1.exe (PID: 1496)
      • abc2.exe (PID: 1784)
      • rarsys32.exe (PID: 3388)
      • system32windows.exe (PID: 2444)
      • vlcsyswin64.exe (PID: 3296)

    • NjRAT is detected

      • abc2.exe (PID: 1784)
      • rarsys32.exe (PID: 3388)
      • abc3.exe (PID: 1420)
      • vlcsyswin64.exe (PID: 3296)
      • system32windows.exe (PID: 2444)

    • Create files in the Startup directory

      • abc3.exe (PID: 1420)
      • rarsys32.exe (PID: 3388)
      • system32windows.exe (PID: 2444)
      • vlcsyswin64.exe (PID: 3296)

    • NJRAT has been detected (YARA)

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • system32windows.exe (PID: 2444)
      • vlcsyswin64.exe (PID: 3296)

    • Changes the autorun value in the registry

      • vlcsyswin64.exe (PID: 3296)
      • rarsys32.exe (PID: 3388)
      • system32windows.exe (PID: 2444)

  • SUSPICIOUS

    • Reads the Internet Settings

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • windowspowrfree.exe (PID: 3068)
      • abc2.exe (PID: 1784)
      • abc1.exe (PID: 1496)
      • abc3.exe (PID: 1420)

    • Checks Windows Trust Settings

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)

    • Reads security settings of Internet Explorer

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)

    • Reads settings of System Certificates

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)

    • Reads Microsoft Outlook installation path

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)

    • Starts itself from another location

      • abc1.exe (PID: 1496)
      • abc2.exe (PID: 1784)
      • abc3.exe (PID: 1420)

    • Uses ATTRIB.EXE to modify file attributes

      • abc3.exe (PID: 1420)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • rarsys32.exe (PID: 3388)
      • system32windows.exe (PID: 2444)

    • Connects to unusual port

      • system32windows.exe (PID: 2444)
      • vlcsyswin64.exe (PID: 3296)
      • rarsys32.exe (PID: 3388)

    • Reads Internet Explorer settings

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)

  • INFO

    • Reads the machine GUID from the registry

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • windowspowrfree.exe (PID: 3068)
      • abc2.exe (PID: 1784)
      • abc3.exe (PID: 1420)
      • wmpnscfg.exe (PID: 1952)
      • abc1.exe (PID: 1496)
      • rarsys32.exe (PID: 3388)
      • vlcsyswin64.exe (PID: 3296)
      • system32windows.exe (PID: 2444)

    • Checks supported languages

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • windowspowrfree.exe (PID: 3068)
      • abc0.exe (PID: 2204)
      • abc1.exe (PID: 1496)
      • abc2.exe (PID: 1784)
      • abc3.exe (PID: 1420)
      • wmpnscfg.exe (PID: 1952)
      • system32windows.exe (PID: 2444)
      • rarsys32.exe (PID: 3388)
      • vlcsyswin64.exe (PID: 3296)

    • Reads the computer name

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • windowspowrfree.exe (PID: 3068)
      • abc2.exe (PID: 1784)
      • abc3.exe (PID: 1420)
      • wmpnscfg.exe (PID: 1952)
      • abc1.exe (PID: 1496)
      • rarsys32.exe (PID: 3388)
      • vlcsyswin64.exe (PID: 3296)
      • system32windows.exe (PID: 2444)

    • Checks proxy server information

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)

    • Reads Environment values

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • windowspowrfree.exe (PID: 3068)
      • rarsys32.exe (PID: 3388)
      • vlcsyswin64.exe (PID: 3296)
      • system32windows.exe (PID: 2444)

    • Creates files or folders in the user directory

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • abc3.exe (PID: 1420)
      • rarsys32.exe (PID: 3388)
      • system32windows.exe (PID: 2444)
      • vlcsyswin64.exe (PID: 3296)

    • Create files in a temporary directory

      • Crocodile Hack Version 3.2.6.exe (PID: 1668)
      • windowspowrfree.exe (PID: 3068)
      • abc3.exe (PID: 1420)
      • abc1.exe (PID: 1496)
      • abc2.exe (PID: 1784)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 1952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(2444) system32windows.exe
C2kiokoav.freeddns.org
Ports1177
Botnetwolf team 1952
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\7aa698f9219eea3c5ee53c7493871b00
Splitter|'|'|
Versionim523
(PID) Process(3296) vlcsyswin64.exe
C2kiokoav.freeddns.org
Ports5552
Botnetwolf team 5
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\vlcsyswin64
Splitter|-F-|
Versionnull
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (45.1)
.exe | Win32 Executable MS Visual C++ (generic) (19.2)
.exe | Win64 Executable (generic) (17)
.scr | Windows screen saver (8)
.dll | Win32 Dynamic Link Library (generic) (4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:11:28 23:01:43+01:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 11
CodeSize: 5843456
InitializedDataSize: 258560
UninitializedDataSize: -
EntryPoint: 0x59490e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Microsoft
FileDescription: Crocodile Pass
FileVersion: 1.0.0.0
InternalName: Crocodile Pass.exe
LegalCopyright: Copyright © Microsoft 2023
OriginalFileName: Crocodile Pass.exe
ProductName: Crocodile Pass
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
14
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NJRAT crocodile hack version 3.2.6.exe windowspowrfree.exe no specs abc0.exe no specs abc1.exe no specs #NJRAT abc2.exe no specs #NJRAT abc3.exe wmpnscfg.exe no specs #NJRAT system32windows.exe #NJRAT rarsys32.exe #NJRAT vlcsyswin64.exe attrib.exe no specs netsh.exe no specs netsh.exe no specs crocodile hack version 3.2.6.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
948"C:\Users\admin\AppData\Local\Temp\Crocodile Hack Version 3.2.6.exe" C:\Users\admin\AppData\Local\Temp\Crocodile Hack Version 3.2.6.exe—explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
Crocodile Pass
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\crocodile hack version 3.2.6.exe
c:\windows\system32\ntdll.dll
1420"C:\Users\admin\AppData\Local\Temp\abc3.exe" C:\Users\admin\AppData\Local\Temp\abc3.exe
windowspowrfree.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\abc3.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1496"C:\Users\admin\AppData\Local\Temp\abc1.exe" C:\Users\admin\AppData\Local\Temp\abc1.exe—windowspowrfree.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\abc1.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1668"C:\Users\admin\AppData\Local\Temp\Crocodile Hack Version 3.2.6.exe" C:\Users\admin\AppData\Local\Temp\Crocodile Hack Version 3.2.6.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
HIGH
Description:
Crocodile Pass
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\crocodile hack version 3.2.6.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1784"C:\Users\admin\AppData\Local\Temp\abc2.exe" C:\Users\admin\AppData\Local\Temp\abc2.exe
windowspowrfree.exe
User:
admin
Integrity Level:
HIGH
Description:
Exit code:
0
Version:
0.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\abc2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1952"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
2204"C:\Users\admin\AppData\Local\Temp\abc0.exe" C:\Users\admin\AppData\Local\Temp\abc0.exe—windowspowrfree.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4294967295
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\abc0.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2444"C:\Users\admin\AppData\Local\Temp\system32windows.exe" C:\Users\admin\AppData\Local\Temp\system32windows.exe
abc1.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\system32windows.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
NjRat
(PID) Process(2444) system32windows.exe
C2kiokoav.freeddns.org
Ports1177
Botnetwolf team 1952
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\7aa698f9219eea3c5ee53c7493871b00
Splitter|'|'|
Versionim523
2536attrib +h +r +s "C:\Users\admin\AppData\Local\Temp\vlcsyswin64.exe"C:\Windows\System32\attrib.exe—abc3.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Attribute Utility
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ulib.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3068"C:\Users\admin\AppData\Local\Temp\windowspowrfree.exe" C:\Users\admin\AppData\Local\Temp\windowspowrfree.exe—Crocodile Hack Version 3.2.6.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\windowspowrfree.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
11 865
Read events
11 473
Write events
389
Delete events
3

Modification events

(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
4600000059010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionReason
Value:
1
(PID) Process:(1668) Crocodile Hack Version 3.2.6.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{FCC67766-6201-4AD1-A6B8-2F4553C93D47}
Operation:writeName:WpadDecisionTime
Value:
7054E456CF22DA01
Executable files
11
Suspicious files
5
Text files
1
Unknown types
1

Dropped files

PID
Process
Filename
Type
1668Crocodile Hack Version 3.2.6.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27der
MD5:1D7ACFE5301E1F91FAA0CE1ABBD6CB5B
SHA256:48D9ADA5008B11AD9B047B9A0B5A515919DFFF10CEB7233CB52547FC60A6F222
1668Crocodile Hack Version 3.2.6.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157compressed
MD5:1BFE591A4FE3D91B03CDF26EAACD8F89
SHA256:9CF94355051BF0F4A45724CA20D1CC02F76371B963AB7D1E38BD8997737B13D8
1420abc3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vlcsyswin64.lnkbinary
MD5:BE0D77A7E88C6777516FFFE0D5B20D8D
SHA256:789F28269320F4F91C2B8FF494E91AF7B992F5CE7E673DB79A312A2FB84FB707
1784abc2.exeC:\Users\admin\AppData\Local\Temp\rarsys32.exeexecutable
MD5:59064D6680AD917BE9479D041F8DECB5
SHA256:B03886F050F0E0021DDF71DA0F32AC319B1A077D3A5A6F9A916C3085881E60F2
1420abc3.exeC:\Users\admin\AppData\Local\Temp\vlcsyswin64.exeexecutable
MD5:61D63A391BBCAE99388937805479125B
SHA256:818A3D8B9FD7F106B27C2D4D593F3081C726DB94DE1AC4FE1133228B538D775F
1420abc3.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\vlcsyswin64.lnkbinary
MD5:030E59A16334253417EF844AA1EBF2EC
SHA256:E18BB9AD585FCA5966B553359ACAC70A1C2308B3DD6629BEC6E512710A1B7280
1496abc1.exeC:\Users\admin\AppData\Local\Temp\system32windows.exeexecutable
MD5:5B906EF5C7BA52E15F355B84CD134197
SHA256:F7B5AD2746967BF8BBD50A7BD22D87458CFC8666D362C9AD8CA34848346F7642
3388rarsys32.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0ee303fac81616912d20573374e66c31.exeexecutable
MD5:59064D6680AD917BE9479D041F8DECB5
SHA256:B03886F050F0E0021DDF71DA0F32AC319B1A077D3A5A6F9A916C3085881E60F2
1668Crocodile Hack Version 3.2.6.exeC:\Users\admin\AppData\Local\Temp\windowspowrfree.exeexecutable
MD5:CF9E1F22BD75677AF755D37C89855082
SHA256:D5F3047F386194FC74847DD1721E4130D51F76F18CD28B0742173938C1CF343A
2444system32windows.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\7aa698f9219eea3c5ee53c7493871b00.exeexecutable
MD5:5B906EF5C7BA52E15F355B84CD134197
SHA256:F7B5AD2746967BF8BBD50A7BD22D87458CFC8666D362C9AD8CA34848346F7642
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
16
DNS requests
8
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1668
Crocodile Hack Version 3.2.6.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?6a6f2ead37dbd6d3
unknown
compressed
4.66 Kb
unknown
1668
Crocodile Hack Version 3.2.6.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAo3h2ReX7SMIk79G%2B0UDDw%3D
unknown
binary
1.47 Kb
unknown
1080
svchost.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?60b2f43ad8cf70d9
unknown
—
—
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5d0f3f151fb92950
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1668
Crocodile Hack Version 3.2.6.exe
104.20.68.143:443
pastebin.com
CLOUDFLARENET
—
unknown
1668
Crocodile Hack Version 3.2.6.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
1668
Crocodile Hack Version 3.2.6.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1080
svchost.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
868
svchost.exe
95.101.148.135:80
armmf.adobe.com
Akamai International B.V.
NL
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3388
rarsys32.exe
156.204.252.0:1188
kiokoav.freeddns.org
TE-AS
EG
unknown
2444
system32windows.exe
156.204.252.0:1177
kiokoav.freeddns.org
TE-AS
EG
unknown

DNS requests

Domain
IP
Reputation
pastebin.com
  • 104.20.68.143
  • 104.20.67.143
  • 172.67.34.170
shared
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
armmf.adobe.com
  • 95.101.148.135
whitelisted
kiokoav.freeddns.org
  • 156.204.252.0
malicious

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.freeddns .org Domain
1080
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.freeddns .org Domain
1080
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.freeddns .org Domain
1080
svchost.exe
Potentially Bad Traffic
ET INFO DYNAMIC_DNS Query to a *.freeddns .org Domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Crocodile Hack Version 3.2.6.exe