File name:

Babi Guling(Legjong 2).exe

Full analysis: https://app.any.run/tasks/5ae7c0d1-165c-41cb-a0b1-c5397bbc860c
Verdict: Malicious activity
Analysis date: May 20, 2025, 02:07:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto
diskwriter
confuser
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 5 sections
MD5:

D4ED2CE974DE54D4B7A42A098F478AB0

SHA1:

3F0044E35C265B73FBA8317563F28CEB4FBA586A

SHA256:

50B09C2D13250AA54090A2A38BE495BE8E3D6AFA888D29876B07CD726508BF2F

SSDEEP:

12288:Jx1M7VP9EOuIrrG205FUXcqfRT0TuN4l+7wFt6:JPM7XEOuI9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DISKWRITER has been found (auto)

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Disables task manager

      • Babi Guling(Legjong 2).exe (PID: 4892)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Starts CMD.EXE for commands execution

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Process drops legitimate windows executable

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 6436)
      • cmd.exe (PID: 6068)

    • Executable content was dropped or overwritten

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Reads the date of Windows installation

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Reads security settings of Internet Explorer

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • The process executes VB scripts

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Process copies executable file

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • The process drops C-runtime libraries

      • Babi Guling(Legjong 2).exe (PID: 4892)

  • INFO

    • Checks supported languages

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Reads the computer name

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Reads the machine GUID from the registry

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • The sample compiled with english language support

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Confuser has been detected (YARA)

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 4756)

    • Process checks computer location settings

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • Manual execution by a user

      • notepad++.exe (PID: 5744)

    • The sample compiled with french language support

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • The sample compiled with chinese language support

      • Babi Guling(Legjong 2).exe (PID: 4892)

    • The sample compiled with korean language support

      • Babi Guling(Legjong 2).exe (PID: 4892)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (41)
.exe | Win64 Executable (generic) (36.3)
.dll | Win32 Dynamic Link Library (generic) (8.6)
.exe | Win32 Executable (generic) (5.9)
.exe | Win16/32 Executable Delphi generic (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2073:01:03 16:54:47+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 122880
InitializedDataSize: 176128
UninitializedDataSize: -
EntryPoint: 0x5000a
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: legjong2.0
CompanyName: CriticForInterpreting
FileDescription: Babi Guling
FileVersion: 1.0.0.0
InternalName: Babi Guling.exe
LegalCopyright: Public Domain
LegalTrademarks: -
OriginalFileName: Babi Guling.exe
ProductName: Babi Guling
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
200
Monitored processes
52
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start babi guling(legjong 2).exe sppextcomobj.exe no specs slui.exe cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs reg.exe no specs reg.exe no specs openwith.exe no specs vdsldr.exe no specs chglogon.exe no specs conhost.exe no specs fhmanagew.exe no specs openwith.exe no specs openwith.exe no specs notepad++.exe no specs wscript.exe no specs slui.exe openwith.exe no specs resetengine.exe no specs register-cimprovider.exe no specs conhost.exe no specs printfilterpipelinesvc.exe no specs musnotification.exe no specs musnotifyicon.exe no specs comp.exe no specs conhost.exe no specs openwith.exe no specs lpksetup.exe no specs lpksetup.exe no specs openwith.exe no specs mspaint.exe no specs mspaint.exe no specs mdeserver.exe no specs fsquirt.exe no specs dialer.exe no specs devicepairingwizard.exe no specs rmactivate_ssp_isv.exe no specs conhost.exe no specs microsoft.uev.cscunpintool.exe no specs mspaint.exe no specs mspaint.exe no specs xcopy.exe no specs conhost.exe no specs rasautou.exe no specs conhost.exe no specs applytrustoffline.exe no specs conhost.exe no specs consent.exe no specs slidetoshutdown.exe no specs babi guling(legjong 2).exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
240"C:\WINDOWS\system32\dialer.exe" C:\Windows\System32\dialer.exe—Babi Guling(Legjong 2).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Windows Phone Dialer
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dialer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
456%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13C:\Windows\System32\MusNotifyIcon.exe—MusNotification.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
MusNotifyIcon.exe
Exit code:
2149884437
Version:
10.0.19041.3693 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\musnotifyicon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
632reg delete HKCC /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
720C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
720"C:\WINDOWS\system32\DevicePairingWizard.exe" C:\Windows\System32\DevicePairingWizard.exe—Babi Guling(Legjong 2).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Device Pairing Application
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\devicepairingwizard.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
920C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
1012\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—comp.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1096"C:\WINDOWS\system32\comp.exe" C:\Windows\System32\comp.exe—Babi Guling(Legjong 2).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
File Compare Utility
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\comp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
1128reg delete HKCC /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1128"C:\WINDOWS\system32\vdsldr.exe" C:\Windows\System32\vdsldr.exe—Babi Guling(Legjong 2).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Virtual Disk Service Loader
Exit code:
1073807364
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\vdsldr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
Total events
14 244
Read events
14 218
Write events
15
Delete events
11

Modification events

(PID) Process:(632) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\TSDDD\DEVICE0
Operation:delete keyName:(default)
Value:
(PID) Process:(632) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\TSDDD
Operation:delete keyName:(default)
Value:
(PID) Process:(632) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES
Operation:delete keyName:(default)
Value:
(PID) Process:(1128) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\Software\Fonts
Operation:delete keyName:(default)
Value:
(PID) Process:(1128) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\Software
Operation:delete keyName:(default)
Value:
(PID) Process:(1128) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\Control\Print\Printers
Operation:delete keyName:(default)
Value:
(PID) Process:(1128) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\Control\Print
Operation:delete keyName:(default)
Value:
(PID) Process:(1128) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\Control
Operation:delete keyName:(default)
Value:
(PID) Process:(1128) reg.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Hardware Profiles\0001\System\CurrentControlSet\SERVICES\TSDDD\DEVICE0
Operation:delete keyName:(default)
Value:
(PID) Process:(4892) Babi Guling(Legjong 2).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System
Operation:writeName:DisableTaskMgr
Value:
1
Executable files
38
Suspicious files
13
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
4892Babi Guling(Legjong 2).exeC:\Windows\System32\msvcp140_atomic_wait.dllexecutable
MD5:21F3417BBD33CBB9F1886E86C7240D1A
SHA256:7E02EFE075B7DD385992F621FDE34728EF7C2D4CF090B127B093D0835345F8FE
4892Babi Guling(Legjong 2).exeC:\Windows\System32\RtkCfg64.dllexecutable
MD5:FF2B83521D3192952E7AF4BA3841014D
SHA256:35E80D9E79DA752A88971EF3EE7F281B4B8AB1C3DD8CD638F878FF707C7CF784
4892Babi Guling(Legjong 2).exeC:\Windows\System32\mmc.exe.configxml
MD5:19D44DDFF72FCA799BA56013AC688B2B
SHA256:11A784EFAEBD8F3981AE61A2B98591C95EEF205247ABE2836750E2A6A37E0F0A
4892Babi Guling(Legjong 2).exeC:\Windows\System32\mfc140u.dllexecutable
MD5:B7D8B3F9D0D62FA30B7D29A736D2720D
SHA256:4545EABA650AF037B76B3F6029101BDE46CEFA3E40F43BDF9B9447B36A7C65B3
4892Babi Guling(Legjong 2).exeC:\Windows\System32\MRT-KB890830.exe —
MD5:—
SHA256:—
4892Babi Guling(Legjong 2).exeC:\Windows\System32\msclmd.dllexecutable
MD5:33D65CB2A7F71AA0ED57CC411BCC716B
SHA256:ED9B1D64A416C20153F4FE5B64AA759760FAFFEFCCA66EB093B7DABF5AFD8EFD
4892Babi Guling(Legjong 2).exeC:\Windows\System32\mfc140esn.dllexecutable
MD5:B8FA6AEE8D3537F9F3CC0F466711B175
SHA256:03538E72F7A3A28DB98A40F7BA48289A072807070CEACD574F367D36CEB65155
4892Babi Guling(Legjong 2).exeC:\Windows\System32\NetSetupMig.logbinary
MD5:662F4565D5900CF8EAF93585E7F0AEFE
SHA256:0E6D8F2D00A205FAAD08388DC00D718B0231C63BCD6FD21F6B5BBC436AFB05CD
5744notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\stylers.xmlxml
MD5:312281C4126FA897EF21A7E8CCB8D495
SHA256:53B4BE3ED1CFD712E53542B30CFE30C5DB35CC48BE7C57727DFEC26C9E882E90
4892Babi Guling(Legjong 2).exeC:\Windows\System32\msvcp140_2.dllexecutable
MD5:1CA1F1E069D28F64CC42B4F7C3C21C66
SHA256:00AA1E37200E85D08C0476529ACA1654AAA67FAD551E837B89D9EEB248EAFEDC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
33
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2040
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5344
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5344
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.17:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2040
backgroundTaskHost.exe
20.199.58.43:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 23.219.150.101
whitelisted
google.com
  • 142.250.181.238
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.17
  • 20.190.160.5
  • 40.126.32.74
  • 20.190.160.130
  • 20.190.160.132
  • 20.190.160.65
  • 20.190.160.64
  • 20.190.160.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted
fd.api.iris.microsoft.com
  • 20.74.19.45
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Babi Guling(Legjong 2).exe