File name:

BadRabbit.exe

Full analysis: https://app.any.run/tasks/c7d42e0d-2aee-4eba-8035-d0ae159d6c6e
Verdict: Malicious activity
Threats:

Ransomware is a type of malicious software that locks users out of their system or data using different methods to force them to pay a ransom. Most often, such programs encrypt files on an infected machine and demand a fee to be paid in exchange for the decryption key. Additionally, such programs can be used to steal sensitive information from the compromised computer and even conduct DDoS attacks against affected organizations to pressure them into paying.

Malware Trends Tracker     >>>
Analysis date: May 11, 2025, 07:23:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
badrabbit
ransomware
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (console) Intel 80386, for MS Windows, 5 sections
MD5:

FBBDC39AF1139AEBBA4DA004475E8839

SHA1:

DE5C8D858E6E41DA715DCA1C019DF0BFB92D32C0

SHA256:

630325CAC09AC3FAB908F903E3B00D0DADD5FDAA0875ED8496FCBB97A558D0DA

SSDEEP:

12288:BHNTywFAvN86pLbqWRKHZKfErrZJyZ0yqsGO3XR63:vT56NbqWRwZaEr3yt2O3XR63

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • BadRabbit.exe (PID: 2904)
      • BadRabbit.exe (PID: 1276)

    • BADRABBIT has been detected

      • BadRabbit.exe (PID: 1276)
      • rundll32.exe (PID: 4400)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 1164)
      • cmd.exe (PID: 5892)
      • cmd.exe (PID: 4488)
      • cmd.exe (PID: 5068)
      • cmd.exe (PID: 3704)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • BadRabbit.exe (PID: 1276)
      • rundll32.exe (PID: 4400)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 1760)
      • schtasks.exe (PID: 1064)
      • schtasks.exe (PID: 3736)
      • schtasks.exe (PID: 1340)
      • schtasks.exe (PID: 5412)
      • schtasks.exe (PID: 4668)
      • schtasks.exe (PID: 2548)
      • schtasks.exe (PID: 6836)
      • schtasks.exe (PID: 4732)

    • Starts application with an unusual extension

      • rundll32.exe (PID: 4400)

    • Starts CMD.EXE for commands execution

      • rundll32.exe (PID: 4400)
      • dispci.exe (PID: 1708)
      • dispci.exe (PID: 504)
      • dispci.exe (PID: 7052)
      • dispci.exe (PID: 3924)
      • dispci.exe (PID: 6124)
      • dispci.exe (PID: 6608)

    • The system shut down or reboot

      • cmd.exe (PID: 952)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4444)
      • cmd.exe (PID: 1744)

  • INFO

    • The sample compiled with english language support

      • BadRabbit.exe (PID: 1276)

    • Checks supported languages

      • BadRabbit.exe (PID: 1276)
      • BEBE.tmp (PID: 5608)

    • Manual execution by a user

      • dispci.exe (PID: 3752)
      • dispci.exe (PID: 1708)
      • dispci.exe (PID: 1176)
      • dispci.exe (PID: 504)
      • mspaint.exe (PID: 2508)
      • svchost.exe (PID: 1092)
      • svchost.exe (PID: 1120)
      • svchost.exe (PID: 1188)
      • svchost.exe (PID: 1544)
      • svchost.exe (PID: 1196)
      • svchost.exe (PID: 1268)
      • svchost.exe (PID: 1372)
      • svchost.exe (PID: 1344)
      • svchost.exe (PID: 1400)
      • svchost.exe (PID: 1456)
      • svchost.exe (PID: 1504)
      • svchost.exe (PID: 1608)
      • upfc.exe (PID: 1756)
      • svchost.exe (PID: 1748)
      • svchost.exe (PID: 1764)
      • svchost.exe (PID: 1856)
      • svchost.exe (PID: 1848)
      • svchost.exe (PID: 1948)
      • svchost.exe (PID: 2416)
      • svchost.exe (PID: 1864)
      • svchost.exe (PID: 1532)
      • svchost.exe (PID: 1984)
      • svchost.exe (PID: 1260)
      • svchost.exe (PID: 2124)
      • svchost.exe (PID: 2220)
      • sppsvc.exe (PID: 2344)
      • svchost.exe (PID: 2372)
      • svchost.exe (PID: 2428)
      • svchost.exe (PID: 2596)
      • svchost.exe (PID: 2508)
      • svchost.exe (PID: 2616)
      • svchost.exe (PID: 2608)
      • svchost.exe (PID: 2980)
      • svchost.exe (PID: 2628)
      • spoolsv.exe (PID: 2716)
      • svchost.exe (PID: 2928)
      • svchost.exe (PID: 2828)
      • svchost.exe (PID: 2608)
      • svchost.exe (PID: 3008)
      • OfficeClickToRun.exe (PID: 3016)
      • svchost.exe (PID: 3040)
      • svchost.exe (PID: 3064)
      • svchost.exe (PID: 2516)
      • svchost.exe (PID: 2872)
      • svchost.exe (PID: 2884)
      • svchost.exe (PID: 3860)
      • svchost.exe (PID: 3124)
      • svchost.exe (PID: 3164)
      • svchost.exe (PID: 3288)
      • svchost.exe (PID: 3820)
      • svchost.exe (PID: 3264)
      • svchost.exe (PID: 3884)
      • svchost.exe (PID: 3940)
      • svchost.exe (PID: 3952)
      • svchost.exe (PID: 4052)
      • svchost.exe (PID: 2324)
      • svchost.exe (PID: 2860)
      • svchost.exe (PID: 4192)
      • svchost.exe (PID: 4484)
      • svchost.exe (PID: 4368)
      • svchost.exe (PID: 5568)
      • TrustedInstaller.exe (PID: 5008)
      • svchost.exe (PID: 4856)
      • svchost.exe (PID: 5388)
      • svchost.exe (PID: 4068)
      • svchost.exe (PID: 4780)
      • svchost.exe (PID: 6424)
      • svchost.exe (PID: 6248)
      • svchost.exe (PID: 6384)
      • dispci.exe (PID: 4964)
      • svchost.exe (PID: 6920)
      • svchost.exe (PID: 6296)
      • WINWORD.EXE (PID: 6360)
      • mspaint.exe (PID: 6212)
      • svchost.exe (PID: 5768)
      • svchost.exe (PID: 5584)
      • dispci.exe (PID: 6340)
      • dispci.exe (PID: 5444)
      • dispci.exe (PID: 6124)
      • dispci.exe (PID: 7052)
      • dispci.exe (PID: 6608)

    • Reads the computer name

      • PLUGScheduler.exe (PID: 4444)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 4444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:10:22 02:33:58+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 12288
InitializedDataSize: 43520
UninitializedDataSize: -
EntryPoint: 0x12c0
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows command line
FileVersionNumber: 27.0.0.170
ProductVersionNumber: 27.0.0.170
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Adobe Systems Incorporated
FileDescription: Adobe® Flash® Player Installer/Uninstaller 27.0 r0
FileVersion: 27,0,0,170
InternalName: Adobe® Flash® Player Installer/Uninstaller 27.0
LegalCopyright: Copyright © 1996-2017 Adobe Systems Incorporated
LegalTrademarks: Adobe® Flash® Player
OriginalFileName: FlashUtil.exe
ProductName: Adobe® Flash® Player Installer/Uninstaller
ProductVersion: 27,0,0,170
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
462
Monitored processes
160
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start start #BADRABBIT badrabbit.exe conhost.exe no specs #BADRABBIT rundll32.exe cmd.exe no specs conhost.exe no specs schtasks.exe no specs sppextcomobj.exe no specs slui.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs bebe.tmp no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs dispci.exe no specs conhost.exe no specs plugscheduler.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs dispci.exe no specs dispci.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs dispci.exe no specs dispci.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs mspaint.exe no specs cmd.exe no specs cmd.exe no specs conhost.exe no specs conhost.exe no specs schtasks.exe no specs schtasks.exe no specs cmd.exe no specs conhost.exe no specs shutdown.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs upfc.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe taskhostw.exe no specs sppsvc.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs spoolsv.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs officeclicktorun.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs sihost.exe no specs svchost.exe no specs svchost.exe no specs taskhostw.exe no specs plugscheduler.exe no specs svchost.exe no specs taskhostw.exe no specs svchost.exe no specs ctfmon.exe no specs svchost.exe no specs svchost.exe no specs trustedinstaller.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs mspaint.exe no specs svchost.exe no specs svchost.exe no specs winword.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs ai.exe no specs dispci.exe no specs consent.exe no specs dispci.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs dispci.exe no specs consent.exe no specs dispci.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs dispci.exe no specs consent.exe no specs dispci.exe conhost.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs badrabbit.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
504"C:\Windows\dispci.exe" C:\Windows\dispci.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Microsoft Display Class Installer
Exit code:
0
Version:
1.1.846.118
Modules
Images
c:\windows\dispci.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
528/c schtasks /Delete /F /TN viserion_3C:\Windows\SysWOW64\cmd.exe—dispci.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
572/c schtasks /Delete /F /TN viserion_2C:\Windows\SysWOW64\cmd.exe—dispci.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
680\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
688\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
732\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
892sihost.exeC:\Windows\System32\sihost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Shell Infrastructure Host
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sihost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
900\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920schtasks /Create /SC ONCE /TN viserion_4 /RU SYSTEM /TR "C:\WINDOWS\system32\shutdown.exe /r /t 0 /f" /ST 07:29:00C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
924\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—dispci.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
120 865
Read events
103 387
Write events
17 229
Delete events
249

Modification events

(PID) Process:(4400) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{71a27cdd-812a-11d0-bec7-08002be2092f}
Operation:writeName:LowerFilters
Value:
cscc
(PID) Process:(4400) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e965-e325-11ce-bfc1-08002be10318}
Operation:writeName:UpperFilters
Value:
cscc
(PID) Process:(4400) rundll32.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\CrashControl
Operation:writeName:DumpFilters
Value:
cscc
(PID) Process:(2508) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:WindowPlacement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1A0000001A000000DA03000003020000
(PID) Process:(2508) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ShowThumbnail
Value:
0
(PID) Process:(2508) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPWidth
Value:
0
(PID) Process:(2508) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:BMPHeight
Value:
0
(PID) Process:(2508) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbXPos
Value:
0
(PID) Process:(2508) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbYPos
Value:
0
(PID) Process:(2508) mspaint.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\View
Operation:writeName:ThumbWidth
Value:
0
Executable files
4
Suspicious files
189
Text files
12
Unknown types
5

Dropped files

PID
Process
Filename
Type
4400rundll32.exeC:\Users\admin\Documents\Database1.accdbbinary
MD5:7A167FE629C7FA02EE2B2E71A9783AC6
SHA256:A2616284608AD3AA056B8C0C29810F29692A3DA1CE17BF7902BAFB615BF66620
4444PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.045.etlbinary
MD5:89BD161BF7B46C9078937CF832786737
SHA256:2B83DF5532E9F54ED301C8F82E2CDD489799C8D5222A2D44C97DCB151A96FAA9
4400rundll32.exeC:\Windows\cscc.datexecutable
MD5:EDB72F4A46C39452D1A5414F7D26454A
SHA256:0B2F863F4119DC88A22CC97C0A136C88A0127CB026751303B045F7322A8972F6
4444PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.043.etlbinary
MD5:8A2BDE0EAFA7E946196A1B114AB636E9
SHA256:1C338CBDD9316D7FD8F208341466FEDC554A04D489B3A86C736EC3831A2F2BA2
4444PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.047.etlbinary
MD5:FED961067F664B5381B65A534B7AB728
SHA256:652F31A8284AE812D1D9D24192BC800976BF74C240591C6AC443A28C4709FB7C
4444PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.048.etlbinary
MD5:A23907B6FDD47DCABFDFD7CF2FCD7671
SHA256:0C9C33FE9E984A2E5A70EBA51F36B9929A86199E424AF2F8080E1267B87DC970
4444PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.050.etlbinary
MD5:C8834D365FAE073DEDE1F1620454CE71
SHA256:C6DD793EEE1D5551CA507A3C5BFFECA82DD3E29C63C2C6DD218A7D4BFB37046B
4444PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.049.etlbinary
MD5:5EA68411BF8E9EAF4621BAF73F61449E
SHA256:9D4CA5A1D871F819C139A498BB910A63576C2FE6367853544F8D172D8B6EBFF7
4444PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.042.etlbinary
MD5:C1F87CF12DD702D2185E703BA004D216
SHA256:9D993487866C9538DC19F281A6346E1796E7478C7C164D61437AF6E698C66125
4444PLUGScheduler.exeC:\ProgramData\PLUG\Logs\RUXIMLog.044.etlbinary
MD5:B53B2070E686FFB1FBC8B06994E7C8D7
SHA256:A3ABD06F4E40CB700B1908AB6BCD2E27455E13EF076E0BF2345BB2FA369EF802
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
89
DNS requests
36
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.2:445
—
—
—
whitelisted
4
System
192.168.100.2:139
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4400
rundll32.exe
192.168.100.1:445
—
—
—
unknown
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 142.250.186.142
whitelisted
www.bing.com
  • 104.126.37.171
  • 104.126.37.170
  • 104.126.37.123
  • 104.126.37.162
  • 104.126.37.130
  • 104.126.37.163
  • 104.126.37.136
  • 104.126.37.178
  • 104.126.37.185
  • 104.126.37.137
  • 104.126.37.131
  • 104.126.37.139
  • 104.126.37.186
  • 104.126.37.144
  • 104.126.37.153
  • 104.126.37.128
  • 104.126.37.138
  • 104.126.37.160
  • 104.126.37.152
  • 104.126.37.147
  • 104.126.37.154
  • 104.126.37.155
  • 104.126.37.161
whitelisted
self.events.data.microsoft.com
  • 20.44.10.122
  • 20.189.173.3
  • 20.189.173.27
  • 104.208.16.88
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.21
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
BadRabbit.exe