File name:

Runtime Broker.scr.exe

Full analysis: https://app.any.run/tasks/2d678313-47c1-4274-93d6-2e17296b7dd1
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: May 28, 2025, 21:57:42
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
njrat
bladabindi
auto-sch
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

B0D3794C8E0344C2EA7A975CFD838A53

SHA1:

C2584B38119ED749714178ED3FA8F5B4E98EC350

SHA256:

88BF0DB97F3BF88A4B7F0AAFF64CC4065CB5DA6C140008E6CB22316DA47428BB

SSDEEP:

6144:xP2IVIsQnodizj0u2qUmMrV5GRcYNDH0PC/A6aJzmb0g/UoO0q:keQnAizj+mY7GRcYNDH0a/AZJzDg/UoE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was injected by another process

      • svchost.exe (PID: 468)
      • svchost.exe (PID: 1252)
      • svchost.exe (PID: 1044)
      • svchost.exe (PID: 1232)
      • svchost.exe (PID: 1260)
      • svchost.exe (PID: 1288)
      • svchost.exe (PID: 1416)
      • svchost.exe (PID: 1524)
      • svchost.exe (PID: 1792)
      • svchost.exe (PID: 1444)
      • svchost.exe (PID: 2396)
      • svchost.exe (PID: 1552)
      • svchost.exe (PID: 1652)
      • svchost.exe (PID: 1980)
      • svchost.exe (PID: 1784)
      • svchost.exe (PID: 1904)
      • svchost.exe (PID: 1892)
      • svchost.exe (PID: 1988)
      • svchost.exe (PID: 2068)
      • svchost.exe (PID: 2536)
      • svchost.exe (PID: 2196)
      • svchost.exe (PID: 2172)
      • svchost.exe (PID: 2292)
      • svchost.exe (PID: 2448)
      • svchost.exe (PID: 2624)
      • svchost.exe (PID: 3564)
      • svchost.exe (PID: 2920)
      • dasHost.exe (PID: 3012)
      • spoolsv.exe (PID: 2732)
      • svchost.exe (PID: 2776)
      • svchost.exe (PID: 2880)
      • svchost.exe (PID: 2932)
      • OfficeClickToRun.exe (PID: 3112)
      • svchost.exe (PID: 3084)
      • svchost.exe (PID: 3104)
      • svchost.exe (PID: 3184)
      • svchost.exe (PID: 3216)
      • svchost.exe (PID: 3196)
      • svchost.exe (PID: 3232)
      • svchost.exe (PID: 3284)
      • svchost.exe (PID: 3812)
      • svchost.exe (PID: 2544)
      • svchost.exe (PID: 2584)
      • svchost.exe (PID: 4312)
      • svchost.exe (PID: 860)
      • svchost.exe (PID: 2996)
      • MoUsoCoreWorker.exe (PID: 5496)
      • svchost.exe (PID: 4508)
      • dllhost.exe (PID: 5880)
      • svchost.exe (PID: 2112)
      • svchost.exe (PID: 6024)
      • uhssvc.exe (PID: 648)
      • svchost.exe (PID: 1572)
      • svchost.exe (PID: 1684)
      • svchost.exe (PID: 4544)
      • dwm.exe (PID: 6568)
      • winlogon.exe (PID: 6648)
      • sihost.exe (PID: 4984)
      • svchost.exe (PID: 6608)
      • svchost.exe (PID: 4952)
      • svchost.exe (PID: 3860)
      • svchost.exe (PID: 4292)
      • explorer.exe (PID: 5492)
      • dllhost.exe (PID: 6896)
      • svchost.exe (PID: 4684)
      • RuntimeBroker.exe (PID: 1036)
      • UserOOBEBroker.exe (PID: 1248)
      • svchost.exe (PID: 6544)
      • svchost.exe (PID: 4348)
      • dllhost.exe (PID: 6176)
      • audiodg.exe (PID: 6168)
      • RuntimeBroker.exe (PID: 4528)
      • svchost.exe (PID: 6180)
      • svchost.exe (PID: 1600)
      • RuntimeBroker.exe (PID: 6160)
      • ctfmon.exe (PID: 956)
      • RuntimeBroker.exe (PID: 5368)
      • ApplicationFrameHost.exe (PID: 6952)
      • RuntimeBroker.exe (PID: 3032)
      • svchost.exe (PID: 2092)
      • MusNotification.exe (PID: 5968)
      • taskhostw.exe (PID: 900)
      • default-browser-agent.exe (PID: 6048)
      • svchost.exe (PID: 6240)
      • svchost.exe (PID: 3396)
      • taskhostw.exe (PID: 3020)
      • conhost.exe (PID: 7344)
      • firefox.exe (PID: 6148)
      • firefox.exe (PID: 4180)
      • WaaSMedicAgent.exe (PID: 7268)
      • MusNotifyIcon.exe (PID: 7528)
      • WmiPrvSE.exe (PID: 4892)
      • svchost.exe (PID: 1452)
      • svchost.exe (PID: 7964)

    • Runs injected code in another process

      • elvvgra1.daq.exe (PID: 4560)

    • XWORM has been detected (YARA)

      • Runtime Broker.scr.exe (PID: 6800)

    • NjRAT is detected

      • Runtime Broker.scr.exe (PID: 6800)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Runtime Broker.scr.exe (PID: 6800)

    • Reads security settings of Internet Explorer

      • Runtime Broker.scr.exe (PID: 6800)

    • Reads the date of Windows installation

      • Runtime Broker.scr.exe (PID: 6800)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • Runtime Broker.scr.exe (PID: 6800)

    • Creates file in the systems drive root

      • explorer.exe (PID: 5492)

    • Potential Corporate Privacy Violation

      • svchost.exe (PID: 2196)

  • INFO

    • Checks supported languages

      • Runtime Broker.scr.exe (PID: 6800)
      • elvvgra1.daq.exe (PID: 4560)
      • uhssvc.exe (PID: 648)
      • default-browser-agent.exe (PID: 6048)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)
      • taskhostw.exe (PID: 3020)

    • Create files in a temporary directory

      • Runtime Broker.scr.exe (PID: 6800)

    • Reads the computer name

      • Runtime Broker.scr.exe (PID: 6800)
      • elvvgra1.daq.exe (PID: 4560)

    • Reads the machine GUID from the registry

      • Runtime Broker.scr.exe (PID: 6800)

    • Process checks computer location settings

      • Runtime Broker.scr.exe (PID: 6800)

    • Uses Task Scheduler to autorun other applications (AUTOMATE)

      • Runtime Broker.scr.exe (PID: 6800)

    • Checks proxy server information

      • Runtime Broker.scr.exe (PID: 6800)

    • Disables trace logs

      • Runtime Broker.scr.exe (PID: 6800)

    • Reads Environment values

      • Runtime Broker.scr.exe (PID: 6800)

    • Reads the software policy settings

      • Runtime Broker.scr.exe (PID: 6800)
      • slui.exe (PID: 8152)
      • WaaSMedicAgent.exe (PID: 7268)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3112)

    • Reads the time zone

      • MusNotifyIcon.exe (PID: 7528)
      • WmiPrvSE.exe (PID: 4892)

    • Creates files in the program directory

      • MusNotifyIcon.exe (PID: 7528)
      • MoUsoCoreWorker.exe (PID: 5496)

    • Manual execution by a user

      • Runtime Broker.scr.exe (PID: 6652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(6800) Runtime Broker.scr.exe
C2PKYR5vis3S8H12Bk/DjJyYP7SlZ+YI+TOIlM/NwlqhaRoS8y9RVkDjiuMoGF7k/F:%IP%
Keys
AES%Port%
Options
SplitterI6QTVADAO+4Z7J5sdSJrrQ==
USB drop nameyaq24HtvY/hBH7v28IrPxQ==
Mutex2
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (42.5)
.exe | InstallShield setup (25)
.exe | Win64 Executable (generic) (16)
.scr | Windows screen saver (7.6)
.dll | Win32 Dynamic Link Library (generic) (3.8)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2090:10:05 05:32:40+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 230912
InitializedDataSize: 5120
UninitializedDataSize: -
EntryPoint: 0x3a40e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: -
FileVersion: 1.0.0.0
InternalName: MasonRootkit.exe
LegalCopyright: -
LegalTrademarks: -
OriginalFileName: MasonRootkit.exe
ProductName: -
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
107
Malicious processes
7
Suspicious processes
89

Behavior graph

Click at the process to see the details
start #XWORM runtime broker.scr.exe elvvgra1.daq.exe no specs schtasks.exe no specs conhost.exe no specs schtasks.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe svchost.exe waasmedicagent.exe conhost.exe musnotifyicon.exe runtime broker.scr.exe no specs svchost.exe netsh.exe no specs conhost.exe no specs wmiprvse.exe slui.exe no specs svchost.exe svchost.exe uhssvc.exe svchost.exe taskhostw.exe ctfmon.exe runtimebroker.exe svchost.exe svchost.exe useroobebroker.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe spoolsv.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe dashost.exe taskhostw.exe runtimebroker.exe svchost.exe svchost.exe officeclicktorun.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe svchost.exe firefox.exe svchost.exe svchost.exe svchost.exe svchost.exe runtimebroker.exe svchost.exe svchost.exe svchost.exe sihost.exe runtimebroker.exe explorer.exe mousocoreworker.exe dllhost.exe musnotification.exe svchost.exe default-browser-agent.exe firefox.exe runtimebroker.exe audiodg.exe dllhost.exe svchost.exe svchost.exe svchost.exe dwm.exe svchost.exe winlogon.exe runtime broker.scr.exe no specs dllhost.exe applicationframehost.exe

Process information

PID
CMD
Path
Indicators
Parent process
468C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSMC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\lsm.dll
c:\windows\system32\msvcrt.dll
648"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Update Health Service
Version:
10.0.19041.3626 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\program files\microsoft update health tools\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
860C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvcC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
900taskhostw.exe NoneC:\Windows\System32\taskhostw.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\taskhostw.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
956"ctfmon.exe"C:\Windows\System32\ctfmon.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CTF Loader
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
1036C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1044C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvcC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1232C:\WINDOWS\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbServiceC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1248C:\Windows\System32\oobe\UserOOBEBroker.exe -EmbeddingC:\Windows\System32\oobe\UserOOBEBroker.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
User OOBE Broker
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\shlwapi.dll
c:\windows\system32\oobe\useroobebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1252C:\WINDOWS\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvcC:\Windows\System32\svchost.exe
services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
15 975
Read events
15 679
Write events
186
Delete events
110

Modification events

(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator
Operation:writeName:SD
Value:
0100049C5C000000680000000000000014000000020048000300000000001400FF011F0001010000000000051200000000001400A900120001010000000000051300000000001800A900120001020000000000052000000020020000010100000000000512000000010100000000000512000000
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Operation:writeName:Index
Value:
3
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:writeName:Hash
Value:
96724EB84434FB60228EE94896FCF50424BD9CE90A3AAB1D32DE6D3441D3F3E8
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:writeName:Schema
Value:
65538
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:delete valueName:Version
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:delete valueName:Date
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:writeName:SecurityDescriptor
Value:
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:delete valueName:Source
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:delete valueName:Author
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:delete valueName:Description
Value:
Executable files
1
Suspicious files
12
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
1260svchost.exeC:\Windows\System32\Tasks\MasonRuntime Broker.scr.exexml
MD5:BBD4ABF1B9B596FD29A775870AF8D3E9
SHA256:209E2941778EE5E282AC23209454A48FC7AD4B95982F16D969D809A715F65DFF
6148firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\prefs-1.jstext
MD5:0E3D46A9BC047F093A50638C7F9D17D6
SHA256:8496E2090CE54F156D02BEDD2D046805C5DA39C0B13544E09E78AA210C3CDA01
6800Runtime Broker.scr.exeC:\Users\admin\AppData\Local\Temp\elvvgra1.daq.exeexecutable
MD5:94F1AB3A068F83B32639579EC9C5D025
SHA256:879CC20B41635709BB304E315AAA5CA4708B480A1BFC2F4935FCF2215188EFB0
6148firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\prefs.jstext
MD5:0E3D46A9BC047F093A50638C7F9D17D6
SHA256:8496E2090CE54F156D02BEDD2D046805C5DA39C0B13544E09E78AA210C3CDA01
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Workxml
MD5:4838EE953DAB2C7A1BF57E0C6620A79D
SHA256:22C798E00C4793749EAC39CFB6EA3DD75112FD4453A3706E839038A64504D45D
6544svchost.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:7CF50B42166C91AE686039AE56ABD276
SHA256:D6CB0F83A5C07EFBD9CF40A192B072F86232ACF7552B2F86FDD213A0FFF09F29
7528MusNotifyIcon.exeC:\ProgramData\USOShared\Logs\User\NotifyIcon.992d9387-eecc-412c-8228-a94fa9c94251.1.etlbinary
MD5:49F233C6A7C843A072F7BB6C276DA5DE
SHA256:A06C7E6741B246BF95766D5A2B847D2C44E53C2BC872A438CD47020B105CAC75
6896dllhost.exeC:\Users\admin\AppData\Local\Microsoft\Windows\WebCache\V01.chkbinary
MD5:E313E6FAE3209AADA08F9555EC656479
SHA256:A7C3F81F6A785EDAD90CA02F02D7FBCBBCCC711A00F924D1AA8ED18284CF7F87
6148firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmpbinary
MD5:63B1BB87284EFE954E1C3AE390E7EE44
SHA256:B017EE25A7F5C09EB4BF359CA721D67E6E9D9F95F8CE6F741D47F33BDE6EF73A
6544svchost.exeC:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776binary
MD5:E1ABA98FC80A2D0569762A9EECDA433A
SHA256:B2D73A113AE462DED411D18F89B349197A3A1479596B03C00F871FBDC31B9DB7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
123
DNS requests
39
Threats
155

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.192:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1196
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1196
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
23.48.23.192:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6800
Runtime Broker.scr.exe
91.134.10.127:443
i.ibb.co
OVH SAS
FR
shared
6800
Runtime Broker.scr.exe
104.26.3.16:443
rentry.co
CLOUDFLARENET
US
suspicious
6544
svchost.exe
40.126.31.0:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
crl.microsoft.com
  • 23.48.23.192
  • 23.48.23.169
  • 23.48.23.158
  • 23.48.23.134
  • 23.48.23.187
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.74.206
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
abol8b-27708.portmap.io
  • —
malicious
i.ibb.co
  • 91.134.10.127
  • 91.134.9.159
  • 91.134.10.168
  • 91.134.10.182
  • 91.134.82.79
  • 91.134.9.160
shared
rentry.co
  • 104.26.3.16
  • 172.67.75.40
  • 104.26.2.16
unknown
login.live.com
  • 40.126.31.0
  • 20.190.159.4
  • 40.126.31.3
  • 40.126.31.128
  • 20.190.159.71
  • 40.126.31.1
  • 40.126.31.131
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
6800
Runtime Broker.scr.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
2196
svchost.exe
Misc activity
ET INFO Pastebin Service Domain in DNS Lookup (rentry .co)
6800
Runtime Broker.scr.exe
Misc activity
ET INFO Observed Pastebin Service Domain (rentry .co in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO DNS Query for Port Mapping/Tunneling Service Domain (.portmap .io)
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
6800
Runtime Broker.scr.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
6800
Runtime Broker.scr.exe
Not Suspicious Traffic
INFO [ANY.RUN] Image hosting service ImgBB
2196
svchost.exe
Potential Corporate Privacy Violation
ET INFO DNS Query to a Reverse Proxy Service Observed
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Runtime Broker.scr.exe