URL:

https://mega.nz/#!HaZj1KIC!WyttfFwKuuxd79JkLqL9iROLeqg76F5NHs4fK-FfQvw

Full analysis: https://app.any.run/tasks/ac3e2c97-b732-4695-aee7-666e2431c5a5
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: May 19, 2020, 13:56:57
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
evasion
rat
njrat
bladabindi
Indicators:
MD5:

152066A717D8B5873EE3ABB237B2FD30

SHA1:

9CC1DBB240B3EFD50ED60342FBCAE7AB28C8D4CC

SHA256:

9C6125BC5255BE10C83D3E0C2ACF8F335018E58E49CCB687C553C22EC8AAEE97

SSDEEP:

3:N8X/iGEYsu7ahFD+k3qbCSINeoen:29NsbHqiy

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 1800)
      • Simple Traffic Bot.exe (PID: 1380)

    • Application was dropped or rewritten from another process

      • Windows Firewall.exe (PID: 1024)
      • Simple Traffic Generator.exe (PID: 3888)
      • Simple Traffic Generator.exe (PID: 3680)
      • Simple Traffic Bot.exe (PID: 1380)
      • KMJXDR.exe (PID: 3184)
      • Server.exe (PID: 1720)
      • microsoft windows explorer.exe (PID: 1756)

    • Disables Windows Defender

      • WScript.exe (PID: 2836)

    • Writes to a start menu file

      • KMJXDR.exe (PID: 3184)
      • microsoft windows explorer.exe (PID: 1756)

    • Changes the autorun value in the registry

      • microsoft windows explorer.exe (PID: 1756)
      • KMJXDR.exe (PID: 3184)

    • NJRAT was detected

      • microsoft windows explorer.exe (PID: 1756)

    • Changes settings of System certificates

      • KMJXDR.exe (PID: 3184)

  • SUSPICIOUS

    • Creates files in the program directory

      • firefox.exe (PID: 2424)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2600)
      • Windows Firewall.exe (PID: 1024)
      • Simple Traffic Generator.exe (PID: 3680)
      • Simple Traffic Bot.exe (PID: 1380)
      • KMJXDR.exe (PID: 3184)
      • Server.exe (PID: 1720)
      • microsoft windows explorer.exe (PID: 1756)

    • Executes scripts

      • Windows Firewall.exe (PID: 1024)
      • WScript.exe (PID: 3272)
      • KMJXDR.exe (PID: 3184)

    • Creates files in the user directory

      • KMJXDR.exe (PID: 3184)
      • powershell.exe (PID: 1156)
      • powershell.exe (PID: 3928)
      • powershell.exe (PID: 1860)
      • powershell.exe (PID: 1920)
      • powershell.exe (PID: 1248)
      • powershell.exe (PID: 3852)
      • powershell.exe (PID: 1504)
      • powershell.exe (PID: 772)
      • powershell.exe (PID: 2676)
      • powershell.exe (PID: 2112)
      • powershell.exe (PID: 3804)
      • microsoft windows explorer.exe (PID: 1756)

    • Reads Internet Cache Settings

      • KMJXDR.exe (PID: 3184)

    • Executes PowerShell scripts

      • WScript.exe (PID: 2836)

    • Application launched itself

      • WScript.exe (PID: 3272)
      • taskmgr.exe (PID: 3888)

    • Starts itself from another location

      • Server.exe (PID: 1720)

    • Uses NETSH.EXE for network configuration

      • microsoft windows explorer.exe (PID: 1756)

    • Adds / modifies Windows certificates

      • KMJXDR.exe (PID: 3184)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 2424)
      • firefox.exe (PID: 2632)

    • Reads CPU info

      • firefox.exe (PID: 2424)

    • Manual execution by user

      • Simple Traffic Generator.exe (PID: 3888)
      • Simple Traffic Generator.exe (PID: 3680)
      • taskmgr.exe (PID: 3888)

    • Dropped object may contain URL to Tor Browser

      • WinRAR.exe (PID: 2600)

    • Reads Internet Cache Settings

      • firefox.exe (PID: 2424)

    • Dropped object may contain Bitcoin addresses

      • WinRAR.exe (PID: 2600)

    • Creates files in the user directory

      • firefox.exe (PID: 2424)

    • Reads settings of System Certificates

      • KMJXDR.exe (PID: 3184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
94
Monitored processes
33
Malicious processes
8
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe winrar.exe firefox.exe searchprotocolhost.exe no specs simple traffic generator.exe no specs simple traffic generator.exe windows firewall.exe simple traffic bot.exe kmjxdr.exe server.exe wscript.exe no specs wscript.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs #NJRAT microsoft windows explorer.exe wscript.exe no specs netsh.exe no specs taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
312"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2424.13.125665739\1322742137" -childID 2 -isForBrowser -prefsHandle 2676 -prefMapHandle 2828 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 2424 "\\.\pipe\gecko-crash-server-pipe.2424" 2840 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
772"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ModerateThreatDefaultAction 6C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
940netsh firewall add allowedprogram "C:\Users\admin\AppData\Local\Temp\microsoft windows explorer.exe" "microsoft windows explorer.exe" ENABLEC:\Windows\system32\netsh.exe—microsoft windows explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\netsh.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\credui.dll
c:\windows\system32\user32.dll
1024"C:\Users\admin\AppData\Local\Temp\Windows Firewall.exe" C:\Users\admin\AppData\Local\Temp\Windows Firewall.exe
Simple Traffic Generator.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\windows firewall.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
1156"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1248"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -DisableIOAVProtection $trueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1380"C:\Users\admin\AppData\Local\Temp\Simple Traffic Bot.exe" C:\Users\admin\AppData\Local\Temp\Simple Traffic Bot.exe
Simple Traffic Generator.exe
User:
admin
Integrity Level:
HIGH
Description:
Simple Traffic Bot
Exit code:
0
Version:
31.8.1.8
Modules
Images
c:\users\admin\appdata\local\temp\simple traffic bot.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1504"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -MAPSReporting 0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1720"C:\Users\admin\AppData\Local\Temp\Server.exe" C:\Users\admin\AppData\Local\Temp\Server.exe
Windows Firewall.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\server.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1756"C:\Users\admin\AppData\Local\Temp\microsoft windows explorer.exe" C:\Users\admin\AppData\Local\Temp\microsoft windows explorer.exe
Server.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\microsoft windows explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
7 437
Read events
5 191
Write events
2 246
Delete events
0

Modification events

(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Browser
Value:
E3A1803709000000
(PID) Process:(2632) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Launcher
Value:
89997C3709000000
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Mozilla\Firefox\Launcher
Operation:writeName:C:\Program Files\Mozilla Firefox\firefox.exe|Telemetry
Value:
1
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2600) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2424) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.rar\OpenWithProgids
Operation:writeName:WinRAR
Value:
Executable files
46
Suspicious files
126
Text files
172
Unknown types
93

Dropped files

PID
Process
Filename
Type
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\scriptCache-current.bin —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\cookies.sqlite-shm —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs-1.js —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\search.json.mozlz4.tmp —
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\startupCache\urlCache-current.binbinary
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\prefs.jstext
MD5:—
SHA256:—
2424firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\qldyz51w.default\safebrowsing-updating\base-track-digest256.sbstorebinary
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
54
DNS requests
151
Threats
38

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2424
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.comodoca.com/
US
der
471 b
whitelisted
2424
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
2424
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.comodoca.com/
US
der
471 b
whitelisted
2424
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.comodoca.com/
US
der
472 b
whitelisted
2424
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.comodoca.com/
US
der
471 b
whitelisted
2424
firefox.exe
POST
200
2.16.186.27:80
http://ocsp.int-x3.letsencrypt.org/
unknown
der
527 b
whitelisted
2424
firefox.exe
POST
200
172.217.21.227:80
http://ocsp.pki.goog/gts1o1
US
der
471 b
whitelisted
2424
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.comodoca.com/
US
der
472 b
whitelisted
2424
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.comodoca.com/
US
der
472 b
whitelisted
2424
firefox.exe
POST
200
151.139.128.14:80
http://ocsp.comodoca.com/
US
der
472 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2424
firefox.exe
184.24.77.19:80
detectportal.firefox.com
Time Warner Cable Internet LLC
US
unknown
2424
firefox.exe
34.211.106.52:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
2424
firefox.exe
31.216.148.10:443
mega.nz
Datacenter Luxembourg S.A.
LU
unknown
2424
firefox.exe
54.191.63.255:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
2424
firefox.exe
2.16.186.27:80
ocsp.int-x3.letsencrypt.org
Akamai International B.V.
—
whitelisted
2424
firefox.exe
216.58.208.42:443
safebrowsing.googleapis.com
Google Inc.
US
whitelisted
2424
firefox.exe
31.216.147.132:443
g.api.mega.co.nz
Cyprus Telecommunications Authority
LU
unknown
2424
firefox.exe
52.222.167.70:443
content-signature-2.cdn.mozilla.net
Amazon.com, Inc.
US
unknown
2424
firefox.exe
172.217.21.227:80
ocsp.pki.goog
Google Inc.
US
whitelisted
2424
firefox.exe
2.16.186.56:443
shavar.services.mozilla.com
Akamai International B.V.
—
whitelisted

DNS requests

Domain
IP
Reputation
mega.nz
  • 31.216.148.10
  • 89.44.169.135
whitelisted
detectportal.firefox.com
  • 184.24.77.19
  • 184.24.77.8
  • 2.16.186.50
  • 2.16.186.112
whitelisted
a1089.dscd.akamai.net
  • 184.24.77.8
  • 184.24.77.19
  • 2.16.186.50
  • 2.16.186.112
whitelisted
search.services.mozilla.com
  • 34.211.106.52
  • 52.26.114.88
  • 52.41.191.52
whitelisted
search.r53-2.services.mozilla.com
  • 52.41.191.52
  • 52.26.114.88
  • 34.211.106.52
whitelisted
push.services.mozilla.com
  • 54.191.63.255
whitelisted
autopush.prod.mozaws.net
  • 54.191.63.255
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.16.186.27
  • 2.16.186.9
whitelisted
snippets.cdn.mozilla.net
  • 52.222.167.9
  • 52.222.167.93
  • 52.222.167.185
  • 52.222.167.76
whitelisted
a771.dscq.akamai.net
  • 2.16.186.9
  • 2.16.186.27
whitelisted

Threats

PID
Process
Class
Message
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1052
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1052
svchost.exe
Potential Corporate Privacy Violation
ET POLICY External IP Lookup Domain (ipapi .co in DNS lookup)
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
1052
svchost.exe
Potentially Bad Traffic
ET POLICY DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://mega.nz/#!HaZj1KIC!WyttfFwKuuxd79JkLqL9iROLeqg76F5NHs4fK-FfQvw