File name:

voicet.exe

Full analysis: https://app.any.run/tasks/f5d86026-1418-46e9-be60-6a1a821bd5b1
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: April 11, 2025, 23:39:30
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
rat
njrat
bladabindi
remote
backdoor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 8 sections
MD5:

34E1A98526534E50FF7D35C6CDB9227F

SHA1:

60C6F1446373DCDC0A8440AF95F5A3D062BD541D

SHA256:

A3F9A1E888E899A33DED1ABFB92D76102FDBD6EEE30145315CC5E1D984ECF02D

SSDEEP:

49152:Cggscof5Ch/j4H383r2syPrV9lN7XvpArIpnRR+eAkrh6YdBPdZCaZ7Yczu927k1:3gsnm8Xmr2syPxBpAyRR+AF6YdEYznk1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • system32.exe (PID: 8092)

    • Changes the autorun value in the registry

      • system32.exe (PID: 8092)

    • NjRAT is detected

      • system32.exe (PID: 8092)

    • Connects to the CnC server

      • system32.exe (PID: 8092)

    • NJRAT has been detected (SURICATA)

      • system32.exe (PID: 8092)

    • NJRAT has been detected (YARA)

      • system32.exe (PID: 8092)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • voicet.exe (PID: 7456)
      • WOMicClientSetup6.0.exe (PID: 7640)
      • Server.exe (PID: 7504)
      • system32.exe (PID: 8092)
      • devcon.exe (PID: 2088)
      • drvinst.exe (PID: 1088)
      • drvinst.exe (PID: 6768)

    • Reads security settings of Internet Explorer

      • voicet.exe (PID: 7456)
      • Server.exe (PID: 7504)
      • devcon.exe (PID: 2088)

    • The process creates files with name similar to system file names

      • WOMicClientSetup6.0.exe (PID: 7640)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • WOMicClientSetup6.0.exe (PID: 7640)

    • Starts itself from another location

      • Server.exe (PID: 7504)

    • There is functionality for taking screenshot (YARA)

      • WOMicClientSetup6.0.exe (PID: 7640)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • system32.exe (PID: 8092)
      • WOMicClientSetup6.0.exe (PID: 7640)

    • Process drops legitimate windows executable

      • WOMicClientSetup6.0.exe (PID: 7640)

    • Creates a software uninstall entry

      • WOMicClientSetup6.0.exe (PID: 7640)

    • Drops a system driver (possible attempt to evade defenses)

      • devcon.exe (PID: 2088)
      • drvinst.exe (PID: 1088)
      • WOMicClientSetup6.0.exe (PID: 7640)
      • drvinst.exe (PID: 6768)

    • Creates files in the driver directory

      • drvinst.exe (PID: 1088)
      • drvinst.exe (PID: 6768)

    • Creates or modifies Windows services

      • drvinst.exe (PID: 6768)

    • Contacting a server suspected of hosting an CnC

      • system32.exe (PID: 8092)

    • Connects to unusual port

      • system32.exe (PID: 8092)

  • INFO

    • Create files in a temporary directory

      • voicet.exe (PID: 7456)
      • WOMicClientSetup6.0.exe (PID: 7640)
      • Server.exe (PID: 7504)
      • devcon.exe (PID: 2088)

    • Reads the computer name

      • voicet.exe (PID: 7456)
      • WOMicClientSetup6.0.exe (PID: 7640)
      • Server.exe (PID: 7504)
      • system32.exe (PID: 8092)
      • devcon.exe (PID: 2088)
      • drvinst.exe (PID: 1088)
      • drvinst.exe (PID: 6768)

    • Process checks computer location settings

      • voicet.exe (PID: 7456)
      • Server.exe (PID: 7504)

    • Checks supported languages

      • voicet.exe (PID: 7456)
      • WOMicClientSetup6.0.exe (PID: 7640)
      • Server.exe (PID: 7504)
      • system32.exe (PID: 8092)
      • drvinst.exe (PID: 1088)
      • devcon.exe (PID: 2088)
      • drvinst.exe (PID: 6768)

    • Creates files in the program directory

      • WOMicClientSetup6.0.exe (PID: 7640)

    • The sample compiled with english language support

      • WOMicClientSetup6.0.exe (PID: 7640)
      • devcon.exe (PID: 2088)
      • drvinst.exe (PID: 1088)
      • drvinst.exe (PID: 6768)

    • Creates files or folders in the user directory

      • system32.exe (PID: 8092)
      • WOMicClientSetup6.0.exe (PID: 7640)

    • Reads the software policy settings

      • drvinst.exe (PID: 1088)
      • devcon.exe (PID: 2088)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 1088)
      • devcon.exe (PID: 2088)
      • system32.exe (PID: 8092)

    • Manual execution by a user

      • Taskmgr.exe (PID: 7516)
      • Taskmgr.exe (PID: 8140)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 8140)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(8092) system32.exe
C2feb-travelers.gl.at.ply.gg
Ports44139
Botnetคนโง่
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\f1509c3795210be72e6898870dc68218
Splitter|'|'|
Version0.7d
No Malware configuration.

TRiD

.scr | Windows screen saver (55.3)
.exe | Win32 Executable (generic) (19)
.exe | Win16/32 Executable Delphi generic (8.7)
.exe | Generic Win/DOS Executable (8.4)
.exe | DOS Executable Generic (8.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 5120
InitializedDataSize: 1733120
UninitializedDataSize: -
EntryPoint: 0x20cc
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
24
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start voicet.exe server.exe womicclientsetup6.0.exe no specs womicclientsetup6.0.exe sppextcomobj.exe no specs slui.exe no specs #NJRAT system32.exe netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs netsh.exe no specs conhost.exe no specs devcon.exe conhost.exe no specs drvinst.exe drvinst.exe svchost.exe taskmgr.exe no specs taskmgr.exe

Process information

PID
CMD
Path
Indicators
Parent process
680C:\WINDOWS\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=out action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=TCPC:\Windows\SysWOW64\netsh.exe—WOMicClientSetup6.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1088DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{508c04e4-155e-1b4b-858e-b26dcbb69e03}\womic.inf" "9" "46d27e6e7" "00000000000001D0" "WinSta0\Default" "00000000000001E0" "208" "c:\program files (x86)\womic\driver"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
2088devcon.exe install womic.inf Root\WOMicC:\Program Files (x86)\WOMic\driver\devcon.exe
WOMicClientSetup6.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Device Console
Exit code:
0
Version:
10.0.19041.685 (WinBuild.160101.0800)
Modules
Images
c:\program files (x86)\womic\driver\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
5116\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5552\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—devcon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5588C:\WINDOWS\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=in action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=UDPC:\Windows\SysWOW64\netsh.exe—WOMicClientSetup6.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6148C:\WINDOWS\system32\netsh.exe advfirewall firewall add rule name="WOMic" profile=any dir=in action=allow program="C:\Program Files (x86)\WOMic\womicclient.exe" enable=yes protocol=TCPC:\Windows\SysWOW64\netsh.exe—WOMicClientSetup6.0.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6488\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6652\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—netsh.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
13 380
Read events
12 686
Write events
686
Delete events
8

Modification events

(PID) Process:(7456) voicet.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7640) WOMicClientSetup6.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:language
Value:
1033
(PID) Process:(8092) system32.exeKey:HKEY_CURRENT_USER\Environment
Operation:writeName:SEE_MASK_NOZONECHECKS
Value:
1
(PID) Process:(7640) WOMicClientSetup6.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:bluetoothDevice
Value:
00:00:00:00:00:00
(PID) Process:(7640) WOMicClientSetup6.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:hotSpot
Value:
192.168.43.1
(PID) Process:(7640) WOMicClientSetup6.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:wifiAddr
Value:
192.168.1.101
(PID) Process:(7640) WOMicClientSetup6.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:transport
Value:
3
(PID) Process:(7640) WOMicClientSetup6.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:bufferSize
Value:
5
(PID) Process:(7640) WOMicClientSetup6.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:controlPort
Value:
8125
(PID) Process:(7640) WOMicClientSetup6.0.exeKey:HKEY_CURRENT_USER\SOFTWARE\Wolicheng\WOMic
Operation:writeName:mediaPort
Value:
60000
Executable files
25
Suspicious files
13
Text files
3
Unknown types
1

Dropped files

PID
Process
Filename
Type
7456voicet.exeC:\Users\admin\AppData\Local\Temp\WOMicClientSetup6.0.exeexecutable
MD5:0EE8920A4863AD09DFCB4E0B71FD11D4
SHA256:1B96EC30945EF54A5CF13CF94F5EF99AAFE64C5929E15DE24EB1D0724E80D372
7456voicet.exeC:\Users\admin\AppData\Local\Temp\Server.exeexecutable
MD5:981647AA65CB3EEA65E4CD8E97A18B6E
SHA256:8B5E9F4487E65AB5C820AA1BC0F949F9EDFC806346FA2568D8FEA475F87F3B05
7640WOMicClientSetup6.0.exeC:\Users\admin\AppData\Local\Temp\nsaB78B.tmp\nsDialogs.dllexecutable
MD5:D6C3DD680C6467D07D730255D0EE5D87
SHA256:AEDB5122C12037BCF5C79C2197D1474E759CF47C67C37CDB21CF27428854A55B
7640WOMicClientSetup6.0.exeC:\Program Files (x86)\WOMic\AdbWinApi.dllexecutable
MD5:ED5A809DC0024D83CBAB4FB9933D598D
SHA256:D60103A5E99BC9888F786EE916F5D6E45493C3247972CB053833803DE7E95CF9
7640WOMicClientSetup6.0.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\WO Mic Client\Uninstall.lnkbinary
MD5:007A180A0F53B3EB43BF76EB88C01811
SHA256:FC77B331AE58CB75837CAF86F008D97387FC2CA369CAAE3F770D6D7DF9122B49
7640WOMicClientSetup6.0.exeC:\Program Files (x86)\WOMic\driver\devcon.exeexecutable
MD5:816C4E245B286B4E4903131F75A94948
SHA256:ACA1BDA08690DCCA930254F96F9185C776671A85A58FFA1B59CF16017546F218
7640WOMicClientSetup6.0.exeC:\Program Files (x86)\WOMic\Resource_ru.dllexecutable
MD5:7E2CB6A75EACA4D4B18D472F2DA65732
SHA256:A239418A6F98BEE9036666375CF216390F4B942A003D1C7E9294FD7FBDD6C604
7640WOMicClientSetup6.0.exeC:\Program Files (x86)\WOMic\adb.exeexecutable
MD5:884242FB6CBBEC1F7711B946EF669E0E
SHA256:65210CB4139672B53ACAA2222B1005D036B0B02C437AA47E0E7B616FAB0E2F6F
7640WOMicClientSetup6.0.exeC:\Program Files (x86)\WOMic\uninstall.exeexecutable
MD5:F548C566E4ACE1155B6DFE365173611F
SHA256:0F77E97EB9A54DB50C883532A020D4300597075556BF4ED933E9E6F598981810
7640WOMicClientSetup6.0.exeC:\Program Files (x86)\WOMic\AdbWinUsbApi.dllexecutable
MD5:0E24119DAF1909E398FA1850B6112077
SHA256:25207C506D29C4E8DCEB61B4BD50E8669BA26012988A43FBF26A890B1E60FC97
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
27
DNS requests
14
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7876
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7876
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
8092
system32.exe
147.185.221.25:44139
feb-travelers.gl.at.ply.gg
PLAYIT-GG
US
malicious
7316
svchost.exe
184.30.18.9:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
google.com
  • 142.250.185.78
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.14
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.5
  • 40.126.32.134
  • 20.190.160.17
  • 20.190.160.22
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
feb-travelers.gl.at.ply.gg
  • 147.185.221.25
malicious
go.microsoft.com
  • 184.30.18.9
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
A Network Trojan was detected
MALWARE [ANY.RUN] Suspected domain Associated with Malware Distribution (.ply .gg)
2196
svchost.exe
Misc activity
ET TA_ABUSED_SERVICES Tunneling Service in DNS Lookup (* .ply .gg)
2196
svchost.exe
Potentially Bad Traffic
ET INFO playit .gg Tunneling Domain in DNS Lookup
8092
system32.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
8092
system32.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
8092
system32.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
8092
system32.exe
Misc activity
ET INFO Possible Host Profile Exfiltration In Pipe Delimited Format
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
voicet.exe