File name:

oriondn.rar

Full analysis: https://app.any.run/tasks/2c523e33-5892-4f65-88cd-55d06fbb003b
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: March 16, 2025, 03:59:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
aspack
backdoor
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

749F55BC8560FEA47A9FD539C5435E4E

SHA1:

9BA559C5D9B7B2B7141B7991763C37A1DAF1DB0B

SHA256:

D6787672CAFFA9B95D900CEDC786387ACFA1D500517F708F133F3C150F6590A7

SSDEEP:

49152:5eqHl5i0CZ65lIJm32EF433Aw100wA2sSxJ6O0SXq/zTy5fU+vfGf3ws5gPDg146:Vfi0x5oE3wWsSvSSXq7m5U+vfCwdgGWV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • Reads security settings of Internet Explorer

      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 7748)
      • VaQhXn.exe (PID: 1164)
      • ShellExperienceHost.exe (PID: 7380)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)
      • VaQhXn.exe (PID: 2980)

    • Connects to unusual port

      • VaQhXn.exe (PID: 7656)

    • Starts CMD.EXE for commands execution

      • VaQhXn.exe (PID: 7656)
      • VaQhXn.exe (PID: 1164)
      • VaQhXn.exe (PID: 2980)

    • Reads Microsoft Outlook installation path

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • Reads Internet Explorer settings

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • Executing commands from a ".bat" file

      • VaQhXn.exe (PID: 7656)
      • VaQhXn.exe (PID: 1164)
      • VaQhXn.exe (PID: 2980)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7940)
      • BackgroundTransferHost.exe (PID: 4244)
      • BackgroundTransferHost.exe (PID: 7288)
      • BackgroundTransferHost.exe (PID: 672)
      • BackgroundTransferHost.exe (PID: 8176)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5544)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8176)
      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8176)
      • oriondn.exe (PID: 7748)
      • slui.exe (PID: 7212)
      • oriondn.exe (PID: 4988)
      • slui.exe (PID: 2392)
      • oriondn.exe (PID: 864)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 8176)
      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • slui.exe (PID: 2392)
      • oriondn.exe (PID: 864)

    • Manual execution by a user

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • The sample compiled with Indonesian language support

      • WinRAR.exe (PID: 5544)

    • Create files in a temporary directory

      • oriondn.exe (PID: 7748)
      • VaQhXn.exe (PID: 7656)
      • VaQhXn.exe (PID: 1164)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)
      • VaQhXn.exe (PID: 2980)

    • Checks supported languages

      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • VaQhXn.exe (PID: 1164)
      • ShellExperienceHost.exe (PID: 7380)
      • oriondn.exe (PID: 864)
      • VaQhXn.exe (PID: 2980)

    • Reads the computer name

      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • VaQhXn.exe (PID: 1164)
      • ShellExperienceHost.exe (PID: 7380)
      • VaQhXn.exe (PID: 2980)
      • oriondn.exe (PID: 864)

    • Reads the machine GUID from the registry

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • Aspack has been detected

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)

    • Process checks computer location settings

      • VaQhXn.exe (PID: 7656)
      • VaQhXn.exe (PID: 1164)
      • VaQhXn.exe (PID: 2980)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 1650096
UncompressedSize: 3225600
OperatingSystem: Win32
ArchivedFileName: oriondn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
24
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs rundll32.exe no specs oriondn.exe vaqhxn.exe cmd.exe no specs conhost.exe no specs slui.exe oriondn.exe vaqhxn.exe no specs cmd.exe no specs conhost.exe no specs shellexperiencehost.exe no specs oriondn.exe vaqhxn.exe no specs cmd.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
672"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
864"C:\Users\admin\Downloads\oriondn.exe" C:\Users\admin\Downloads\oriondn.exe
explorer.exe
User:
admin
Company:
Orion GAMES. Inc.
Integrity Level:
MEDIUM
Description:
oriondn Launcher
Exit code:
2
Version:
1.0.0.1
Modules
Images
c:\users\admin\downloads\oriondn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1164C:\Users\admin\AppData\Local\Temp\VaQhXn.exeC:\Users\admin\AppData\Local\Temp\VaQhXn.exe—oriondn.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vaqhxn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\shlwapi.dll
1300C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\2ce67702.bat" "C:\Windows\SysWOW64\cmd.exe—VaQhXn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2516C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2980C:\Users\admin\AppData\Local\Temp\VaQhXn.exeC:\Users\admin\AppData\Local\Temp\VaQhXn.exe—oriondn.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vaqhxn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\shlwapi.dll
4244"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4988"C:\Users\admin\Downloads\oriondn.exe" C:\Users\admin\Downloads\oriondn.exe
explorer.exe
User:
admin
Company:
Orion GAMES. Inc.
Integrity Level:
MEDIUM
Description:
oriondn Launcher
Exit code:
2
Version:
1.0.0.1
Modules
Images
c:\users\admin\downloads\oriondn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
9 939
Read events
9 874
Write events
46
Delete events
19

Modification events

(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\oriondn.rar
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
4
Suspicious files
15
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ad5634bf-e75a-46c0-b25f-4cbf38ab920f.down_data —
MD5:—
SHA256:—
5544WinRAR.exeC:\Users\admin\Downloads\oriondn.exeexecutable
MD5:FB739E625DCDF17D29E962B231DFF179
SHA256:C0AA82F5AF076C8EEEEA4EDAF975BD6BE9A650CE021B7C1D1B76292F4FBF2835
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\452289e7-62fa-4509-9257-9da139d824ea.up_meta_securebinary
MD5:243F401BE355AA8C2F9BA5F20A593E06
SHA256:015320C0D3C9892CDFB9E70F8498DB7D11B2DDE40D2FEA24C08AE4E442550095
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:F7FE92715B7C9A5FA2A24DF7747DA34D
SHA256:5266AE18DB53CAEC6712C75D4859B7FF00A62952B47D649E3BB295DBA95331DB
7748oriondn.exeC:\Users\admin\Downloads\PatchConfigList.xmlxml
MD5:3C35A2462B3367055437438BF185F0FA
SHA256:39AF772DB90D9E09AACFE8F76A0724C9869D9ECF3DC26880AAB9BA9E840BCD9A
7748oriondn.exeC:\Users\admin\AppData\Local\Temp\VaQhXn.exeexecutable
MD5:56B2C3810DBA2E939A8BB9FA36D3CF96
SHA256:4354970CCC7CD6BB16318F132C34F6A1B3D5C2EA7FF53E1C9271905527F2DB07
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ad5634bf-e75a-46c0-b25f-4cbf38ab920f.739be81f-d6ba-49d3-9103-deae5ef2308a.down_metabinary
MD5:44B5F3D10AE42EB1DBDEF831FD7B24B9
SHA256:1539A3AFB6823C35EC7A1E0507DAE6CE03174E5B06D18E202A506DA36E3BDB0D
7656VaQhXn.exeC:\Users\admin\AppData\Local\Temp\32E47903.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
7748oriondn.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:971C514F84BBA0785F80AA1C23EDFD79
SHA256:F157ED17FCAF8837FA82F8B69973848C9B10A02636848F995698212A08F31895
7748oriondn.exeC:\Users\admin\Downloads\Log\oriondn_20250316_040018_Log.txttext
MD5:C26CC6EA6FDB76CB90C4646050DD8861
SHA256:69370EBB96DCF9DE2045F27B0BAFCF7D32A29248FC7DF2E6D1EE14C6B1B30EEF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
41
DNS requests
21
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7748
oriondn.exe
GET
301
172.67.178.108:80
http://oriondn.org/orionpatch/PatchInfoServer.cfg
unknown
—
—
unknown
7656
VaQhXn.exe
GET
—
3.229.117.57:799
http://ddos.dnsnb8.net:799/cj//k2.rar
unknown
—
—
malicious
7748
oriondn.exe
GET
301
172.67.178.108:80
http://oriondn.org/launcher/testt.html
unknown
—
—
unknown
7656
VaQhXn.exe
GET
—
3.229.117.57:799
http://ddos.dnsnb8.net:799/cj//k3.rar
unknown
—
—
malicious
7656
VaQhXn.exe
GET
—
3.229.117.57:799
http://ddos.dnsnb8.net:799/cj//k4.rar
unknown
—
—
malicious
7656
VaQhXn.exe
GET
—
3.229.117.57:799
http://ddos.dnsnb8.net:799/cj//k5.rar
unknown
—
—
malicious
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7504
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8176
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7504
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7504
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.132
  • 40.126.32.133
  • 40.126.32.140
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.4
  • 40.126.32.76
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
ddos.dnsnb8.net
  • 3.229.117.57
malicious
oriondn.org
  • 172.67.178.108
  • 104.21.75.154
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Domain previously seen in multiple payload deliveries (ddos .dnsnb8 .net)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
oriondn.rar