File name:

oriondn.rar

Full analysis: https://app.any.run/tasks/2c523e33-5892-4f65-88cd-55d06fbb003b
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: March 16, 2025, 03:59:50
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
opendir
aspack
backdoor
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

749F55BC8560FEA47A9FD539C5435E4E

SHA1:

9BA559C5D9B7B2B7141B7991763C37A1DAF1DB0B

SHA256:

D6787672CAFFA9B95D900CEDC786387ACFA1D500517F708F133F3C150F6590A7

SSDEEP:

49152:5eqHl5i0CZ65lIJm32EF433Aw100wA2sSxJ6O0SXq/zTy5fU+vfGf3ws5gPDg146:Vfi0x5oE3wWsSvSSXq7m5U+vfCwdgGWV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Connects to unusual port

      • VaQhXn.exe (PID: 7656)

    • Reads security settings of Internet Explorer

      • oriondn.exe (PID: 7748)
      • VaQhXn.exe (PID: 7656)
      • VaQhXn.exe (PID: 1164)
      • oriondn.exe (PID: 4988)
      • ShellExperienceHost.exe (PID: 7380)
      • VaQhXn.exe (PID: 2980)
      • oriondn.exe (PID: 864)

    • Executable content was dropped or overwritten

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • Executing commands from a ".bat" file

      • VaQhXn.exe (PID: 7656)
      • VaQhXn.exe (PID: 1164)
      • VaQhXn.exe (PID: 2980)

    • Starts CMD.EXE for commands execution

      • VaQhXn.exe (PID: 7656)
      • VaQhXn.exe (PID: 1164)
      • VaQhXn.exe (PID: 2980)

    • Reads Microsoft Outlook installation path

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • Reads Internet Explorer settings

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7940)
      • BackgroundTransferHost.exe (PID: 4244)
      • BackgroundTransferHost.exe (PID: 8176)
      • BackgroundTransferHost.exe (PID: 672)
      • BackgroundTransferHost.exe (PID: 7288)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8176)
      • oriondn.exe (PID: 7748)
      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 4988)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5544)

    • The sample compiled with Indonesian language support

      • WinRAR.exe (PID: 5544)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 8176)
      • oriondn.exe (PID: 7748)
      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 4988)
      • slui.exe (PID: 2392)
      • oriondn.exe (PID: 864)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8176)
      • slui.exe (PID: 7212)
      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • slui.exe (PID: 2392)
      • oriondn.exe (PID: 864)

    • Reads the machine GUID from the registry

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • Create files in a temporary directory

      • oriondn.exe (PID: 7748)
      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 4988)
      • VaQhXn.exe (PID: 1164)
      • oriondn.exe (PID: 864)
      • VaQhXn.exe (PID: 2980)

    • Reads the computer name

      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 7748)
      • VaQhXn.exe (PID: 1164)
      • ShellExperienceHost.exe (PID: 7380)
      • oriondn.exe (PID: 4988)
      • VaQhXn.exe (PID: 2980)
      • oriondn.exe (PID: 864)

    • Checks supported languages

      • VaQhXn.exe (PID: 7656)
      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • VaQhXn.exe (PID: 1164)
      • oriondn.exe (PID: 864)
      • ShellExperienceHost.exe (PID: 7380)
      • VaQhXn.exe (PID: 2980)

    • Manual execution by a user

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
      • oriondn.exe (PID: 864)

    • Process checks computer location settings

      • VaQhXn.exe (PID: 7656)
      • VaQhXn.exe (PID: 1164)
      • VaQhXn.exe (PID: 2980)

    • Aspack has been detected

      • oriondn.exe (PID: 7748)
      • oriondn.exe (PID: 4988)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 1650096
UncompressedSize: 3225600
OperatingSystem: Win32
ArchivedFileName: oriondn.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
160
Monitored processes
24
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs rundll32.exe no specs oriondn.exe vaqhxn.exe cmd.exe no specs conhost.exe no specs slui.exe oriondn.exe vaqhxn.exe no specs cmd.exe no specs conhost.exe no specs shellexperiencehost.exe no specs oriondn.exe vaqhxn.exe no specs cmd.exe no specs conhost.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
672"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
864"C:\Users\admin\Downloads\oriondn.exe" C:\Users\admin\Downloads\oriondn.exe
explorer.exe
User:
admin
Company:
Orion GAMES. Inc.
Integrity Level:
MEDIUM
Description:
oriondn Launcher
Exit code:
2
Version:
1.0.0.1
Modules
Images
c:\users\admin\downloads\oriondn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
1164C:\Users\admin\AppData\Local\Temp\VaQhXn.exeC:\Users\admin\AppData\Local\Temp\VaQhXn.exe—oriondn.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vaqhxn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\shlwapi.dll
1300C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\2ce67702.bat" "C:\Windows\SysWOW64\cmd.exe—VaQhXn.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2392C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2516C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
2980C:\Users\admin\AppData\Local\Temp\VaQhXn.exeC:\Users\admin\AppData\Local\Temp\VaQhXn.exe—oriondn.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\vaqhxn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\shlwapi.dll
4244"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4988"C:\Users\admin\Downloads\oriondn.exe" C:\Users\admin\Downloads\oriondn.exe
explorer.exe
User:
admin
Company:
Orion GAMES. Inc.
Integrity Level:
MEDIUM
Description:
oriondn Launcher
Exit code:
2
Version:
1.0.0.1
Modules
Images
c:\users\admin\downloads\oriondn.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
9 939
Read events
9 874
Write events
46
Delete events
19

Modification events

(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Downloads\oriondn.rar
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:15
Value:
(PID) Process:(5544) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\DialogEditHistory\ExtrPath
Operation:delete valueName:14
Value:
Executable files
4
Suspicious files
15
Text files
27
Unknown types
0

Dropped files

PID
Process
Filename
Type
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ad5634bf-e75a-46c0-b25f-4cbf38ab920f.down_data —
MD5:—
SHA256:—
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:F7FE92715B7C9A5FA2A24DF7747DA34D
SHA256:5266AE18DB53CAEC6712C75D4859B7FF00A62952B47D649E3BB295DBA95331DB
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ad5634bf-e75a-46c0-b25f-4cbf38ab920f.739be81f-d6ba-49d3-9103-deae5ef2308a.down_metabinary
MD5:44B5F3D10AE42EB1DBDEF831FD7B24B9
SHA256:1539A3AFB6823C35EC7A1E0507DAE6CE03174E5B06D18E202A506DA36E3BDB0D
7656VaQhXn.exeC:\Users\admin\AppData\Local\Temp\32E47903.exetext
MD5:D3B07384D113EDEC49EAA6238AD5FF00
SHA256:B5BB9D8014A0F9B1D61E21E796D78DCCDF1352F23CD32812F4850B878AE4944C
7748oriondn.exeC:\Users\admin\Downloads\PatchInfoServer.cfgtext
MD5:57CFB01258B3DB941E8F7FA9729FFCA8
SHA256:AA03D28EB7012048677EDBDD24EA290ECB220F7989EF84A7388EAC6E9380FCC7
7748oriondn.exeC:\Users\admin\Downloads\Log\oriondn_20250316_040018_Log.txttext
MD5:C26CC6EA6FDB76CB90C4646050DD8861
SHA256:69370EBB96DCF9DE2045F27B0BAFCF7D32A29248FC7DF2E6D1EE14C6B1B30EEF
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:D7709AE0349BB42B473595A016224350
SHA256:8537A7E4F989277897E26C65966C34247F733FC2B823D73C10C565C84BB46A61
8176BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\452289e7-62fa-4509-9257-9da139d824ea.739be81f-d6ba-49d3-9103-deae5ef2308a.down_metabinary
MD5:44B5F3D10AE42EB1DBDEF831FD7B24B9
SHA256:1539A3AFB6823C35EC7A1E0507DAE6CE03174E5B06D18E202A506DA36E3BDB0D
7748oriondn.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12binary
MD5:C9BE626E9715952E9B70F92F912B9787
SHA256:C13E8D22800C200915F87F71C31185053E4E60CA25DE2E41E160E09CD2D815D4
7748oriondn.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8binary
MD5:226ACDCE944E940C9219DEA2E2F882C6
SHA256:980EDF84033E41AD31101433656C01A9FF041FAD5877D39E6DB05EEEC35CA84A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
21
TCP/UDP connections
41
DNS requests
21
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7656
VaQhXn.exe
GET
—
3.229.117.57:799
http://ddos.dnsnb8.net:799/cj//k1.rar
unknown
—
—
malicious
7504
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8176
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7748
oriondn.exe
GET
301
172.67.178.108:80
http://oriondn.org/orionpatch/PatchConfigList.xml
unknown
—
—
unknown
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7748
oriondn.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
7748
oriondn.exe
GET
200
172.217.18.3:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
8040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8040
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.120:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.103.199:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7504
backgroundTaskHost.exe
20.223.35.26:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7504
backgroundTaskHost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 2.16.164.120
  • 2.16.164.49
whitelisted
client.wns.windows.com
  • 40.113.103.199
whitelisted
login.live.com
  • 20.190.160.132
  • 40.126.32.133
  • 40.126.32.140
  • 40.126.32.134
  • 40.126.32.74
  • 20.190.160.4
  • 40.126.32.76
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 2.23.227.215
  • 2.23.227.208
whitelisted
ddos.dnsnb8.net
  • 3.229.117.57
malicious
oriondn.org
  • 172.67.178.108
  • 104.21.75.154
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
SUSPICIOUS [ANY.RUN] Domain previously seen in multiple payload deliveries (ddos .dnsnb8 .net)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
7656
VaQhXn.exe
A Network Trojan was detected
BACKDOOR [ANY.RUN] Bdaejec Backdoor (download .rar)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
oriondn.rar