File name:

C57991E4269B688783BC55D013358972.exe

Full analysis: https://app.any.run/tasks/ffe5e0f0-e798-48bc-a5af-5edb2193376b
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: May 17, 2025, 16:46:22
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
rat
njrat
bladabindi
remote
backdoor
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

C57991E4269B688783BC55D013358972

SHA1:

15C47B1D9BED294B972B685FF5261E91ABAB0217

SHA256:

E53D13923B4CB4503360A71F1A2F63E4954615FAF55EDC0B0116F1B2836142BB

SSDEEP:

12288:Gp7J8xoGYWjOjqyMyy291xLt4+UsJjju93YkKVbowE:Gp7iVjOjqyMy91xLt4+UsJjju93XKVbE

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Widget_21F2E8883D418A0C.exe (PID: 7548)

    • NJRAT has been detected (SURICATA)

      • MSBuild.exe (PID: 7620)

    • Connects to the CnC server

      • MSBuild.exe (PID: 7620)

    • NJRAT has been detected (YARA)

      • MSBuild.exe (PID: 7620)

    • NjRAT is detected

      • MSBuild.exe (PID: 7620)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • C57991E4269B688783BC55D013358972.exe (PID: 6032)

    • Starts itself from another location

      • C57991E4269B688783BC55D013358972.exe (PID: 6032)

    • Executable content was dropped or overwritten

      • C57991E4269B688783BC55D013358972.exe (PID: 6032)

    • Connects to unusual port

      • MSBuild.exe (PID: 7620)

    • Contacting a server suspected of hosting an CnC

      • MSBuild.exe (PID: 7620)

  • INFO

    • Creates files in the program directory

      • MoUsoCoreWorker.exe (PID: 5496)
      • MusNotifyIcon.exe (PID: 7228)

    • Reads the time zone

      • MoUsoCoreWorker.exe (PID: 5496)
      • MusNotifyIcon.exe (PID: 7228)
      • WmiPrvSE.exe (PID: 7772)

    • Checks supported languages

      • C57991E4269B688783BC55D013358972.exe (PID: 6032)
      • Widget_21F2E8883D418A0C.exe (PID: 7548)
      • MSBuild.exe (PID: 7620)
      • Widget_21F2E8883D418A0C.exe (PID: 7668)
      • MSBuild.exe (PID: 7720)

    • Local mutex for internet shortcut management

      • taskhostw.exe (PID: 4652)

    • Reads the computer name

      • C57991E4269B688783BC55D013358972.exe (PID: 6032)
      • Widget_21F2E8883D418A0C.exe (PID: 7548)
      • MSBuild.exe (PID: 7620)
      • Widget_21F2E8883D418A0C.exe (PID: 7668)
      • MSBuild.exe (PID: 7720)

    • Reads security settings of Internet Explorer

      • taskhostw.exe (PID: 4652)

    • Reads the machine GUID from the registry

      • C57991E4269B688783BC55D013358972.exe (PID: 6032)
      • Widget_21F2E8883D418A0C.exe (PID: 7548)
      • MSBuild.exe (PID: 7620)
      • Widget_21F2E8883D418A0C.exe (PID: 7668)
      • MSBuild.exe (PID: 7720)

    • Creates files or folders in the user directory

      • C57991E4269B688783BC55D013358972.exe (PID: 6032)

    • Reads the software policy settings

      • WaaSMedicAgent.exe (PID: 7248)
      • SIHClient.exe (PID: 7908)
      • slui.exe (PID: 7360)

    • Process checks computer location settings

      • C57991E4269B688783BC55D013358972.exe (PID: 6032)

    • Auto-launch of the file from Registry key

      • Widget_21F2E8883D418A0C.exe (PID: 7548)

    • Manual execution by a user

      • Widget_21F2E8883D418A0C.exe (PID: 7668)

    • .NET Reactor protector has been detected

      • Widget_21F2E8883D418A0C.exe (PID: 7548)
      • Widget_21F2E8883D418A0C.exe (PID: 7668)

    • Reads Windows Product ID

      • WmiPrvSE.exe (PID: 7772)

    • Reads Microsoft Office registry keys

      • OfficeClickToRun.exe (PID: 3112)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(7620) MSBuild.exe
C2hsolic.duckdns.org
Ports6903
BotnetMAY25
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\bda8e5e4e3a30f46083515049261d195
SplitterboolLove
VersionHallaj PRO Rat [Fixed]
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2105:05:09 15:46:11+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 104448
InitializedDataSize: 333312
UninitializedDataSize: -
EntryPoint: 0xccef
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: -
FileDescription: Widget
FileVersion: 1.0.0.0
InternalName: Stub.exe
LegalCopyright: Copyright © 2025
LegalTrademarks: -
OriginalFileName: Stub.exe
ProductName: Widget
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
122
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start start svchost.exe no specs c57991e4269b688783bc55d013358972.exe musnotifyicon.exe no specs waasmedicagent.exe no specs sppextcomobj.exe no specs conhost.exe no specs slui.exe widget_21f2e8883d418a0c.exe msbuild.exe no specs msbuild.exe no specs #NJRAT msbuild.exe widget_21f2e8883d418a0c.exe no specs msbuild.exe no specs wmiprvse.exe no specs filecoauth.exe no specs sihclient.exe slui.exe no specs svchost.exe no specs uhssvc.exe no specs svchost.exe no specs svchost.exe no specs upfc.exe no specs ctfmon.exe no specs svchost.exe no specs runtimebroker.exe no specs svchost.exe no specs musnotificationux.exe no specs svchost.exe no specs svchost.exe no specs useroobebroker.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs startmenuexperiencehost.exe no specs svchost.exe no specs svchost.exe no specs backgroundtaskhost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs spoolsv.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs searchapp.exe no specs svchost.exe no specs svchost.exe no specs backgroundtaskhost.exe no specs dashost.exe no specs runtimebroker.exe no specs svchost.exe no specs svchost.exe no specs officeclicktorun.exe svchost.exe no specs svchost.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs firefox.exe no specs svchost.exe svchost.exe no specs svchost.exe no specs systemsettings.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs svchost.exe no specs runtimebroker.exe no specs svchost.exe no specs taskhostw.exe no specs svchost.exe no specs musnotification.exe no specs svchost.exe no specs svchost.exe no specs sihost.exe no specs runtimebroker.exe no specs svchost.exe no specs mousocoreworker.exe no specs default-browser-agent.exe no specs firefox.exe no specs taskhostw.exe no specs dllhost.exe no specs svchost.exe no specs runtimebroker.exe no specs audiodg.exe no specs dllhost.exe no specs svchost.exe no specs svchost.exe no specs sppsvc.exe no specs svchost.exe svchost.exe no specs textinputhost.exe no specs dllhost.exe no specs applicationframehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
468C:\WINDOWS\system32\svchost.exe -k DcomLaunch -p -s LSMC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\lsm.dll
c:\windows\system32\msvcrt.dll
648"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe"C:\Program Files\Microsoft Update Health Tools\uhssvc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Update Health Service
Version:
10.0.19041.3626 (WinBuild.160101.0800)
Modules
Images
c:\program files\microsoft update health tools\uhssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
860C:\WINDOWS\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvcC:\Windows\System32\svchost.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
884C:\WINDOWS\system32\svchost.exe -k DcomLaunch -pC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\umpnpmgr.dll
c:\windows\system32\msvcrt.dll
896C:\WINDOWS\System32\Upfc.exe /launchtype periodic /cv K+8SRldlyk69wp5/P2MGNA.0C:\Windows\System32\upfc.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Updateability From SCM
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\netprofm.dll
c:\windows\system32\npmproxy.dll
956"ctfmon.exe"C:\Windows\System32\ctfmon.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
CTF Loader
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msctfmonitor.dll
c:\windows\system32\msctf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
996C:\WINDOWS\system32\svchost.exe -k RPCSS -pC:\Windows\System32\svchost.exe—services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcepmap.dll
c:\windows\system32\wldp.dll
1036C:\Windows\System32\RuntimeBroker.exe -EmbeddingC:\Windows\System32\RuntimeBroker.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Runtime Broker
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\runtimebroker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\powrprof.dll
1044C:\WINDOWS\system32\svchost.exe -k netsvcs -p -s gpsvcC:\Windows\System32\svchost.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
1132%systemroot%\system32\MusNotificationUx.exe ClearActiveNotificationsC:\Windows\System32\MusNotificationUx.exe—MusNotification.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MusNotificationUx.exe
Exit code:
0
Version:
10.0.19041.3693 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\usoapi.dll
c:\windows\system32\onecorecommonproxystub.dll
c:\windows\system32\onecoreuapcommonproxystub.dll
Total events
29 018
Read events
28 371
Write events
417
Delete events
230

Modification events

(PID) Process:(2104) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Wake To Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(2104) svchost.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\WaaS\WaaSMedic\TaskStore
Operation:writeName:Schedule Maintenance Work
Value:
Microsoft\Windows\UpdateOrchestrator
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator
Operation:writeName:SD
Value:
0100049C5C000000680000000000000014000000020048000300000000001400FF011F0001010000000000051200000000001400A900120001010000000000051300000000001800A900120001020000000000052000000020020000010100000000000512000000010100000000000512000000
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work
Operation:writeName:Index
Value:
3
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:writeName:Hash
Value:
96724EB84434FB60228EE94896FCF50424BD9CE90A3AAB1D32DE6D3441D3F3E8
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:writeName:Schema
Value:
65538
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:delete valueName:Version
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:delete valueName:Date
Value:
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:writeName:SecurityDescriptor
Value:
D:P(A;;FA;;;SY)(A;;FRFX;;;LS)(A;;FRFX;;;BA)
(PID) Process:(1260) svchost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks\{A0BAB1E0-8FAF-482E-B71A-58DFBB3B502F}
Operation:delete valueName:Source
Value:
Executable files
1
Suspicious files
64
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
1772svchost.exeC:\Windows\Prefetch\SVCHOST.EXE-6C525542.pfbinary
MD5:96CB4BF8630B6810050A8814E902DD9B
SHA256:999BA77862A79155E6E4CB6EC076E074B18FD147911F24BFEFC3886308A3445D
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Workxml
MD5:C6086D02F8CE044F5FA07A98303DC7EB
SHA256:8901D9C9AEA465DA4EA7AA874610A90B8CF0A71EBA0E321CF9675FCEEE0B54A0
5776firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.binbinary
MD5:1C3C58F7838DDE7F753614D170F110FC
SHA256:81C14432135B2A50DC505904E87781864CA561EFEF9E94BAECA3704D04E6DB3D
6456sppsvc.exeC:\Windows\System32\spp\store\2.0\data.dat.tmpbinary
MD5:523C7C923CE18E2492DA471051B4E6F5
SHA256:954750635CE8CE6DFF00B71DC0992D7C321F985B3AEF0B53011C6FA9E81ED691
5776firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Background Tasks Profiles\93u99co2.MozillaBackgroundTask-308046B0AF4A39CB-defaultagent\datareporting\glean\db\data.safe.tmpbinary
MD5:1C3C58F7838DDE7F753614D170F110FC
SHA256:81C14432135B2A50DC505904E87781864CA561EFEF9E94BAECA3704D04E6DB3D
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskNetworkxml
MD5:18E755C987BFC19E9243E2297F9E5973
SHA256:28A47DB050051049E35249EA57B389E3946003173806D02064ADFCC5F46E0880
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTaskLogonxml
MD5:8CBC84881481158749FD559D1D305C46
SHA256:F4902BEF1E82CDAB34A23A43A7F15C0D1C0A0B86E5DD187CACB75E3DF4024153
1260svchost.exeC:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Workxml
MD5:4838EE953DAB2C7A1BF57E0C6620A79D
SHA256:22C798E00C4793749EAC39CFB6EA3DD75112FD4453A3706E839038A64504D45D
2104svchost.exeC:\Windows\Logs\waasmediccapsule\WaasRemediation.002.etlbinary
MD5:D5C3C6FF92AB9DC318CD2CEA16B05D13
SHA256:AD2AC123C272119801B396032898A17A9C6E0ADF6DE2DE218794E31723136DD2
1772svchost.exeC:\Windows\Prefetch\HOST.EXE-F5D74C61.pfbinary
MD5:F682BAD1CC180B1FB39C1C51CE6D16F5
SHA256:70745F5417D9C96400EB54E35ECA1DB442A0FE8AF08A1C843FA0C8E12F605950
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
22
DNS requests
16
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
2.18.161.157:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7908
SIHClient.exe
GET
200
2.18.161.157:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7620
MSBuild.exe
39.46.104.231:6903
hsolic.duckdns.org
Pakistan Telecommunication Company Limited
PK
malicious
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.18.161.157
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.67
  • 40.126.32.138
  • 40.126.32.76
  • 40.126.32.74
  • 20.190.160.66
  • 20.190.160.128
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
hsolic.duckdns.org
  • 39.46.104.231
malicious
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
7620
MSBuild.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
7620
MSBuild.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
7620
MSBuild.exe
Malware Command and Control Activity Detected
ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
7620
MSBuild.exe
Malware Command and Control Activity Detected
BACKDOOR [ANY.RUN] njRAT Bladabindi CnC Communication command ll
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
C57991E4269B688783BC55D013358972.exe