File name:

1 (1251)

Full analysis: https://app.any.run/tasks/d74da91c-436b-45fd-8be5-6eb2117846f9
Verdict: Malicious activity
Threats:

njRAT is a remote access trojan. It is one of the most widely accessible RATs on the market that features an abundance of educational information. Interested attackers can even find tutorials on YouTube. This allows it to become one of the most popular RATs in the world.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 10:27:49
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pastebin
rat
njrat
bladabindi
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

AF36F2A7D31412B76E66276BD8A54390

SHA1:

A1F96F86169783B1B196B66787287679FE31C45A

SHA256:

E61610581A1B4BDAA94B70076840318862FE4BCF9E7FE3D85CB4A83AE4F43E48

SSDEEP:

3072:34ZzIMiUl8kBsetynVKVRiis1p55bevNbp+16eXRxkGH9t/SGINYK130XTzM7UTo:oZzILEstVKVAisTIbhufO130XTA7mGF

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • NJRAT mutex has been found

      • 1 (1251).exe (PID: 6244)
      • RasMediaManager32.exe (PID: 6132)
      • RasMediaManager32.exe (PID: 7508)

    • Starts CMD.EXE for self-deleting

      • 1 (1251).exe (PID: 6244)

    • Uses Task Scheduler to run other applications

      • RasMediaManager32.exe (PID: 6132)

    • Changes the autorun value in the registry

      • 1 (1251).exe (PID: 6244)
      • RasMediaManager32.exe (PID: 6132)

    • NJRAT has been detected (YARA)

      • RasMediaManager32.exe (PID: 6132)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • 1 (1251).exe (PID: 6244)
      • RasMediaManager32.exe (PID: 6132)

    • Starts itself from another location

      • 1 (1251).exe (PID: 6244)

    • Reads the date of Windows installation

      • 1 (1251).exe (PID: 6244)
      • RasMediaManager32.exe (PID: 6132)

    • Executable content was dropped or overwritten

      • 1 (1251).exe (PID: 6244)

    • Starts CMD.EXE for commands execution

      • 1 (1251).exe (PID: 6244)

    • Uses TIMEOUT.EXE to delay execution

      • cmd.exe (PID: 4208)

    • Requests information from PasteBin

      • RasMediaManager32.exe (PID: 6132)

    • The process checks if it is being run in the virtual environment

      • RasMediaManager32.exe (PID: 6132)

    • Connects to unusual port

      • RasMediaManager32.exe (PID: 6132)

    • The process executes via Task Scheduler

      • RasMediaManager32.exe (PID: 7508)

    • Potential Corporate Privacy Violation

      • RasMediaManager32.exe (PID: 6132)

  • INFO

    • Checks supported languages

      • 1 (1251).exe (PID: 6244)
      • RasMediaManager32.exe (PID: 6132)
      • InstallUtil.exe (PID: 7844)

    • Process checks computer location settings

      • 1 (1251).exe (PID: 6244)
      • RasMediaManager32.exe (PID: 6132)

    • Reads the machine GUID from the registry

      • 1 (1251).exe (PID: 6244)
      • InstallUtil.exe (PID: 7844)
      • RasMediaManager32.exe (PID: 6132)
      • RasMediaManager32.exe (PID: 7508)

    • Reads the computer name

      • 1 (1251).exe (PID: 6244)
      • RasMediaManager32.exe (PID: 6132)
      • InstallUtil.exe (PID: 7844)
      • RasMediaManager32.exe (PID: 7508)

    • Creates files or folders in the user directory

      • 1 (1251).exe (PID: 6244)
      • BackgroundTransferHost.exe (PID: 7256)
      • RasMediaManager32.exe (PID: 6132)

    • Checks proxy server information

      • RasMediaManager32.exe (PID: 6132)
      • BackgroundTransferHost.exe (PID: 7256)

    • Reads the software policy settings

      • RasMediaManager32.exe (PID: 6132)
      • BackgroundTransferHost.exe (PID: 7256)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8032)
      • BackgroundTransferHost.exe (PID: 7180)
      • BackgroundTransferHost.exe (PID: 3008)
      • BackgroundTransferHost.exe (PID: 1276)
      • BackgroundTransferHost.exe (PID: 7256)

    • Disables trace logs

      • RasMediaManager32.exe (PID: 6132)

    • Reads Environment values

      • RasMediaManager32.exe (PID: 6132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

NjRat

(PID) Process(6132) RasMediaManager32.exe
C2213.183.58.4
Ports5558
Botnetadmin
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2
Splitter|'|'|
Versionnull
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (82.9)
.dll | Win32 Dynamic Link Library (generic) (7.4)
.exe | Win32 Executable (generic) (5.1)
.exe | Generic Win/DOS Executable (2.2)
.exe | DOS Executable Generic (2.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:10:25 22:06:11+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32
LinkerVersion: 48
CodeSize: 219648
InitializedDataSize: 2560
UninitializedDataSize: -
EntryPoint: 0x379ba
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.8.0
ProductVersionNumber: 1.0.8.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: TypeScript Keyboard Sync
CompanyName: TypeScript Keyboard Sync
FileDescription: TypeScript Keyboard Sync
FileVersion: 1.0.8.0
InternalName: TypeScript Keyboard Sync.exe
LegalCopyright: Copyright © TypeScript Keyboard Sync 2017
LegalTrademarks: -
OriginalFileName: TypeScript Keyboard Sync.exe
ProductName: TypeScript Keyboard Sync
ProductVersion: 1.0.8.0
AssemblyVersion: 1.0.8.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
157
Monitored processes
20
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #NJRAT 1 (1251).exe #NJRAT rasmediamanager32.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs timeout.exe no specs sppextcomobj.exe no specs slui.exe schtasks.exe no specs conhost.exe no specs installutil.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs #NJRAT rasmediamanager32.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1276"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
2320\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3008"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4120"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4208"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\admin\AppData\Local\Temp\1 (1251).exe" && del "C:\Users\admin\AppData\Local\Temp\1 (1251).exe.config"C:\Windows\System32\cmd.exe—1 (1251).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5124C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5260C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5608timeout /t 5 C:\Windows\System32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
timeout - pauses command processing
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\timeout.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
6132"C:\Users\admin\AppData\Local\_foldernamelocalappdata_\RasMediaManager32.exe" C:\Users\admin\AppData\Local\_foldernamelocalappdata_\RasMediaManager32.exe
1 (1251).exe
User:
admin
Company:
TypeScript Keyboard Sync
Integrity Level:
MEDIUM
Description:
TypeScript Keyboard Sync
Version:
1.0.8.0
Modules
Images
c:\users\admin\appdata\local\_foldernamelocalappdata_\rasmediamanager32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
NjRat
(PID) Process(6132) RasMediaManager32.exe
C2213.183.58.4
Ports5558
Botnetadmin
Options
Auto-run registry keySoftware\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2
Splitter|'|'|
Versionnull
Total events
6 848
Read events
6 749
Write events
93
Delete events
6

Modification events

(PID) Process:(6244) 1 (1251).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:writeName:*RasMediaManager32
Value:
C:\Users\admin\AppData\Local\Temp\1 (1251).exe
(PID) Process:(6244) 1 (1251).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:RasMediaManager32
Value:
C:\Users\admin\AppData\Local\Temp\1 (1251).exe
(PID) Process:(6132) RasMediaManager32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:OneDrive
Value:
"C:\Users\admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe" /background
(PID) Process:(6132) RasMediaManager32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:MicrosoftEdgeAutoLaunch_29EBC4579851B72EE312C449CF839B1A
Value:
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
(PID) Process:(6132) RasMediaManager32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Skype for Desktop
Value:
C:\Program Files (x86)\Microsoft\Skype for Desktop\Skype.exe
(PID) Process:(6132) RasMediaManager32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:CCleaner Smart Cleaning
Value:
"C:\Program Files\CCleaner\CCleaner64.exe" /MONITOR
(PID) Process:(6132) RasMediaManager32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:RasMediaManager32
Value:
C:\Users\admin\AppData\Local\Temp\1 (1251).exe
(PID) Process:(6132) RasMediaManager32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Operation:delete valueName:*RasMediaManager32
Value:
C:\Users\admin\AppData\Local\Temp\1 (1251).exe
(PID) Process:(6132) RasMediaManager32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RasMediaManager32_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(6132) RasMediaManager32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RasMediaManager32_RASAPI32
Operation:writeName:EnableAutoFileTracing
Value:
0
Executable files
1
Suspicious files
5
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
7256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5b7c7f8c-139f-4415-a572-1d21103cdc6b.down_data —
MD5:—
SHA256:—
62441 (1251).exeC:\Users\admin\AppData\Local\_foldernamelocalappdata_\RasMediaManager32.exe.configxml
MD5:DD3D04C365984B4EC57A80503F81FDDF
SHA256:40A59CA9744DC3D4647F246B2DC553F37F8095418C1B48A9BD94CDB5C03DBC5C
7256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:57268E320FB445736905AAFE50DD25B4
SHA256:FC3B31BD083872ED81DF6353A1C2A9E4316A1575A5CEEC4A8C83DE83C36CAD00
7256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\af2f6fcc-5edc-4574-88ea-9b038dc117cd.61ae9c02-4b4d-41f9-97c6-152f0cde91eb.down_metabinary
MD5:B8C06FB27FE17311FCB53B1852A021C6
SHA256:275D8D041C48E41D9314718B8D544BA41D79CE19FECFA196BA170F5788A58EBB
7256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
7256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\af2f6fcc-5edc-4574-88ea-9b038dc117cd.up_meta_securebinary
MD5:9B834C28E7C00D545FC4F950DD29C04E
SHA256:23155294D75072A8F96FDE21ABE929CB219629A7C8F665DCF3DD1AB1BE351703
62441 (1251).exeC:\Users\admin\AppData\Local\_foldernamelocalappdata_\RasMediaManager32.exeexecutable
MD5:AF36F2A7D31412B76E66276BD8A54390
SHA256:E61610581A1B4BDAA94B70076840318862FE4BCF9E7FE3D85CB4A83AE4F43E48
7256BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\5b7c7f8c-139f-4415-a572-1d21103cdc6b.61ae9c02-4b4d-41f9-97c6-152f0cde91eb.down_metabinary
MD5:B8C06FB27FE17311FCB53B1852A021C6
SHA256:275D8D041C48E41D9314718B8D544BA41D79CE19FECFA196BA170F5788A58EBB
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
37
DNS requests
20
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6132
RasMediaManager32.exe
GET
301
172.67.19.24:80
http://pastebin.com/raw/XMKKNkb0
unknown
—
—
whitelisted
3676
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7256
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
3676
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6132
RasMediaManager32.exe
GET
301
23.186.113.60:80
http://paste.ee/r/Jcre9
unknown
—
—
shared
1532
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
1616
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
3216
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
6132
RasMediaManager32.exe
172.67.19.24:80
pastebin.com
CLOUDFLARENET
US
whitelisted
6132
RasMediaManager32.exe
172.67.19.24:443
pastebin.com
CLOUDFLARENET
US
whitelisted
3812
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
google.com
  • 142.250.181.238
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 20.190.160.4
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.134
  • 20.190.160.130
  • 20.190.160.132
  • 20.190.160.64
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
pastebin.com
  • 172.67.19.24
  • 104.20.3.235
  • 104.20.4.235
whitelisted
paste.ee
  • 23.186.113.60
shared
arc.msn.com
  • 20.223.35.26
whitelisted
www.bing.com
  • 92.123.104.37
  • 92.123.104.33
  • 92.123.104.38
  • 92.123.104.31
  • 92.123.104.43
  • 92.123.104.36
  • 92.123.104.35
  • 92.123.104.34
  • 92.123.104.32
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Not Suspicious Traffic
INFO [ANY.RUN] Online Pastebin Text Storage
2196
svchost.exe
Misc activity
ET INFO Pastebin-like Service Domain in DNS Lookup (paste .ee)
6132
RasMediaManager32.exe
Potential Corporate Privacy Violation
ET INFO Pastebin-style Service (paste .ee) in TLS SNI
6132
RasMediaManager32.exe
Potential Corporate Privacy Violation
ET INFO Pastebin-style Service (paste .ee) in TLS SNI
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (1251)