I check the connections with Sysinternal ProcessExplorer on a system in an active directory environment.
@matt the fully connection looks like:
TCP, 192.168.42.1:55928 --> Domain Controller 192.168.1.1:135 and
TCP, 192.168.42.1:55929 --> Domain Controller 192.168.1.1:49158
and restic makes this connections exactly during backup is running. So the lower ports used on the domain controller and not on the local machine.
@cdhowie good to know, I found similar information, this makes sense because I use restic in an environment where an active directory is running. But why does the domain controller to know, that I will run an restic backup? If I run restic on many servers does this have any negative side effects?
@fd0 Do you have an idea how stop all remote connection in restic?
BTW: I found many http urls embedded to restic, may this part of the GO standard library or some libs but there many urls which are not related to any restic possible backup destination. Does anyone checked this?
Regarding my motivation of this questions: I entrust my data to restic and I want to make sure that the data does not somehow flow off or disappear due to a faulty operation on my side. 
Restic is exact what I’m looking for since years for my Windows Backups. Good job. 