File name:

36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe

Full analysis: https://app.any.run/tasks/4943f00e-ed5a-4204-9d10-dd4b7c0b7f58
Verdict: Malicious activity
Threats:

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Malware Trends Tracker     >>>
Analysis date: March 03, 2025, 02:24:36
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
delphi
dbatloader
loader
remote
xworm
netreactor
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

6F1EAD21AA70A3E69CD5C69595FC7916

SHA1:

5FEACB3A236A1E2A981540ACA03FC6AB16D2AA76

SHA256:

36F19CCDFA20772EBEB1C2A89E0EDD174465F5AC697323B4AB05C2A46EC1A1A7

SSDEEP:

49152:B28B1RuRISXmT1sD/F2UoAIsw5/5w5/5w5/5w5/S/o/5/o/5/o/5/o/muUwhEycS:96AJbU8lWlWlWlKslslslsUwuycH8qg9

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DBATLOADER has been detected (YARA)

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 7972)
      • alpha.pif (PID: 8128)

    • Starts PowerShell from an unusual location

      • alpha.pif (PID: 8128)

    • XWORM has been detected (YARA)

      • ktfomwzY.pif (PID: 4180)

    • XWORM has been detected (SURICATA)

      • ktfomwzY.pif (PID: 4180)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)

    • Drops a file with a rarely used extension (PIF)

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • extrac32.exe (PID: 7808)
      • extrac32.exe (PID: 8104)
      • extrac32.exe (PID: 8044)
      • extrac32.exe (PID: 8080)

    • Executable content was dropped or overwritten

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • extrac32.exe (PID: 7808)
      • extrac32.exe (PID: 8080)
      • extrac32.exe (PID: 8104)
      • extrac32.exe (PID: 8044)

    • Likely accesses (executes) a file from the Public directory

      • cmd.exe (PID: 7660)
      • cmd.exe (PID: 7744)
      • extrac32.exe (PID: 7808)
      • ndpha.pif (PID: 7848)
      • cmd.exe (PID: 7972)
      • extrac32.exe (PID: 8044)
      • extrac32.exe (PID: 8080)
      • extrac32.exe (PID: 8104)
      • aken.pif (PID: 8144)
      • alpha.pif (PID: 8128)
      • ktfomwzY.pif (PID: 4180)

    • Reads security settings of Internet Explorer

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • ndpha.pif (PID: 7848)
      • aken.pif (PID: 8144)

    • Process drops legitimate windows executable

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • extrac32.exe (PID: 7808)
      • extrac32.exe (PID: 8044)
      • extrac32.exe (PID: 8104)
      • extrac32.exe (PID: 8080)

    • Executing commands from ".cmd" file

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • svchost.pif (PID: 7944)

    • Starts CMD.EXE for commands execution

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • svchost.pif (PID: 7944)

    • Rename legitimate system utilities

      • cmd.exe (PID: 7744)
      • cmd.exe (PID: 7972)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7744)
      • ndpha.pif (PID: 7848)
      • cmd.exe (PID: 7972)
      • alpha.pif (PID: 8128)
      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)

    • Starts a Microsoft application from unusual location

      • ndpha.pif (PID: 7848)
      • alpha.pif (PID: 8128)
      • aken.pif (PID: 8144)

    • Starts itself from another location

      • cmd.exe (PID: 7972)

    • Connects to unusual port

      • ktfomwzY.pif (PID: 4180)

    • Checks Windows Trust Settings

      • aken.pif (PID: 8144)

    • Contacting a server suspected of hosting an CnC

      • ktfomwzY.pif (PID: 4180)

  • INFO

    • Compiled with Borland Delphi (YARA)

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)

    • Checks supported languages

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • extrac32.exe (PID: 7808)
      • ndpha.pif (PID: 7848)
      • svchost.pif (PID: 7944)
      • extrac32.exe (PID: 8044)
      • extrac32.exe (PID: 8080)
      • extrac32.exe (PID: 8104)
      • alpha.pif (PID: 8128)
      • aken.pif (PID: 8144)
      • ktfomwzY.pif (PID: 4180)

    • Reads the computer name

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • extrac32.exe (PID: 7808)
      • ndpha.pif (PID: 7848)
      • extrac32.exe (PID: 8080)
      • extrac32.exe (PID: 8104)
      • extrac32.exe (PID: 8044)
      • aken.pif (PID: 8144)
      • ktfomwzY.pif (PID: 4180)

    • Checks proxy server information

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • slui.exe (PID: 6572)

    • The sample compiled with english language support

      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • extrac32.exe (PID: 7808)
      • extrac32.exe (PID: 8080)
      • extrac32.exe (PID: 8044)
      • extrac32.exe (PID: 8104)

    • Process checks computer location settings

      • ndpha.pif (PID: 7848)

    • Process checks Powershell version

      • aken.pif (PID: 8144)

    • Reads the machine GUID from the registry

      • aken.pif (PID: 8144)
      • 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe (PID: 7368)
      • ktfomwzY.pif (PID: 4180)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • aken.pif (PID: 8144)

    • Script raised an exception (POWERSHELL)

      • aken.pif (PID: 8144)

    • .NET Reactor protector has been detected

      • ktfomwzY.pif (PID: 4180)

    • Reads the software policy settings

      • aken.pif (PID: 8144)
      • slui.exe (PID: 6572)

    • Create files in a temporary directory

      • aken.pif (PID: 8144)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(4180) ktfomwzY.pif
C223.94.126.41:8888
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexjJ8yoJzLryDQI8pN
No Malware configuration.

TRiD

.scr | Windows screen saver (43.2)
.dll | Win32 Dynamic Link Library (generic) (21.7)
.exe | Win32 Executable (generic) (14.8)
.exe | Win16/32 Executable Delphi generic (6.8)
.exe | Generic Win/DOS Executable (6.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 471040
InitializedDataSize: 1412608
UninitializedDataSize: -
EntryPoint: 0x747c8
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
18
Malicious processes
8
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #DBATLOADER 36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs extrac32.exe ndpha.pif no specs svchost.pif no specs svchost.pif cmd.exe no specs conhost.exe no specs extrac32.exe extrac32.exe extrac32.exe alpha.pif no specs aken.pif no specs #XWORM ktfomwzy.pif slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
4180C:\Users\Public\Libraries\ktfomwzY.pifC:\Users\Public\Libraries\ktfomwzY.pif
36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe
User:
admin
Company:
David Harris
Integrity Level:
MEDIUM
Description:
Mercury/32 Loader Module v4.62
Version:
4.62
Modules
Images
c:\users\public\libraries\ktfomwzy.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
XWorm
(PID) Process(4180) ktfomwzY.pif
C223.94.126.41:8888
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexjJ8yoJzLryDQI8pN
6572C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7368"C:\Users\admin\Desktop\36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe" C:\Users\admin\Desktop\36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7660C:\WINDOWS\system32\cmd.exe /c ""C:\Users\Public\YzwmoftkF.cmd" "C:\Windows\SysWOW64\cmd.exe—36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7668\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7744C:\WINDOWS\system32\cmd.exe /c C:\Users\Public\Libraries\\Yzwmoftk99.cmdC:\Windows\SysWOW64\cmd.exe—36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7808extrac32 /C /Y C:\\Windows\\System32\\rundll32.exe C:\\Users\\Public\\ndpha.pif C:\Windows\SysWOW64\extrac32.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® CAB File Extract Utility
Exit code:
0
Version:
5.00 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\extrac32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7848C:\\Users\\Public\\ndpha.pif zipfldr.dll,RouteTheCall C:\Windows \SysWOW64\svchost.pif C:\Users\Public\ndpha.pif—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\public\ndpha.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7884"C:\Windows \SysWOW64\svchost.pif" C:\Windows \SysWOW64\svchost.pif—ndpha.pif
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Exchange ActiveSync Invoker
Exit code:
3221226540
Version:
10.0.22621.1 (WinBuild.160101.0800)
Modules
Images
c:\windows \syswow64\svchost.pif
c:\windows\system32\ntdll.dll
Total events
10 166
Read events
10 165
Write events
1
Delete events
0

Modification events

(PID) Process:(7848) ndpha.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
7
Suspicious files
1
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
8080extrac32.exeC:\Users\Public\Upha.pifexecutable
MD5:3FB5CF71F7E7EB49790CB0E663434D80
SHA256:41F067C3A11B02FE39947F9EBA68AE5C7CB5BD1872A6009A4CD1506554A9ABA9
8144aken.pifC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jnxnat05.3qt.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
736836f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exeC:\Windows \SysWOW64\svchost.pifexecutable
MD5:869640D0A3F838694AB4DFEA9E2F544D
SHA256:0DB4D3FFDB96D13CF3B427AF8BE66D985728C55AE254E4B67D287797E4C0B323
8144aken.pifC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ccke40zz.cti.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
736836f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exeC:\Users\Public\YzwmoftkF.cmdtext
MD5:616F542F94791979D27798E12FE9374B
SHA256:D3C9DDAA8DEBFA28BFDFF1DFC8C5BA4E11E39C7D9029EAD83C874FCFC8325DDB
736836f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exeC:\Users\Public\Libraries\Yzwmoftk99.cmdtext
MD5:D202469089FA5EC9032F44408562F842
SHA256:9C330F29B95689D3AB2F7A461479CD87869464CC03E53B0D8FF5727BAA8DA979
736836f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exeC:\Users\Public\Libraries\NEO.cmdtext
MD5:D9B276C49813262BA64F91B640235BA9
SHA256:67BB0E1739291769728FE9E8A77F6E8F5CF506CCF617D55A3349B0A7542D49A5
736836f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exeC:\Windows \SysWOW64\NETUTILS.dllexecutable
MD5:1E2A3532537D01C1BE8597C87D8918C3
SHA256:FCBEA11F75B132FC4A6746F80F62DA0064C61092CFCD15CC12879BB95DA5048A
8044extrac32.exeC:\Users\Public\alpha.pifexecutable
MD5:CB6CD09F6A25744A8FA6E4B3E4D260C5
SHA256:265B69033CEA7A9F8214A34CD9B17912909AF46C7A47395DD7BB893A24507E59
8104extrac32.exeC:\Users\Public\aken.pifexecutable
MD5:2E5A8590CF6848968FC23DE3FA1E25F1
SHA256:9785001B0DCF755EDDB8AF294A373C0B87B2498660F724E76C4D53F9C217C7A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
19
DNS requests
4
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
POST
500
20.83.72.98:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
—
—
POST
500
40.91.76.224:443
https://activation-v2.sls.microsoft.com/SLActivateProduct/SLActivateProduct.asmx?configextension=Retail
unknown
xml
512 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4208
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4180
ktfomwzY.pif
23.94.126.41:8888
—
AS-COLOCROSSING
US
malicious
7280
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6572
slui.exe
40.91.76.224:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
google.com
  • 216.58.206.78
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
4180
ktfomwzY.pif
Malware Command and Control Activity Detected
REMOTE [ANY.RUN] Xworm TCP Packet
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
36f19ccdfa20772ebeb1c2a89e0edd174465f5ac697323b4ab05c2a46ec1a1a7.exe