File name:

New Compressed (zipped) Folder.zip

Full analysis: https://app.any.run/tasks/3cfd800d-83a1-4f36-9a3d-1d36c04d4080
Verdict: Malicious activity
Threats:

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Malware Trends Tracker     >>>
Analysis date: May 21, 2025, 21:08:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-scr
delphi
dbatloader
loader
rat
remcos
remote
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

00FB2ECFE6608AA171009871F8940F6C

SHA1:

2C86EF46F170B51C58349CEA9EC296B2BBECA10D

SHA256:

AF78B1E7DC57A457FDB850112E5FDDD1F9C6DCC8A6F726A22B1FDA805C83F3F8

SSDEEP:

49152:xqj5fpYOAdSYdTmHJivhILYdgu5fKoNOo2p2zFv+HhoC5zysEbMdNQiEFLxaApHg:gjx9MZ4ESWKeq2F+BoC5ZyQNQNFdacJq

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 4400)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7912)

    • DBATLOADER has been detected (YARA)

      • INVOICE.exe (PID: 5892)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 6752)

    • REMCOS has been detected (SURICATA)

      • colorcpl.exe (PID: 7868)
      • SndVol.exe (PID: 2088)
      • SndVol.exe (PID: 6264)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 7736)
      • WinRAR.exe (PID: 4400)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7736)
      • WinRAR.exe (PID: 4400)
      • Agreementdocument.exe (PID: 4040)
      • INVOICE.exe (PID: 5892)

    • There is functionality for taking screenshot (YARA)

      • Agreementdocument.exe (PID: 4040)
      • INVOICE.exe (PID: 5892)
      • Cxsdjmfb.PIF (PID: 7916)
      • Cxsdjmfb.PIF (PID: 2268)

    • Starts CMD.EXE for commands execution

      • Agreementdocument.exe (PID: 4040)
      • INVOICE.exe (PID: 5892)

    • Created directory related to system

      • alpha.pif (PID: 7464)

    • Executing commands from ".cmd" file

      • INVOICE.exe (PID: 5892)

    • Executable content was dropped or overwritten

      • esentutl.exe (PID: 7636)
      • INVOICE.exe (PID: 5892)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7500)

    • Likely accesses (executes) a file from the Public directory

      • esentutl.exe (PID: 7636)
      • alpha.pif (PID: 7496)
      • alpha.pif (PID: 7464)

    • Drops a file with a rarely used extension (PIF)

      • esentutl.exe (PID: 7636)

    • Starts itself from another location

      • cmd.exe (PID: 7356)

    • Starts application with an unusual extension

      • cmd.exe (PID: 7356)
      • rundll32.exe (PID: 7940)
      • rundll32.exe (PID: 1228)
      • rundll32.exe (PID: 6028)
      • rundll32.exe (PID: 7452)

    • Connects to unusual port

      • colorcpl.exe (PID: 7868)
      • SndVol.exe (PID: 2088)
      • SndVol.exe (PID: 6264)

    • Executes application which crashes

      • colorcpl.exe (PID: 7868)
      • SndVol.exe (PID: 6264)

    • The process executes via Task Scheduler

      • rundll32.exe (PID: 7940)
      • rundll32.exe (PID: 6028)
      • rundll32.exe (PID: 1228)
      • rundll32.exe (PID: 7452)

    • Starts a Microsoft application from unusual location

      • alpha.pif (PID: 7464)
      • alpha.pif (PID: 7496)

    • Contacting a server suspected of hosting an CnC

      • colorcpl.exe (PID: 7868)
      • SndVol.exe (PID: 2088)
      • SndVol.exe (PID: 6264)

    • Starts POWERSHELL.EXE for commands execution

      • Agreementdocument.exe (PID: 4040)

    • Start notepad (likely ransomware note)

      • Agreementdocument.exe (PID: 4040)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7804)
      • WinRAR.exe (PID: 4400)

    • Manual execution by a user

      • powershell.exe (PID: 7912)
      • Agreementdocument.exe (PID: 3100)
      • INVOICE.exe (PID: 5892)
      • Agreementdocument.exe (PID: 4040)

    • Checks supported languages

      • Agreementdocument.exe (PID: 4040)
      • INVOICE.exe (PID: 5892)
      • alpha.pif (PID: 7496)
      • alpha.pif (PID: 7464)

    • Reads the computer name

      • Agreementdocument.exe (PID: 4040)
      • INVOICE.exe (PID: 5892)

    • Process checks computer location settings

      • Agreementdocument.exe (PID: 4040)

    • Checks proxy server information

      • INVOICE.exe (PID: 5892)

    • Reads the software policy settings

      • slui.exe (PID: 7316)

    • Creates files in the program directory

      • INVOICE.exe (PID: 5892)

    • The sample compiled with english language support

      • esentutl.exe (PID: 7636)

    • Compiled with Borland Delphi (YARA)

      • INVOICE.exe (PID: 5892)
      • Cxsdjmfb.PIF (PID: 7916)
      • Cxsdjmfb.PIF (PID: 2268)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 7444)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2025:05:21 16:53:20
ZipCRC: 0x02074246
ZipCompressedSize: 1120372
ZipUncompressedSize: 1120372
ZipFileName: INVOICE-5-11-2025.tar.lz.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
214
Monitored processes
79
Malicious processes
10
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe winrar.exe no specs winrar.exe powershell.exe no specs conhost.exe no specs agreementdocument.exe no specs agreementdocument.exe #DBATLOADER invoice.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs esentutl.exe slui.exe alpha.pif no specs alpha.pif no specs taskmgr.exe no specs control.exe no specs explorer.exe no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs COpenControlPanel no specs #REMCOS colorcpl.exe svchost.exe cscript.exe no specs conhost.exe no specs rundll32.exe no specs cxsdjmfb.pif no specs werfault.exe no specs control.exe no specs #REMCOS sndvol.exe COpenControlPanel no specs notepad.exe no specs powershell.exe no specs conhost.exe no specs wscript.exe no specs rundll32.exe no specs cxsdjmfb.pif no specs colorcpl.exe no specs wscript.exe no specs werfault.exe no specs powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs notepad.exe no specs cmd.exe no specs conhost.exe no specs calc.exe no specs openwith.exe no specs schtasks.exe no specs conhost.exe no specs rundll32.exe no specs cxsdjmfb.pif no specs cmd.exe no specs conhost.exe no specs #REMCOS sndvol.exe powershell.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs certutil.exe no specs conhost.exe no specs control.exe no specs explorer.exe no specs calc.exe no specs openwith.exe no specs COpenControlPanel no specs taskmgr.exe no specs powershell.exe no specs conhost.exe no specs rundll32.exe no specs cxsdjmfb.pif no specs

Process information

PID
CMD
Path
Indicators
Parent process
300\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
668"C:\Windows\System32\cmd.exe" C:\Windows\SysWOW64\cmd.exe—Agreementdocument.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
684C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7868 -s 1456C:\Windows\SysWOW64\WerFault.exe—colorcpl.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1052"C:\Windows\System32\notepad.exe" C:\Windows\SysWOW64\notepad.exe—Agreementdocument.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
1228C:\WINDOWS\system32\rundll32.exe "C:\WINDOWS\system32\ieframe.dll",OpenURL C:\\ProgramData\\Cxsdjmfb.urlC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1328"C:\Windows\System32\control.exe" C:\Windows\SysWOW64\control.exe—Agreementdocument.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Control Panel
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\control.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
1452C:\WINDOWS\system32\OpenWith.exe -EmbeddingC:\Windows\System32\OpenWith.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Pick an app
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\openwith.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1676"C:\Windows\System32\notepad.exe" C:\Windows\SysWOW64\notepad.exe—Agreementdocument.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\gdi32.dll
2040schtasks /create /sc minute /mo 1 /tn "Cxsdjmfb" /tr C:\\ProgramData\\Cxsdjmfb.url"C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2088C:\Windows\System32\SndVol.exeC:\Windows\SysWOW64\SndVol.exe
Cxsdjmfb.PIF
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Volume Mixer
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\sndvol.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\gdi32.dll
c:\windows\syswow64\win32u.dll
Total events
57 510
Read events
57 360
Write events
146
Delete events
4

Modification events

(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\New Compressed (zipped) Folder.zip
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4400) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7736) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7736) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
4
Suspicious files
29
Text files
23
Unknown types
0

Dropped files

PID
Process
Filename
Type
4040Agreementdocument.exe\Device\Harddisk0\DR0 —
MD5:—
SHA256:—
4400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4400.383\VMwareCloak.ps1text
MD5:B50760A1D69D9B30BD6FE30E66ED6FB0
SHA256:16ED46300B3D4C56F96D7E26D610A5294E3C26ECF8DC3F27D0B5BD0725B15929
7912powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_jjvokzlg.yg4.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
4400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa4400.630\Coran2.exeexecutable
MD5:7515A456AA66EC1FE09AEBF6E68B4C84
SHA256:80AE2ECE773FB57B57B2AC90D3A429D26EEC5B21A0D27EFAE9EF6BD314F7E456
7736WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7736.984\INVOICE-5-11-2025.tar.lzcompressed
MD5:3384D28D716B50BC39E3EB11E6632D94
SHA256:B5E045856D711A4F3965A77FB3E46234BC5E9745323A3A31CFDDEC85773948C3
4400WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa4400.784\INVOICE-5-11-2025.tar.lz.zipcompressed
MD5:D1652EAA3569B566104E34FE4D0B63FF
SHA256:660B25FBB09AA30F644783D14110759C8DAC66254CDE0068E282830DE53C14E7
7912powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YVHJWCRTGC31EQ3FFU37.tempbinary
MD5:5C41CC17812226009462B79FC3C83D37
SHA256:0D6012A0C6DEA014DFE72263F13D3097A71AC1D5223B58A48F38D91BD134F922
7912powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1106d3.TMPbinary
MD5:D040F64E9E7A2BB91ABCA5613424598E
SHA256:D04E0A6940609BD6F3B561B0F6027F5CA4E8C5CF0FB0D0874B380A0374A8D670
684WerFault.exeC:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_colorcpl.exe_b69e27ab5d6baa5decac1422331ef9a8217_ddba1c1d_f7e7e143-6a0c-47e6-af59-33916c0eb54a\Report.wer —
MD5:—
SHA256:—
7912powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:897245C4A8D24C7A4D89AE26DA4C1579
SHA256:9CCCAFC0D7D45C2DEE1340EA53191D9D91706745D858AF38CE87B2B6885350C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
30
DNS requests
20
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8144
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6264
SndVol.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
2088
SndVol.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
7868
colorcpl.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
google.com
  • 216.58.206.78
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.4
  • 20.190.160.65
  • 40.126.32.136
  • 20.190.160.66
  • 40.126.32.76
  • 40.126.32.138
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
7868
colorcpl.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7868
colorcpl.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6264
SndVol.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6264
SndVol.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2088
SndVol.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
2088
SndVol.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
New Compressed (zipped) Folder.zip