File name:

CPY_O2025MAY19.cmd

Full analysis: https://app.any.run/tasks/acd10a5c-d55f-4a7d-9f17-2d7ac7b87eb9
Verdict: Malicious activity
Threats:

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Malware Trends Tracker     >>>
Analysis date: May 19, 2025, 11:24:06
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remcos
rat
remote
stealer
delphi
dbatloader
loader
mpress
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 text, with very long lines (1182), with CRLF line terminators
MD5:

34B7162A4AB35B3D276CD71D019D9D5D

SHA1:

63B59D3B9F50264B9B0A944F75C986389A3B8A78

SHA256:

D3AE64CF51C8FE8B26DC8E85E0C8602361F05FE9B56062073C565F9D9405B0C6

SSDEEP:

49152:FafXzCBEPOFHnVrpaXrA4WrYke3qwV1yV6NtLTqk87lTsn5hoKjZ31+PD+cP0AMG:H

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2140)

    • DBATLOADER has been detected (YARA)

      • chrome.PIF (PID: 7852)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3888)

    • REMCOS has been detected

      • colorcpl.exe (PID: 6728)
      • colorcpl.exe (PID: 6728)

    • REMCOS has been detected (SURICATA)

      • colorcpl.exe (PID: 6728)

    • REMCOS mutex has been found

      • colorcpl.exe (PID: 6728)

    • Actions looks like stealing of personal data

      • colorcpl.exe (PID: 7324)
      • colorcpl.exe (PID: 7332)

    • Steals credentials from Web Browsers

      • colorcpl.exe (PID: 7332)

    • REMCOS has been detected (YARA)

      • colorcpl.exe (PID: 6728)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • extrac32.exe (PID: 7260)
      • expha.pif (PID: 7292)
      • expha.pif (PID: 7316)
      • expha.pif (PID: 7340)
      • ghf.pif (PID: 7424)
      • esentutl.exe (PID: 5968)
      • chrome.PIF (PID: 7852)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 2320)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 2320)

    • Drops a file with a rarely used extension (PIF)

      • extrac32.exe (PID: 7260)
      • expha.pif (PID: 7292)
      • expha.pif (PID: 7316)
      • expha.pif (PID: 7340)
      • ghf.pif (PID: 7424)
      • esentutl.exe (PID: 5968)
      • chrome.PIF (PID: 7852)

    • Process drops legitimate windows executable

      • extrac32.exe (PID: 7260)
      • expha.pif (PID: 7292)
      • expha.pif (PID: 7316)

    • Process drops legitimate windows executable (CertUtil.exe)

      • expha.pif (PID: 7340)

    • Starts itself from another location

      • cmd.exe (PID: 2320)
      • cmd.exe (PID: 8084)

    • Starts application with an unusual extension

      • cmd.exe (PID: 2320)
      • alpha.pif (PID: 7364)
      • rdha.pif (PID: 7816)
      • alpha.pif (PID: 7408)
      • cmd.exe (PID: 8084)

    • Runs PING.EXE to delay simulation

      • alpha.pif (PID: 7528)
      • cmd.exe (PID: 8100)

    • Reads security settings of Internet Explorer

      • rdha.pif (PID: 7816)
      • chrome.PIF (PID: 7852)

    • Application launched itself

      • cmd.exe (PID: 2320)
      • colorcpl.exe (PID: 6728)

    • Reads the date of Windows installation

      • rdha.pif (PID: 7816)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2320)
      • chrome.PIF (PID: 7852)

    • Likely accesses (executes) a file from the Public directory

      • esentutl.exe (PID: 5968)
      • alpha.pif (PID: 6800)
      • alpha.pif (PID: 5936)

    • Starts a Microsoft application from unusual location

      • alpha.pif (PID: 6800)
      • alpha.pif (PID: 5936)

    • Executing commands from ".cmd" file

      • chrome.PIF (PID: 7852)

    • There is functionality for taking screenshot (YARA)

      • chrome.PIF (PID: 7852)
      • colorcpl.exe (PID: 6728)

    • Created directory related to system

      • alpha.pif (PID: 6800)

    • Contacting a server suspected of hosting an CnC

      • colorcpl.exe (PID: 6728)

    • Connects to unusual port

      • colorcpl.exe (PID: 6728)

  • INFO

    • Creates files in the program directory

      • extrac32.exe (PID: 7260)
      • expha.pif (PID: 7292)
      • expha.pif (PID: 7316)
      • expha.pif (PID: 7340)
      • ghf.pif (PID: 7380)
      • ghf.pif (PID: 7424)
      • chrome.PIF (PID: 7852)
      • colorcpl.exe (PID: 6728)

    • Checks supported languages

      • expha.pif (PID: 7292)
      • extrac32.exe (PID: 7260)
      • expha.pif (PID: 7316)
      • alpha.pif (PID: 7364)
      • expha.pif (PID: 7340)
      • ghf.pif (PID: 7380)
      • alpha.pif (PID: 7408)
      • alpha.pif (PID: 7528)
      • rdha.pif (PID: 7816)
      • chrome.PIF (PID: 7852)
      • ghf.pif (PID: 7424)
      • alpha.pif (PID: 6800)
      • alpha.pif (PID: 5936)

    • Reads the computer name

      • extrac32.exe (PID: 7260)
      • ghf.pif (PID: 7380)
      • rdha.pif (PID: 7816)
      • ghf.pif (PID: 7424)
      • chrome.PIF (PID: 7852)

    • The sample compiled with english language support

      • expha.pif (PID: 7292)
      • extrac32.exe (PID: 7260)
      • expha.pif (PID: 7316)
      • expha.pif (PID: 7340)
      • esentutl.exe (PID: 5968)

    • Process checks computer location settings

      • rdha.pif (PID: 7816)

    • Checks proxy server information

      • chrome.PIF (PID: 7852)
      • colorcpl.exe (PID: 6728)

    • Compiled with Borland Delphi (YARA)

      • chrome.PIF (PID: 7852)

    • Reads the machine GUID from the registry

      • chrome.PIF (PID: 7852)

    • Creates files or folders in the user directory

      • colorcpl.exe (PID: 6728)

    • Create files in a temporary directory

      • colorcpl.exe (PID: 7336)
      • colorcpl.exe (PID: 7324)
      • colorcpl.exe (PID: 7332)

    • Reads security settings of Internet Explorer

      • colorcpl.exe (PID: 6728)

    • Mpress packer has been detected

      • colorcpl.exe (PID: 6728)

    • Reads the software policy settings

      • slui.exe (PID: 7476)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(6728) colorcpl.exe
C2 (2)may2025.duckdns.org:2065
activedns4rat.duckdns.org:2065
BotnetYak M19
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_filedate.exe
Startup_valueDateandTime
Hide_fileFalse
Mutex_nameRmc-39EKIW
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirCalender
Keylog_dirremcos
Max_keylog_file100000
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
35
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cmd.exe no specs conhost.exe no specs powershell.exe no specs extrac32.exe expha.pif expha.pif expha.pif alpha.pif no specs ghf.pif no specs alpha.pif no specs ghf.pif sppextcomobj.exe no specs slui.exe alpha.pif no specs ping.exe no specs rdha.pif no specs #DBATLOADER chrome.pif cmd.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs esentutl.exe alpha.pif no specs alpha.pif no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs #REMCOS colorcpl.exe svchost.exe colorcpl.exe colorcpl.exe colorcpl.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140PowerShell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -CommandC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
4294770688
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2320C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\CPY_O2025MAY19.cmd" "C:\Windows\System32\cmd.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3888C:\WINDOWS\system32\cmd.exe /c C:\\ProgramData\\168.cmdC:\Windows\SysWOW64\cmd.exe—chrome.PIF
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4776\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4844ping 127.0.0.1 -n 10 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
5936C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64" C:\Users\Public\alpha.pif—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\public\alpha.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5968C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o C:\Windows\SysWOW64\esentutl.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extensible Storage Engine Utilities for Microsoft(R) Windows(R)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\esentutl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\esent.dll
6728C:\Windows\System32\colorcpl.exeC:\Windows\SysWOW64\colorcpl.exe
chrome.PIF
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Color Control Panel
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\colorcpl.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\colorui.dll
Remcos
(PID) Process(6728) colorcpl.exe
C2 (2)may2025.duckdns.org:2065
activedns4rat.duckdns.org:2065
BotnetYak M19
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_filedate.exe
Startup_valueDateandTime
Hide_fileFalse
Mutex_nameRmc-39EKIW
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirCalender
Keylog_dirremcos
Max_keylog_file100000
Total events
6 476
Read events
6 470
Write events
6
Delete events
0

Modification events

(PID) Process:(7816) rdha.pifKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(6728) colorcpl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-39EKIW
Operation:writeName:exepath
Value:
99402A8C38BFF1D7BE3D5EC19A7AC826537B051A59ED21E39550AD1DE85B584DEAA1D3A9E3D4B02FBDB3856027CA60A4A1E45F71A4B4F9477F0D2C66E777BA73444B
(PID) Process:(6728) colorcpl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-39EKIW
Operation:writeName:licence
Value:
2C11CF1EF824789E295D4E701417DEFE
(PID) Process:(6728) colorcpl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6728) colorcpl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6728) colorcpl.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
Executable files
7
Suspicious files
4
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
7332colorcpl.exeC:\Users\admin\AppData\Local\Temp\bhv3F58.tmp —
MD5:—
SHA256:—
2140powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_rdlgfiot.t15.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
2140powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:43736F075565473ADE9FF521F3276532
SHA256:47A3EABD7EDF915D4D8DEED186DDDC2BA5B0DD8573E73B94D8FBEA70FEB7627E
7260extrac32.exeC:\ProgramData\expha.pifexecutable
MD5:41330D97BF17D07CD4308264F3032547
SHA256:A224559FD6621066347A5BA8F4AEECEEA8A0A7A881A71BD36DE69ACEB52E9DF7
7852chrome.PIFC:\ProgramData\1728.cmdtext
MD5:1DF650CCA01129127D30063634AB5C03
SHA256:EDD4094E7A82A6FF8BE65D6B075E9513BD15A6B74F8032B5C10CE18F7191FA60
7316expha.pifC:\ProgramData\rdha.pifexecutable
MD5:100F56A73211E0B2BCD076A55E6393FD
SHA256:00BE065F405E93233CC2F0012DEFDCBB1D6817B58969D5FFD9FD72FC4783C6F4
5968esentutl.exeC:\Users\Public\alpha.pifexecutable
MD5:D3348AC2130C7E754754A6E9CB053B09
SHA256:E9EF013238495BFFCE7459E059BFFE340A0F08B439EC94E7D4436F4E13714ECD
7852chrome.PIFC:\ProgramData\17730.cmdtext
MD5:9A020804EBA1FFAC2928D7C795144BBF
SHA256:A86C6C7A2BF9E12C45275A5E7EBEBD5E6D2BA302FE0A12600B7C9FDF283D9E63
7852chrome.PIFC:\Users\admin\Links\Ahkdvekf.PIFexecutable
MD5:6148468F47AB1472E63B2ACD8933C943
SHA256:219F7EFC54F32554C573B5C689D3B408FC1217A030C58C0AF7760BA0EDB269CE
7852chrome.PIFC:\ProgramData\Ahkdvekf.urlbinary
MD5:DC42A55CD94B9CE88EB8D4A35E0993B0
SHA256:53C437D7738D0D662FD47245D594AFFB9D16C33EA251B4DAD52CFB8A6D45DEAF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
25
DNS requests
18
Threats
6

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.241.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1804
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1804
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6728
colorcpl.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.241.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2112
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 2.16.241.19
  • 2.16.241.12
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.2
  • 40.126.31.3
  • 40.126.31.131
  • 40.126.31.67
  • 20.190.159.23
  • 20.190.159.128
  • 40.126.31.69
  • 20.190.159.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
may2025.duckdns.org
  • 209.54.102.162
unknown

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2196
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
6728
colorcpl.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6728
colorcpl.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6728
colorcpl.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6728
colorcpl.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CPY_O2025MAY19.cmd