File name:

1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded

Full analysis: https://app.any.run/tasks/189550df-6ee1-43b4-9c7e-635de82b724a
Verdict: Malicious activity
Threats:

DBatLoader is a loader malware used for distributing payloads of different types, including WarzoneRAT and Formbook. It is employed in multi-stage attacks that usually start with a phishing email carrying a malicious attachment.

Malware Trends Tracker     >>>
Analysis date: April 18, 2025, 05:06:10
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
delphi
dbatloader
loader
crypto-regex
netreactor
xworm
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 9 sections
MD5:

DF7FFCFE26EDCC3903178CDAC8057DFF

SHA1:

2BFD00A3B870C5586C0E4013E38E10BD0E38380E

SHA256:

D81E8904BD7FE99CB71DCA45476EDD03B67F687C057C338FC8177784F151B34B

SSDEEP:

49152:Ak4oXHn42Bg9J9mKvnq22VjKy4iHO1rXayJ/n0pbCBJgqEtK7yfPgr4kFbAfPyCe:Yc4177vn9rXDMp+gGaw73ZurSX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • DBATLOADER has been detected (YARA)

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 8156)

    • XWORM has been detected (YARA)

      • hbdvuxjB.pif (PID: 4112)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)

    • Executing commands from ".cmd" file

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)

    • Reads security settings of Internet Explorer

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)
      • Bjxuvdbh.PIF (PID: 4988)
      • Bjxuvdbh.PIF (PID: 7376)

    • Starts CMD.EXE for commands execution

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7892)

    • Likely accesses (executes) a file from the Public directory

      • esentutl.exe (PID: 7992)
      • alpha.pif (PID: 8040)
      • alpha.pif (PID: 8060)

    • Drops a file with a rarely used extension (PIF)

      • esentutl.exe (PID: 7992)
      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)

    • Executable content was dropped or overwritten

      • esentutl.exe (PID: 7992)
      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)

    • Starts itself from another location

      • cmd.exe (PID: 7856)

    • Starts a Microsoft application from unusual location

      • alpha.pif (PID: 8040)
      • alpha.pif (PID: 8060)

    • Starts application with an unusual extension

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)
      • cmd.exe (PID: 7856)
      • rundll32.exe (PID: 680)
      • Bjxuvdbh.PIF (PID: 4988)
      • rundll32.exe (PID: 7356)
      • Bjxuvdbh.PIF (PID: 7376)

    • Created directory related to system

      • alpha.pif (PID: 8040)

    • Found regular expressions for crypto-addresses (YARA)

      • hbdvuxjB.pif (PID: 4112)

    • The process executes via Task Scheduler

      • rundll32.exe (PID: 680)
      • rundll32.exe (PID: 7356)

  • INFO

    • Checks proxy server information

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)
      • Bjxuvdbh.PIF (PID: 4988)
      • Bjxuvdbh.PIF (PID: 7376)

    • Creates files in the program directory

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)

    • Reads the computer name

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)
      • hbdvuxjB.pif (PID: 4112)
      • Bjxuvdbh.PIF (PID: 4988)
      • Bjxuvdbh.PIF (PID: 7376)
      • hbdvuxjB.pif (PID: 1052)
      • hbdvuxjB.pif (PID: 6476)

    • Compiled with Borland Delphi (YARA)

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)
      • Bjxuvdbh.PIF (PID: 4988)

    • Checks supported languages

      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)
      • alpha.pif (PID: 8060)
      • hbdvuxjB.pif (PID: 4112)
      • alpha.pif (PID: 8040)
      • Bjxuvdbh.PIF (PID: 4988)
      • Bjxuvdbh.PIF (PID: 7376)
      • hbdvuxjB.pif (PID: 6476)
      • hbdvuxjB.pif (PID: 1052)

    • The sample compiled with english language support

      • esentutl.exe (PID: 7992)
      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)

    • Reads the machine GUID from the registry

      • hbdvuxjB.pif (PID: 4112)
      • 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe (PID: 7328)
      • hbdvuxjB.pif (PID: 6476)
      • Bjxuvdbh.PIF (PID: 7376)
      • Bjxuvdbh.PIF (PID: 4988)
      • hbdvuxjB.pif (PID: 1052)

    • .NET Reactor protector has been detected

      • hbdvuxjB.pif (PID: 4112)

    • Reads security settings of Internet Explorer

      • rundll32.exe (PID: 680)
      • rundll32.exe (PID: 7356)

    • Reads the software policy settings

      • slui.exe (PID: 7412)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

XWorm

(PID) Process(4112) hbdvuxjB.pif
C2xwormdnslogs.ddns.net,xwormnewlog.duckdns.org,xwormnotcreated.duckdns.org,xwormuncreated.duckdns.org:3360
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexFqWb0jeYuIwbIsHV
No Malware configuration.

TRiD

.exe | Win32 Executable Borland Delphi 7 (95.6)
.scr | Windows screen saver (1.8)
.dll | Win32 Dynamic Link Library (generic) (0.9)
.exe | Win32 Executable (generic) (0.6)
.exe | Win16/32 Executable Delphi generic (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 1992:06:19 22:22:17+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 443904
InitializedDataSize: 1186816
UninitializedDataSize: -
EntryPoint: 0x6d818
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
23
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start #DBATLOADER 1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs ping.exe no specs esentutl.exe alpha.pif no specs alpha.pif no specs cmd.exe no specs conhost.exe no specs schtasks.exe no specs #XWORM hbdvuxjb.pif no specs svchost.exe rundll32.exe no specs bjxuvdbh.pif no specs hbdvuxjb.pif no specs slui.exe no specs rundll32.exe no specs bjxuvdbh.pif no specs hbdvuxjb.pif no specs

Process information

PID
CMD
Path
Indicators
Parent process
680C:\WINDOWS\system32\rundll32.exe "C:\WINDOWS\system32\ieframe.dll",OpenURL C:\\ProgramData\\Bjxuvdbh.urlC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1052C:\\Users\\admin\\Links\hbdvuxjB.pifC:\Users\admin\Links\hbdvuxjB.pif—Bjxuvdbh.PIF
User:
admin
Company:
David Harris
Integrity Level:
MEDIUM
Description:
Mercury/32 Loader Module v4.62
Exit code:
0
Version:
4.62
Modules
Images
c:\users\admin\links\hbdvuxjb.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4112C:\\Users\\admin\\Links\hbdvuxjB.pifC:\Users\admin\Links\hbdvuxjB.pif
1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe
User:
admin
Company:
David Harris
Integrity Level:
MEDIUM
Description:
Mercury/32 Loader Module v4.62
Version:
4.62
Modules
Images
c:\users\admin\links\hbdvuxjb.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
XWorm
(PID) Process(4112) hbdvuxjB.pif
C2xwormdnslogs.ddns.net,xwormnewlog.duckdns.org,xwormnotcreated.duckdns.org,xwormuncreated.duckdns.org:3360
Keys
AES<123456789>
Options
Splitter<Xwormmm>
Sleep time3
USB drop nameXWorm V5.6
MutexFqWb0jeYuIwbIsHV
4784schtasks /create /sc minute /mo 1 /tn "Bjxuvdbh" /tr C:\\ProgramData\\Bjxuvdbh.url"C:\Windows\SysWOW64\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4988"C:\Users\admin\Links\Bjxuvdbh.PIF" C:\Users\admin\Links\Bjxuvdbh.PIF—rundll32.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\links\bjxuvdbh.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
6004C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6476C:\\Users\\admin\\Links\hbdvuxjB.pifC:\Users\admin\Links\hbdvuxjB.pif—Bjxuvdbh.PIF
User:
admin
Company:
David Harris
Integrity Level:
MEDIUM
Description:
Mercury/32 Loader Module v4.62
Exit code:
0
Version:
4.62
Modules
Images
c:\users\admin\links\hbdvuxjb.pif
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ole32.dll
c:\windows\syswow64\ucrtbase.dll
7328"C:\Users\admin\AppData\Local\Temp\1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe" C:\Users\admin\AppData\Local\Temp\1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\oleaut32.dll
7356C:\WINDOWS\system32\rundll32.exe "C:\WINDOWS\system32\ieframe.dll",OpenURL C:\\ProgramData\\Bjxuvdbh.urlC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
Total events
4 501
Read events
4 499
Write events
2
Delete events
0

Modification events

(PID) Process:(680) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
(PID) Process:(7356) rundll32.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer
Operation:writeName:SlowContextMenuEntries
Value:
6024B221EA3A6910A2DC08002B30309D0A010000BD0E0C47735D584D9CEDE91E22E23282770100000114020000000000C0000000000000468D0000006078A409B011A54DAFA526D86198A780390100009AD298B2EDA6DE11BA8CA68E55D895936E000000
Executable files
3
Suspicious files
1
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7992esentutl.exeC:\Users\Public\alpha.pifexecutable
MD5:D3348AC2130C7E754754A6E9CB053B09
SHA256:E9EF013238495BFFCE7459E059BFFE340A0F08B439EC94E7D4436F4E13714ECD
73281744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exeC:\ProgramData\473.cmdtext
MD5:EDD6286391BE184C7878A89CA6B7E800
SHA256:F61B065C30F83FB66F099E1D5555EE555AC030B978A7E62F3AF7BEF2CDB9DFCD
73281744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exeC:\Users\admin\Links\Bjxuvdbh.PIFexecutable
MD5:DF7FFCFE26EDCC3903178CDAC8057DFF
SHA256:D81E8904BD7FE99CB71DCA45476EDD03B67F687C057C338FC8177784F151B34B
73281744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exeC:\ProgramData\Bjxuvdbh.urlbinary
MD5:85AA6A0BD78F269C5FB10AB9E68BC487
SHA256:49F38C416B583D6963CD3E15347975527319699717C888DA55F0FD465A2A9B06
73281744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exeC:\ProgramData\neo.cmdtext
MD5:5BAF253744AD26F35BA17DB6B80763E9
SHA256:9CBB41E6C4F8565A6D121B770FCF3F15A6891C8DF8BFBA6D0414B3AD3298BDBA
73281744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exeC:\ProgramData\1160.cmdtext
MD5:1DF650CCA01129127D30063634AB5C03
SHA256:EDD4094E7A82A6FF8BE65D6B075E9513BD15A6B74F8032B5C10CE18F7191FA60
73281744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exeC:\Users\admin\Links\hbdvuxjB.pifexecutable
MD5:C116D3604CEAFE7057D77FF27552C215
SHA256:7BCDC2E607ABC65EF93AFD009C3048970D9E8D1C2A18FC571562396B13EBB301
73281744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded.exeC:\ProgramData\500.cmdtext
MD5:9A020804EBA1FFAC2928D7C795144BBF
SHA256:A86C6C7A2BF9E12C45275A5E7EBEBD5E6D2BA302FE0A12600B7C9FDF283D9E63
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
19
DNS requests
15
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2140
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2140
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.4:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2140
SIHClient.exe
52.149.20.212:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2140
SIHClient.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.6
whitelisted
google.com
  • 142.250.185.142
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.4
  • 20.190.160.2
  • 20.190.160.20
  • 20.190.160.22
  • 40.126.32.140
  • 40.126.32.68
  • 40.126.32.76
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.246.101
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
xwormdnslogs.ddns.net
  • 0.0.0.0
malicious

Threats

PID
Process
Class
Message
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DNS Query to DynDNS Domain *.ddns .net
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1744952705432a34cd002a31b04e333172dc6923edb797be49bd0d9ca0d64fff0279e46f32383.dat-decoded