File name:

Payment_details_HSBC7412529828654.exe

Full analysis: https://app.any.run/tasks/e60245e2-bf56-440b-b8e9-a33a39cc3026
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 10, 2025, 11:39:57
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remcos
rat
netreactor
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows, 3 sections
MD5:

6CEBC7622DC1C098FF31B53F024E3AD8

SHA1:

6FB358A0D33F51A5FDE463649A2D334C96225E56

SHA256:

1630E8B9995D554A7B791DFA929F77C659C48E0358008FB7EB66FE54D63D86B3

SSDEEP:

49152:YsZ17+BWpLkqTDZ2U6RqQ8aZ9ktXwvDSLrmxq+LknBeocHnhQ3l7:Yy+BuZGZeXYDSKbL8AoMhQ3

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • java.exe (PID: 5260)

    • REMCOS mutex has been found

      • Payment_details_HSBC7412529828654.exe (PID: 6040)
      • java.exe (PID: 4944)

    • Changes the autorun value in the registry

      • Payment_details_HSBC7412529828654.exe (PID: 6040)
      • java.exe (PID: 4944)

    • Deletes a file (SCRIPT)

      • wscript.exe (PID: 5380)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • wscript.exe (PID: 5380)

    • REMCOS has been detected

      • java.exe (PID: 4944)
      • java.exe (PID: 4944)

    • REMCOS has been detected (YARA)

      • java.exe (PID: 4944)

    • REMCOS has been detected (SURICATA)

      • java.exe (PID: 4944)

  • SUSPICIOUS

    • Application launched itself

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • java.exe (PID: 5260)

    • Executable content was dropped or overwritten

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • Payment_details_HSBC7412529828654.exe (PID: 6040)

    • Reads security settings of Internet Explorer

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • Payment_details_HSBC7412529828654.exe (PID: 6040)
      • java.exe (PID: 5260)

    • The process executes VB scripts

      • Payment_details_HSBC7412529828654.exe (PID: 6040)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 5380)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 5380)

    • Gets full path of the running script (SCRIPT)

      • wscript.exe (PID: 5380)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 5380)

    • Contacting a server suspected of hosting an CnC

      • java.exe (PID: 4944)

    • Connects to unusual port

      • java.exe (PID: 4944)

    • There is functionality for taking screenshot (YARA)

      • java.exe (PID: 4944)

  • INFO

    • Reads the computer name

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • Payment_details_HSBC7412529828654.exe (PID: 6040)
      • java.exe (PID: 5260)
      • java.exe (PID: 4944)

    • Creates files or folders in the user directory

      • Payment_details_HSBC7412529828654.exe (PID: 4608)

    • Checks supported languages

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • Payment_details_HSBC7412529828654.exe (PID: 6040)
      • java.exe (PID: 5260)
      • java.exe (PID: 4944)

    • Create files in a temporary directory

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • Payment_details_HSBC7412529828654.exe (PID: 6040)
      • java.exe (PID: 5260)

    • .NET Reactor protector has been detected

      • Payment_details_HSBC7412529828654.exe (PID: 4608)

    • Reads the machine GUID from the registry

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • java.exe (PID: 5260)
      • java.exe (PID: 4944)

    • Process checks computer location settings

      • Payment_details_HSBC7412529828654.exe (PID: 4608)
      • Payment_details_HSBC7412529828654.exe (PID: 6040)
      • java.exe (PID: 5260)

    • Creates files in the program directory

      • Payment_details_HSBC7412529828654.exe (PID: 6040)
      • java.exe (PID: 4944)

    • Checks proxy server information

      • slui.exe (PID: 1628)

    • Reads the software policy settings

      • slui.exe (PID: 1628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(4944) java.exe
C2 (1)154.39.0.198:2404
BotnetRClient001
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_filejava.exe
Startup_valuejavaruntime
Hide_fileTrue
Mutex_nameRmc-YUSJR4
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogTrue
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotTrue
Screenshot_namenotepad,browser,chrome,edge,firefox,
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirjava-runtime
Keylog_dirremcos
Max_keylog_file100000
No Malware configuration.

TRiD

.exe | Generic CIL Executable (.NET, Mono, etc.) (63.1)
.exe | Win64 Executable (generic) (23.8)
.dll | Win32 Dynamic Link Library (generic) (5.6)
.exe | Win32 Executable (generic) (3.8)
.exe | Generic Win/DOS Executable (1.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:04:09 01:42:00+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 48
CodeSize: 1022976
InitializedDataSize: 101888
UninitializedDataSize: -
EntryPoint: 0xfbb8e
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: -
CompanyName: Microsoft
FileDescription: BindingSourceAddingNew
FileVersion: 1.0.0.0
InternalName: BdVf.exe
LegalCopyright: Copyright © Microsoft 2015
LegalTrademarks: -
OriginalFileName: BdVf.exe
ProductName: BindingSourceAddingNew
ProductVersion: 1.0.0.0
AssemblyVersion: 1.0.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
136
Monitored processes
12
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start payment_details_hsbc7412529828654.exe schtasks.exe no specs conhost.exe no specs #REMCOS payment_details_hsbc7412529828654.exe wscript.exe no specs cmd.exe no specs conhost.exe no specs java.exe no specs schtasks.exe no specs conhost.exe no specs #REMCOS java.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1328"C:\Windows\System32\cmd.exe" /c "C:\ProgramData\java-runtime\java.exe"C:\Windows\SysWOW64\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
1628C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2268\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4608"C:\Users\admin\Desktop\Payment_details_HSBC7412529828654.exe" C:\Users\admin\Desktop\Payment_details_HSBC7412529828654.exe
explorer.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
BindingSourceAddingNew
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\payment_details_hsbc7412529828654.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4920"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gYhPNwCWigZEK" /XML "C:\Users\admin\AppData\Local\Temp\tmp1BB3.tmp"C:\Windows\SysWOW64\schtasks.exe—Payment_details_HSBC7412529828654.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
4944"C:\ProgramData\java-runtime\java.exe"C:\ProgramData\java-runtime\java.exe
java.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
BindingSourceAddingNew
Version:
1.0.0.0
Modules
Images
c:\programdata\java-runtime\java.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Remcos
(PID) Process(4944) java.exe
C2 (1)154.39.0.198:2404
BotnetRClient001
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Setup_path%LOCALAPPDATA%
Copy_filejava.exe
Startup_valuejavaruntime
Hide_fileTrue
Mutex_nameRmc-YUSJR4
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogTrue
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotTrue
Screenshot_namenotepad,browser,chrome,edge,firefox,
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirjava-runtime
Keylog_dirremcos
Max_keylog_file100000
5200\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5260C:\ProgramData\java-runtime\java.exeC:\ProgramData\java-runtime\java.exe—cmd.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
BindingSourceAddingNew
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\programdata\java-runtime\java.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
5380"C:\WINDOWS\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\install.vbs" C:\Windows\SysWOW64\wscript.exe—Payment_details_HSBC7412529828654.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\syswow64\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6040"C:\Users\admin\Desktop\Payment_details_HSBC7412529828654.exe"C:\Users\admin\Desktop\Payment_details_HSBC7412529828654.exe
Payment_details_HSBC7412529828654.exe
User:
admin
Company:
Microsoft
Integrity Level:
MEDIUM
Description:
BindingSourceAddingNew
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\payment_details_hsbc7412529828654.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
6 580
Read events
6 573
Write events
7
Delete events
0

Modification events

(PID) Process:(6040) Payment_details_HSBC7412529828654.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:javaruntime
Value:
"C:\ProgramData\java-runtime\java.exe"
(PID) Process:(6040) Payment_details_HSBC7412529828654.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:javaruntime
Value:
"C:\ProgramData\java-runtime\java.exe"
(PID) Process:(6040) Payment_details_HSBC7412529828654.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids
Operation:writeName:VBSFile
Value:
(PID) Process:(4944) java.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:javaruntime
Value:
"C:\ProgramData\java-runtime\java.exe"
(PID) Process:(4944) java.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:javaruntime
Value:
"C:\ProgramData\java-runtime\java.exe"
(PID) Process:(4944) java.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YUSJR4
Operation:writeName:exepath
Value:
C221E53C2C0070807867D3FA09554F88E58C5C1FAF9976566165537083E9E39548FFBD4913881BE3AD215C15462B28C4AD5BA7FBFA401EB193A1E677A6808506AE8AD3C337F4BF47BE4E
(PID) Process:(4944) java.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-YUSJR4
Operation:writeName:licence
Value:
7ADA0BDFC9DD341D1787EB19B588E107
Executable files
2
Suspicious files
2
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
4608Payment_details_HSBC7412529828654.exeC:\Users\admin\AppData\Roaming\gYhPNwCWigZEK.exeexecutable
MD5:6CEBC7622DC1C098FF31B53F024E3AD8
SHA256:1630E8B9995D554A7B791DFA929F77C659C48E0358008FB7EB66FE54D63D86B3
4944java.exeC:\ProgramData\remcos\logs.datbinary
MD5:07C58E8C617B4A7AABE7170DF7815B48
SHA256:1BABE2DE559C9424147ADDDEFA44B3BDD7980AD9A53A7FF19D98A8FB6AB9ED95
5260java.exeC:\Users\admin\AppData\Local\Temp\tmp6176.tmpxml
MD5:581BDD135F03D960E4FE778A0DFC6BE4
SHA256:89185FA488071F5B4822652936D1D8CC4AD94D97D02A0679F2536B357A663495
6040Payment_details_HSBC7412529828654.exeC:\Users\admin\AppData\Local\Temp\install.vbsbinary
MD5:76B8485D86144C83E1DA3BCFE4CAA2C4
SHA256:9E9BB949D81D96433A366DC063961A1122C78DD6A0E66F0D9E8E892071626674
4608Payment_details_HSBC7412529828654.exeC:\Users\admin\AppData\Local\Temp\tmp1BB3.tmpxml
MD5:581BDD135F03D960E4FE778A0DFC6BE4
SHA256:89185FA488071F5B4822652936D1D8CC4AD94D97D02A0679F2536B357A663495
6040Payment_details_HSBC7412529828654.exeC:\ProgramData\java-runtime\java.exeexecutable
MD5:6CEBC7622DC1C098FF31B53F024E3AD8
SHA256:1630E8B9995D554A7B791DFA929F77C659C48E0358008FB7EB66FE54D63D86B3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
127
DNS requests
16
Threats
156

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6708
RUXIMICS.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
304
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
—
—
GET
200
52.149.20.212:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
unknown
—
—
—
4464
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4464
SIHClient.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
4464
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4464
SIHClient.exe
GET
200
23.216.77.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
—
—
GET
200
20.3.187.198:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
unknown
—
—
—
4464
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
4464
SIHClient.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6708
RUXIMICS.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
—
—
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6708
RUXIMICS.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2112
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.67
  • 20.190.160.128
  • 20.190.160.2
  • 20.190.160.22
  • 40.126.32.140
  • 40.126.32.136
  • 40.126.32.133
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
google.com
  • 172.217.16.206
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.20
  • 23.216.77.42
  • 23.216.77.22
  • 23.216.77.30
  • 23.216.77.36
whitelisted
slscr.update.microsoft.com
  • 52.149.20.212
whitelisted
www.microsoft.com
  • 2.23.181.156
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
activation-v2.sls.microsoft.com
  • 20.83.72.98
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted

Threats

PID
Process
Class
Message
4944
java.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4944
java.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4944
java.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4944
java.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4944
java.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4944
java.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4944
java.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
4944
java.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4944
java.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
4944
java.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Payment_details_HSBC7412529828654.exe