URL:

http://webdefence.global.blackspider.com/urlwrap/?q=AXicHcpLDoIwFADAxxH0EO4sVOI3IRoB4ydujCZuS0sKSenDtoJ4Bc_oCbyE0e1kejG8Aw9efQ-M6uikINY0pGKl4qidQUU4VhCuk3RHm0swDSd0Dkwy80S94qXOOSqsspL9X-FcbRe-L5BbIhGlyn_u3_kyf9RoXCSw1QqZGJQioiaL63Rk9nZ821yDrY6HnTxn7jhLTvyAbQEAn8iDL1bKNms&Z

Full analysis: https://app.any.run/tasks/4865aafd-d194-4004-ba65-3eb68d3897e9
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: December 13, 2023, 16:23:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
remote
keylogger
Indicators:
MD5:

8C8984D58116DD1A0E8D05EC738BAC5D

SHA1:

D190A4A8C83B50461313B25A9E18AB64131BCE33

SHA256:

427108751D56350CD3D578FFB4AAD6D6DDF4B05D149A5E72CCB27AC2EB648AC0

SSDEEP:

6:COcuCugjiERSwZRwN4EwEsTwqGsCh48XEOLAychpbjLNx2OAdMB:xDg3RSwZ84ENbtLBLAychpfLP2+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 3512)
      • cmd.exe (PID: 944)
      • cmd.exe (PID: 2904)
      • cmd.exe (PID: 2004)
      • cmd.exe (PID: 3828)

    • Remcos is detected

      • AppLaunch.exe (PID: 900)

    • REMCOS has been detected (YARA)

      • AppLaunch.exe (PID: 900)

    • REMCOS has been detected (SURICATA)

      • AppLaunch.exe (PID: 900)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 2968)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3224)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3364)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1952)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1828)

    • Writes files like Keylogger logs

      • AppLaunch.exe (PID: 900)

    • Connects to unusual port

      • AppLaunch.exe (PID: 900)

    • Reads the Internet Settings

      • AppLaunch.exe (PID: 900)

  • INFO

    • Application launched itself

      • iexplore.exe (PID: 2920)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3140)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 2968)
      • AppLaunch.exe (PID: 900)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3224)
      • AppLaunch.exe (PID: 1452)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3364)
      • AppLaunch.exe (PID: 3888)
      • AppLaunch.exe (PID: 3552)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1952)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1828)
      • AppLaunch.exe (PID: 2496)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3140)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 2968)
      • AppLaunch.exe (PID: 900)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3224)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3364)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1952)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1828)

    • The process uses the downloaded file

      • iexplore.exe (PID: 2920)
      • WinRAR.exe (PID: 3756)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3140)
      • explorer.exe (PID: 3716)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3364)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1828)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1952)

    • Reads the machine GUID from the registry

      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 2968)
      • AppLaunch.exe (PID: 900)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3224)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 3364)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1828)
      • Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe (PID: 1952)

    • Reads product name

      • AppLaunch.exe (PID: 900)

    • Reads Environment values

      • AppLaunch.exe (PID: 900)

    • Checks proxy server information

      • AppLaunch.exe (PID: 900)

    • Creates files in the program directory

      • AppLaunch.exe (PID: 900)

    • Creates files or folders in the user directory

      • AppLaunch.exe (PID: 900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(900) AppLaunch.exe
C2 (1)anhelo.con-ip.com:7770
BotnetRD
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-IP7X9Y
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
90
Monitored processes
35
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start iexplore.exe iexplore.exe wmpnscfg.exe no specs winrar.exe no specs docx 00e279a611a032499c91b7eda523b26728d92d7fb.exe no specs #REMCOS applaunch.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs docx 00e279a611a032499c91b7eda523b26728d92d7fb.exe no specs applaunch.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs explorer.exe no specs docx 00e279a611a032499c91b7eda523b26728d92d7fb.exe no specs cmd.exe no specs cmd.exe no specs applaunch.exe no specs cmd.exe no specs schtasks.exe no specs docx 00e279a611a032499c91b7eda523b26728d92d7fb.exe no specs cmd.exe no specs cmd.exe no specs applaunch.exe no specs cmd.exe no specs schtasks.exe no specs docx 00e279a611a032499c91b7eda523b26728d92d7fb.exe no specs applaunch.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
900"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
0
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Remcos
(PID) Process(900) AppLaunch.exe
C2 (1)anhelo.con-ip.com:7770
BotnetRD
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-IP7X9Y
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
944"cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\cmd.exe—Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1160"cmd" /c copy "C:\Users\admin\Documents\Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe" "C:\Users\admin\AppData\Roaming\AppData\AppData.exe"C:\Windows\System32\cmd.exe—Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1348"cmd" /c copy "C:\Users\admin\Documents\Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe" "C:\Users\admin\AppData\Roaming\AppData\AppData.exe"C:\Windows\System32\cmd.exe—Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1452"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe—Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET ClickOnce Launch Utility
Exit code:
2
Version:
4.8.3761.0 built by: NET48REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1828"C:\Users\admin\Documents\Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe" C:\Users\admin\Documents\Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe—explorer.exe
User:
admin
Company:
Mathias Svensson
Integrity Level:
MEDIUM
Description:
Multi Commander installation
Exit code:
4294967295
Version:
13.3.0.2969
Modules
Images
c:\users\admin\documents\docx 00e279a611a032499c91b7eda523b26728d92d7fb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1952"C:\Users\admin\Documents\Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe" C:\Users\admin\Documents\Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe—explorer.exe
User:
admin
Company:
Mathias Svensson
Integrity Level:
MEDIUM
Description:
Multi Commander installation
Exit code:
4294967295
Version:
13.3.0.2969
Modules
Images
c:\users\admin\documents\docx 00e279a611a032499c91b7eda523b26728d92d7fb.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2004"cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\cmd.exe—Docx 00E279A611A032499C91B7EDA523B26728D92D7FB.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2156schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppData\AppData.exe'" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
2184"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2920 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
20 557
Read events
20 433
Write events
122
Delete events
2

Modification events

(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPDaysSinceLastAutoMigration
Value:
0
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing
Operation:writeName:NTPLastLaunchHighDateTime
Value:
30847387
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30847437
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2920) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
0
Suspicious files
30
Text files
25
Unknown types
0

Dropped files

PID
Process
Filename
Type
2184iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\bootstrap[1].csstext
MD5:AB3117DE176756AE49FE66166F1DBE72
SHA256:0A879254A8059FFCA5F46C30DA040F603B9A08EC9CF769B923294DA9E6669943
2184iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\bootstrap-responsive[1].csstext
MD5:F9DEE47322D809A5B97EFB10FF9E45E7
SHA256:E738183A60E8CF19E763729B96C19D0CCEE30F225E75AD61B8648A3CC7BFA969
2920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2920iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EAF8AA29A62AB29E614331747385D816_F9E4DC0B9D5C777357D7DB8DEF51118Ader
MD5:461874FCA610F80FCC893D02540D1A60
SHA256:9976A5299257D66B30E7527B5425022E6B402E97E69C616954FA71FBECA2BDF5
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:93A7BC0743F220295CA1327EAF04508F
SHA256:6787829DAF01BEE799AAD070B0C089F0F31FB2BE6084C4FBB4F126CC92814B83
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[2].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2920iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\favicon[1].icoimage
MD5:DA597791BE3B6E732F0BC8B20E38EE62
SHA256:5B2C34B3C4E8DD898B664DBA6C3786E2FF9869EFF55D673AA48361F11325ED07
2184iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5IWPIAR9\Docx%2000E279A611A032499C91B7EDA523B26728D92D7FB[1].tarcompressed
MD5:3671F5C7ED3D82C2CEA3CA12EF7123AE
SHA256:9215FADA5E6ACD4C75704B6FD1EA2A15AEAD1E4982FF2C8FEE4894A333761B81
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2184iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_C7CF4FA7BCF717E50C9341D69112D7D7binary
MD5:7CE521158FA92DC841D1CF2FA9E8C561
SHA256:AB4139A56BFDB279264437E77139FBED19E80F2F4617D95A1EFF3F377EE7AFD2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
23
TCP/UDP connections
36
DNS requests
17
Threats
5

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2184
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/2020/notification_page_logo_145x35.png
unknown
image
4.24 Kb
unknown
2184
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/empty.js
unknown
—
—
unknown
2184
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/icons60/warning.png
unknown
image
5.02 Kb
unknown
2184
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/bootstrap/css/bootstrap.css
unknown
text
14.2 Kb
unknown
2920
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9c39c51ec95c49f5
unknown
compressed
4.66 Kb
unknown
2920
iexplore.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7bb6036743caffca
unknown
compressed
4.66 Kb
unknown
2920
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D
unknown
binary
313 b
unknown
2184
iexplore.exe
GET
200
85.115.52.220:80
http://www.mailcontrol.com/http-resources/notification-pages/icons60/success.png
unknown
image
6.40 Kb
unknown
2184
iexplore.exe
GET
303
85.115.58.180:80
http://webdefence.global.blackspider.com/urlwrap/?q=AXicHcrbDYIwFADQywg6hH8CFUUkIRpB4yOYaDTxt7QIaOnFUp8rOKMTuITR35PTCOFtG_BqGqDEg7i5WaurWdJCMJRaoTAZluCMo8mcXHd233HJAGhG1RPliBUyZSiwTAr6f7nWVe1bFkdWmxliJtKfWxc2TO8VKh1wvEmBlLcKHhCVhNWkoxZ17zzd2zMZth_ZNtGxF23YEm85nPgiXh_9aLU--KTreqTfA_gEBnwBpb07uQ&action=scan
unknown
—
—
unknown
2184
iexplore.exe
GET
403
85.115.58.180:80
http://webdefence.global.blackspider.com/urlwrap/?q=AXicHcxhTsIwHAXwcgQ9hB9Muv67retGQjQCRiGYYDTxa9d23aBbZ7tB8Aqe0RN4CcH36eXll3c1Rz8wQd_XE-TtiWZ1FPwhakVjpesG72wkXYuSh8XymR7egScZLZAwwn-57l42nZbOurZsxL-rh6EPU0KUkxgMjg0-txAZ54zVY9D-cqq74YIvKJCg5eh1kKQW4F2RcCNHyS1Xuqr2YbS1YTVvy54SWRYAko9c7MyuNaEJvJCWD701tS56QyiHOM1TxuAcAllGacIKyBlQyJMMWEpuCfXlvF_GfhXY5-MHPHVzfDJv5bDJF69y7Y71nZ4pd-ysE-pmHBs105qKpBIaK1UwnEKe4vK8YcnjTFTAEk4l2qvVZrubLl621ZSmWU45Q-h3NkF_aapvFA&action=scan
unknown
html
4.91 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2184
iexplore.exe
85.115.58.180:80
webdefence.global.blackspider.com
Forcepoint Cloud Ltd
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
2184
iexplore.exe
85.115.52.220:80
www.mailcontrol.com
Forcepoint Cloud Ltd
GB
unknown
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2920
iexplore.exe
2.19.96.128:443
www.bing.com
Akamai International B.V.
DE
unknown
2920
iexplore.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
2920
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
2184
iexplore.exe
172.217.23.97:443
doc-0g-2g-docs.googleusercontent.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
webdefence.global.blackspider.com
  • 85.115.58.180
whitelisted
www.mailcontrol.com
  • 85.115.52.220
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 2.19.96.128
  • 2.19.96.112
  • 2.19.96.104
  • 2.19.96.130
  • 2.19.96.129
  • 2.19.96.123
  • 2.19.96.90
  • 2.19.96.107
  • 2.19.96.121
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
doc-0g-2g-docs.googleusercontent.com
  • 172.217.23.97
shared
ocsp.pki.goog
  • 142.250.186.131
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

PID
Process
Class
Message
2184
iexplore.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
900
AppLaunch.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
900
AppLaunch.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
http://webdefence.global.blackspider.com/urlwrap/?q=AXicHcpLDoIwFADAxxH0EO4sVOI3IRoB4ydujCZuS0sKSenDtoJ4Bc_oCbyE0e1kejG8Aw9efQ-M6uikINY0pGKl4qidQUU4VhCuk3RHm0swDSd0Dkwy80S94qXOOSqsspL9X-FcbRe-L5BbIhGlyn_u3_kyf9RoXCSw1QqZGJQioiaL63Rk9nZ821yDrY6HnTxn7jhLTvyAbQEAn8iDL1bKNms&Z