File name:

AUDIENCIA PREPARATORIA PROCESO No. 2023- 02191.msg

Full analysis: https://app.any.run/tasks/c07885c9-b9c0-4386-b424-9c20ec086181
Verdict: Malicious activity
Threats:

A keylogger is a type of spyware that infects a system and has the ability to record every keystroke made on the device. This lets attackers collect personal information of victims, which may include their online banking credentials, as well as personal conversations. The most widespread vector of attack leading to a keylogger infection begins with a phishing email or link. Keylogging is also often present in remote access trojans as part of an extended set of malicious tools.

Malware Trends Tracker     >>>
Analysis date: November 21, 2023, 20:54:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
rat
remcos
remote
keylogger
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

4E288D9ACF3DD7707D854F47002F3F7F

SHA1:

5C9C58FEDC1A6DE34B99E934E09E5D9AEDD6C104

SHA256:

6232C12D40D609637159C4485632689D23EFF0EF26785B021055BB9A2B077455

SSDEEP:

1536:J4OLpfvDNRzHzD7rDk39/QuN4/ueuNrWQW+w3GPXWTtV0SWidjUB:J4OLpbuNmuNK2cXV

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses Task Scheduler to run other applications

      • cmd.exe (PID: 880)
      • cmd.exe (PID: 2324)
      • cmd.exe (PID: 3516)

    • REMCOS has been detected (SURICATA)

      • csc.exe (PID: 2996)

    • Starts Visual C# compiler

      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3268)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 1560)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3680)

    • Remcos is detected

      • csc.exe (PID: 2996)

    • REMCOS has been detected (YARA)

      • csc.exe (PID: 2996)

  • SUSPICIOUS

    • Starts CMD.EXE for commands execution

      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3268)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 1560)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3680)

    • Connects to unusual port

      • csc.exe (PID: 2996)

    • Reads the Internet Settings

      • csc.exe (PID: 2996)

    • Writes files like Keylogger logs

      • csc.exe (PID: 2996)

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 556)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3268)
      • csc.exe (PID: 2996)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 1560)
      • csc.exe (PID: 2328)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3680)
      • csc.exe (PID: 2684)

    • Reads the computer name

      • wmpnscfg.exe (PID: 556)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3268)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 1560)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3680)
      • csc.exe (PID: 2996)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 556)
      • csc.exe (PID: 2996)

    • Reads Environment values

      • csc.exe (PID: 2996)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 556)
      • AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe (PID: 3680)
      • explorer.exe (PID: 3584)

    • The process uses the downloaded file

      • msedge.exe (PID: 3780)
      • WinRAR.exe (PID: 280)

    • Creates files or folders in the user directory

      • csc.exe (PID: 2996)

    • Creates files in the program directory

      • csc.exe (PID: 2996)

    • Reads product name

      • csc.exe (PID: 2996)

    • Checks proxy server information

      • csc.exe (PID: 2996)

    • Application launched itself

      • msedge.exe (PID: 3864)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2996) csc.exe
C2 (1)svdjvhinvosdhfojsdfdffhdoflsnj.con-ip.com:1997
BotnetZAPATO
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-3HG4DL
Keylog_flag1
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path%ProgramFiles%
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
96
Monitored processes
41
Malicious processes
5
Suspicious processes
2

Behavior graph

Click at the process to see the details
start outlook.exe msedge.exe msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs wmpnscfg.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs msedge.exe no specs msedge.exe no specs audiencia preparatoria, proceso no. 2023- 02191.exe no specs #REMCOS csc.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs explorer.exe no specs audiencia preparatoria, proceso no. 2023- 02191.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs csc.exe no specs schtasks.exe no specs audiencia preparatoria, proceso no. 2023- 02191.exe csc.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs schtasks.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3924 --field-trial-handle=1352,i,4371949217020738776,2538823140843411311,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
280"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.tar"C:\program files\WinRAR\WinRAR.exe—msedge.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
284"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3776 --field-trial-handle=1352,i,4371949217020738776,2538823140843411311,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
556"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\ole32.dll
712"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3860 --field-trial-handle=1352,i,4371949217020738776,2538823140843411311,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
788"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1580 --field-trial-handle=1352,i,4371949217020738776,2538823140843411311,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
880"cmd" /c schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppDta\AppDta.exe'" /fC:\Windows\System32\cmd.exe—AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
888schtasks /create /sc minute /mo 10 /tn "Nano" /tr "'C:\Users\admin\AppData\Roaming\AppDta\AppDta.exe'" /fC:\Windows\System32\schtasks.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Manages scheduled tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\ole32.dll
1276"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3428 --field-trial-handle=1352,i,4371949217020738776,2538823140843411311,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1560"C:\Users\admin\AppData\Local\Temp\Rar$EXb280.22080\AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXb280.22080\AUDIENCIA PREPARATORIA, PROCESO No. 2023- 02191.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\rar$exb280.22080\audiencia preparatoria, proceso no. 2023- 02191.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
11 907
Read events
11 456
Write events
428
Delete events
23

Modification events

(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(3448) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
1
Suspicious files
92
Text files
37
Unknown types
0

Dropped files

PID
Process
Filename
Type
3448OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR7796.tmp.cvr —
MD5:—
SHA256:—
3448OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
3864msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF16e554.TMP —
MD5:—
SHA256:—
3864msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
3864msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF16e582.TMP —
MD5:—
SHA256:—
3864msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
3864msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF16e5f0.TMP —
MD5:—
SHA256:—
3864msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old —
MD5:—
SHA256:—
3864msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\a53f3efa-3865-4078-9696-9c9feef040a3.tmpbinary
MD5:AA09289758D06425B106BA383EC30379
SHA256:85CEA7B642D4474BFB1F06DBAC4D4514C249D5C3552AE288F07C77A8BCC942E5
3864msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variationsbinary
MD5:961E3604F228B0D10541EBF921500C86
SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
40
DNS requests
39
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2996
csc.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
binary
948 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3448
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2588
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
3968
msedge.exe
142.250.186.174:443
docs.google.com
GOOGLE
US
whitelisted
3864
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted
3968
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3968
msedge.exe
51.104.176.40:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3968
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
docs.google.com
  • 142.250.186.174
shared
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
nav-edge.smartscreen.microsoft.com
  • 51.104.176.40
whitelisted
www.bing.com
  • 13.107.21.200
  • 204.79.197.200
whitelisted
self.events.data.microsoft.com
  • 20.189.173.7
whitelisted
msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com
  • 152.199.21.175
whitelisted
doc-0k-8s-docs.googleusercontent.com
  • 216.58.212.1
shared
data-edge.smartscreen.microsoft.com
  • 20.105.95.163
whitelisted

Threats

PID
Process
Class
Message
3968
msedge.exe
Potential Corporate Privacy Violation
POLICY [ANY.RUN] Downloading from a file sharing service is observed
1080
svchost.exe
Potentially Bad Traffic
ET INFO DNS Redirection Service Domain in DNS Lookup (con-ip .com)
2996
csc.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2996
csc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2996
csc.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2996
csc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
2996
csc.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x TLS Connection
2996
csc.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS JA3 Hash
1 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AUDIENCIA PREPARATORIA PROCESO No. 2023- 02191.msg