File name:

z1Document_PDF.scr

Full analysis: https://app.any.run/tasks/80ef7499-aa3c-4394-82ff-37b6a6eb5e7d
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 16, 2025, 06:04:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remcos
rat
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

9A57C83B3AE8652EBC22AD72FFEF5EA5

SHA1:

80756AB0BB1B55542D5E50DEA1F9C195B4FF9E27

SHA256:

668B34FAE64114638C8C3320885C2BAA4ADDD223587BB9ECF17292EE83EAD09E

SSDEEP:

49152:VG8AEzAB9lU5I8i8bTr6OPZy8Q8/nIkrixyYqPotee/jhMRCTibgSicFWEzB5/8r:VG8AEYQG8iKrDByYrrixyrPotiROibgf

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS has been detected

      • msiexec.exe (PID: 5640)

    • REMCOS mutex has been found

      • msiexec.exe (PID: 5640)

    • REMCOS has been detected (YARA)

      • msiexec.exe (PID: 5640)

    • REMCOS has been detected (SURICATA)

      • msiexec.exe (PID: 5640)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • z1Document_PDF.scr.exe (PID: 6044)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 2320)

    • Starts POWERSHELL.EXE for commands execution

      • z1Document_PDF.scr.exe (PID: 6044)

    • Contacting a server suspected of hosting an CnC

      • msiexec.exe (PID: 5640)

    • There is functionality for taking screenshot (YARA)

      • msiexec.exe (PID: 5640)

  • INFO

    • Checks supported languages

      • z1Document_PDF.scr.exe (PID: 6044)

    • Reads the computer name

      • z1Document_PDF.scr.exe (PID: 6044)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 2320)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 2320)

    • Process checks computer location settings

      • z1Document_PDF.scr.exe (PID: 6044)

    • Checks proxy server information

      • msiexec.exe (PID: 5640)
      • slui.exe (PID: 812)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 2320)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 2320)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 2320)

    • The sample compiled with english language support

      • z1Document_PDF.scr.exe (PID: 6044)

    • Create files in a temporary directory

      • z1Document_PDF.scr.exe (PID: 6044)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 5640)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 5640)

    • Reads the software policy settings

      • msiexec.exe (PID: 5640)
      • slui.exe (PID: 1628)
      • slui.exe (PID: 812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(5640) msiexec.exe
C2 (1)176.65.142.222:8080
BotnetHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-QEJUV8
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:07:24 22:19:26+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 141824
UninitializedDataSize: 2048
EntryPoint: 0x35d8
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.5.0.0
ProductVersionNumber: 3.5.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
Comments: havkrydser antirachitic trimer
CompanyName: lukketid
FileVersion: 3.5.0.0
LegalCopyright: tankrensningernes
OriginalFileName: oppiskning flavonoid.exe
ProductName: forskansninger
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
7
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start z1document_pdf.scr.exe no specs powershell.exe no specs conhost.exe no specs sppextcomobj.exe no specs slui.exe #REMCOS msiexec.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
812C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1628"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2320"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" " $Medlemsorganisationernes=cat -raw 'C:\Users\admin\AppData\Local\Temp\norddata\Filiety27\Antilogism.Fil212';$Decentrale=$Medlemsorganisationernes.substring(15648,3);.$Decentrale($Medlemsorganisationernes)" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—z1Document_PDF.scr.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2384\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4400C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5640"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Remcos
(PID) Process(5640) msiexec.exe
C2 (1)176.65.142.222:8080
BotnetHost
Options
Connect_interval1
Install_flagFalse
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-QEJUV8
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
6044"C:\Users\admin\Desktop\z1Document_PDF.scr.exe" C:\Users\admin\Desktop\z1Document_PDF.scr.exe—explorer.exe
User:
admin
Company:
lukketid
Integrity Level:
MEDIUM
Exit code:
2
Version:
3.5.0.0
Modules
Images
c:\users\admin\desktop\z1document_pdf.scr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
Total events
9 721
Read events
9 706
Write events
15
Delete events
0

Modification events

(PID) Process:(6044) z1Document_PDF.scr.exeKey:HKEY_CURRENT_USER\portren\Uninstall\isafklet
Operation:writeName:strobiliferous
Value:
0
(PID) Process:(6044) z1Document_PDF.scr.exeKey:HKEY_CURRENT_USER\radiochlorine\Lagringskapaciteten223
Operation:writeName:nonunique
Value:
%sammenstningsledenes%\wallop\vvstypers.jpg
(PID) Process:(6044) z1Document_PDF.scr.exeKey:HKEY_CURRENT_USER\Lydbilledets\Danic
Operation:writeName:mobiliseringens
Value:
14B7A8
(PID) Process:(5640) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-QEJUV8
Operation:writeName:exepath
Value:
B7FC1F3015036B6DA00F1474A25D706CD0EEC1324D4AB5DA7CD4A6E47961B775A37C296BFBC7C89A782A28F19C087684F7BB4D58044647EDB790DDEBB8750E60
(PID) Process:(5640) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-QEJUV8
Operation:writeName:licence
Value:
43207426A0268C4471EEDB223896E373
(PID) Process:(5640) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-QEJUV8
Operation:writeName:time
Value:
(PID) Process:(5640) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Rmc-QEJUV8
Operation:writeName:UID
Value:
849774358
(PID) Process:(5640) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(5640) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(5640) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
1
Suspicious files
13
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Electrocardiogramme\Maalgruppers148.for —
MD5:—
SHA256:—
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\nsmBB73.tmp —
MD5:—
SHA256:—
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Filiety27\Antilogism.Fil212text
MD5:B5573CA6754D832CFA0E9A81CDCB85A1
SHA256:C1BBFF106898443D2231CE62131C5BA0A03D357A71E4C32DA2C81E8818057CC2
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Electrocardiogramme\Syndsforladelserne.jpgimage
MD5:1B76CF8961D92FA55320EAA2F8C784AA
SHA256:65FD4D0E43979EF666C84D42F08C0D33035D859F13B23BF0F2B70810C363F2D3
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Filiety27\Ligningsmyndighedens.txttext
MD5:5D1AAF1595EFAB85A3B681EF4491B17C
SHA256:13CA4EEAE0291A19399CDA540EFB9400249B5009AC22A8F7BA3A7D9A81D11493
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Electrocardiogramme\gimperne.initext
MD5:917451278D1E4F1641B0F3137F8137A5
SHA256:8219E4AC70D969F97BA13F74E3C5151C7276002F9EA9574C4ADECE3E90C4B2BF
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Electrocardiogramme\jordfylden.jpgimage
MD5:BA8C59EF5ED0EC9C33936A0271D62013
SHA256:A9EEF0DAEEC81D4B85AF9DE0D28D3BC6A709BAD60DE2320D266237C8C63F48CB
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Filiety27\Discigerous.txtbinary
MD5:B0A4435C808812B0A60A5C7CC68C1D1E
SHA256:AA7DD452283C6B351479A25CB24C099129FEA6D20E8DB0FBB0A49F4D5C8543FD
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Electrocardiogramme\forbedringsforslagets.initext
MD5:81F264F7076B6389C758EC1C794EDCB1
SHA256:E0F8290A5E25F164568EA21B0111147B3F1F5F9A597F35609399AFA2BD32D6E8
6044z1Document_PDF.scr.exeC:\Users\admin\AppData\Local\Temp\norddata\Electrocardiogramme\informer.jpgimage
MD5:AE181DA11736FD47DAA8401862E7E749
SHA256:D166016EAD902E811F08CEB490D1F06D840FF988C97FE61472D729E77D9A642D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
48
DNS requests
32
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5640
msiexec.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
5640
msiexec.exe
GET
200
216.58.206.67:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
6752
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6752
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5640
msiexec.exe
GET
200
172.217.16.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEA85wFTvuwmlCdtY0UxEIqg%3D
unknown
—
—
whitelisted
5640
msiexec.exe
GET
200
178.237.33.50:80
http://geoplugin.net/json.gp
unknown
—
—
whitelisted
5640
msiexec.exe
GET
200
172.217.16.195:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEH0th7t%2BrhK7Cmbia6iF80g%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
23.53.40.176:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.53.40.176
  • 23.53.40.178
whitelisted
google.com
  • 142.250.185.78
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.159.71
  • 20.190.159.75
  • 20.190.159.129
  • 40.126.31.69
  • 40.126.31.3
  • 40.126.31.0
  • 20.190.159.4
  • 40.126.31.71
  • 40.126.32.134
  • 40.126.32.140
  • 40.126.32.74
  • 20.190.160.17
  • 20.190.160.128
  • 20.190.160.130
  • 20.190.160.4
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
drive.google.com
  • 142.250.74.206
whitelisted
c.pki.goog
  • 216.58.206.67
whitelisted
o.pki.goog
  • 172.217.16.195
whitelisted

Threats

PID
Process
Class
Message
5640
msiexec.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 31
5640
msiexec.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
5640
msiexec.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
z1Document_PDF.scr