File name:

68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf

Full analysis: https://app.any.run/tasks/251a87ea-29ab-406e-80f3-b20b91eebb10
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 09, 2025, 19:35:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
remcos
rat
remote
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

4DF94298FD7B539B66400C3ABC73296F

SHA1:

86326436F15454B57906529CDDCCE0630F560391

SHA256:

68AFD578633DB89932A8CF7BBA27F9E879D8BF14A84C538C04C205C6C02D0DBF

SSDEEP:

49152:2IU8tAth4ZLUt2+ielxSQq9tW6RMD7R2ZUaoCQ6QN4Vuj4pU2EjSRnsvT5DS4d:2e84ZLUTfIQq9hOD7R2Zxo96yFE45T55

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS has been detected

      • msiexec.exe (PID: 7636)

    • REMCOS mutex has been found

      • msiexec.exe (PID: 7636)

    • REMCOS has been detected (SURICATA)

      • msiexec.exe (PID: 7636)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe (PID: 2140)
      • powershell.exe (PID: 7176)

    • Starts POWERSHELL.EXE for commands execution

      • 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe (PID: 2140)

    • There is functionality for taking screenshot (YARA)

      • 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe (PID: 2140)

    • Converts a specified value to a byte (POWERSHELL)

      • powershell.exe (PID: 7176)

    • Connects to unusual port

      • msiexec.exe (PID: 7636)

    • Contacting a server suspected of hosting an CnC

      • msiexec.exe (PID: 7636)

  • INFO

    • Checks supported languages

      • 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe (PID: 2140)

    • Creates files or folders in the user directory

      • 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe (PID: 2140)
      • msiexec.exe (PID: 7636)

    • The sample compiled with english language support

      • 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe (PID: 2140)
      • powershell.exe (PID: 7176)

    • Reads the computer name

      • 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe (PID: 2140)

    • Create files in a temporary directory

      • 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe (PID: 2140)

    • Manual execution by a user

      • WINWORD.EXE (PID: 7288)

    • Reads the software policy settings

      • msiexec.exe (PID: 7636)
      • slui.exe (PID: 7312)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7176)

    • Checks whether the specified file exists (POWERSHELL)

      • powershell.exe (PID: 7176)

    • Converts byte array into ASCII string (POWERSHELL)

      • powershell.exe (PID: 7176)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 7176)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 7176)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7636)

    • Checks proxy server information

      • msiexec.exe (PID: 7636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2017:08:01 00:34:06+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26112
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x3373
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.0.0.0
ProductVersionNumber: 3.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: polede paafyldningers gipsywort
FileDescription: sapsucker cyano orddelinger
LegalCopyright: bnkevllings
ProductVersion: 3.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
144
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe powershell.exe conhost.exe no specs sppextcomobj.exe no specs winword.exe slui.exe ai.exe no specs #REMCOS msiexec.exe conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2140"C:\Users\admin\AppData\Local\Temp\68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe" C:\Users\admin\AppData\Local\Temp\68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe
explorer.exe
User:
admin
Company:
polede paafyldningers gipsywort
Integrity Level:
MEDIUM
Description:
sapsucker cyano orddelinger
Exit code:
4294967295
Modules
Images
c:\users\admin\appdata\local\temp\68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7176"powershell.exe" -windowstyle minimized "$Advowsance=gc -Raw 'C:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\Koreaners.Spe';$Salsuginous=$Advowsance.SubString(54534,3);.$Salsuginous($Advowsance)"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
7184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7264C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7268C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7288"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\Desktop\nexthas.rtf" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7312"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7636"C:\WINDOWS\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
7940\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8024"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "5469A039-F531-4D4F-B9AE-3D85BEA38A3C" "F9465795-9604-4D96-8001-A41328B048CA" "7288"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
Total events
23 439
Read events
23 037
Write events
378
Delete events
24

Modification events

(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:writeName:<j-
Value:
3C6A2D00781C0000010000000000000045E4CE7E19C1DB0100000000
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7288
Operation:writeName:0
Value:
0B0E107BD4D604ABEB004BB531DBE2E92FA849230046EACBF8F597A3F0ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511F838D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(7288) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
Executable files
36
Suspicious files
146
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\Brnefamilierne.txttext
MD5:55493DF92AE63654EAF5274B0B985FCA
SHA256:081EC35C28CA318D57156553B64232024ED636E9FDADF4E23BF956C253B3ACB9
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\Shrinkingness.jpgbinary
MD5:A7910930CFC609F9C4B6BC4EFB820975
SHA256:2C2448FCDAF2B19FEA8D0F4F552ED99A9F10C18DCF14B4758DCD58ABD0D8D932
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\dishumor.disbinary
MD5:E4D36E2CF6BF737E89943CA0F755461E
SHA256:02BCC38A84B662B978027AECFE6A6E70ED78FBFD0BD22C0173581C6FED5B0528
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\staahjdes.cyabinary
MD5:065E63FD5B8F604A3CD6FE524F70BCFA
SHA256:F1F7A6BB7392E8E1A0975C9AFC270DB9C51AC855352330BEA6CBD16AC74D9E9D
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\Koreaners.Spetext
MD5:E2514EE8F92CA09B55E7667569DEAD44
SHA256:CA0BF04BCBD6D3B2CF1B8A13FDCDEDE116FE0C7DDE3EBE0DDEEA6AD8A36D4BB1
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\Roofers.Afpbinary
MD5:D1B921E882703BA4647896A710FA81F1
SHA256:917FFC65504C918FD56D4D89B0CB26D60ACEE36E17D283027A3808A371AB7D2B
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\Eb.initext
MD5:8206DA3BE0EF0AB4CC61B85C89445449
SHA256:0DE17000FF01FA2FC73D48179E6931B2E77D2E6F7F009C92143A14C1D1EE627B
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\Semostomous192.initext
MD5:8372C7B6563A613FBF4A50A8FB8C6C5D
SHA256:53A25F2AE832931416796E6D4743FC2A197B85E7185CE0D4CE88B7090796975F
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\langtidsindstillede.jpgbinary
MD5:91D56B147359B3EED8894066036E07F6
SHA256:2ADB166FA054CD17752388795193080C78D20EAE256A86D898C3A36942ACCF57
214068afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf.exeC:\Users\admin\AppData\Local\uncontestablely\virkelighedsopfattelse\ministerprsidenten\Uudforsket.initext
MD5:65CE9B2C75B070FE88FAD7C81B9A5217
SHA256:84759E8BA150756E69E8C33AFD408560B14535AC2DF52D3951173E14C5074EFC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
72
DNS requests
29
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7636
msiexec.exe
GET
200
142.250.181.227:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEH0th7t%2BrhK7Cmbia6iF80g%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7288
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
1180
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1180
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7288
WINWORD.EXE
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
7288
WINWORD.EXE
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
7288
WINWORD.EXE
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7288
WINWORD.EXE
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
7636
msiexec.exe
GET
200
142.250.181.227:80
http://o.pki.goog/we2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEA85wFTvuwmlCdtY0UxEIqg%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
7288
WINWORD.EXE
52.109.32.97:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7288
WINWORD.EXE
52.109.68.129:443
roaming.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7288
WINWORD.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7288
WINWORD.EXE
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.64
  • 20.190.160.5
  • 20.190.160.132
  • 40.126.32.74
  • 20.190.160.131
  • 40.126.32.133
  • 40.126.32.138
  • 40.126.32.76
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
roaming.officeapps.live.com
  • 52.109.68.129
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
omex.cdn.office.net
  • 2.19.11.103
  • 2.19.11.102
whitelisted
fs.microsoft.com
  • 23.60.203.209
whitelisted
messaging.engagement.office.com
  • 52.111.236.4
whitelisted
messaging.lifecycle.office.com
  • 52.111.236.4
whitelisted

Threats

PID
Process
Class
Message
7636
msiexec.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
7636
msiexec.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 30
7636
msiexec.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
68afd578633db89932a8cf7bba27f9e879d8bf14a84c538c04c205c6c02d0dbf