File name:

REMCOS v1.7 Professional.zip

Full analysis: https://app.any.run/tasks/7148a53a-ff8c-45d1-8d69-e97d31e82bf2
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 16:18:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
remcos
rat
vmprotect
delphi
fsg
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

EA780080E82CBA41F7E6E5320912B00F

SHA1:

E7D16EEDF35C67450C43B80AAC36CE80BA9E0533

SHA256:

737E97FC4A8C7D6B2492A059252913DD594AC3B54AD465E00B9606D1260E67A6

SSDEEP:

98304:P0nBfHy03HvO/qQdWilL8mZUANsBjwl65r9gDxDM0K4YIw6Yo1rWfKsPXkdOHXej:coIEJcFxftMGHh0doBrXQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7432)

    • Runs injected code in another process

      • remcos.exe (PID: 7972)

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • REMCOS mutex has been found

      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 2960)

    • REMCOS has been detected (YARA)

      • remcos.exe (PID: 7972)

    • REMCOS has been detected

      • Backdoor.exe (PID: 2960)

    • Starts CMD.EXE for commands execution

      • iexplore.exe (PID: 6080)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7432)
      • Backdoor.exe (PID: 2960)
      • remcos.exe (PID: 7972)

    • Executable content was dropped or overwritten

      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 1912)

    • Executing commands from a ".bat" file

      • Backdoor.exe (PID: 1912)
      • iexplore.exe (PID: 6080)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7864)

    • The executable file from the user directory is run by the CMD process

      • remcos.exe (PID: 720)

    • Starts CMD.EXE for commands execution

      • Backdoor.exe (PID: 1912)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7432)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)
      • mmc.exe (PID: 7328)
      • mmc.exe (PID: 728)

    • Manual execution by a user

      • Remcos Loader.exe (PID: 7944)
      • Backdoor.exe (PID: 2960)
      • Backdoor.exe (PID: 1912)

    • Checks supported languages

      • Remcos Loader.exe (PID: 7944)
      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 2960)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7432)

    • Reads the computer name

      • Remcos Loader.exe (PID: 7944)
      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 2960)

    • VMProtect protector has been detected

      • Remcos Loader.exe (PID: 7944)

    • FSG packer has been detected

      • remcos.exe (PID: 7972)

    • Checks proxy server information

      • remcos.exe (PID: 7972)
      • slui.exe (PID: 7428)

    • Compiled with Borland Delphi (YARA)

      • remcos.exe (PID: 7972)
      • slui.exe (PID: 7428)
      • mmc.exe (PID: 728)

    • Creates files or folders in the user directory

      • remcos.exe (PID: 7972)

    • Reads the software policy settings

      • slui.exe (PID: 7580)
      • slui.exe (PID: 7428)

    • Process checks computer location settings

      • Backdoor.exe (PID: 2960)

    • Creates files in the program directory

      • mmc.exe (PID: 728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:08:16 17:41:08
ZipCRC: 0xcfd098de
ZipCompressedSize: 99
ZipUncompressedSize: 106
ZipFileName: Read me.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
23
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs remcos loader.exe no specs #REMCOS remcos.exe slui.exe #REMCOS backdoor.exe no specs eventvwr.exe no specs eventvwr.exe mmc.exe no specs mmc.exe no specs backdoor.exe cmd.exe no specs conhost.exe no specs ping.exe no specs remcos.exe no specs iexplore.exe no specs ucpdmgr.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Users\admin\AppData\Roaming\remcos\remcos.exe" C:\Users\admin\AppData\Roaming\remcos\remcos.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
728"C:\WINDOWS\system32\eventvwr.msc" "C:\WINDOWS\system32\eventvwr.msc"C:\Windows\System32\mmc.exe—mmc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mmc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1196"C:\Windows\SysWOW64\eventvwr.exe" C:\Windows\SysWOW64\eventvwr.exe
Backdoor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\eventvwr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1388PING 127.0.0.1 -n 2 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
1912"C:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exe" C:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\remcos v1.7 professional\backdoor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2960"C:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exe" C:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\remcos v1.7 professional\backdoor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4728C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\uninstall.bat" "C:\Windows\SysWOW64\cmd.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 732
Read events
27 501
Write events
204
Delete events
27

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010013000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C0000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C0000000D0000000000000053006B007900700065002E006C006E006B003E0020007C000000110000000000000061006E007900730065006C006C00650072002E007200740066003E002000200000000E00000000000000620069007400610073006B002E0070006E0067003E00200020000000110000000000000063006900760069006C007200690073006B002E007200740066003E00200020000000160000000000000063006F006D00700061006E0069006500730074006F00740061006C002E007200740066003E00200020000000110000000000000064006500630065006E00640069006E0067002E007200740066003E0020002000000010000000000000006500730074006100740065006D0079002E0070006E0067003E00200020000000130000000000000068006F006D00650073006300680061006E00630065002E007200740066003E0020002000000012000000000000006F00720061006C0062006F00730074006F006E002E006A00700067003E00200020000000110000000000000070006C00750073006D006F006E00740068002E0070006E0067003E002000200000001000000000000000770068006900740065007700610073002E007200740066003E002000200000002000000000000000520045004D0043004F0053002000760031002E0037002000500072006F00660065007300730069006F006E0061006C002E007A00690070003E00200020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001300000000000000000000000000000000000000803F0000004008000000803F0000404009000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F0000000040000080401000000000400000A0401100000000000000803F0100000000000000004002000000000000004040030000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F070000004040000000001200
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconNameVersion
Value:
1
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
40082A6800000000
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000030308
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\REMCOS v1.7 Professional.zip
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
10
Suspicious files
8
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
5492explorer.exeC:\Users\admin\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.datbinary
MD5:E49C56350AEDF784BFE00E444B879672
SHA256:A8BD235303668981563DFB5AAE338CB802817C4060E2C199B7C84901D57B7E1E
7972remcos.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\BuilderProfiles\CustomProfile.initext
MD5:E2D57396C13D597855EB6FEA1122667A
SHA256:6422F98D8A559EC4F886892A806B427AF84B8814A114CDE4BBEC14B6B0B9AC50
7972remcos.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\RCXEB04.tmpexecutable
MD5:953525E41D29C07EEAF144B8B8762DA3
SHA256:E7A79CC2F17DFEE70ADCD2DB9E7AE43D3AC8DE061BAD5C8B2EC595691D586D95
7972remcos.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exeexecutable
MD5:C9E54162155068559973AEFA62A7E6C4
SHA256:B88F895FCFF3F5939807E26A04D7E8B5FEEA2BB0E8314AE598A3B2DE0A2140C7
1912Backdoor.exeC:\Users\admin\AppData\Local\Temp\install.battext
MD5:4BE8E47D35A08B8B6AD69312F7B4E077
SHA256:428B8E9AF103691C24E02AA1F514D45763C29FD1F83EA77DAB7DEF653545FB60
728mmc.exeC:\Users\admin\AppData\Local\Microsoft\Event Viewer\Settings.Xmltext
MD5:884320A9B8F018F309F5A96107133F89
SHA256:50FD9D76D1C43BB16B166DE02AAF8ADEC09EB5BC4CEFDCA9D1AF2E0F7B1D8F64
7972remcos.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\RCXBBE2.tmpexecutable
MD5:0452875EC7A408169CB236B8FC0946D6
SHA256:DF4E7B8EDE8D0AEB57F445984918AAF5EECFB50B500AE3CB4238F7FA3BE6EF39
728mmc.exeC:\Users\admin\AppData\Local\Microsoft\Event Viewer\RecentViewsbinary
MD5:785FB8E1B562E2FCC8C0C0C6572EE3D7
SHA256:5607B57C3C58070F54B8F68FA22808F9AD14C60BBF05F00DA92A162585C3C562
6080iexplore.exeC:\Users\admin\AppData\Roaming\Screens\0.pngbinary
MD5:BC265263C8F8CD5E9F6AC1D1675735B8
SHA256:CB41FBDD47521A22BB7B9FD46F6513067124C067B87B8195F7A484177ADCA584
5492explorer.exeC:\Users\admin\AppData\Local\Temp\{6960B5D7-4BAA-4109-99CE-530A21E5618E}.pngimage
MD5:00E5FCFD833151F7CBDE607E2F7AFEB4
SHA256:B80192AAABE007BAECD0603E3CE183E9D554B8A6B0411D20716ACFA086AE3035
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2656
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2656
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7972
remcos.exe
GET
200
178.237.33.50:80
http://www.geoplugin.net/json.gp?ip=127.0.0.1
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2112
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.1
  • 40.126.31.67
  • 40.126.31.0
  • 40.126.31.129
  • 20.190.159.2
  • 20.190.159.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
www.google.com
  • 142.250.185.164
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
REMCOS v1.7 Professional.zip