File name:

REMCOS v1.7 Professional.zip

Full analysis: https://app.any.run/tasks/7148a53a-ff8c-45d1-8d69-e97d31e82bf2
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: May 18, 2025, 16:18:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-doc
remcos
rat
vmprotect
delphi
fsg
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

EA780080E82CBA41F7E6E5320912B00F

SHA1:

E7D16EEDF35C67450C43B80AAC36CE80BA9E0533

SHA256:

737E97FC4A8C7D6B2492A059252913DD594AC3B54AD465E00B9606D1260E67A6

SSDEEP:

98304:P0nBfHy03HvO/qQdWilL8mZUANsBjwl65r9gDxDM0K4YIw6Yo1rWfKsPXkdOHXej:coIEJcFxftMGHh0doBrXQ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7432)

    • Runs injected code in another process

      • remcos.exe (PID: 7972)

    • Application was injected by another process

      • explorer.exe (PID: 5492)

    • REMCOS has been detected (YARA)

      • remcos.exe (PID: 7972)

    • REMCOS mutex has been found

      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 2960)

    • REMCOS has been detected

      • Backdoor.exe (PID: 2960)

    • Starts CMD.EXE for commands execution

      • iexplore.exe (PID: 6080)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7432)
      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 2960)

    • Executable content was dropped or overwritten

      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 1912)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7864)

    • The executable file from the user directory is run by the CMD process

      • remcos.exe (PID: 720)

    • Executing commands from a ".bat" file

      • iexplore.exe (PID: 6080)
      • Backdoor.exe (PID: 1912)

    • Starts CMD.EXE for commands execution

      • Backdoor.exe (PID: 1912)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7432)

    • Manual execution by a user

      • Remcos Loader.exe (PID: 7944)
      • Backdoor.exe (PID: 2960)
      • Backdoor.exe (PID: 1912)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 5492)
      • mmc.exe (PID: 7328)
      • mmc.exe (PID: 728)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7432)

    • Reads the computer name

      • Remcos Loader.exe (PID: 7944)
      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 2960)

    • Checks supported languages

      • Remcos Loader.exe (PID: 7944)
      • remcos.exe (PID: 7972)
      • Backdoor.exe (PID: 2960)

    • VMProtect protector has been detected

      • Remcos Loader.exe (PID: 7944)

    • FSG packer has been detected

      • remcos.exe (PID: 7972)

    • Compiled with Borland Delphi (YARA)

      • remcos.exe (PID: 7972)
      • slui.exe (PID: 7428)
      • mmc.exe (PID: 728)

    • Checks proxy server information

      • remcos.exe (PID: 7972)
      • slui.exe (PID: 7428)

    • Creates files or folders in the user directory

      • remcos.exe (PID: 7972)

    • Reads the software policy settings

      • slui.exe (PID: 7428)
      • slui.exe (PID: 7580)

    • Process checks computer location settings

      • Backdoor.exe (PID: 2960)

    • Creates files in the program directory

      • mmc.exe (PID: 728)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2023:08:16 17:41:08
ZipCRC: 0xcfd098de
ZipCompressedSize: 99
ZipUncompressedSize: 106
ZipFileName: Read me.txt
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
23
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs remcos loader.exe no specs #REMCOS remcos.exe slui.exe #REMCOS backdoor.exe no specs eventvwr.exe no specs eventvwr.exe mmc.exe no specs mmc.exe no specs backdoor.exe cmd.exe no specs conhost.exe no specs ping.exe no specs remcos.exe no specs iexplore.exe no specs ucpdmgr.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs explorer.exe

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Users\admin\AppData\Roaming\remcos\remcos.exe" C:\Users\admin\AppData\Roaming\remcos\remcos.exe—cmd.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3
Modules
Images
c:\users\admin\appdata\roaming\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
728"C:\WINDOWS\system32\eventvwr.msc" "C:\WINDOWS\system32\eventvwr.msc"C:\Windows\System32\mmc.exe—mmc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Management Console
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\mmc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\acgenral.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1196"C:\Windows\SysWOW64\eventvwr.exe" C:\Windows\SysWOW64\eventvwr.exe
Backdoor.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Event Viewer Snapin Launcher
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\eventvwr.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1388PING 127.0.0.1 -n 2 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
1912"C:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exe" C:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\remcos v1.7 professional\backdoor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
2092\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2960"C:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exe" C:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\remcos v1.7 professional\backdoor.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4728C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\uninstall.bat" "C:\Windows\SysWOW64\cmd.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
5136\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5380\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
27 732
Read events
27 501
Write events
204
Delete events
27

Modification events

(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconLayouts
Value:
00000000000000000000000000000000030001000100010013000000000000002C000000000000003A003A007B00360034003500460046003000340030002D0035003000380031002D0031003000310042002D0039004600300038002D003000300041004100300030003200460039003500340045007D003E002000200000001000000000000000430043006C00650061006E00650072002E006C006E006B003E0020007C0000001500000000000000410064006F006200650020004100630072006F006200610074002E006C006E006B003E0020007C0000000F00000000000000460069007200650066006F0078002E006C006E006B003E0020007C000000150000000000000047006F006F0067006C00650020004300680072006F006D0065002E006C006E006B003E0020007C000000180000000000000056004C00430020006D006500640069006100200070006C0061007900650072002E006C006E006B003E0020007C00000016000000000000004D006900630072006F0073006F0066007400200045006400670065002E006C006E006B003E0020007C0000000D0000000000000053006B007900700065002E006C006E006B003E0020007C000000110000000000000061006E007900730065006C006C00650072002E007200740066003E002000200000000E00000000000000620069007400610073006B002E0070006E0067003E00200020000000110000000000000063006900760069006C007200690073006B002E007200740066003E00200020000000160000000000000063006F006D00700061006E0069006500730074006F00740061006C002E007200740066003E00200020000000110000000000000064006500630065006E00640069006E0067002E007200740066003E0020002000000010000000000000006500730074006100740065006D0079002E0070006E0067003E00200020000000130000000000000068006F006D00650073006300680061006E00630065002E007200740066003E0020002000000012000000000000006F00720061006C0062006F00730074006F006E002E006A00700067003E00200020000000110000000000000070006C00750073006D006F006E00740068002E0070006E0067003E002000200000001000000000000000770068006900740065007700610073002E007200740066003E002000200000002000000000000000520045004D0043004F0053002000760031002E0037002000500072006F00660065007300730069006F006E0061006C002E007A00690070003E00200020000000010000000000000002000100000000000000000001000000000000000200010000000000000000001100000006000000010000001300000000000000000000000000000000000000803F0000004008000000803F0000404009000000803F000080400A000000803F0000A0400B0000000040000000000C00000000400000803F0D0000000040000000400E0000000040000040400F0000000040000080401000000000400000A0401100000000000000803F0100000000000000004002000000000000004040030000000000000080400400000000000000A04005000000803F0000000006000000803F0000803F070000004040000000001200
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop
Operation:writeName:IconNameVersion
Value:
1
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\OneDrive\Accounts
Operation:writeName:LastUpdate
Value:
40082A6800000000
(PID) Process:(5492) explorer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\5\ApplicationViewManagement\W32:0000000000030308
Operation:writeName:VirtualDesktop
Value:
1000000030304456BFA0DB55E4278845B426357D5B5F97B3
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\REMCOS v1.7 Professional.zip
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7432) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
Executable files
10
Suspicious files
8
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
7432WinRAR.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\Read me.txttext
MD5:F2325D150B1B4BB01D2B5F6C3B2EA2A2
SHA256:6CD281E52C6A56813C5307495F338D34CD341D428F3DEB5ACD82BFD72E689CA9
7432WinRAR.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\REMCOSAuthHooks.dllexecutable
MD5:A329F92AD3B9311AF3130DBDE81155CE
SHA256:D695A2EE6FCAE64F4D8C4387A0A4C4AAE05D08CE44A52598984673B890D02F27
7972remcos.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\BuilderProfiles\MyProfile.initext
MD5:E2D57396C13D597855EB6FEA1122667A
SHA256:6422F98D8A559EC4F886892A806B427AF84B8814A114CDE4BBEC14B6B0B9AC50
7972remcos.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\gettime[1].htmtext
MD5:D19021C3E24FFF276CE831D27901DB2B
SHA256:A51CE6D2543445BDA96479C74113F63C5FBA8C1DF87B0628D983683CB8970F82
728mmc.exeC:\Users\admin\AppData\Roaming\Microsoft\MMC\eventvwrxml
MD5:6DD5AF5ECC18456F56AA8A9F94150ADF
SHA256:3AF4031DD973FC01E5CFFDEDE4E96E571E7CEBBCED0BDDF06C1B4B88E6AFD704
7972remcos.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\BuilderProfiles\CustomProfile.initext
MD5:E2D57396C13D597855EB6FEA1122667A
SHA256:6422F98D8A559EC4F886892A806B427AF84B8814A114CDE4BBEC14B6B0B9AC50
728mmc.exeC:\Users\admin\AppData\Local\Microsoft\Event Viewer\RecentViewsbinary
MD5:785FB8E1B562E2FCC8C0C0C6572EE3D7
SHA256:5607B57C3C58070F54B8F68FA22808F9AD14C60BBF05F00DA92A162585C3C562
7972remcos.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\OnlineCheck_MT[1].htmtext
MD5:442D4F5216CD9DA1FD121655A23E8843
SHA256:0A3706B1424059F3F718B8FBAA2DD145EA0FD1F8D950744CA78C7B32D2DFA4A8
7972remcos.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\RCXEB04.tmpexecutable
MD5:953525E41D29C07EEAF144B8B8762DA3
SHA256:E7A79CC2F17DFEE70ADCD2DB9E7AE43D3AC8DE061BAD5C8B2EC595691D586D95
7972remcos.exeC:\Users\admin\Desktop\REMCOS v1.7 Professional\Backdoor.exeexecutable
MD5:C9E54162155068559973AEFA62A7E6C4
SHA256:B88F895FCFF3F5939807E26A04D7E8B5FEEA2BB0E8314AE598A3B2DE0A2140C7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
28
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2656
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2656
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7972
remcos.exe
GET
200
178.237.33.50:80
http://www.geoplugin.net/json.gp?ip=127.0.0.1
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
20.190.159.68:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2112
svchost.exe
40.127.240.158:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
login.live.com
  • 20.190.159.68
  • 20.190.159.71
  • 40.126.31.1
  • 40.126.31.67
  • 40.126.31.0
  • 40.126.31.129
  • 20.190.159.2
  • 20.190.159.128
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.248
  • 172.211.123.250
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.3.187.198
whitelisted
www.google.com
  • 142.250.185.164
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
REMCOS v1.7 Professional.zip