File name:

Laporan Survei Karyawan.PDF.exe

Full analysis: https://app.any.run/tasks/b4581bae-d939-4ced-bd63-68aa9362d955
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: June 26, 2025, 08:25:32
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
auto-reg
rat
remcos
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections
MD5:

EA22EBBBA9F0D0248332DB643BD2E6DA

SHA1:

B77C15B2F3569B3DA3AF91DCA1F0D66096481517

SHA256:

C1FA6E55486B388EB064F222153D7DF4580EB1C6D804EC5156411AC62254D4EF

SSDEEP:

24576:uRyguKuDowdTNfAqF7lLLQmxcHjctIhIYFCOcIW4lFDtwkuA7X4Y/GL28IhT3/:uRyguKuDowdTN5BlLLQmxajctIhIYFCU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • REMCOS has been detected

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 6228)

    • REMCOS mutex has been found

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 6228)

    • Changes the autorun value in the registry

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 6228)

    • REMCOS has been detected (YARA)

      • remcos.exe (PID: 6228)

  • SUSPICIOUS

    • Application launched itself

      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • remcos.exe (PID: 5020)
      • updater.exe (PID: 1324)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • remcos.exe (PID: 5020)

    • The process creates files with name similar to system file names

      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • remcos.exe (PID: 5020)

    • Executable content was dropped or overwritten

      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 5020)

    • Reads security settings of Internet Explorer

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 6228)

    • Starts itself from another location

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)

    • The process executes via Task Scheduler

      • updater.exe (PID: 1324)

    • Connects to unusual port

      • remcos.exe (PID: 6228)

    • There is functionality for taking screenshot (YARA)

      • remcos.exe (PID: 3880)
      • remcos.exe (PID: 6228)

  • INFO

    • Checks supported languages

      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 5020)
      • remcos.exe (PID: 3880)
      • remcos.exe (PID: 6228)
      • updater.exe (PID: 1324)
      • updater.exe (PID: 6472)

    • Creates files or folders in the user directory

      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • Laporan Survei Karyawan.PDF.exe (PID: 7048)

    • Create files in a temporary directory

      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • remcos.exe (PID: 5020)

    • The sample compiled with english language support

      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • Laporan Survei Karyawan.PDF.exe (PID: 7048)

    • Reads the computer name

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • Laporan Survei Karyawan.PDF.exe (PID: 2780)
      • remcos.exe (PID: 5020)
      • updater.exe (PID: 1324)
      • remcos.exe (PID: 3880)
      • remcos.exe (PID: 6228)

    • Reads the machine GUID from the registry

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 6228)

    • Checks proxy server information

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 6228)
      • slui.exe (PID: 4844)

    • Reads the software policy settings

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 6228)
      • slui.exe (PID: 4844)

    • Creates files in the program directory

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)

    • Launching a file from a Registry key

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)
      • remcos.exe (PID: 6228)

    • Process checks computer location settings

      • Laporan Survei Karyawan.PDF.exe (PID: 7048)

    • Process checks whether UAC notifications are on

      • updater.exe (PID: 1324)

    • Manual execution by a user

      • remcos.exe (PID: 3880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(6228) remcos.exe
C2 (3)104.37.4.100:6000
104.37.4.100:6001
104.37.4.100:6002
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-B3LFEQ
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2019:12:16 00:50:59+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 26624
InitializedDataSize: 186368
UninitializedDataSize: 2048
EntryPoint: 0x33fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.4.0.0
ProductVersionNumber: 1.4.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
Comments: haandskriften antimonate
CompanyName: pyoptysis bogstavelig
FileDescription: geologi
InternalName: mimus damascerer.exe
LegalTrademarks: houdah trawlfiskeris fuppen
ProductName: macerators clints skridtendes
ProductVersion: 1.4.0.0
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
8
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start laporan survei karyawan.pdf.exe #REMCOS laporan survei karyawan.pdf.exe remcos.exe updater.exe no specs updater.exe no specs remcos.exe no specs #REMCOS remcos.exe slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
1324"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --wake --systemC:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—svchost.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2780"C:\Users\admin\AppData\Local\Temp\Laporan Survei Karyawan.PDF.exe" C:\Users\admin\AppData\Local\Temp\Laporan Survei Karyawan.PDF.exe
explorer.exe
User:
admin
Company:
pyoptysis bogstavelig
Integrity Level:
MEDIUM
Description:
geologi
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\laporan survei karyawan.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3880"C:\ProgramData\Remcos\remcos.exe"C:\ProgramData\Remcos\remcos.exe—explorer.exe
User:
admin
Company:
pyoptysis bogstavelig
Integrity Level:
MEDIUM
Description:
geologi
Modules
Images
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4844C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5020"C:\ProgramData\Remcos\remcos.exe" C:\ProgramData\Remcos\remcos.exe
Laporan Survei Karyawan.PDF.exe
User:
admin
Company:
pyoptysis bogstavelig
Integrity Level:
MEDIUM
Description:
geologi
Exit code:
0
Modules
Images
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6228"C:\ProgramData\Remcos\remcos.exe" C:\ProgramData\Remcos\remcos.exe
remcos.exe
User:
admin
Company:
pyoptysis bogstavelig
Integrity Level:
MEDIUM
Description:
geologi
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Remcos
(PID) Process(6228) remcos.exe
C2 (3)104.37.4.100:6000
104.37.4.100:6001
104.37.4.100:6002
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-B3LFEQ
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
6472"C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=134.0.6985.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x111c460,0x111c46c,0x111c478C:\Program Files (x86)\Google\GoogleUpdater\134.0.6985.0\updater.exe—updater.exe
User:
SYSTEM
Company:
Google LLC
Integrity Level:
SYSTEM
Description:
Google Updater
Exit code:
0
Version:
134.0.6985.0
Modules
Images
c:\program files (x86)\google\googleupdater\134.0.6985.0\updater.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
7048"C:\Users\admin\AppData\Local\Temp\Laporan Survei Karyawan.PDF.exe" C:\Users\admin\AppData\Local\Temp\Laporan Survei Karyawan.PDF.exe
Laporan Survei Karyawan.PDF.exe
User:
admin
Company:
pyoptysis bogstavelig
Integrity Level:
MEDIUM
Description:
geologi
Exit code:
0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\laporan survei karyawan.pdf.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
5 422
Read events
5 403
Write events
19
Delete events
0

Modification events

(PID) Process:(2780) Laporan Survei Karyawan.PDF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\CLR\Start
Operation:writeName:CLR Start
Value:
2
(PID) Process:(2780) Laporan Survei Karyawan.PDF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5
(PID) Process:(2780) Laporan Survei Karyawan.PDF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0)
(PID) Process:(2780) Laporan Survei Karyawan.PDF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::VirtualAlloc(i 0,i 38658048, i 0x3000, i 0x40)p.r2
(PID) Process:(2780) Laporan Survei Karyawan.PDF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::ReadFile(i r5, i r2, i 38658048,*i 0, i 0)
(PID) Process:(2780) Laporan Survei Karyawan.PDF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
user32::EnumWindows(i r2 ,i 0)
(PID) Process:(7048) Laporan Survei Karyawan.PDF.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Rmc-B3LFEQ
Value:
"C:\ProgramData\Remcos\remcos.exe"
(PID) Process:(5020) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::CreateFileA(m r4 , i 0x80000000, i 0, p 0, i 4, i 0x80, i 0)i.r5
(PID) Process:(5020) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::SetFilePointer(i r5, i 13101 , i 0,i 0)
(PID) Process:(5020) remcos.exeKey:HKEY_CURRENT_USER\SOFTWARE\Service
Operation:writeName:System_Check
Value:
kernel32::ReadFile(i r5, i r2, i 38658048,*i 0, i 0)
Executable files
3
Suspicious files
7
Text files
10
Unknown types
6

Dropped files

PID
Process
Filename
Type
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Eris.initext
MD5:AEF92A42E89D632A22275AB117BC6068
SHA256:4DD6FC3F53AA1919706C87FA330E89F971050831844C62FD8D18F322B9CC6FB8
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Skrudet\stenkastene.jpgimage
MD5:8E52890BDF9FA28D90D366CB6FCDE015
SHA256:AA002A1A6BDADD8793603BB958DA7C8276091AD38E517A649DD545982054403B
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Skrudet\midwinters.initext
MD5:BB00B62E3EA37C99C52D7618066E6350
SHA256:5A5A2495AD4C03A1F223984B9DDB8F75881148808D1D84A9CDDC9E4B32DBE62E
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Skrudet\tins.initext
MD5:BF3D97C32AB148F648299771BA7081A0
SHA256:9FC706813A5B88855289728EF091D86516E5574664A1F6FCCC6A95CC1239FA4D
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Skrudet\forfladigelsen.initext
MD5:C9D70580BC3F17BBDD3B70591C629A02
SHA256:93497DB2D36BB1AD587F554CBA2475CCC79219DC68A1E9F1F5D21B5E1E6CEBAB
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Trugformet112.Kilbinary
MD5:6B8C16A3E74E83C8F2463E315B5CC9DD
SHA256:0EACB7BF4F1197F9A9DDD12BEE3FA084C889E4887642C5DEFCA0AE873EA5191B
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Skrudet\antibiotika.jpgimage
MD5:DD0A8ABE53291E83300F161FE7EC643F
SHA256:A51297329924EF24D80333441836402A3B4C188679932A2DF6F6630F6BF4166F
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Skrudet\airspace.chiabr
MD5:C688102A5F937218B5BA5AE8F98F3E5C
SHA256:6BE9559ED3A46CC546A4AD14F0AF8BD3B852D3F1C11B5F460A89E4192BF8734C
2780Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\Local\rutilate\alme\Skrudet\stikpillerne.slibinary
MD5:E81099871BFFF165C8479BCA98451AE1
SHA256:55E493F43E0A0444EC79C4663E3D4B63E713FF8B7150F871C5BE1E3E7D11CB8F
7048Laporan Survei Karyawan.PDF.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12der
MD5:4A90329071AE30B759D279CCA342B0A6
SHA256:4F544379EDA8E2653F71472AB968AEFD6B5D1F4B3CE28A5EDB14196184ED3B60
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
36
DNS requests
24
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5628
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5628
SIHClient.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2940
svchost.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7048
Laporan Survei Karyawan.PDF.exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/gsr1.crl
unknown
—
—
whitelisted
7048
Laporan Survei Karyawan.PDF.exe
GET
200
216.58.206.35:80
http://c.pki.goog/r/r4.crl
unknown
—
—
whitelisted
7048
Laporan Survei Karyawan.PDF.exe
GET
200
216.58.206.35:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQCebGtkb2cNegm%2FGwwoZmjS
unknown
—
—
whitelisted
7048
Laporan Survei Karyawan.PDF.exe
GET
200
216.58.206.35:80
http://o.pki.goog/we2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTuMJxAT2trYla0jia%2F5EUSmLrk3QQUdb7Ed66J9kQ3fc%2BxaB8dGuvcNFkCEQCLv9IIZH%2B2MBIS18%2FOut80
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
69.192.161.161:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2876
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1740
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7048
Laporan Survei Karyawan.PDF.exe
142.250.185.174:443
drive.google.com
GOOGLE
US
whitelisted
7048
Laporan Survei Karyawan.PDF.exe
216.58.206.35:80
c.pki.goog
GOOGLE
US
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
69.192.161.161:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 172.217.16.206
whitelisted
drive.google.com
  • 142.250.185.174
whitelisted
c.pki.goog
  • 216.58.206.35
whitelisted
o.pki.goog
  • 216.58.206.35
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.28
  • 23.216.77.42
whitelisted
www.microsoft.com
  • 69.192.161.161
whitelisted
drive.usercontent.google.com
  • 142.250.185.97
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.136
  • 40.126.32.140
  • 20.190.160.64
  • 20.190.160.130
  • 20.190.160.17
  • 20.190.160.20
  • 20.190.160.14
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted

Threats

PID
Process
Class
Message
—
—
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Laporan Survei Karyawan.PDF.exe