Malware analysis vfcompat.dll Malicious activity | ANY.RUN

Add for printing

File name:	vfcompat.dll
Full analysis:	https://app.any.run/tasks/3e8d1768-e5cf-4192-8c3d-faeb378c05ac
Verdict:	Malicious activity
Threats:	Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links. Remcos is a commercially distributed remote administration and surveillance tool that has been widely observed in unauthorized deployments, where threat actors use it to perform remote actions on compromised machines. It is actively maintained by its vendor, with new versions and feature updates released on a frequent, near-monthly basis. Remcos ist eine Malware vom Typ RAT, mit der Angreifer aus der Ferne Aktionen auf infizierten Computern durchführen können. Diese Malware ist extrem aktiv und wird fast jeden Monat mit Updates auf den neuesten Stand gebracht. Malware Trends Tracker >>>
Analysis date:	June 27, 2025, 22:41:58
OS:	Windows 10 Professional (build: 19044, 64 bit)
Tags:	remcos rat
Indicators:
MIME:	application/vnd.microsoft.portable-executable
File info:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows, 3 sections
MD5:	C14E25FBE264D836C8815A3E28B43940
SHA1:	30891D87A1F6C798E9297B5858A72A511FD68C62
SHA256:	E026D5FA9E9BB111944B65813541C5ED39E1D2C52602B1008856A9C5DF7A1A16
SSDEEP:	12288:2oypbEFG5GjffbkThCsUwpNueugPmBH6hS2FW3WU13sE:2oy4JsUwpNuLgPmBH6hS2w3WU13s

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

Launch configuration

Task duration:: 60 seconds
Heavy Evasion option:: off
Network geolocation:: off
Additional time used:: none
MITM proxy:: off
Privacy:: Public submission
Fakenet option:: off
Route via Tor:: off
Autoconfirmation of UAC:: on
Network:: on

Software preset

Internet Explorer 11.3636.19041.0
Adobe Acrobat (64-bit) (23.001.20093)
Adobe Flash Player 32 NPAPI (32.0.0.465)
Adobe Flash Player 32 PPAPI (32.0.0.465)
CCleaner (6.20)
FileZilla 3.65.0 (3.65.0)
Google Chrome (133.0.6943.127)
Google Update Helper (1.3.36.51)
Java 8 Update 271 (64-bit) (8.0.2710.9)
Java Auto Updater (2.8.271.9)
Microsoft Edge (133.0.3065.92)
Microsoft Office Professional 2019 - de-de (16.0.16026.20146)
Microsoft Office Professional 2019 - en-us (16.0.16026.20146)
Microsoft Office Professional 2019 - es-es (16.0.16026.20146)
Microsoft Office Professional 2019 - it-it (16.0.16026.20146)
Microsoft Office Professional 2019 - ja-jp (16.0.16026.20146)
Microsoft Office Professional 2019 - ko-kr (16.0.16026.20146)
Microsoft Office Professional 2019 - pt-br (16.0.16026.20146)
Microsoft Office Professional 2019 - tr-tr (16.0.16026.20146)
Microsoft Office Professionnel 2019 - fr-fr (16.0.16026.20146)
Microsoft Office профессиональный 2019 - ru-ru (16.0.16026.20146)
Microsoft OneNote - en-us (16.0.16026.20146)
Microsoft Update Health Tools (3.74.0.0)
Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501 (12.0.30501.0)
Microsoft Visual C++ 2013 x64 Additional Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2013 x64 Minimum Runtime - 12.0.21005 (12.0.21005)
Microsoft Visual C++ 2015-2022 Redistributable (x64) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2015-2022 Redistributable (x86) - 14.36.32532 (14.36.32532.0)
Microsoft Visual C++ 2022 X64 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Additional Runtime - 14.36.32532 (14.36.32532)
Microsoft Visual C++ 2022 X86 Minimum Runtime - 14.36.32532 (14.36.32532)
Mozilla Firefox (x64 en-US) (136.0)
Mozilla Maintenance Service (136.0)
Notepad++ (64-bit x64) (7.9.1)
Office 16 Click-to-Run Extensibility Component (16.0.15726.20202)
Office 16 Click-to-Run Licensing Component (16.0.16026.20146)
Office 16 Click-to-Run Localization Component (16.0.15726.20202)
Office 16 Click-to-Run Localization Component (16.0.15928.20198)
PowerShell 7-x64 (7.3.5.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.59.0.0)
Update for Windows 10 for x64-based Systems (KB4023057) (2.63.0.0)
Update for Windows 10 for x64-based Systems (KB4480730) (2.55.0.0)
Update for Windows 10 for x64-based Systems (KB5001716) (8.93.0.0)
VLC media player (3.0.11)
WinRAR 5.91 (64-bit) (5.91.0)
Windows PC Health Check (3.6.2204.08001)

Hotfixes

Client LanguagePack Package
DotNetRollup
DotNetRollup 481
FodMetadata Package
Foundation Package
Hello Face Package
InternetExplorer Optional Package
KB5003791
KB5011048
KB5015684
KB5033052
LanguageFeatures Basic en us Package
LanguageFeatures Handwriting en us Package
LanguageFeatures OCR en us Package
LanguageFeatures Speech en us Package
LanguageFeatures TextToSpeech en us Package
MSPaint FoD Package
MediaPlayer Package
Microsoft OneCore ApplicationModel Sync Desktop FOD Package
Microsoft OneCore DirectX Database FOD Package
NetFx3 OnDemand Package
Notepad FoD Package
OpenSSH Client Package
PowerShell ISE FOD Package
Printing PMCPPC FoD Package
Printing WFS FoD Package
ProfessionalEdition
QuickAssist Package
RollupFix
ServicingStack
ServicingStack 3989
StepsRecorder Package
TabletPCMath Package
UserExperience Desktop Package
WordPad FoD Package

Add for printing

MALICIOUS
- REMCOS mutex has been found
  - wab.exe (PID: 1096)
- REMCOS has been detected
  - wab.exe (PID: 1096)
- REMCOS has been detected (YARA)
  - wab.exe (PID: 1096)
SUSPICIOUS
- Connects to unusual port
  - wab.exe (PID: 1096)
- There is functionality for taking screenshot (YARA)
  - wab.exe (PID: 1096)
INFO
- Manual execution by a user
  - wab.exe (PID: 1096)
  - msinfo32.exe (PID: 2368)
- Reads the software policy settings
  - rundll32.exe (PID: 2708)
  - SearchApp.exe (PID: 5328)
- Checks proxy server information
  - rundll32.exe (PID: 2708)
- Reads the computer name
  - wab.exe (PID: 1096)
- Checks supported languages
  - wab.exe (PID: 1096)
  - SearchApp.exe (PID: 5328)
- Reads the machine GUID from the registry
  - SearchApp.exe (PID: 5328)
- Process checks computer location settings
  - SearchApp.exe (PID: 5328)

Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Add for printing

Remcos

(PID) Process(1096) wab.exe

C2 (1)172.16.219.134:9348

BotnetRemoteHost

Options

Connect_interval1

Install_flagFalse

Install_HKCU\RunTrue

Install_HKLM\RunTrue

Install_HKLM\Explorer\Run1

Setup_path%LOCALAPPDATA%

Copy_fileremcos.exe

Startup_valueRemcos

Hide_fileFalse

Mutex_nameRmc-797PJS

Keylog_flag0

Keylog_path%LOCALAPPDATA%

Keylog_filelogs.dat

Keylog_cryptFalse

Hide_keylogFalse

Screenshot_flagFalse

Screenshot_time5

Take_ScreenshotFalse

Screenshot_path%APPDATA%

Screenshot_fileScreenshots

Screenshot_cryptFalse

Mouse_optionFalse

Delete_fileFalse

Audio_record_time5

Audio_path%ProgramFiles%

Audio_dirMicRecords

Connect_delay0

Copy_dirRemcos

Keylog_dirremcos

Max_keylog_file100000

No Malware configuration.

Add for printing

TRiD

.exe	\|	Generic Win/DOS Executable (50)
.exe	\|	DOS Executable Generic (49.9)

EXIF

EXE

MachineType:	AMD AMD64
TimeStamp:	2025:06:27 22:39:08+00:00
ImageFileCharacteristics:	Executable, Large address aware, DLL
PEType:	PE32+
LinkerVersion:	14
CodeSize:	660992
InitializedDataSize:	105984
UninitializedDataSize:	-
EntryPoint:	0x90500
OSVersion:	6
ImageVersion:	-
SubsystemVersion:	6
Subsystem:	Windows GUI

No data.

Add for printing

All screenshots are available in the full report

Add for printing

Total processes

140

Monitored processes

Malicious processes

Suspicious processes

Behavior graph

Click at the process to see the details

Process information

PID

CMD

Path

Indicators

Parent process

1096

"C:\Program Files (x86)\Windows Mail\wab.exe"

C:\Program Files (x86)\Windows Mail\wab.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Contacts

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\users\admin\appdata\local\temp\wc6206.tmp
c:\program files (x86)\windows mail\wab.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll

Remcos

(PID) Process(1096) wab.exe

C2 (1)172.16.219.134:9348

BotnetRemoteHost

Options

Connect_interval1

Install_flagFalse

Install_HKCU\RunTrue

Install_HKLM\RunTrue

Install_HKLM\Explorer\Run1

Setup_path%LOCALAPPDATA%

Copy_fileremcos.exe

Startup_valueRemcos

Hide_fileFalse

Mutex_nameRmc-797PJS

Keylog_flag0

Keylog_path%LOCALAPPDATA%

Keylog_filelogs.dat

Keylog_cryptFalse

Hide_keylogFalse

Screenshot_flagFalse

Screenshot_time5

Take_ScreenshotFalse

Screenshot_path%APPDATA%

Screenshot_fileScreenshots

Screenshot_cryptFalse

Mouse_optionFalse

Delete_fileFalse

Audio_record_time5

Audio_path%ProgramFiles%

Audio_dirMicRecords

Connect_delay0

Copy_dirRemcos

Keylog_dirremcos

Max_keylog_file100000

2368

"C:\WINDOWS\system32\msinfo32.exe"

C:\Windows\System32\msinfo32.exe

—

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

System Information

Version:

10.0.19041.3636 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\msinfo32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll

2708

"C:\Windows\System32\rundll32.exe" vfcompat.dll, IEX

C:\Windows\System32\rundll32.exe

explorer.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows host process (Rundll32)

Exit code:

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll

4816

C:\WINDOWS\System32\slui.exe -Embedding

C:\Windows\System32\slui.exe

—

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

MEDIUM

Description:

Windows Activation Client

Version:

10.0.19041.1 (WinBuild.160101.0800)

Modules

Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll

5328

"C:\WINDOWS\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

svchost.exe

User:

admin

Company:

Microsoft Corporation

Integrity Level:

LOW

Description:

Search application

Version:

10.0.19041.3996 (WinBuild.160101.0800)

Modules

Images
c:\windows\systemapps\microsoft.windows.search_cw5n1h2txyewy\searchapp.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\combase.dll

Add for printing

Total events

2 042

Read events

2 026

Write events

Delete events

Modification events


(PID) Process:	(1096) wab.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Rmc-797PJS
Operation:	write	Name:	exepath
Value: A3056D99ECE7773697D16A99E889E4158EFB3F0865F9284BF17C22CCE3B921B38BCEAE8345F2BF9B97F90DEA6009B8CD4974916134AB7D0386F184F1D8445C3E762472979AE8D94791B61744848BBE51F8902287260E1642
(PID) Process:	(1096) wab.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Rmc-797PJS
Operation:	write	Name:	licence
Value: 59620C4CC275872C64E4CFC69D464182
(PID) Process:	(5328) SearchApp.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting
Operation:	delete value	Name:	CachedFeatureString
Value:
(PID) Process:	(5328) SearchApp.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\A1hdl50UVDh2ZbG324Nx-6fZgntcGnHOs5kHLdmaJYE\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Speech_OneCore\Recognizers
Operation:	write	Name:	DefaultTokenId
Value: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN
(PID) Process:	(5328) SearchApp.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:	write	Name:	IsMSACloudSearchEnabled
Value: 0
(PID) Process:	(5328) SearchApp.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\SearchSettings
Operation:	write	Name:	IsAADCloudSearchEnabled
Value: 0
(PID) Process:	(5328) SearchApp.exe	Key:	HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search
Operation:	write	Name:	CortanaStateLastRun
Value: 521E5F6800000000
(PID) Process:	(5328) SearchApp.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:	write	Name:	Total
Value: 1517
(PID) Process:	(5328) SearchApp.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:	write	Name:	Total
Value: 949
(PID) Process:	(5328) SearchApp.exe	Key:	HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com
Operation:	write	Name:	Total
Value: 1675

Add for printing

Executable files

Suspicious files

Text files

Unknown types

Dropped files

PID	Process	Filename		Type
2708	rundll32.exe	C:\Users\admin\AppData\Local\Temp\wc6206.tmp		—
		MD5:—	SHA256:—
5328	SearchApp.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187		binary
		MD5:FF3DFE916B6D66A815E8EE635894DED2	SHA256:224F6CFA5445F6DE7DF046C142D3285DACC88F276F2C441F3FA60BEC5B9B5118
5328	SearchApp.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres		binary
		MD5:1AD3B7DA1D5E4CBF989EB21823F066B4	SHA256:69E4EEB7CF9534DF9BCC397983F75498EEB66D19E9832D2EAD29119FFEA21813
5328	SearchApp.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187		binary
		MD5:63735AD7CA4962AA5D065213815C0311	SHA256:696B5D170DBE386377E82353D7218102E17920B41E51CC037C868A1DB50D0BAB
5328	SearchApp.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D		binary
		MD5:8B9E91468B2A01155A2B401A5EC61C0F	SHA256:A171F393A13EEF8F2B15CA83DAF04698BCA1FB249B32C77AFF07091E3A471BF7
5328	SearchApp.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\ZWUI0EBX\www.bing[1].xml		text
		MD5:D506EA25EE063E9B27477E0F72A29558	SHA256:6F7EF967ED5A263C32238BB6F410DCFCC6E3F0BA3D9A5821891DD1C9769EF9FA
5328	SearchApp.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\Q84V0JUH\fpconfig.min[1].json		binary
		MD5:50904A06BC16803B621B17BB4A6B1C8D	SHA256:5D8CF6725BB1A25877323AB2E7C8E31A1539B14D6F05D300D63604CC66D7CA96
5328	SearchApp.exe	C:\Users\admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10D		binary
		MD5:E2EAB01D8F3704E1C1367FC67E7A7D9C	SHA256:19EE5D2AD2E3F924154C6239912110E4171B1722D6E7BB0FA9A115D82DE9C9C7

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Add for printing

HTTP(S) requests

TCP/UDP connections

DNS requests

Threats

HTTP requests

PID	Process	Method	HTTP Code	IP	URL	CN	Type	Size	Reputation
1268	svchost.exe	GET	200	69.192.161.161:80	http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl	unknown	—	—	whitelisted
1268	svchost.exe	GET	200	23.48.23.166:80	http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl	unknown	—	—	whitelisted
5328	SearchApp.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D	unknown	—	—	whitelisted
7020	svchost.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D	unknown	—	—	whitelisted
3876	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl	unknown	—	—	whitelisted
3876	SIHClient.exe	GET	200	184.30.21.171:80	http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl	unknown	—	—	whitelisted
5328	SearchApp.exe	GET	200	2.17.190.73:80	http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D	unknown	—	—	whitelisted

Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID	Process	IP	Domain	ASN	CN	Reputation
4	System	192.168.100.255:137	—	—	—	whitelisted
5944	MoUsoCoreWorker.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
1268	svchost.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
4860	RUXIMICS.exe	51.104.136.2:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	IE	whitelisted
2708	rundll32.exe	104.21.80.1:443	www2.0zz0.com	CLOUDFLARENET	—	whitelisted
4	System	192.168.100.255:138	—	—	—	whitelisted
1096	wab.exe	172.16.219.134:9348	—	—	—	unknown
1268	svchost.exe	20.73.194.208:443	settings-win.data.microsoft.com	MICROSOFT-CORP-MSN-AS-BLOCK	NL	whitelisted
1268	svchost.exe	23.48.23.166:80	crl.microsoft.com	Akamai International B.V.	DE	whitelisted
1268	svchost.exe	69.192.161.161:80	www.microsoft.com	AKAMAI-AS	DE	whitelisted

DNS requests

Domain	IP	Reputation
settings-win.data.microsoft.com	51.104.136.2 20.73.194.208 4.231.128.59	whitelisted
google.com	216.58.212.174	whitelisted
www2.0zz0.com	104.21.80.1 104.21.48.1 104.21.64.1 104.21.16.1 104.21.112.1 104.21.96.1 104.21.32.1	whitelisted
crl.microsoft.com	23.48.23.166 23.48.23.147 23.48.23.177 23.48.23.156 23.48.23.173 23.48.23.164 23.48.23.143 23.48.23.180 23.48.23.145	whitelisted
www.microsoft.com	69.192.161.161 184.30.21.171	whitelisted
login.live.com	40.126.32.76 20.190.160.67 20.190.160.132 20.190.160.14 40.126.32.133 20.190.160.128 20.190.160.64 40.126.32.68	whitelisted
ocsp.digicert.com	2.17.190.73	whitelisted
nexusrules.officeapps.live.com	52.111.227.14	whitelisted
www.bing.com	92.123.104.38 92.123.104.31 92.123.104.32 92.123.104.63 92.123.104.34 92.123.104.33	whitelisted
slscr.update.microsoft.com	52.149.20.212	whitelisted

Threats

PID	Process	Class	Message
—	—	Unknown Traffic	ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)

Add for printing

No debug info

General Info

vfcompat.dll

C14E25FBE264D836C8815A3E28B43940

30891D87A1F6C798E9297B5858A72A511FD68C62

E026D5FA9E9BB111944B65813541C5ED39E1D2C52602B1008856A9C5DF7A1A16

12288:2oypbEFG5GjffbkThCsUwpNueugPmBH6hS2FW3WU13sE:2oy4JsUwpNuLgPmBH6hS2w3WU13s

Software environment set and analysis options

Launch configuration

Software preset

Hotfixes

Behavior activities

MALICIOUS

REMCOS mutex has been found

REMCOS has been detected

REMCOS has been detected (YARA)

SUSPICIOUS

Connects to unusual port

There is functionality for taking screenshot (YARA)

INFO

Manual execution by a user

Reads the software policy settings

Checks proxy server information

Reads the computer name

Checks supported languages

Reads the machine GUID from the registry

Process checks computer location settings

Malware configuration

Remcos

Static information

TRiD

EXIF

EXE

Video and screenshots

Processes

Behavior graph

Specs description

Process information

Information

Modules

Malware configuration

Remcos

Information

Modules

Information

Modules

Information

Modules

Information

Modules

Registry activity

Modification events

Files activity

Dropped files

Network activity

HTTP requests

Connections

DNS requests

Threats

Debug output strings