File name:

Approved bonuses.rar

Full analysis: https://app.any.run/tasks/3603bd01-03d8-44af-bfed-17fd951b4bcd
Verdict: Malicious activity
Threats:

Remote access trojans (RATs) are a type of malware that enables attackers to establish complete to partial control over infected computers. Such malicious programs often have a modular design, offering a wide range of functionalities for conducting illicit activities on compromised systems. Some of the most common features of RATs include access to the users’ data, webcam, and keystrokes. This malware is often distributed through phishing emails and links.

Malware Trends Tracker     >>>
Analysis date: April 17, 2026, 04:37:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
rat
remcos
remote
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

B80CD64775D30B791D5EED8BA4D0C13B

SHA1:

6AC1A2539AC839910100FD8DC8A78B93BF2AE5D5

SHA256:

F0BA3C05EF14646474B74B5C93D85EDD2E2A9FF07DF582BC09AC2C1D0115C7A2

SSDEEP:

12288:suvzg12P7kMYAk/Lfv6l029vAnxVDbXTWz5voSV5o:swzg1StTk/jv6l029vAnxVDbXU5g

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • Approved bonuses.exe (PID: 5724)
      • Approved bonuses.exe (PID: 2368)
      • Approved bonuses.exe (PID: 2956)
      • Approved bonuses.exe (PID: 7764)
      • remcos.exe (PID: 5228)
      • remcos.exe (PID: 508)
      • remcos.exe (PID: 6796)
      • remcos.exe (PID: 4480)
      • Approved bonuses.exe (PID: 7760)
      • Approved bonuses.exe (PID: 7740)
      • Approved bonuses.exe (PID: 5140)
      • Approved bonuses.exe (PID: 5160)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 880)
      • Approved bonuses.exe (PID: 6272)
      • Approved bonuses.exe (PID: 6092)
      • Approved bonuses.exe (PID: 5988)
      • Approved bonuses.exe (PID: 7760)
      • Approved bonuses.exe (PID: 2532)
      • Approved bonuses.exe (PID: 4816)

    • REMCOS has been detected (YARA)

      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 6796)
      • Approved bonuses.exe (PID: 5140)
      • Approved bonuses.exe (PID: 6092)
      • Approved bonuses.exe (PID: 2532)

    • REMCOS has been detected

      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 6796)

    • Changes the autorun value in the registry

      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 6796)

    • REMCOS has been detected (SURICATA)

      • remcos.exe (PID: 6796)

  • SUSPICIOUS

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Approved bonuses.exe (PID: 5724)
      • remcos.exe (PID: 5228)
      • Approved bonuses.exe (PID: 7760)
      • Approved bonuses.exe (PID: 880)

    • The process creates files with name similar to system file names

      • Approved bonuses.exe (PID: 5724)
      • remcos.exe (PID: 5228)
      • Approved bonuses.exe (PID: 7760)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 880)

    • Executable content was dropped or overwritten

      • Approved bonuses.exe (PID: 5724)
      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 5228)
      • Approved bonuses.exe (PID: 7760)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 880)

    • Executable file located in non-executable user directories

      • Approved bonuses.exe (PID: 5724)
      • remcos.exe (PID: 5228)
      • Approved bonuses.exe (PID: 7760)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 880)

    • Application launched itself

      • Approved bonuses.exe (PID: 5724)
      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 5228)
      • remcos.exe (PID: 6796)
      • Approved bonuses.exe (PID: 7760)
      • Approved bonuses.exe (PID: 5140)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 6092)
      • Approved bonuses.exe (PID: 2532)
      • Approved bonuses.exe (PID: 880)

    • Starts itself from another location

      • Approved bonuses.exe (PID: 2956)

    • Contacting a server suspected of hosting an CnC

      • remcos.exe (PID: 6796)

  • INFO

    • Generic archive extractor

      • WinRAR.exe (PID: 2960)

    • Checks supported languages

      • Approved bonuses.exe (PID: 5724)
      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 5228)
      • Approved bonuses.exe (PID: 7760)
      • remcos.exe (PID: 6796)
      • Approved bonuses.exe (PID: 5140)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 880)
      • Approved bonuses.exe (PID: 6092)
      • Approved bonuses.exe (PID: 2532)

    • The sample compiled with english language support

      • WinRAR.exe (PID: 2960)
      • Approved bonuses.exe (PID: 2956)
      • firefox.exe (PID: 7652)

    • Reads the computer name

      • Approved bonuses.exe (PID: 5724)
      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 5228)
      • Approved bonuses.exe (PID: 7760)
      • remcos.exe (PID: 6796)
      • Approved bonuses.exe (PID: 5140)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 880)
      • Approved bonuses.exe (PID: 6092)
      • Approved bonuses.exe (PID: 2532)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 2960)
      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 6796)
      • Approved bonuses.exe (PID: 5140)
      • Approved bonuses.exe (PID: 6092)
      • Approved bonuses.exe (PID: 2532)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 2960)
      • firefox.exe (PID: 7652)

    • Create files in a temporary directory

      • Approved bonuses.exe (PID: 5724)
      • remcos.exe (PID: 5228)
      • Approved bonuses.exe (PID: 7760)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 880)

    • There is functionality for taking screenshot (YARA)

      • Approved bonuses.exe (PID: 5724)
      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 5228)
      • Approved bonuses.exe (PID: 7760)
      • remcos.exe (PID: 6796)
      • Approved bonuses.exe (PID: 880)
      • Approved bonuses.exe (PID: 5140)
      • Approved bonuses.exe (PID: 2588)
      • Approved bonuses.exe (PID: 6092)
      • Approved bonuses.exe (PID: 2532)

    • Reads the machine GUID from the registry

      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 6796)
      • Approved bonuses.exe (PID: 5140)
      • Approved bonuses.exe (PID: 6092)
      • Approved bonuses.exe (PID: 2532)

    • Creates files or folders in the user directory

      • Approved bonuses.exe (PID: 2956)

    • Launching a file from a Registry key

      • Approved bonuses.exe (PID: 2956)
      • remcos.exe (PID: 6796)

    • Process checks computer location settings

      • Approved bonuses.exe (PID: 2956)

    • Manual execution by a user

      • Approved bonuses.exe (PID: 7760)
      • firefox.exe (PID: 5484)
      • Approved bonuses.exe (PID: 880)

    • Application launched itself

      • firefox.exe (PID: 7652)
      • firefox.exe (PID: 5484)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Remcos

(PID) Process(2956) Approved bonuses.exe
C2 (1)192.227.135.240:3000
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-40TJWS
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
(PID) Process(6796) remcos.exe
C2 (1)192.227.135.240:3000
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-40TJWS
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
(PID) Process(5140) Approved bonuses.exe
C2 (1)192.227.135.240:3000
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-40TJWS
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
(PID) Process(6092) Approved bonuses.exe
C2 (1)192.227.135.240:3000
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-40TJWS
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
(PID) Process(2532) Approved bonuses.exe
C2 (1)192.227.135.240:3000
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-40TJWS
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 381681
UncompressedSize: 736488
OperatingSystem: Win32
ArchivedFileName: Approved bonuses.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
165
Monitored processes
32
Malicious processes
11
Suspicious processes
10

Behavior graph

Click at the process to see the details
start winrar.exe approved bonuses.exe approved bonuses.exe no specs #REMCOS approved bonuses.exe approved bonuses.exe no specs remcos.exe approved bonuses.exe remcos.exe no specs #REMCOS remcos.exe remcos.exe no specs firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs firefox.exe no specs approved bonuses.exe no specs #REMCOS approved bonuses.exe approved bonuses.exe no specs approved bonuses.exe approved bonuses.exe approved bonuses.exe no specs #REMCOS approved bonuses.exe approved bonuses.exe no specs approved bonuses.exe no specs #REMCOS approved bonuses.exe approved bonuses.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
508"C:\ProgramData\Remcos\remcos.exe" C:\ProgramData\Remcos\remcos.exe—remcos.exe
User:
admin
Company:
transmutableness
Integrity Level:
MEDIUM
Description:
rationalizables skabelsesberetnings
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
880"C:\Users\admin\Desktop\Approved bonuses.exe" C:\Users\admin\Desktop\Approved bonuses.exe
explorer.exe
User:
admin
Company:
transmutableness
Integrity Level:
MEDIUM
Description:
rationalizables skabelsesberetnings
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\users\admin\desktop\approved bonuses.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2368"C:\Users\admin\AppData\Local\Temp\Rar$EXa2960.31859\Approved bonuses.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2960.31859\Approved bonuses.exe—Approved bonuses.exe
User:
admin
Company:
transmutableness
Integrity Level:
MEDIUM
Description:
rationalizables skabelsesberetnings
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2960.31859\approved bonuses.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
2532"C:\Users\admin\Desktop\Approved bonuses.exe" C:\Users\admin\Desktop\Approved bonuses.exe
Approved bonuses.exe
User:
admin
Company:
transmutableness
Integrity Level:
MEDIUM
Description:
rationalizables skabelsesberetnings
Version:
1.4.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\desktop\approved bonuses.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Remcos
(PID) Process(2532) Approved bonuses.exe
C2 (1)192.227.135.240:3000
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-40TJWS
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
2588"C:\Users\admin\AppData\Local\Temp\Rar$EXa2960.46502\Approved bonuses.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2960.46502\Approved bonuses.exe
WinRAR.exe
User:
admin
Company:
transmutableness
Integrity Level:
MEDIUM
Description:
rationalizables skabelsesberetnings
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa2960.46502\approved bonuses.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
2956"C:\Users\admin\AppData\Local\Temp\Rar$EXa2960.31859\Approved bonuses.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa2960.31859\Approved bonuses.exe
Approved bonuses.exe
User:
admin
Company:
transmutableness
Integrity Level:
MEDIUM
Description:
rationalizables skabelsesberetnings
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\appdata\local\temp\rar$exa2960.31859\approved bonuses.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Remcos
(PID) Process(2956) Approved bonuses.exe
C2 (1)192.227.135.240:3000
BotnetRemoteHost
Options
Connect_interval1
Install_flagTrue
Install_HKCU\RunTrue
Install_HKLM\RunTrue
Install_HKLM\Explorer\Run1
Install_HKLM\Winlogon\Shell100000
Setup_path%LOCALAPPDATA%
Copy_fileremcos.exe
Startup_valueFalse
Hide_fileFalse
Mutex_nameRmc-40TJWS
Keylog_flag0
Keylog_path%LOCALAPPDATA%
Keylog_filelogs.dat
Keylog_cryptFalse
Hide_keylogFalse
Screenshot_flagFalse
Screenshot_time5
Take_ScreenshotFalse
Screenshot_path%APPDATA%
Screenshot_fileScreenshots
Screenshot_cryptFalse
Mouse_optionFalse
Delete_fileFalse
Audio_record_time5
Audio_path1
Audio_dirMicRecords
Connect_delay0
Copy_dirRemcos
Keylog_dirremcos
2960"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Approved bonuses.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3104"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250227124745 -sandboxingKind 0 -prefsHandle 4856 -prefsLen 45425 -prefMapHandle 4840 -prefMapSize 273045 -ipcHandle 4872 -initialChannelId {a901e398-9793-4275-96a1-d997b9a533d7} -parentPid 7652 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7652" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utilityC:\Program Files\Mozilla Firefox\firefox.exe—firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Version:
136.0
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\vcruntime140.dll
c:\windows\system32\vcruntime140_1.dll
4480"C:\ProgramData\Remcos\remcos.exe" C:\ProgramData\Remcos\remcos.exe—remcos.exe
User:
admin
Company:
transmutableness
Integrity Level:
MEDIUM
Description:
rationalizables skabelsesberetnings
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\programdata\remcos\remcos.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4816"C:\Users\admin\Desktop\Approved bonuses.exe" C:\Users\admin\Desktop\Approved bonuses.exe—Approved bonuses.exe
User:
admin
Company:
transmutableness
Integrity Level:
MEDIUM
Description:
rationalizables skabelsesberetnings
Exit code:
0
Version:
1.4.0.0
Modules
Images
c:\users\admin\desktop\approved bonuses.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
Total events
26 964
Read events
14 569
Write events
12 382
Delete events
13

Modification events

(PID) Process:(2960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(2960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(2960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Downloads\chromium_build 1.zip
(PID) Process:(2960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Approved bonuses.rar
(PID) Process:(2960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2960) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5724) Approved bonuses.exeKey:HKEY_CURRENT_USER\reinsurance\anvendelsesform
Operation:writeName:sennite
Value:
FF6A52FC
(PID) Process:(5724) Approved bonuses.exeKey:HKEY_CURRENT_USER\sulphatocarbonic\Brith
Operation:writeName:Chinles
Value:
c:\Daphnid206\Terminsydelse.bin
Executable files
13
Suspicious files
246
Text files
1 906
Unknown types
3

Dropped files

PID
Process
Filename
Type
5724Approved bonuses.exeC:\Users\admin\AppData\Local\Temp\sfyrbders\Skosvrte\Londonish\Fodboldbanens.polbinary
MD5:239191E7372941CA477DF298382CE2D9
SHA256:4F808038A686320277EC6356EC97B30EE85461B7B0AEA6B3BFDF29096288734F
5724Approved bonuses.exeC:\Users\admin\AppData\Local\Temp\sfyrbders\Skosvrte\Londonish\heliophobe.shabinary
MD5:D6EDA4D4E5331DE27177C33E07773989
SHA256:B1913EF61D8E7C1A9DEC0DE207782F06622D29534F279A2F0621B2FC1836F162
5724Approved bonuses.exeC:\Users\admin\AppData\Local\Temp\sfyrbders\Skosvrte\Flatterers.vapbinary
MD5:9E2D079D66FB188544A2A51BC43CC3C7
SHA256:F93EF70DC168103559DE288CB016AD47902B457785479E87FF0A0AC60770A5D3
5724Approved bonuses.exeC:\Users\admin\AppData\Local\Temp\nsoC571.tmpbinary
MD5:8CE4B16B22B58894AA86C421E8759DF3
SHA256:8254C329A92850F6D539DD376F4816EE2764517DA5E0235514AF433164480D7A
5724Approved bonuses.exeC:\Users\admin\AppData\Local\Temp\sfyrbders\Skosvrte\Elaphebolionbinary
MD5:5787EC58A65B81DDE17FCEDABC73569F
SHA256:2DF3756DAC9C5D9210F0CE0219C8CA9BDC94B6C274DF39095033C72DB74757D9
2960WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa2960.31859\Approved bonuses.exeexecutable
MD5:6475F71200C3EEB18953D76916FA2705
SHA256:5646873F89E3468C306385EF3D65B7DAF63AEEE4128553C3224C75CB0E6902CA
5724Approved bonuses.exeC:\Users\admin\AppData\Local\Temp\sfyrbders\Skosvrte\Nonpurgatorialbinary
MD5:8314C8E85C004BA10039AB8424787315
SHA256:8F81955E512F13B812703457D883D0E129899C5FC735D074569BFD92AFA26F53
2956Approved bonuses.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:75C9696789E6842355477E4C0D225D48
SHA256:4AF2F07D060049989C931EB2953454CD4BEE9F1B10E35F96FED969D2558391FE
5724Approved bonuses.exeC:\Users\admin\AppData\Local\Temp\nsj4CF.tmpbinary
MD5:8CE4B16B22B58894AA86C421E8759DF3
SHA256:8254C329A92850F6D539DD376F4816EE2764517DA5E0235514AF433164480D7A
5724Approved bonuses.exeC:\Users\admin\AppData\Local\Temp\nsuE0CA.tmpbinary
MD5:8CE4B16B22B58894AA86C421E8759DF3
SHA256:8254C329A92850F6D539DD376F4816EE2764517DA5E0235514AF433164480D7A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
142
TCP/UDP connections
69
DNS requests
132
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5584
svchost.exe
GET
304
40.127.240.158:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/UpdateHealthTools?os=Windows&osVer=10.0.19041.1.amd64fre.vb_release.191206-&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3626&FlightRing=Retail&TelemetryLevel=1&HidOverGattReg=C%3A%5CWINDOWS%5CSystem32%5CDriverStore%5CFileRepository%5Chidbthle.inf_amd64_9610b4821fdf82a5%5CMicrosoft.Bluetooth.Profiles.HidOverGatt.dll&AppVer=&ProcessorIdentifier=AMD64%20Family%2023%20Model%201%20Stepping%202&OEMModel=DELL&UpdateOfferedDays=4294967295&ProcessorManufacturer=AuthenticAMD&InstallDate=1661339444&OEMModelBaseBoard=&BranchReadinessLevel=CB&OEMSubModel=J5CR&IsCloudDomainJoined=0&DeferFeatureUpdatePeriodInDays=30&IsDeviceRetailDemo=0&FlightingBranchName=&OSUILocale=en-US&DeviceFamily=Windows.Desktop&WuClientVer=10.0.19041.3996&UninstallActive=1&IsFlightingEnabled=0&OSSkuId=48&ProcessorClockSpeed=3094&TotalPhysicalRAM=6144&SecureBootCapable=0&App=SedimentPack&ProcessorCores=6&CurrentBranch=vb_release&InstallLanguage=en-US&DeferQualityUpdatePeriodInDays=0&OEMName_Uncleaned=DELL&TPMVersion=0&PrimaryDiskTotalCapacity=262144&InstallationType=Client&AttrDataVer=186&ProcessorModel=AMD%20Ryzen%205%203500%206-Core%20Processor&IsEdgeWithChromiumInstalled=1&OSVersion=10.0.19045.4046&IsMDMEnrolled=0&ActivationChannel=Retail&FirmwareVersion=A.40&TrendInstalledKey=1&OSArchitecture=AMD64&DefaultUserRegion=244&UpdateManagementGroup=2
US
—
—
whitelisted
996
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
996
SIHClient.exe
GET
200
74.178.76.54:443
https://fe3cr.delivery.mp.microsoft.com/clientwebservice/ping
US
—
—
whitelisted
996
SIHClient.exe
GET
200
74.178.240.61:443
https://slscr.update.microsoft.com/sls/ping
US
—
—
whitelisted
996
SIHClient.exe
GET
304
74.178.240.61:443
https://slscr.update.microsoft.com/SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.4046/0?CH=686&L=en-US&P=&PT=0x30&WUA=10.0.19041.3996&MK=DELL&MD=DELL
US
—
—
whitelisted
2956
Approved bonuses.exe
GET
303
192.178.25.206:443
https://drive.google.com/uc?export=download&id=1w-P3o07hlsvfExTbIzIMfFsWbWr23TtB
US
—
—
whitelisted
5316
svchost.exe
GET
200
23.11.40.157:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAz1vQYrVgL0erhQLCPM8GY%3D
NL
binary
471 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
23.209.125.34:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5276
MoUsoCoreWorker.exe
GET
200
23.210.18.103:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
5316
svchost.exe
POST
400
20.190.159.64:443
https://login.live.com/ppsecure/deviceaddcredential.srf
US
text
203 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5584
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4
System
192.168.100.255:137
—
Not routed
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
48.192.1.64:443
activation-v2.sls.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5276
MoUsoCoreWorker.exe
23.209.125.34:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5276
MoUsoCoreWorker.exe
23.210.18.103:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:138
—
Not routed
—
whitelisted
3428
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5316
svchost.exe
23.11.40.157:80
ocsp.digicert.com
AKAMAI-AMS
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
  • 40.127.240.158
whitelisted
activation-v2.sls.microsoft.com
  • 48.192.1.64
whitelisted
crl.microsoft.com
  • 23.209.125.34
whitelisted
google.com
  • 172.217.17.206
whitelisted
www.microsoft.com
  • 23.210.18.103
whitelisted
client.wns.windows.com
  • 172.211.123.249
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 23.11.40.157
whitelisted
slscr.update.microsoft.com
  • 74.178.240.61
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 74.178.76.54
whitelisted

Threats

PID
Process
Class
Message
5584
svchost.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
2956
Approved bonuses.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] HTTP request to Google Drive with minimal headers
6796
remcos.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] HTTP request to Google Drive with minimal headers
5140
Approved bonuses.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] HTTP request to Google Drive with minimal headers
6796
remcos.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6796
remcos.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
6092
Approved bonuses.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] HTTP request to Google Drive with minimal headers
6796
remcos.exe
A Network Trojan was detected
REMOTE [ANY.RUN] REMCOS TLS Connection JA3 Hash
6796
remcos.exe
Malware Command and Control Activity Detected
ET JA3 Hash - Remcos 3.x/4.x TLS Connection
2532
Approved bonuses.exe
Potentially Bad Traffic
SUSPICIOUS [ANY.RUN] HTTP request to Google Drive with minimal headers
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Approved bonuses.rar