File name:

[__Virus__] COMPROBANTE DE PAGO (FACTURAS VENCIDAS).eml

Full analysis: https://app.any.run/tasks/9ce47840-8a37-4866-8e69-1d551d0d7331
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 11, 2025, 17:39:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
attachments
attc-unc
susp-attachments
arch-exec
evasion
stealer
smtp
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text, with CRLF line terminators
MD5:

6F5AA1D579B83142940F313D4FDBF8D0

SHA1:

2F3C8B241D752563A7309966F0FD4A0FA1B2D17F

SHA256:

091F41F5EBAE9363A27C8B39DBE2F37A9724A5BD29C4DBFC076EEED380D77943

SSDEEP:

12288:Fpqv17UnHVqEfI4QWFKPH4sexDd+16WrJ5ZmTeCp/FbemqS6v9LY/NzC9Ri39:3qvdwLTQWFKQfDd+J5QJlrNzCut

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • OUTLOOK.EXE (PID: 6032)

    • Steals credentials from Web Browsers

      • MSBuild.exe (PID: 1280)
      • MSBuild.exe (PID: 6712)
      • MSBuild.exe (PID: 4812)

    • Actions looks like stealing of personal data

      • MSBuild.exe (PID: 1280)
      • MSBuild.exe (PID: 6712)
      • MSBuild.exe (PID: 4812)

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • WinRAR.exe (PID: 8136)
      • OUTLOOK.EXE (PID: 6032)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 8136)

    • Starts a Microsoft application from unusual location

      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 6436)
      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 5332)
      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 5728)
      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 7500)
      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 1676)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • MSBuild.exe (PID: 1280)
      • MSBuild.exe (PID: 6712)
      • MSBuild.exe (PID: 4812)

    • Connects to SMTP port

      • MSBuild.exe (PID: 1280)
      • MSBuild.exe (PID: 6712)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 8136)
      • OUTLOOK.EXE (PID: 6032)

    • Checks supported languages

      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 6436)
      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 5332)
      • MSBuild.exe (PID: 1280)
      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 5728)
      • MSBuild.exe (PID: 6712)
      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 7500)
      • MSBuild.exe (PID: 4812)
      • Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe (PID: 1676)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 8136)

    • Reads the computer name

      • MSBuild.exe (PID: 1280)
      • MSBuild.exe (PID: 6712)
      • MSBuild.exe (PID: 4812)

    • Reads the machine GUID from the registry

      • MSBuild.exe (PID: 1280)
      • MSBuild.exe (PID: 6712)
      • MSBuild.exe (PID: 4812)

    • Disables trace logs

      • MSBuild.exe (PID: 1280)
      • MSBuild.exe (PID: 6712)
      • MSBuild.exe (PID: 4812)

    • Checks proxy server information

      • MSBuild.exe (PID: 1280)
      • MSBuild.exe (PID: 6712)
      • MSBuild.exe (PID: 4812)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 1) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
146
Monitored processes
17
Malicious processes
7
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe sppextcomobj.exe no specs slui.exe no specs ai.exe no specs winrar.exe facturas de pago, 3432157645, 6572545675, 2315768,35432.exe no specs msbuild.exe facturas de pago, 3432157645, 6572545675, 2315768,35432.exe no specs msbuild.exe no specs msbuild.exe no specs facturas de pago, 3432157645, 6572545675, 2315768,35432.exe no specs msbuild.exe svchost.exe facturas de pago, 3432157645, 6572545675, 2315768,35432.exe no specs msbuild.exe facturas de pago, 3432157645, 6572545675, 2315768,35432.exe no specs msbuild.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1052"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
1280"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1676"C:\Users\admin\AppData\Local\Temp\Rar$EXa8136.1099\Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa8136.1099\Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa8136.1099\facturas de pago, 3432157645, 6572545675, 2315768,35432.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4812"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
5332"C:\Users\admin\AppData\Local\Temp\Rar$EXa8136.49293\Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa8136.49293\Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa8136.49293\facturas de pago, 3432157645, 6572545675, 2315768,35432.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
5728"C:\Users\admin\AppData\Local\Temp\Rar$EXa8136.49751\Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa8136.49751\Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa8136.49751\facturas de pago, 3432157645, 6572545675, 2315768,35432.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
5892"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6032"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\[__Virus__] COMPROBANTE DE PAGO (FACTURAS VENCIDAS).eml"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6436"C:\Users\admin\AppData\Local\Temp\Rar$EXa8136.48891\Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa8136.48891\Facturas de pago, 3432157645, 6572545675, 2315768,35432.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft® HTML Help Executable
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa8136.48891\facturas de pago, 3432157645, 6572545675, 2315768,35432.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
Total events
17 633
Read events
16 481
Write events
1 031
Delete events
121

Modification events

(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01941A000000001000B24E9A3E06000000000000000600000000000000
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\6032
Operation:writeName:0
Value:
0B0E10DB05DA75279290408045075BB88FDC31230046989DAACB8AE1EAED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511902FD2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:delete keyName:(default)
Value:
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:CantBootResolution
Value:
BootSuccess
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:ProfileBeingOpened
Value:
Outlook
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:SessionId
Value:
C3D8E96E-C1AF-4750-8D52-F4E28119C131
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:BootDiagnosticsLogFile
Value:
C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20240718T1116060318-1644.etl
(PID) Process:(6032) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:ProfileBeingOpened
Value:
Executable files
5
Suspicious files
10
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
6032OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
6032OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\F2CF0E8D-E036-4C8B-A4B7-68F48676A1E6xml
MD5:62EA434E9F4A78AA2A1B49A7656E9DF6
SHA256:4B171CB571F43202F45757EAD41298A7CCB69978FB82A3A09AE5873DFD1BA381
6032OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkD1F8.tmpbinary
MD5:98003424B3A53937D2170407DB1C9E4F
SHA256:E492B12A5FF5DF36ADEF64EBD500F34C9F7452E605D544B6FA152811C6AC2F81
6032OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:434A91CF3042866442C254E8C017222B
SHA256:614916299D04A81926AFFF215D42980B7C5C5E4513C1ADD75E9F6446735F7095
6032OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:FDCAA297CE53D447C0B06ACD7012CBB2
SHA256:0EC93019D0862DC75D685C05D85531E76D30C98FA3A6C61DA340AB7D50D2726A
6032OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:AAF26DB3ADBE2101306FE9EAFE814948
SHA256:B9E2ACBA30CB606C90A12F2E74E208054A61E08455CFDA52D57A0EBB2F49D46A
6032OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
6032OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DUHKEXPX\Facturas de pago 3432157645 6572545675 231576835432 (002).gzcompressed
MD5:74B76C11F04F1C5D4E95734BE8847A04
SHA256:E61219E76E20C10CD4FB38CA1A08508B7926B8FCCD6658D1CAA329DD974EC703
6032OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:CA134E12935735069159975BB4304887
SHA256:590C110F9722808C3C9F8DE582FA37891B573854702999E944B63F911883F3A4
6032OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\DUHKEXPX\Facturas de pago 3432157645 6572545675 231576835432.gz:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
32
DNS requests
24
Threats
11

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.18.121.139:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6032
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6032
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1812
SIHClient.exe
GET
200
104.123.41.162:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
1812
SIHClient.exe
GET
200
104.123.41.162:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1280
MSBuild.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6712
MSBuild.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
4812
MSBuild.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.18.121.139:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6032
OUTLOOK.EXE
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6032
OUTLOOK.EXE
52.123.128.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
6032
OUTLOOK.EXE
52.109.76.243:443
roaming.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.142
whitelisted
crl.microsoft.com
  • 2.18.121.139
  • 2.18.121.147
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
login.live.com
  • 40.126.31.2
  • 40.126.31.69
  • 40.126.31.1
  • 20.190.159.130
  • 40.126.31.73
  • 40.126.31.131
  • 20.190.159.64
  • 20.190.159.128
  • 20.190.160.132
  • 20.190.160.5
  • 40.126.32.72
  • 20.190.160.65
  • 40.126.32.68
  • 20.190.160.14
  • 20.190.160.131
  • 20.190.160.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
roaming.officeapps.live.com
  • 52.109.76.243
whitelisted
omex.cdn.office.net
  • 2.18.121.29
  • 2.18.121.10
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
1280
MSBuild.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
1280
MSBuild.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
1280
MSBuild.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
6712
MSBuild.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
6712
MSBuild.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
6712
MSBuild.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
4812
MSBuild.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
4812
MSBuild.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
[__Virus__] COMPROBANTE DE PAGO (FACTURAS VENCIDAS).eml