analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Quarantined Messages (4).zip

Full analysis: https://app.any.run/tasks/aa7111f2-c307-4a3f-afb8-439ec332f8ca
Verdict: Malicious activity
Analysis date: March 31, 2023, 22:36:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract
MD5:

C6946E7417C96158201CCAD64F254AFE

SHA1:

09791E92B7CB31A15E2C09664DC294F86F58F70D

SHA256:

2FEDA6EEDAA541F640199F9F5E5999BF69E88CA598BC4F252D8BDC5768841038

SSDEEP:

1536:4mu1SofH2rFZf7PjojXV4/wu9nRwDcotEwkaMf6UtvCteE9fUZsnROAiDu4kX0nr:4muN25YV80ckI9f6McecfUZsT4ncDTwb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Internet Settings

      • OUTLOOK.EXE (PID: 1124)
      • sdiagnhost.exe (PID: 2696)

    • Searches for installed software

      • OUTLOOK.EXE (PID: 1124)

    • Reads settings of System Certificates

      • msdt.exe (PID: 2272)

    • Probably uses Microsoft diagnostics tool to execute malicious payload

      • iexplore.exe (PID: 584)

    • Executable content was dropped or overwritten

      • msdt.exe (PID: 2272)

    • Reads security settings of Internet Explorer

      • msdt.exe (PID: 2272)
      • sdiagnhost.exe (PID: 2696)

    • Executes as Windows Service

      • IEEtwCollector.exe (PID: 1788)

  • INFO

    • Checks supported languages

      • OUTLOOK.EXE (PID: 1124)

    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 1124)

    • The process checks LSA protection

      • OUTLOOK.EXE (PID: 1124)
      • sdiagnhost.exe (PID: 2696)
      • msdt.exe (PID: 2272)
      • IEEtwCollector.exe (PID: 1788)

    • Reads the machine GUID from the registry

      • OUTLOOK.EXE (PID: 1124)

    • Reads the computer name

      • OUTLOOK.EXE (PID: 1124)

    • Manual execution by a user

      • OUTLOOK.EXE (PID: 1124)
      • iexplore.exe (PID: 584)

    • Create files in a temporary directory

      • OUTLOOK.EXE (PID: 1124)
      • iexplore.exe (PID: 584)
      • msdt.exe (PID: 2272)

    • Checks proxy server information

      • OUTLOOK.EXE (PID: 1124)

    • Process checks computer location settings

      • OUTLOOK.EXE (PID: 1124)

    • The process uses the downloaded file

      • OUTLOOK.EXE (PID: 1124)

    • Creates files or folders in the user directory

      • OUTLOOK.EXE (PID: 1124)
      • msdt.exe (PID: 2272)

    • Application launched itself

      • iexplore.exe (PID: 584)

    • Reads the time zone

      • IEEtwCollector.exe (PID: 1788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipFileName: cc026b45-b09c-4785-40c5-08db2bc90b86/88cd3794-c627-1343-3f01-f93414dcbf6d.eml
ZipUncompressedSize: 4294967295
ZipCompressedSize: 4294967295
ZipCRC: 0xb674c02d
ZipModifyDate: 2023:03:31 22:36:24
ZipCompression: Deflated
ZipBitFlag: 0x0009
ZipRequiredVersion: 45
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
54
Monitored processes
11
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe iexplore.exe iexplore.exe iexplore.exe no specs msdt.exe sdiagnhost.exe no specs iexplore.exe no specs iexplore.exe iexplore.exe no specs ieetwcollector.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2668"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Downloads\Quarantined Messages (4).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
1124"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\cc026b45-b09c-4785-40c5-08db2bc90b86\88cd3794-c627-1343-3f01-f93414dcbf6d.eml"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
584"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\Desktop\Claim 895374 Mar 23.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3648"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:584 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3308"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:584 CREDAT:1905929 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2272 -modal 196948 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\admin\AppData\Local\Temp\NDFFEFD.tmp -ep NetworkDiagnosticsWebC:\Windows\System32\msdt.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Diagnostics Troubleshooting Wizard
Exit code:
2
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msdt.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\usp10.dll
2696C:\Windows\System32\sdiagnhost.exe -EmbeddingC:\Windows\System32\sdiagnhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Scripted Diagnostics Native Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\sdiagnhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\usp10.dll
3728"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:584 CREDAT:2364688 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
976"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:584 CREDAT:1316116 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2428"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:584 CREDAT:2692415 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
Total events
75 822
Read events
74 344
Write events
1 428
Delete events
50

Modification events

(PID) Process:(2668) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\16D\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\virtio_ivshmem_master_build.zip
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\Win7-KB3191566-x86.zip
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\phacker.zip
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2668) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\Desktop
Executable files
4
Suspicious files
80
Text files
410
Unknown types
56

Dropped files

PID
Process
Filename
Type
1124OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR5986.tmp.cvr —
MD5:—
SHA256:—
1124OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
2668WinRAR.exeC:\Users\admin\Desktop\cc026b45-b09c-4785-40c5-08db2bc90b86\88cd3794-c627-1343-3f01-f93414dcbf6d.emleml
MD5:95D880734423B3D0797E0DBD006D6261
SHA256:8A92D8B3CBD10884726BFE93963C2C0F215E0FA007D0B874EA3EC5FD3AFB5217
1124OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:C37F9240DD7A58DCA090AA634A4A0D1C
SHA256:522285EB2199A1470423053CE324274BB36D1B43B085259714A82E50705BBB7E
1124OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:8D211CF6A5661FAB69264B6CD418007B
SHA256:149C6B7FB3A1CF0C796F93D35EDAC685188A7AC1874E7865AEBC92EDF195CE1D
1124OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\QQNG35G3\Claim 895374 Mar 23.htmlhtml
MD5:CD16193889298D8977C6B21F5DBC92EF
SHA256:60848C52C262FA3D03F499032E68F794020384B5BB467DC7A42EDEBC49FA6B4E
1124OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_Calendar_2_F9A45768B3E6994C925419E93ACB7C8E.datxml
MD5:B21ED3BD946332FF6EBC41A87776C6BB
SHA256:B1AAC4E817CD10670B785EF8E5523C4A883F44138E50486987DC73054A46F6F4
1124OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Outlook\NoMail.srssrs
MD5:D4FD9603B8345DD01B8B338F28783E4E
SHA256:67472CD337E87DE97B4A0061533709D4FDEBAEC4EEE665748D11E33B7F5401FC
1124OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\tmp5B2C.tmptext
MD5:3679E10BB9CBE0B5F61E25F5D8CBA54F
SHA256:B6C5C2EDE474DB5B42F2AA35089D9D96C9F4588B97DF27CA5A9EDB8943EB12E6
1124OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.Outlook\QQNG35G3\Claim 895374 Mar 23 (2).html:Zone.Identifier:$DATAtext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
43
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3648
iexplore.exe
GET
200
216.58.212.163:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
US
der
1.41 Kb
whitelisted
3648
iexplore.exe
GET
200
216.58.212.163:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQDTHapPXttJahK0MpJdGmyD
US
der
472 b
whitelisted
3648
iexplore.exe
GET
200
216.58.212.163:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEGuOw5S%2FgZeuCs2W38ctSDs%3D
US
der
471 b
whitelisted
584
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8Ull8gIGmZT9XHrHiJQeI%3D
US
der
1.47 Kb
whitelisted
584
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
584
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEALnkXH7gCHpP%2BLZg4NMUMA%3D
US
der
471 b
whitelisted
3648
iexplore.exe
GET
200
8.248.113.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?303635a1627bc152
US
compressed
4.70 Kb
whitelisted
3648
iexplore.exe
GET
200
216.58.212.163:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3648
iexplore.exe
GET
200
8.241.11.254:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e56267937126398a
US
compressed
4.70 Kb
whitelisted
584
iexplore.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3648
iexplore.exe
216.58.212.163:80
ocsp.pki.goog
GOOGLE
US
whitelisted
584
iexplore.exe
204.79.197.200:443
www.bing.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
3648
iexplore.exe
142.250.185.131:443
fonts.gstatic.com
GOOGLE
US
whitelisted
1124
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3648
iexplore.exe
8.241.11.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious
584
iexplore.exe
152.199.19.161:443
iecvlist.microsoft.com
EDGECAST
US
whitelisted
584
iexplore.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
3648
iexplore.exe
142.250.185.106:443
fonts.googleapis.com
GOOGLE
US
whitelisted
3648
iexplore.exe
8.248.113.254:80
ctldl.windowsupdate.com
LEVEL3
US
suspicious

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
fonts.googleapis.com
  • 142.250.185.106
whitelisted
ctldl.windowsupdate.com
  • 8.241.11.254
  • 67.27.233.254
  • 8.248.143.254
  • 8.248.133.254
  • 8.248.113.254
whitelisted
ocsp.pki.goog
  • 216.58.212.163
whitelisted
fonts.gstatic.com
  • 142.250.185.131
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Quarantined Messages (4).zip