File name:

Llega Mi Descuento con hasta 50% dcto!.eml

Full analysis: https://app.any.run/tasks/574aad2b-e07b-4bfb-8e70-fb87c8ba0ddf
Verdict: Malicious activity
Analysis date: May 15, 2025, 20:59:45
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
obfuscated-js
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines (366), with CRLF line terminators
MD5:

F8DC862835050DABD87C5BC8856D7747

SHA1:

8042D95EB0FFAED58701DA52BB0AA9CB95C0F6FE

SHA256:

7C90FFE8148F3DA115B4AD85F92087EAA6736D79102C26C0338CCAD67FB3FA2D

SSDEEP:

1536:5WNhBHrAz61To/DcKMcdMGrGRxuZnjvVmKA1NIkaRJZ50HlSgiGLfsiEQusC+x5C:gNLRhrmZj8F1fwRIOprAwn7

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Reads the software policy settings

      • slui.exe (PID: 7344)

    • Connects to unusual port

      • msedge.exe (PID: 6872)

    • The sample compiled with english language support

      • msedge.exe (PID: 9228)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 9228)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 5256)

    • Application launched itself

      • msedge.exe (PID: 8164)
      • chrome.exe (PID: 2896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
271
Monitored processes
125
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe sppextcomobj.exe no specs slui.exe ai.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs openwith.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs openwith.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs chrome.exe msedge.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs chrome.exe no specs msedge.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=7112 --field-trial-handle=2300,i,10152532091940059884,6333322201243704244,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
776"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5008 --field-trial-handle=1848,i,13805288228065743752,13881606592017655693,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
924"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6360 --field-trial-handle=2300,i,10152532091940059884,6333322201243704244,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1020"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2308 --field-trial-handle=2300,i,10152532091940059884,6333322201243704244,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4836 --field-trial-handle=2300,i,10152532091940059884,6333322201243704244,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1128"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5192 --field-trial-handle=1848,i,13805288228065743752,13881606592017655693,262144 --variations-seed-version /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
122.0.6261.70
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
1184"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2732 --field-trial-handle=2300,i,10152532091940059884,6333322201243704244,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://nam10.safelinks.protection.outlook.com/?url=http%3A%2F%2Femaillink.exito.com%2Fls%2Fclick%3Fupn%3Du001.5yK3pLVjpD2nACqAJCc2G5QwOj1bwEvgv16I0GiGbcM-3DejQ5_ZU419CqD4erpN8hgyUQURJzH4gXYp0trxjjk-2BHgVTnugBespxOnycC9mPlaMJyxHL9u96ngUb7315D4-2BppPs9NsJFSqCg-2FB8oFHhTpnVlFIhBac03Fwr3Twm8GhJIVfTfFY2fNRha3SSNpQVaShEi4z-2BcaaivvEEdEzvns6dwWiQb88-2B9f6YDvRTkl9vUsWtHLjxyJAMdpbkm0LckcQN0OzjTQ-2Fw3Bld0YP3DFPQm7y4ySWG8TQ1qJkFmIS-2FVOYC1I6B4pSgSdeqRu4M6haKNjyYkaiGI2-2Fs4Lax4avnvI5AokIrA8UqZxfjKwsapEs30zAZCHWPtH0vm-2BtDtLJi9TammSy4wa7ophNvxXHZOToWL3hsR1LNVUeKGSF4elHgp-2BtoxYpzl9eli4ossoyZANzL6mROpoNZMwoMCtXEAc7iiPSZM6kEwmQQ4nmgGP4FhLGMyhOyQ-2B9zTA6-2Bf06o4Q8QqciJbcRAELMFWbsWjFUHu0lQnJueToGqE6vF4u8-2BAg9O6UL3ECDKxQRuPXMCbn5I73XLzIHOnYiIGXSW0baI-2FQKFnWbR-2F-2B1B7LDhVzDg&data=05%7C02%7Cjohn.castiblanco%40mibanco.com.co%7C228af9a7c01142580f3c08dd93d39231%7Ceaf7618fda834f9ea848c1f7d2906047%7C1%7C0%7C638829259120912206%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=j8yh1VsyPAnyhVKBUlb8hwvGuLzQAu3IlnfsduyfoZQ%3D&reserved=0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1512"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6904 --field-trial-handle=2300,i,10152532091940059884,6333322201243704244,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1628"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3584 --field-trial-handle=2300,i,10152532091940059884,6333322201243704244,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
37 011
Read events
36 357
Write events
569
Delete events
85

Modification events

(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01941A000000001000B24E9A3E06000000000000000600000000000000
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\6584
Operation:writeName:0
Value:
0B0E1015382CC70F14664EAA8FF9A551332387230046D2BCC9F5C4BBF1ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511B833D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:delete keyName:(default)
Value:
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:CantBootResolution
Value:
BootSuccess
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:ProfileBeingOpened
Value:
Outlook
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:SessionId
Value:
C3D8E96E-C1AF-4750-8D52-F4E28119C131
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:BootDiagnosticsLogFile
Value:
C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20240718T1116060318-1644.etl
(PID) Process:(6584) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:ProfileBeingOpened
Value:
Executable files
25
Suspicious files
858
Text files
180
Unknown types
2

Dropped files

PID
Process
Filename
Type
6584OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF10fb0b.TMP —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF10fb0b.TMP —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10fb1b.TMP —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10fb1b.TMP —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
8164msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF10fb1b.TMP —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
79
TCP/UDP connections
508
DNS requests
538
Threats
29

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.6:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7852
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6584
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
6872
msedge.exe
GET
302
167.89.115.78:80
http://emaillink.exito.com/ls/click?upn=u001.5yK3pLVjpD2nACqAJCc2G5QwOj1bwEvgv16I0GiGbcM-3DejQ5_ZU419CqD4erpN8hgyUQURJzH4gXYp0trxjjk-2BHgVTnugBespxOnycC9mPlaMJyxHL9u96ngUb7315D4-2BppPs9NsJFSqCg-2FB8oFHhTpnVlFIhBac03Fwr3Twm8GhJIVfTfFY2fNRha3SSNpQVaShEi4z-2BcaaivvEEdEzvns6dwWiQb88-2B9f6YDvRTkl9vUsWtHLjxyJAMdpbkm0LckcQN0OzjTQ-2Fw3Bld0YP3DFPQm7y4ySWG8TQ1qJkFmIS-2FVOYC1I6B4pSgSdeqRu4M6haKNjyYkaiGI2-2Fs4Lax4avnvI5AokIrA8UqZxfjKwsapEs30zAZCHWPtH0vm-2BtDtLJi9TammSy4wa7ophNvxXHZOToWL3hsR1LNVUeKGSF4elHgp-2BtoxYpzl9eli4ossoyZANzL6mROpoNZMwoMCtXEAc7iiPSZM6kEwmQQ4nmgGP4FhLGMyhOyQ-2B9zTA6-2Bf06o4Q8QqciJbcRAELMFWbsWjFUHu0lQnJueToGqE6vF4u8-2BAg9O6UL3ECDKxQRuPXMCbn5I73XLzIHOnYiIGXSW0baI-2FQKFnWbR-2F-2B1B7LDhVzDg
unknown
—
—
whitelisted
7852
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6872
msedge.exe
GET
302
167.89.115.78:80
http://emaillink.exito.com/ls/click?upn=u001.5yK3pLVjpD2nACqAJCc2G5QwOj1bwEvgv16I0GiGbcM-3D4fch_ZU419CqD4erpN8hgyUQURJzH4gXYp0trxjjk-2BHgVTnugBespxOnycC9mPlaMJyxHL9u96ngUb7315D4-2BppPs9NsJFSqCg-2FB8oFHhTpnVlFIhBac03Fwr3Twm8GhJIVfTfFY2fNRha3SSNpQVaShEi4z-2BcaaivvEEdEzvns6dwWiQb88-2B9f6YDvRTkl9vUsWtHLjxyJAMdpbkm0LckcQN0OzjTQ-2Fw3Bld0YP3DFPQm7y4ySWG8TQ1qJkFmIS-2FVOYC1I6B4pSgSdeqRu4M6haKNjyYkaiGI2-2Fs4Lax4avnvI6nW-2BUzf3D7j3UrsNT0VDOf1jL3Yp1HJMpsaeG93mpLlK9hhAicDIF7cCpTbSu7iKb7GQ4M0uDvdZZpC1K38op33sg6VK3MSIUQjSNb-2BOjdVwdx4fZ3-2Fktk8eRKUK1-2BgADkATEVhzvA6VmekKcx1iYmfcsAYariytb-2F6M65LfWWxKoXakIsesE0tNVqtM-2Fp3OEcOVdk0URHArK5rTRhk0RarwpgMh3vVniEL0PjcTca6IM-2FImXoDhTJ4-2BX65sAwuwO783rEIMDmNReiS8vO7J42
unknown
—
—
whitelisted
6872
msedge.exe
GET
302
167.89.115.78:80
http://emaillink.exito.com/ls/click?upn=u001.5yK3pLVjpD2nACqAJCc2GwQMMP3MnDot0CQJp-2FmKQoqhlruVjmuOgGeYL4l7ywVmd0X-2B572Ub0xSErQnyLuaO73JPKFu-2FQryS69i0vG8vvYLd1sYP6y11Si3i8ytwmZMduaJo5x6GOtMwOsbdWtiP8M5YvLNPaejeZHDVTy6vAoejekg6Ew2gqmVjCIoKZW3PnLn9I-2FcaY2JobwZ6V4HUMyxZOVv-2B8Tc-2BGCBB-2FWB2ZGDZ6d0Fj7sRvy0jv2edy4mqDf8Q-2F7VcnSdBy1ddHVFW2VuvejQdMb-2FqwnyrL0W7MB4xnnEj5hvo-2F8hPJIC3-2FlZLtBpcnwC37ZDswrripyOpqWZ8XEuuT-2F55k4FGuz58Jl33ZDxiHJfuB-2BlU7dlJmGr4tmLRe7xNK5g0CJwPj4S5n95uZXudj2bdAeiCzIl66nc0wcNXJ1QL-2F34UBv2Ys9h4Cgq_ZU419CqD4erpN8hgyUQURJzH4gXYp0trxjjk-2BHgVTnugBespxOnycC9mPlaMJyxHL9u96ngUb7315D4-2BppPs9NsJFSqCg-2FB8oFHhTpnVlFIhBac03Fwr3Twm8GhJIVfTfFY2fNRha3SSNpQVaShEi4z-2BcaaivvEEdEzvns6dwWiQb88-2B9f6YDvRTkl9vUsWtHLjxyJAMdpbkm0LckcQN0OzjTQ-2Fw3Bld0YP3DFPQm7y4ySWG8TQ1qJkFmIS-2FVOYC1I6B4pSgSdeqRu4M6haKNjyYkaiGI2-2Fs4Lax4avnvI62AAUmO4QrIcy9EYwUXusTuQU2MN514rSHP3P-2BOE6YWoZFkfQG4qlrREcz0VfSCHaT9sVpyDYkZFScinGY63J-2F2hatgJQ-2Bh1kYmQjzQhqv1LVl6W8s8Od-2BgNn29ASAPCv6Od2cWQ0VCYEoVuSE8vFmW8CgTSoYG-2Fe5F7K0AX-2BEejnIt7tOnmpFM25tnE7bCGxlgxFYAH2Di-2B9sQDyQ-2Bn9IgPRk77ikqUojFGxmco0pg5dko-2F3GTwv0WNf30Vdwd1PqjW4em9Id1h0yc1f-2Bx2ux
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5364
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.216.77.6:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6584
OUTLOOK.EXE
52.123.224.72:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
google.com
  • 216.58.206.46
whitelisted
crl.microsoft.com
  • 23.216.77.6
  • 23.216.77.5
  • 23.216.77.7
  • 23.216.77.42
  • 23.216.77.16
  • 23.216.77.18
  • 23.216.77.38
  • 23.216.77.15
  • 23.216.77.39
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
ecs.office.com
  • 52.123.224.72
  • 52.123.243.196
  • 52.123.243.88
  • 52.123.243.195
whitelisted
client.wns.windows.com
  • 172.211.123.250
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.66
  • 40.126.32.76
  • 20.190.160.64
  • 40.126.32.68
  • 20.190.160.65
  • 40.126.32.138
  • 20.190.160.4
  • 40.126.32.74
  • 40.126.31.67
  • 40.126.31.128
  • 20.190.159.73
  • 40.126.31.69
  • 40.126.31.0
  • 40.126.31.3
  • 20.190.159.129
  • 40.126.31.129
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
roaming.officeapps.live.com
  • 52.109.32.7
whitelisted
self.events.data.microsoft.com
  • 40.79.167.8
  • 20.189.173.10
whitelisted

Threats

PID
Process
Class
Message
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Request to Azure content delivery network (aadcdn .msauth .net)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Request to Azure content delivery network (aadcdn .msauth .net)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Request to Azure content delivery network (aadcdn .msauth .net)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Request to Azure content delivery network (aadcdn .msauth .net)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Request to Azure content delivery network (aadcdn .msauth .net)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Request to Azure content delivery network (aadcdn .msauth .net)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
6872
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Llega Mi Descuento con hasta 50% dcto!.eml