File name:

Quarantined Messages.zip

Full analysis: https://app.any.run/tasks/09277304-8f24-42f0-a0c8-7af0564266d1
Verdict: Malicious activity
Threats:

Quasar is a very popular RAT in the world thanks to its code being available in open-source. This malware can be used to control the victim’s computer remotely.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 20:30:21
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
susp-attachments
attachments
attc-unc
evasion
phishing
quasar
confuser
Indicators:
MIME: application/zip
File info: Zip archive data, at least v4.5 to extract, compression method=deflate
MD5:

9E9F45F5EE755EAAC037C58A3759BDEF

SHA1:

1F071E5EE40A005C3918C363AA8D8E07B9A521D9

SHA256:

81EACA07F2D2C3714AFE4F27353FB9958A9CE41489CF8A64335B041FF297BC05

SSDEEP:

49152:k+W2NgvuuUinLGvuri/Zvnfe57WTwom6PXS4s7m8sfNzD1twsG9IiUgpOJKjXDsP:KIOlLlrYZvq7WfpvSX7m8sVzDnPWIiLi

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the autorun value in the registry

      • Informacion del documento.exe (PID: 7476)
      • updates.exe (PID: 7856)

    • QUASAR has been detected (YARA)

      • updates.exe (PID: 7856)

    • PHISHING has been detected (SURICATA)

      • svchost.exe (PID: 2196)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7012)
      • WinRAR.exe (PID: 1244)
      • ShellExperienceHost.exe (PID: 1748)

    • Reads Microsoft Outlook installation path

      • WinRAR.exe (PID: 7012)

    • Application launched itself

      • Informacion del documento.exe (PID: 7568)
      • updates.exe (PID: 7256)
      • Informacion del documento.exe (PID: 660)
      • Informacion del documento.exe (PID: 7656)

    • Executable content was dropped or overwritten

      • Informacion del documento.exe (PID: 7476)

    • Executes application which crashes

      • updates.exe (PID: 7860)

    • Starts itself from another location

      • Informacion del documento.exe (PID: 7476)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Informacion del documento.exe (PID: 7476)
      • updates.exe (PID: 7856)

    • There is functionality for taking screenshot (YARA)

      • updates.exe (PID: 7856)

    • Connects to unusual port

      • updates.exe (PID: 7856)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 7012)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 8044)
      • BackgroundTransferHost.exe (PID: 7840)
      • BackgroundTransferHost.exe (PID: 516)
      • BackgroundTransferHost.exe (PID: 6080)
      • BackgroundTransferHost.exe (PID: 7328)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7328)
      • Informacion del documento.exe (PID: 7476)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7328)
      • Informacion del documento.exe (PID: 7476)
      • updates.exe (PID: 7856)
      • slui.exe (PID: 5512)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7328)
      • slui.exe (PID: 5512)
      • slui.exe (PID: 7268)

    • Checks supported languages

      • Informacion del documento.exe (PID: 7476)
      • Informacion del documento.exe (PID: 7568)
      • Informacion del documento.exe (PID: 7464)
      • updates.exe (PID: 7256)
      • updates.exe (PID: 7856)
      • Informacion del documento.exe (PID: 660)
      • Informacion del documento.exe (PID: 6036)
      • Informacion del documento.exe (PID: 2852)
      • Informacion del documento.exe (PID: 7656)
      • Informacion del documento.exe (PID: 7500)
      • Informacion del documento.exe (PID: 6584)
      • ShellExperienceHost.exe (PID: 1748)

    • Reads the computer name

      • Informacion del documento.exe (PID: 7464)
      • Informacion del documento.exe (PID: 7568)
      • Informacion del documento.exe (PID: 7476)
      • updates.exe (PID: 7256)
      • updates.exe (PID: 7856)
      • Informacion del documento.exe (PID: 660)
      • Informacion del documento.exe (PID: 6036)
      • Informacion del documento.exe (PID: 2852)
      • Informacion del documento.exe (PID: 7656)
      • Informacion del documento.exe (PID: 7500)
      • Informacion del documento.exe (PID: 6584)
      • ShellExperienceHost.exe (PID: 1748)

    • Reads the machine GUID from the registry

      • Informacion del documento.exe (PID: 7568)
      • Informacion del documento.exe (PID: 7476)
      • Informacion del documento.exe (PID: 7464)
      • updates.exe (PID: 7256)
      • Informacion del documento.exe (PID: 660)
      • Informacion del documento.exe (PID: 6036)
      • Informacion del documento.exe (PID: 2852)
      • updates.exe (PID: 7856)
      • Informacion del documento.exe (PID: 7656)
      • Informacion del documento.exe (PID: 7500)
      • Informacion del documento.exe (PID: 6584)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1244)

    • Disables trace logs

      • Informacion del documento.exe (PID: 7476)
      • updates.exe (PID: 7856)

    • Confuser has been detected (YARA)

      • updates.exe (PID: 7856)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

Quasar

(PID) Process(7856) updates.exe
Version1.3.0.0
C2 (4)fortyfive5.ydns.eu:61539
seventyfive75.ydns.eu:61539
fortyfivev.crabdance.com:61540
Sub_Dirwindows
Install_Nameupdates.exe
MutexQSR_MUTEX_5Kh4llnQQz8E6x39sb
Startupwindows espdater
TagStroy8
LogDirLogs
Signature
Certificate
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 45
ZipBitFlag: 0x0009
ZipCompression: Deflated
ZipModifyDate: 2025:03:24 20:28:34
ZipCRC: 0x4e80b97b
ZipCompressedSize: 4294967295
ZipUncompressedSize: 4294967295
ZipFileName: 68bd5945-c758-4364-2ca6-08dd6a049871/83c573df-a7f0-17b5-07b0-47ed1872eea4.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
172
Monitored processes
27
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe outlook.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs ai.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs winrar.exe informacion del documento.exe no specs informacion del documento.exe informacion del documento.exe no specs updates.exe no specs #PHISHING svchost.exe #QUASAR updates.exe updates.exe werfault.exe no specs informacion del documento.exe no specs informacion del documento.exe no specs informacion del documento.exe no specs slui.exe informacion del documento.exe no specs informacion del documento.exe no specs informacion del documento.exe no specs shellexperiencehost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
516"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
660"C:\Users\admin\AppData\Local\Temp\Rar$EXa1244.8884\Informacion del documento.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa1244.8884\Informacion del documento.exe—WinRAR.exe
User:
admin
Company:
Edge update
Integrity Level:
MEDIUM
Description:
Edge update
Exit code:
0
Version:
2.3.6.6
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1244.8884\informacion del documento.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
1244"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\F5EOXEGQ\Informacion del documento.gz"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1748"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\wincorlib.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2852"C:\Users\admin\AppData\Local\Temp\Rar$EXa1244.8884\Informacion del documento.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa1244.8884\Informacion del documento.exe—Informacion del documento.exe
User:
admin
Company:
Edge update
Integrity Level:
MEDIUM
Description:
Edge update
Exit code:
0
Version:
2.3.6.6
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1244.8884\informacion del documento.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
5384"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "D235E3AB-DF36-487C-A295-636F37D212A6" "75838F26-6324-4E4A-85E7-0D95241F52C4" "7980"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\rpcrt4.dll
5512C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
6036"C:\Users\admin\AppData\Local\Temp\Rar$EXa1244.8884\Informacion del documento.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa1244.8884\Informacion del documento.exe—Informacion del documento.exe
User:
admin
Company:
Edge update
Integrity Level:
MEDIUM
Description:
Edge update
Exit code:
0
Version:
2.3.6.6
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa1244.8884\informacion del documento.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
6080"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
Total events
26 063
Read events
24 747
Write events
1 160
Delete events
156

Modification events

(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Quarantined Messages.zip
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(7012) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\OpenWithProgids
Operation:writeName:Outlook.File.eml.15
Value:
Executable files
4
Suspicious files
19
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
7980OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
7328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\f2d78b61-79ff-4241-a09f-c9ba7c663e0f.down_data —
MD5:—
SHA256:—
7012WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7012.4537\83c573df-a7f0-17b5-07b0-47ed1872eea4.eml:OECustomPropertybinary
MD5:2C3AB378DE7F21640A5252433F067B3C
SHA256:B064787ADF734160C6D15F72B96E8A1DDF4B93FC9DE90B8299E4C8BA7191E14F
7012WinRAR.exeC:\Users\admin\AppData\Local\Temp\__rzi_7012.5486compressed
MD5:F6313ACC7BD90040B3BCD57B54D0E842
SHA256:873CBB94C787D38917D5BD3D7890175B1D4709E7A3C44AACF313C73CC333AF73
7012WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb7012.4537\83c573df-a7f0-17b5-07b0-47ed1872eea4.emlbinary
MD5:556EA9D3C86BB849E9F0CF9D75ED3E3F
SHA256:53B823F0ADBD5E113F3DA25C9361E8DC2E1DBC5EBCD3789C8ADE6C1469DD02A9
7980OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:FC7CE799BB9D6DBD09514CBDCF9823EA
SHA256:AF84F34F2819460B1924067971FB4818F5895F0F2335B86C983CD01133D4B05E
7328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\Content\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:4872BABAF39AA62B8D32695EBB7E9173
SHA256:2EE85DF86EE29BBEB3DCA81AA29B6DE204F605A2769B84C728A329178A2D0999
7980OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkF743.tmpbinary
MD5:9FC6294072F49C2046F88DDB669FB6D9
SHA256:F1243E77B0E8BDA957D63485B9A6544B02E48B8885CA4EC8039B0F8C117720EF
7328BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\Microsoft\CryptnetUrlCache\MetaData\26C212D9399727259664BDFCA073966E_F9F7D6A7ECE73106D2A8C63168CDA10Dbinary
MD5:B4FD3E441B9B0914CB3F43A91095F6A7
SHA256:1019995181E612D26879CF0A57C3E09185088CE7C7D357CFB1DC0F690B614604
7012WinRAR.exeC:\Users\admin\AppData\Local\Temp\Quarantined Messages.zipcompressed
MD5:F6313ACC7BD90040B3BCD57B54D0E842
SHA256:873CBB94C787D38917D5BD3D7890175B1D4709E7A3C44AACF313C73CC333AF73
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
241
DNS requests
30
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.159:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7456
backgroundTaskHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7980
OUTLOOK.EXE
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
7328
BackgroundTransferHost.exe
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7512
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7512
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7980
OUTLOOK.EXE
GET
200
23.54.109.203:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
7476
Informacion del documento.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
7856
updates.exe
GET
200
208.95.112.1:80
http://ip-api.com/json/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.159:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7456
backgroundTaskHost.exe
20.223.36.55:443
arc.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7456
backgroundTaskHost.exe
23.54.109.203:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.159
  • 23.48.23.162
  • 23.48.23.169
  • 23.48.23.190
  • 23.48.23.137
  • 23.48.23.173
  • 23.48.23.183
  • 23.48.23.158
  • 23.48.23.176
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.73
  • 20.190.159.131
  • 40.126.31.69
  • 40.126.31.1
  • 20.190.159.23
  • 20.190.159.129
  • 40.126.31.3
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 23.54.109.203
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
www.bing.com
  • 2.19.122.32
  • 2.19.122.47
  • 2.19.122.39
  • 2.19.122.40
  • 2.19.122.46
  • 2.19.122.35
  • 2.19.122.36
  • 2.19.122.34
  • 2.19.122.44
whitelisted

Threats

PID
Process
Class
Message
7476
Informacion del documento.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7476
Informacion del documento.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
7856
updates.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
7856
updates.exe
A Network Trojan was detected
ET MALWARE Common RAT Connectivity Check Observed
2196
svchost.exe
Misc activity
INFO [ANY.RUN] Dynamic DNS Service (ydns .eu)
—
—
Misc activity
INFO [ANY.RUN] Dynamic DNS Service (ydns .eu)
2196
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.crabdance .com Domain
2196
svchost.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain ( .crabdance .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Quarantined Messages.zip