File name:

Orden de compra.eml

Full analysis: https://app.any.run/tasks/378a4c05-3af1-46c1-9ba9-06bf7ff237e7
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: May 15, 2025, 16:00:39
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
java
evasion
stealer
smtp
exfiltration
agenttesla
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text, with CRLF line terminators
MD5:

610133724927F138608AB3F016B52A30

SHA1:

292C6992D1A61E3B35D3741A3C3BD1FEFA985287

SHA256:

99D3E781968BA117811CB28EF4B8CD522BD535A6C17552D679A3F7C47D2868A1

SSDEEP:

24576:AsERJuW4UJf7JsPIHXzPTRCjGSBD0C+/ENR6i:MBjXHSBL+/Ex

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AGENTTESLA has been detected (YARA)

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Steals credentials from Web Browsers

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Actions looks like stealing of personal data

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • AGENTTESLA has been detected (SURICATA)

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)

    • Application launched itself

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)

    • The process creates files with name similar to system file names

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)

    • Checks for external IP

      • svchost.exe (PID: 2196)
      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Connects to SMTP port

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Contacting a server suspected of hosting an CnC

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Connects to the server without a host name

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Reads security settings of Internet Explorer

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • There is functionality for taking screenshot (YARA)

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4112)

  • INFO

    • Java executable

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)
      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Manual execution by a user

      • WinRAR.exe (PID: 5404)
      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)

    • The sample compiled with english language support

      • OUTLOOK.EXE (PID: 7420)

    • Creates files or folders in the user directory

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)

    • Reads the computer name

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)
      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Checks supported languages

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)
      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Create files in a temporary directory

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8068)

    • Reads the machine GUID from the registry

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Reads the software policy settings

      • slui.exe (PID: 7540)

    • Disables trace logs

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)

    • Checks proxy server information

      • Orden de compra_896758576568857657858756857645674656745677.exe (PID: 8080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

AgentTesla

(PID) Process(8080) Orden de compra_896758576568857657858756857645674656745677.exe
Protocolsmtp
Hostmail.rvoccte.com
Port587
Usernamenewfile@rvoccte.com
PasswordPJtiky;+*ayY
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 1) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
268
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start outlook.exe sppextcomobj.exe no specs slui.exe ai.exe no specs winrar.exe no specs orden de compra_896758576568857657858756857645674656745677.exe #AGENTTESLA orden de compra_896758576568857657858756857645674656745677.exe svchost.exe slui.exe plugscheduler.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
900C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
4112"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
5404"C:\Program Files\WinRAR\WinRAR.exe" x -iext -ow -ver -- "C:\Users\admin\Desktop\Orden de compra_896758576_pdf.uue" C:\Users\admin\Desktop\C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6964"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "4BF95FDE-C249-4A72-865C-15839F9E295E" "D2C60893-D6EE-406C-9ADD-71FDDE838DB8" "7420"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
7420"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\admin\Desktop\Orden de compra.eml"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\microsoft office\root\office16\vcruntime140_1.dll
c:\program files\microsoft office\root\office16\outlookservicing.dll
7500C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7540"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
8068"C:\Users\admin\Desktop\Orden de compra_896758576568857657858756857645674656745677.exe" C:\Users\admin\Desktop\Orden de compra_896758576568857657858756857645674656745677.exe
explorer.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Platform SE binary
Exit code:
0
Version:
8.0.4510.0
Modules
Images
c:\users\admin\desktop\orden de compra_896758576568857657858756857645674656745677.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
8080"C:\Users\admin\Desktop\Orden de compra_896758576568857657858756857645674656745677.exe" C:\Users\admin\Desktop\Orden de compra_896758576568857657858756857645674656745677.exe
Orden de compra_896758576568857657858756857645674656745677.exe
User:
admin
Company:
Oracle Corporation
Integrity Level:
MEDIUM
Description:
Java Platform SE binary
Exit code:
0
Version:
8.0.4510.0
Modules
Images
c:\windows\syswow64\mshtml.dll
c:\users\admin\desktop\orden de compra_896758576568857657858756857645674656745677.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
AgentTesla
(PID) Process(8080) Orden de compra_896758576568857657858756857645674656745677.exe
Protocolsmtp
Hostmail.rvoccte.com
Port587
Usernamenewfile@rvoccte.com
PasswordPJtiky;+*ayY
Total events
15 219
Read events
14 496
Write events
658
Delete events
65

Modification events

(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01941A000000001000B24E9A3E06000000000000000600000000000000
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\7420
Operation:writeName:0
Value:
0B0E103E3EDF5B09510C4BAC896C48876013E3230046D7E1BEBAA8B6F1ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511FC39D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:delete keyName:(default)
Value:
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:CantBootResolution
Value:
BootSuccess
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:ProfileBeingOpened
Value:
Outlook
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:SessionId
Value:
C3D8E96E-C1AF-4750-8D52-F4E28119C131
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:BootDiagnosticsLogFile
Value:
C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20240718T1116060318-1644.etl
(PID) Process:(7420) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:ProfileBeingOpened
Value:
Executable files
2
Suspicious files
64
Text files
14
Unknown types
0

Dropped files

PID
Process
Filename
Type
7420OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
7420OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkC4F8.tmpbinary
MD5:8170F7CCDD71AD17652CB2AEB3304EF6
SHA256:C380121028D448EB9428E862239F208495975C66B7CCA8909C04BBA732BE4F6A
7420OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:74FD55188857959254D4D4320D1D4961
SHA256:1FF592794BB6D849DD861F0312C563FD9C01DD8CC3B3A85C5496B75824FDAD13
5404WinRAR.exeC:\Users\admin\Desktop\Orden de compra_896758576568857657858756857645674656745677.exe —
MD5:—
SHA256:—
7420OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
7420OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_853AE073E71BBD448E8BE73C3740AD43.datxml
MD5:0E092DB99AEE99FDFF9B5B222C732CFD
SHA256:D1614AD99ADED9F6F5C1BE7FE7FFA5124BD04A526580DA3818EA8A954E852AA6
7420OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmbinary
MD5:292AF93A955B3FB9D5C3F039514D3CD7
SHA256:8B146EB54AF04EE3FD586C55C0FFC4909641E51085621DB1BB539FD671AB1525
7420OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\51BC2384.datimage
MD5:ACF6C668899C3D5DBBA8CEBF5049219D
SHA256:0CBED3430B36B0EB547E3FBE76DBBDDF1A2C2064425AC198650F2568629CF5A9
7420OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:476AEB9C650EB410DE2DFD7DBB69A5B5
SHA256:ECD34195DCDDEC291B8018695A9A0F3DA0FC8F1EC9C9A1CD52D2AE0B7DA7F357
7420OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkC508.tmpbinary
MD5:D831978B14E33DA627BC781CEDFEAD8A
SHA256:3E17901830B4DEA2B3D7E2280D1DBE142D033C3A7B48B90622BFA40BA580539C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
22
Threats
8

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4024
RUXIMICS.exe
GET
200
173.223.117.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4024
RUXIMICS.exe
GET
200
2.18.121.147:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
173.223.117.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7420
OUTLOOK.EXE
GET
200
2.22.98.7:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8080
Orden de compra_896758576568857657858756857645674656745677.exe
GET
200
198.12.83.69:80
http://198.12.83.69/SOYrCyIiGRkX220.bin
unknown
—
—
unknown
2924
SearchApp.exe
GET
200
2.22.98.7:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.22.98.7:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8080
Orden de compra_896758576568857657858756857645674656745677.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4024
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
4024
RUXIMICS.exe
2.18.121.147:80
crl.microsoft.com
AKAMAI-AS
FR
whitelisted
5496
MoUsoCoreWorker.exe
173.223.117.131:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
4024
RUXIMICS.exe
173.223.117.131:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.206
whitelisted
crl.microsoft.com
  • 2.18.121.147
whitelisted
www.microsoft.com
  • 173.223.117.131
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
omex.cdn.office.net
  • 2.18.121.19
whitelisted
messaging.lifecycle.office.com
  • 52.111.243.8
whitelisted
self.events.data.microsoft.com
  • 13.89.179.14
whitelisted
ocsp.digicert.com
  • 2.22.98.7
whitelisted
ip-api.com
  • 208.95.112.1
whitelisted

Threats

PID
Process
Class
Message
8080
Orden de compra_896758576568857657858756857645674656745677.exe
Potentially Bad Traffic
ET HUNTING Generic .bin download from Dotted Quad
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
8080
Orden de compra_896758576568857657858756857645674656745677.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
8080
Orden de compra_896758576568857657858756857645674656745677.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
8080
Orden de compra_896758576568857657858756857645674656745677.exe
Malware Command and Control Activity Detected
ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
8080
Orden de compra_896758576568857657858756857645674656745677.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
8080
Orden de compra_896758576568857657858756857645674656745677.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration SMTP (Base64 encoded)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Orden de compra.eml