File name:

1744039233-104323-7845-5650-1.eml

Full analysis: https://app.any.run/tasks/430c0c01-ecf3-4b0d-b5d4-ba22ff52c545
Verdict: Malicious activity
Threats:

Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.

Malware Trends Tracker     >>>
Analysis date: April 08, 2025, 16:11:00
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
attachments
attc-unc
susp-attachments
arch-exec
stealer
evasion
smtp
exfiltration
agenttesla
netreactor
Indicators:
MIME: text/html
File info: HTML document, ASCII text, with CRLF line terminators
MD5:

7B73AAD91C4DA44455B91D20A44C313A

SHA1:

DEDAF834C409CC3660AC43C901DF43CAB65AD50A

SHA256:

BC7942841815C39173713EA258303A3BC15EBB82FC3A8E918A94AC963859AA97

SSDEEP:

24576:Q4hf8goD+YeZPxuupPZ4Xp2FxT2AT/LUpfBw5lG4Z:Q4GgeeRZQ2m+5lx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Steals credentials from Web Browsers

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • Actions looks like stealing of personal data

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • AGENTTESLA has been detected (SURICATA)

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • AGENTTESLA has been detected (YARA)

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7512)

    • Checks for external IP

      • RegSvcs.exe (PID: 7760)
      • svchost.exe (PID: 2196)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • Connects to SMTP port

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • Contacting a server suspected of hosting an CnC

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • Application launched itself

      • Pago devuelto y confirmacion bancaria.exe (PID: 7292)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7288)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7512)
      • WinRAR.exe (PID: 8168)

    • The sample compiled with english language support

      • OUTLOOK.EXE (PID: 1276)
      • WinRAR.exe (PID: 7512)
      • WinRAR.exe (PID: 8168)

    • Reads mouse settings

      • Pago devuelto y confirmacion bancaria.exe (PID: 7736)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7292)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7288)
      • Pago devuelto y confirmacion bancaria.exe (PID: 6516)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7488)

    • Checks supported languages

      • Pago devuelto y confirmacion bancaria.exe (PID: 7736)
      • RegSvcs.exe (PID: 7760)
      • Pago devuelto y confirmacion bancaria.exe (PID: 6516)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7292)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7288)
      • RegSvcs.exe (PID: 6512)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7488)
      • RegSvcs.exe (PID: 7480)

    • Reads the computer name

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 7480)
      • RegSvcs.exe (PID: 6512)

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • Disables trace logs

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • Checks proxy server information

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • slui.exe (PID: 7920)
      • RegSvcs.exe (PID: 7480)

    • Create files in a temporary directory

      • Pago devuelto y confirmacion bancaria.exe (PID: 7736)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7292)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7288)
      • Pago devuelto y confirmacion bancaria.exe (PID: 6516)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7488)

    • .NET Reactor protector has been detected

      • RegSvcs.exe (PID: 7760)
      • RegSvcs.exe (PID: 6512)
      • RegSvcs.exe (PID: 7480)

    • Reads the software policy settings

      • slui.exe (PID: 3268)
      • slui.exe (PID: 7920)

    • Manual execution by a user

      • WinRAR.exe (PID: 8168)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7292)
      • Pago devuelto y confirmacion bancaria.exe (PID: 7488)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 3) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
153
Monitored processes
19
Malicious processes
10
Suspicious processes
1

Behavior graph

Click at the process to see the details
start outlook.exe sppextcomobj.exe no specs slui.exe ai.exe no specs winrar.exe pago devuelto y confirmacion bancaria.exe no specs #AGENTTESLA regsvcs.exe svchost.exe slui.exe rundll32.exe no specs winrar.exe pago devuelto y confirmacion bancaria.exe no specs regsvcs.exe no specs pago devuelto y confirmacion bancaria.exe no specs regsvcs.exe no specs pago devuelto y confirmacion bancaria.exe no specs #AGENTTESLA regsvcs.exe pago devuelto y confirmacion bancaria.exe #AGENTTESLA regsvcs.exe

Process information

PID
CMD
Path
Indicators
Parent process
1276"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml C:\Users\admin\AppData\Local\Temp\1744039233-104323-7845-5650-1.emlC:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
3268"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4896"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "F3E9338C-CF0C-464A-AB8A-23EA0E1D9481" "185D53A3-98CC-4F83-B382-2051759C70C0" "1276"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\rpcrt4.dll
5008C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
5680"C:\Users\admin\Documents\Pago devuelto y confirmacion bancaria.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—Pago devuelto y confirmacion bancaria.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
6512"C:\Users\admin\Documents\Pago devuelto y confirmacion bancaria.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
Pago devuelto y confirmacion bancaria.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ole32.dll
6516"C:\Users\admin\Documents\Pago devuelto y confirmacion bancaria.exe"C:\Users\admin\Documents\Pago devuelto y confirmacion bancaria.exe—Pago devuelto y confirmacion bancaria.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\documents\pago devuelto y confirmacion bancaria.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
7264"C:\Users\admin\Documents\Pago devuelto y confirmacion bancaria.exe" C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe—Pago devuelto y confirmacion bancaria.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft .NET Services Installation Utility
Exit code:
0
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\regsvcs.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7288"C:\Users\admin\Documents\Pago devuelto y confirmacion bancaria.exe"C:\Users\admin\Documents\Pago devuelto y confirmacion bancaria.exe—Pago devuelto y confirmacion bancaria.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\documents\pago devuelto y confirmacion bancaria.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
Total events
20 922
Read events
19 624
Write events
1 148
Delete events
150

Modification events

(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01941A000000001000B24E9A3E06000000000000000600000000000000
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\1276
Operation:writeName:0
Value:
0B0E10F872B7D63CAC364BAF0E336C87F02FDA230046A79DC1BC8D94EAED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511FC09D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:delete keyName:(default)
Value:
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:CantBootResolution
Value:
BootSuccess
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:ProfileBeingOpened
Value:
Outlook
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:SessionId
Value:
C3D8E96E-C1AF-4750-8D52-F4E28119C131
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:BootDiagnosticsLogFile
Value:
C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20240718T1116060318-1644.etl
(PID) Process:(1276) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:ProfileBeingOpened
Value:
Executable files
2
Suspicious files
22
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
1276OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
1276OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:F25DCDC613A8E29D6F29372622AC2CED
SHA256:F0A1FF2488B1B4FFBB7AA9FD0108763A6F535D6E485C0C3FCEAE202B63079D20
7736Pago devuelto y confirmacion bancaria.exeC:\Users\admin\AppData\Local\Temp\aut22D7.tmpbinary
MD5:6229CEAD99274722CE6C7933B08440BA
SHA256:5CDFFBAEEF4F542213081D49F53657A285870EB829F30B6D1862AAF702748A2E
1276OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:F701671918F778501BADB7B27C8DB649
SHA256:428142103AFF31C9E60F45CEE95128FB2AB471916A3BB4740DEA2B3655B53B1B
1276OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ZYUJOWWK\Pago devuelto y confirmacion bancaria.001compressed
MD5:69BF0A7E8155E757633A78AC9AA54A67
SHA256:2955DF54C92F76B0B9D01136CEB5707A2C9C8775AC4CA1FD33C4280D383DE5DC
1276OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkC287.tmpbinary
MD5:88D4FF8A6B7D65073740FE6914C6F988
SHA256:414B1BDFFC10AB6E01D3967F3987DA20BAA11F8353FCF144A6EC3D389C387C4A
1276OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:45C782A8DDCFBBBB10632240212A7221
SHA256:ED32A60954193EDBB200A20B7749920501D1A52EB4BF135766A7D2084D56138C
1276OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:DB654F1A2D2C2111A595AF0F12762144
SHA256:965344EBA938F581279031B24E5955958864C7626E3FDC6710B1C91A65E13483
1276OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:C79C0F94B5DC2531E4B26D18799FB415
SHA256:665EFCD1AE5A6C4B8E2EA6CF966ADBEE75EF29CB99E9FA282DC083E96B5BE151
1276OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\ZYUJOWWK\Pago devuelto y confirmacion bancaria (002).001compressed
MD5:69BF0A7E8155E757633A78AC9AA54A67
SHA256:2955DF54C92F76B0B9D01136CEB5707A2C9C8775AC4CA1FD33C4280D383DE5DC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
41
DNS requests
27
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7652
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7652
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1276
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
1276
OUTLOOK.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
7760
RegSvcs.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
7480
RegSvcs.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
6512
RegSvcs.exe
GET
200
208.95.112.1:80
http://ip-api.com/line/?fields=hosting
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1276
OUTLOOK.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.66:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1276
OUTLOOK.EXE
52.109.89.19:443
roaming.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.66
  • 20.190.160.5
  • 20.190.160.64
  • 20.190.160.132
  • 20.190.160.67
  • 20.190.160.17
  • 20.190.160.4
  • 20.190.160.3
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
roaming.officeapps.live.com
  • 52.109.89.19
whitelisted
omex.cdn.office.net
  • 23.50.131.87
  • 23.50.131.86
whitelisted
messaging.lifecycle.office.com
  • 52.111.231.8
whitelisted
nleditor.osi.office.net
  • 52.111.236.32
  • 52.111.236.33
  • 52.111.236.35
  • 52.111.236.34
whitelisted

Threats

PID
Process
Class
Message
7760
RegSvcs.exe
Device Retrieving External IP Address Detected
POLICY [ANY.RUN] External Hosting Lookup by ip-api
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
7760
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
7760
RegSvcs.exe
Misc activity
INFO [ANY.RUN] SMTP email client opens transfer with server (EHLO)
7760
RegSvcs.exe
Malware Command and Control Activity Detected
ET MALWARE MSIL/Kryptik.XSY Data Exfil via SMTP
7760
RegSvcs.exe
A Network Trojan was detected
STEALER [ANY.RUN] AgentTesla Exfiltration SMTP (Base64 encoded)
2196
svchost.exe
Device Retrieving External IP Address Detected
INFO [ANY.RUN] External IP Check (ip-api .com)
2196
svchost.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup Domain in DNS Lookup (ip-api .com)
6512
RegSvcs.exe
Device Retrieving External IP Address Detected
ET INFO External IP Lookup ip-api.com
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1744039233-104323-7845-5650-1.eml