File name:

Fw_ estado de cuentas (Ref_ -4264795 ® 📅)-password(RQuhRddr).zip

Full analysis: https://app.any.run/tasks/e130a95a-0e29-4d9f-b7dd-f902480b0ff9
Verdict: Malicious activity
Analysis date: February 17, 2025, 19:35:22
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
attachments
attc-unc
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

054DBB672BB8D2AD4B623D184D1B3C88

SHA1:

F40A970B947586E5D8DB9C1436C071BB36E4BAA0

SHA256:

E077FEC342FC701565440C194E5BAAD04694CD31DC128ACB86CF3B272CEC8E5C

SSDEEP:

98304:rIM8ATOLc76U2j6AewRbM0n7p23opL8uspfOQOvoID8NBdHP999wz/CRcqtP7cU5:vkI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6724)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6952)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6900)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6412)
      • WinRAR.exe (PID: 6296)

    • Reads Microsoft Outlook installation path

      • WinRAR.exe (PID: 6412)

  • INFO

    • Manual execution by a user

      • WinRAR.exe (PID: 6296)
      • MSBuild.exe (PID: 1020)
      • MSBuild.exe (PID: 2956)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6412)

    • Checks supported languages

      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6900)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6724)
      • MSBuild.exe (PID: 2956)
      • MSBuild.exe (PID: 1020)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6952)

    • Reads the machine GUID from the registry

      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6900)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6724)
      • MSBuild.exe (PID: 1020)
      • MSBuild.exe (PID: 2956)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6952)

    • Reads the computer name

      • MSBuild.exe (PID: 1020)
      • MSBuild.exe (PID: 2956)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6900)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6724)
      • facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe (PID: 6952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0801
ZipCompression: Unknown (99)
ZipModifyDate: 2025:02:17 19:30:56
ZipCRC: 0x00000000
ZipCompressedSize: 2273262
ZipUncompressedSize: 2273234
ZipFileName: ae3c231fd240c277039193087e64e717a5fb894f0d8cc5108424334205432706.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
140
Monitored processes
10
Malicious processes
1
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe no specs outlook.exe ai.exe no specs rundll32.exe no specs winrar.exe no specs facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe no specs facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe no specs facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe no specs msbuild.exe no specs msbuild.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1020"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Exit code:
4294967295
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
2956"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
MSBuild.exe
Version:
4.8.9037.0 built by: NET481REL1
Modules
Images
c:\windows\microsoft.net\framework\v4.0.30319\msbuild.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
4132C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
4872"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Rar$DIb6412.24610\ae3c231fd240c277039193087e64e717a5fb894f0d8cc5108424334205432706.eml"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
6148"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "E21C83F7-976C-46A4-BA11-DF9073645F73" "28E4CA9A-E378-4C91-B9F4-239A0C5893C2" "4872"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
6296"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Documents\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.bz2"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6412"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Fw_ estado de cuentas (Ref_ -4264795 ® 📅)-password(RQuhRddr).zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6724"C:\Users\admin\AppData\Local\Temp\Rar$EXa6296.34606\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6296.34606\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Foxmail安装程序
Version:
7.2.25.331
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6296.34606\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6900"C:\Users\admin\AppData\Local\Temp\Rar$EXa6296.31939\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6296.31939\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Foxmail安装程序
Exit code:
4294967295
Version:
7.2.25.331
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6296.31939\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6952"C:\Users\admin\AppData\Local\Temp\Rar$EXa6296.32375\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6296.32375\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Foxmail安装程序
Exit code:
4294967295
Version:
7.2.25.331
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6296.32375\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
Total events
23 136
Read events
21 854
Write events
1 140
Delete events
142

Modification events

(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Fw_ estado de cuentas (Ref_ -4264795 ® 📅)-password(RQuhRddr).zip
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
1
(PID) Process:(6412) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\OpenWithProgids
Operation:writeName:Outlook.File.eml.15
Value:
Executable files
0
Suspicious files
12
Text files
9
Unknown types
0

Dropped files

PID
Process
Filename
Type
4872OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
4872OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:0FE086FB15B02B61EB155BB97576F926
SHA256:83B2E3CF90535832A0F1E65DADC6D5CAB13935721194FA8F2542E988F915B876
6296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6296.31939\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe —
MD5:—
SHA256:—
6296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6296.32375\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe —
MD5:—
SHA256:—
6412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb6412.24610\ae3c231fd240c277039193087e64e717a5fb894f0d8cc5108424334205432706.emlhtml
MD5:A3D776065E32A1776A23A8F7392863B8
SHA256:518F16054BC6E1B1953589344280C33ECAF35357F0C0FD94EFA4A712F7A3958A
6296WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa6296.34606\facturas vencidas, 0098, 0099, 00976, 009668, 009678, 00565984333232.exe —
MD5:—
SHA256:—
4872OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:F4E4C43EFA1A5EBED5C59EE42F3821B5
SHA256:52EB64F6F72F84121E9C86265A94AC7406F6F7A89121888749E97ABDCFAF174C
4872OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:5798F9560CF805131118626D407C72A8
SHA256:DA98238E16A962692B5AB6EA02722825DECB00C5B969A9FD8A26422417ADBB7F
4872OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:CEB61D9D7BEB21CBDDE7796471EBC1DE
SHA256:4236A61617F4961DA988161BE06DA59D13DB9C6949A1436774B3B6621EB84BE0
4872OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkE5FE.tmpbinary
MD5:7E91C21E5DEC94B5810A6A244AC000CF
SHA256:F7E942BC409AF7B157C8E1ADAB2BE753B6F21E9A76FAA4721C792D1371DAAAA5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
42
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.37:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5892
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4872
OUTLOOK.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7016
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4872
OUTLOOK.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
6316
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6316
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.37:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5892
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
936
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
104.126.37.130:443
www.bing.com
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.37
  • 23.48.23.10
  • 23.48.23.35
  • 23.48.23.24
  • 23.48.23.30
  • 23.48.23.29
whitelisted
google.com
  • 142.250.186.110
whitelisted
www.bing.com
  • 104.126.37.130
  • 104.126.37.160
  • 104.126.37.123
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.186
  • 104.126.37.145
  • 104.126.37.131
  • 104.126.37.139
whitelisted
www.microsoft.com
  • 184.30.21.171
  • 2.23.246.101
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
login.live.com
  • 20.190.159.23
  • 20.190.159.0
  • 40.126.31.131
  • 40.126.31.0
  • 20.190.159.131
  • 40.126.31.69
  • 20.190.159.75
  • 40.126.31.2
whitelisted
go.microsoft.com
  • 2.19.246.123
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 52.165.164.15
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Fw_ estado de cuentas (Ref_ -4264795 ® 📅)-password(RQuhRddr).zip