File name:

Complete el pago total como se adjunta-password(tzGVo7mH).zip

Full analysis: https://app.any.run/tasks/8be8968d-09e7-4ee5-b31e-04356e74613f
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: April 25, 2025, 16:29:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
susp-attachments
attachments
attc-unc
arch-exec
stealer
evasion
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

AEAEF2247AA469E6ED0AE1CC24B9CFCF

SHA1:

BEE0F2EA4442D58CA07272C8AE12F7083C3C146F

SHA256:

FD42CAA9FC9AE090FBCE2E33F374989D1A24F7CBBC35D1FFDBBE251FFF027AD9

SSDEEP:

49152:R7ggWyi+jBOzjprBUZ69t7oHAZ7fUidAHnhRX4+Gu6VMptOOuAO0eRNxkSliNGyL:R7bm+lOX5uI7oHAZSHnh14zu6Gpc2DQC

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Copia del pago__xls.exe (PID: 1748)
      • Copia del pago__xls.exe (PID: 5588)
      • Copia del pago__xls.exe (PID: 2104)

    • Uses Task Scheduler to run other applications

      • Copia del pago__xls.exe (PID: 5384)
      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 5984)

    • Stealers network behavior

      • Copia del pago__xls.exe (PID: 5588)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 5988)
      • WinRAR.exe (PID: 5600)
      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 1748)
      • Copia del pago__xls.exe (PID: 5384)
      • Copia del pago__xls.exe (PID: 5588)
      • Copia del pago__xls.exe (PID: 5984)
      • Copia del pago__xls.exe (PID: 2104)

    • Reads Microsoft Outlook installation path

      • WinRAR.exe (PID: 5988)

    • Executable content was dropped or overwritten

      • Copia del pago__xls.exe (PID: 6112)

    • Application launched itself

      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 5384)
      • Copia del pago__xls.exe (PID: 5984)

    • Checks for external IP

      • Copia del pago__xls.exe (PID: 1748)
      • Copia del pago__xls.exe (PID: 5588)
      • Copia del pago__xls.exe (PID: 2104)

  • INFO

    • Reads the computer name

      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 5384)
      • Copia del pago__xls.exe (PID: 5984)
      • Copia del pago__xls.exe (PID: 1748)
      • Copia del pago__xls.exe (PID: 5588)
      • Copia del pago__xls.exe (PID: 2104)

    • Checks supported languages

      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 5984)
      • Copia del pago__xls.exe (PID: 5384)
      • Copia del pago__xls.exe (PID: 1748)
      • Copia del pago__xls.exe (PID: 5588)
      • Copia del pago__xls.exe (PID: 2104)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 5988)

    • Reads the software policy settings

      • slui.exe (PID: 2908)

    • Reads the machine GUID from the registry

      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 5384)
      • Copia del pago__xls.exe (PID: 5984)
      • Copia del pago__xls.exe (PID: 1748)
      • Copia del pago__xls.exe (PID: 5588)
      • Copia del pago__xls.exe (PID: 2104)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5600)

    • Creates files or folders in the user directory

      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 5588)
      • Copia del pago__xls.exe (PID: 1748)
      • Copia del pago__xls.exe (PID: 2104)

    • Process checks computer location settings

      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 5384)
      • Copia del pago__xls.exe (PID: 5984)

    • Create files in a temporary directory

      • Copia del pago__xls.exe (PID: 6112)
      • Copia del pago__xls.exe (PID: 5384)
      • Copia del pago__xls.exe (PID: 5984)

    • Checks proxy server information

      • Copia del pago__xls.exe (PID: 1748)
      • Copia del pago__xls.exe (PID: 5588)
      • Copia del pago__xls.exe (PID: 2104)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0801
ZipCompression: Unknown (99)
ZipModifyDate: 2025:04:25 16:28:58
ZipCRC: 0x00000000
ZipCompressedSize: 1055562
ZipUncompressedSize: 1055534
ZipFileName: f193add8b5b2423c7b12075d1ad9ada83251d1594c44e480a9c2489ac6da8616.eml
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
19
Malicious processes
4
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe no specs sppextcomobj.exe no specs slui.exe outlook.exe ai.exe no specs winrar.exe slui.exe no specs copia del pago__xls.exe copia del pago__xls.exe no specs copia del pago__xls.exe no specs schtasks.exe no specs conhost.exe no specs copia del pago__xls.exe schtasks.exe no specs conhost.exe no specs copia del pago__xls.exe schtasks.exe no specs conhost.exe no specs copia del pago__xls.exe

Process information

PID
CMD
Path
Indicators
Parent process
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1748"C:\Users\admin\AppData\Local\Temp\Rar$EXa5600.44686\Copia del pago__xls.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa5600.44686\Copia del pago__xls.exe
Copia del pago__xls.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5600.44686\copia del pago__xls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
2088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2104"C:\Users\admin\AppData\Local\Temp\Rar$EXa5600.45480\Copia del pago__xls.exe"C:\Users\admin\AppData\Local\Temp\Rar$EXa5600.45480\Copia del pago__xls.exe
Copia del pago__xls.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Change Tracking
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa5600.45480\copia del pago__xls.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvbvm60.dll
c:\windows\syswow64\user32.dll
2316"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "9772DE6D-1B0A-4EBD-9A79-28EC65C1EE6F" "8D967CC4-F6B4-4667-A6A5-6E457EF0D118" "6584"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
2908"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4108"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\axIcIVwpkXDRz" /XML "C:\Users\admin\AppData\Local\Temp\tmp1A85.tmp"C:\Windows\SysWOW64\schtasks.exe—Copia del pago__xls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5228"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\axIcIVwpkXDRz" /XML "C:\Users\admin\AppData\Local\Temp\tmpA0A.tmp"C:\Windows\SysWOW64\schtasks.exe—Copia del pago__xls.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Task Scheduler Configuration Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\schtasks.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
5232\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—schtasks.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
20 693
Read events
19 465
Write events
1 088
Delete events
140

Modification events

(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Complete el pago total como se adjunta-password(tzGVo7mH).zip
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(5988) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.eml\OpenWithProgids
Operation:writeName:Outlook.File.eml.15
Value:
Executable files
4
Suspicious files
20
Text files
11
Unknown types
0

Dropped files

PID
Process
Filename
Type
6584OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
5988WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb5988.39611\f193add8b5b2423c7b12075d1ad9ada83251d1594c44e480a9c2489ac6da8616.emlhtml
MD5:E88A5385888FD4556BD134AD872D5D1F
SHA256:D12DAE9E80ED9FE323ACE41A25E0F44501696B81703BAAAED04699AAE261D162
5988WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIb5988.39611\f193add8b5b2423c7b12075d1ad9ada83251d1594c44e480a9c2489ac6da8616.eml:OECustomPropertybinary
MD5:663A2771A7B9C0AA302FD6C00C6FCE22
SHA256:ADA9D892E33592A3B97CAC3080065B727FC210B07B4D8ABB34F418F02C688C84
6584OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:A7D1540262CB6D359137C7C986E3117C
SHA256:4192244D2D2BB4A0EE3C0563E6347D29B17F72D980DCDF1583A974962F7256AE
6584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:2BDE491F79179EBE4B7B404DA4BBD0C6
SHA256:5A56BFC700112A5DF477CF5BFB1712AD0A34F092536152F4955664CE4DF4332A
6584OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:00F6527700D795BBCB9E20296D1F7D0C
SHA256:482DBBCB9A94F046708C6736708248AF0553A04C8F8F6FC49DB278A127634498
6584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
6584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_46783D2F8950A0449C29D8F4F3612BFD.datxml
MD5:0E092DB99AEE99FDFF9B5B222C732CFD
SHA256:D1614AD99ADED9F6F5C1BE7FE7FFA5124BD04A526580DA3818EA8A954E852AA6
6584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:C82623484D2E2C27079C76617358EAC3
SHA256:6748A86D2403FBBB1EBDF0CEA2EBFC74E4FF4FA5B7995D1F543E16F4FA4F2B52
6584OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\H10VDZ5P\Copia del pago__xls.z:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
33
DNS requests
25
Threats
9

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.194:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6800
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6584
OUTLOOK.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6584
OUTLOOK.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
5588
Copia del pago__xls.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
1748
Copia del pago__xls.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
2104
Copia del pago__xls.exe
GET
200
162.55.60.2:80
http://showip.net/
unknown
—
—
shared
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.194:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6800
SIHClient.exe
20.109.210.53:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.194
  • 23.48.23.141
  • 23.48.23.192
  • 23.48.23.189
  • 23.48.23.140
  • 23.48.23.132
  • 23.48.23.188
  • 23.48.23.190
  • 23.48.23.195
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.32.134
  • 20.190.160.67
  • 40.126.32.76
  • 40.126.32.74
  • 40.126.32.138
  • 20.190.160.22
  • 20.190.160.3
  • 20.190.160.20
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
slscr.update.microsoft.com
  • 20.109.210.53
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted

Threats

PID
Process
Class
Message
1748
Copia del pago__xls.exe
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
1748
Copia del pago__xls.exe
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
1748
Copia del pago__xls.exe
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
5588
Copia del pago__xls.exe
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
5588
Copia del pago__xls.exe
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
5588
Copia del pago__xls.exe
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
2104
Copia del pago__xls.exe
Attempted Information Leak
ET INFO IP Check Domain (showip in HTTP Host)
2104
Copia del pago__xls.exe
A Network Trojan was detected
STEALER [ANY.RUN] DarkCloud External IP Check
2104
Copia del pago__xls.exe
Device Retrieving External IP Address Detected
ET HUNTING [ANY.RUN] DARKCLOUD Style External IP Check
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Complete el pago total como se adjunta-password(tzGVo7mH).zip