File name:

19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe

Full analysis: https://app.any.run/tasks/366c8ab5-cba9-40d8-a004-2150dead4f3c
Verdict: Malicious activity
Analysis date: December 22, 2024, 16:24:04
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 5 sections
MD5:

5CA954C3CED923B9D6FDAFB1DF72C7E4

SHA1:

23F1B3C9654012785C6E4147E776C18C3B471EA0

SHA256:

19ABAF55340FF70009D0E622D28844A6159EAF0E449EDA55269CB8B5917B5634

SSDEEP:

1536:ukKRJOd/kibf2bR7m+vbODE7hZegUzNVDtXPGCgtIKlW:u/Cdcibf2bRdvSrzlPGtRlW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the login/logoff helper path in the registry

      • CTFMON.EXE (PID: 6560)
      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)
      • SPOOLSV.EXE (PID: 6484)
      • SVCHOST.EXE (PID: 6436)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)

    • Executable content was dropped or overwritten

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)

    • The process creates files with name similar to system file names

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)

    • Starts itself from another location

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)
      • SPOOLSV.EXE (PID: 6484)
      • CTFMON.EXE (PID: 6560)
      • SVCHOST.EXE (PID: 6436)

    • Application launched itself

      • SVCHOST.EXE (PID: 6436)
      • SPOOLSV.EXE (PID: 6484)
      • CTFMON.EXE (PID: 6560)

    • Reads security settings of Internet Explorer

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)

    • Reads the Windows owner or organization settings

      • WINWORD.EXE (PID: 6880)

  • INFO

    • Checks supported languages

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)
      • SVCHOST.EXE (PID: 6436)
      • SVCHOST.EXE (PID: 6464)
      • SVCHOST.EXE (PID: 6636)
      • SPOOLSV.EXE (PID: 6656)
      • SPOOLSV.EXE (PID: 6536)
      • CTFMON.EXE (PID: 6560)
      • SPOOLSV.EXE (PID: 6484)
      • SVCHOST.EXE (PID: 6516)
      • CTFMON.EXE (PID: 6680)

    • Create files in a temporary directory

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)
      • SVCHOST.EXE (PID: 6436)
      • SVCHOST.EXE (PID: 6464)
      • SPOOLSV.EXE (PID: 6536)
      • CTFMON.EXE (PID: 6560)
      • SVCHOST.EXE (PID: 6636)
      • SPOOLSV.EXE (PID: 6656)
      • SVCHOST.EXE (PID: 6516)
      • SPOOLSV.EXE (PID: 6484)
      • CTFMON.EXE (PID: 6680)

    • Failed to create an executable file in Windows directory

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)
      • SVCHOST.EXE (PID: 6436)
      • CTFMON.EXE (PID: 6560)
      • SPOOLSV.EXE (PID: 6484)

    • Reads the computer name

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)

    • The process uses the downloaded file

      • WINWORD.EXE (PID: 6880)
      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)

    • Process checks computer location settings

      • 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe (PID: 6408)

    • Drops encrypted VBS script (Microsoft Script Encoder)

      • WINWORD.EXE (PID: 6880)

    • Sends debugging messages

      • WINWORD.EXE (PID: 6880)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:08:06 18:34:23+00:00
ImageFileCharacteristics: Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 7.1
CodeSize: 61440
InitializedDataSize: 20480
UninitializedDataSize: -
EntryPoint: 0x11d0
OSVersion: 4
ImageVersion: 10
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
12
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe svchost.exe svchost.exe no specs spoolsv.exe svchost.exe no specs spoolsv.exe no specs ctfmon.exe svchost.exe no specs spoolsv.exe no specs ctfmon.exe no specs winword.exe ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
3988"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "B630F4F2-7BEE-4435-A86A-2A421DDF57D2" "C64C9CF3-8E64-4C44-9A6B-060293756184" "6880"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
6408"C:\Users\admin\Desktop\19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe" C:\Users\admin\Desktop\19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Version:
11.0.5604
Modules
Images
c:\users\admin\desktop\19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6436C:\recycled\SVCHOST.EXE :agentC:\Recycled\SVCHOST.EXE
19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Version:
11.0.5604
Modules
Images
c:\recycled\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6464C:\recycled\SVCHOST.EXE :agentC:\Recycled\SVCHOST.EXE—SVCHOST.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
11.0.5604
Modules
Images
c:\recycled\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6484C:\recycled\SPOOLSV.EXE :agentC:\Recycled\SPOOLSV.EXE
SVCHOST.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Version:
11.0.5604
Modules
Images
c:\recycled\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6516C:\recycled\SVCHOST.EXE :agentC:\Recycled\SVCHOST.EXE—SPOOLSV.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
11.0.5604
Modules
Images
c:\recycled\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6536C:\recycled\SPOOLSV.EXE :agentC:\Recycled\SPOOLSV.EXE—SPOOLSV.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
11.0.5604
Modules
Images
c:\recycled\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6560C:\recycled\CTFMON.EXE :agentC:\Recycled\CTFMON.EXE
SPOOLSV.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Version:
11.0.5604
Modules
Images
c:\recycled\ctfmon.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6636C:\recycled\SVCHOST.EXE :agentC:\Recycled\SVCHOST.EXE—CTFMON.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
11.0.5604
Modules
Images
c:\recycled\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6656C:\recycled\SPOOLSV.EXE :agentC:\Recycled\SPOOLSV.EXE—CTFMON.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Version:
11.0.5604
Modules
Images
c:\recycled\spoolsv.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
Total events
15 999
Read events
15 325
Write events
635
Delete events
39

Modification events

(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
Operation:delete keyName:(default)
Value:
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config
Operation:delete keyName:(default)
Value:
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
Operation:delete keyName:(default)
Value:
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install
Operation:delete keyName:(default)
Value:
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
Explorer.exe "C:\recycled\SVCHOST.exe"
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Operation:writeName:UncheckedValue
Value:
1
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Operation:writeName:CheckedValue
Value:
1
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
Operation:writeName:CheckedValue
Value:
0
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
Operation:writeName:UncheckedValue
Value:
0
(PID) Process:(6408) 19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
Value:
01000000000000001D377EF28D54DB01
Executable files
23
Suspicious files
130
Text files
33
Unknown types
1

Dropped files

PID
Process
Filename
Type
640819abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeC:\Recycled\desktop.initext
MD5:AD0B0B4416F06AF436328A3C12DC491B
SHA256:23521DE51CA1DB2BC7B18E41DE7693542235284667BF85F6C31902547A947416
640819abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeC:\Recycled\SPOOLSV.EXEexecutable
MD5:2CCBA2CF3EFF0BC3B98B9F1F59D27942
SHA256:CCFD03FD8E7F906155AB0072AEDEC870579ED372608F2622A89BEE52C2E9A681
6656SPOOLSV.EXEC:\Users\admin\AppData\Local\Temp\~DFAC5DE9C1A6288C81.TMPbinary
MD5:45638515285B284998E3256870EFED0A
SHA256:F1DEC64C759D94C12FC3ECC6237C7402EFCE00370058AF86BFBBBBC3859167B1
640819abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeC:\Recycled\CTFMON.EXEexecutable
MD5:79F62D3097399A7312ADB8DDF9208061
SHA256:52A3534FB732E4B66F408B93639E84EC719814D3A4F457E9D638F932C130A6D5
6464SVCHOST.EXEC:\Users\admin\AppData\Local\Temp\~DF34EA2716A82E70D8.TMPbinary
MD5:E71B95C80B2C12FB45260852FF807560
SHA256:73988D9C8B422111F74664272F16398ED92E46A41A45F3AC54875D5DE7B5D0CD
640819abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeC:\Recycled\SVCHOST.EXEexecutable
MD5:48048D48F0B9970C86A38B6AA56BD013
SHA256:912AFD56E8EA6E28BE7477226AA61C7A267DC30F4D75117E44B4E405BE69DD67
640819abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeC:\Recycled\SMSS.EXEexecutable
MD5:0788179D173422CC09F53DDCF8ED7013
SHA256:04F9B9223F30120EB7F929230D673DBC91286591D51E1166CCDFF55AF0125337
6636SVCHOST.EXEC:\Users\admin\AppData\Local\Temp\~DF7737781ED5F17AE8.TMPbinary
MD5:BE9F6D0A43BEF1CDE6D4123EBB6E0208
SHA256:D40795BE4607B2B59272BDBE4940E28973EA21B5B936A8986B398245F0D04B32
640819abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exeC:\Users\admin\AppData\Local\Temp\~DFAFA84DAF6A3EBCBB.TMPbinary
MD5:BFA4FEDB7FF4072B842161FFCCC7F762
SHA256:6A7C05FC01F0E159CBE3E537C5685EFC8E06DA84F5B4EDAC2AE78C4CAE51397C
6560CTFMON.EXEC:\Users\admin\AppData\Local\Temp\~DF6693C41BD67CA11D.TMPbinary
MD5:103F7362C9C427FA801CBFCFDD9EBC82
SHA256:1CC081862B13F4B6A921816FFE724A2FCBFEC289E6057FD6259D5F80C6B22886
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
71
TCP/UDP connections
84
DNS requests
16
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.30:443
https://omex.cdn.office.net/addinclassifier/officesharedentities
unknown
text
314 Kb
whitelisted
—
—
GET
200
52.109.89.18:443
https://officeclient.microsoft.com/config16/?lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3
unknown
xml
178 Kb
whitelisted
—
—
GET
200
52.111.231.13:443
https://messaging.lifecycle.office.com/getcustommessage16?app=0&ui=en-US&src=BizBar&messagetype=BizBar&hwid=04111-083-043729&ver=16.0.16026&lc=en-US&platform=10%3A0%3A19045%3A2%3A0%3A0%3A256%3A1%3A&productid=%7B1717C1E0-47D3-4899-A6D3-1022DB7415E0%7D%3A00411-10830-43729-AA720%3AOffice%2019%2C%20Office19Professional2019R_Retail%20edition&clientsessionid=%7B58307C81-E4CC-4926-A470-B0EAD361F0AD%7D&datapropertybag=%7B%22Audience%22%3A%22Production%22%2C%22AudienceGroup%22%3A%22Production%22%2C%22AudienceChannel%22%3A%22CC%22%2C%22Flight%22%3A%22ofsh6c2b1tla1a31%2Cofcrui4yvdulbf31%2Cofhpex3jznepoo31%2Cofpioygfqmufst31%2Cofjhlwlmoc1pz531%22%7D
unknown
text
542 b
whitelisted
—
—
GET
200
52.113.194.132:443
https://ecs.office.com/config/v2/Office/word/16.0.16026.20146/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=word&Platform=win32&Version=16.0.16026.20146&MsoVersion=16.0.16026.20002&SDX=fa000000002.2.0.1907.31003&SDX=fa000000005.1.0.1909.30011&SDX=fa000000006.1.0.1909.13002&SDX=fa000000008.1.0.1908.16006&SDX=fa000000009.1.0.1908.6002&SDX=fa000000016.1.0.1810.13001&SDX=fa000000029.1.0.1906.25001&SDX=fa000000033.1.0.1908.24001&SDX=wa104381125.1.0.1810.9001&ProcessName=winword.exe&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=6&LicenseSKU=Professional2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7b58307C81-E4CC-4926-A470-B0EAD361F0AD%7d&LabMachine=false
unknown
binary
398 Kb
whitelisted
—
—
GET
200
184.24.77.20:443
https://binaries.templates.cdn.office.net/support/templates/en-us/tp02835233.cab
unknown
compressed
45.3 Kb
whitelisted
—
—
POST
200
20.189.173.5:443
https://self.events.data.microsoft.com/OneCollector/1.0/
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
192.168.100.255:137
—
—
—
whitelisted
440
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.23.209.149:443
www.bing.com
Akamai International B.V.
GB
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6880
WINWORD.EXE
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
www.bing.com
  • 2.23.209.149
  • 2.23.209.150
  • 2.23.209.189
  • 2.23.209.161
  • 2.23.209.176
  • 2.23.209.133
  • 2.23.209.148
  • 2.23.209.140
  • 2.23.209.130
whitelisted
google.com
  • 172.217.23.110
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.120
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
omex.cdn.office.net
  • 2.22.242.130
  • 2.22.242.90
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
messaging.lifecycle.office.com
  • 52.111.231.13
whitelisted
self.events.data.microsoft.com
  • 104.46.162.224
  • 52.168.117.175
whitelisted

Threats

No threats detected
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
19abaf55340ff70009d0e622d28844a6159eaf0e449eda55269cb8b5917b5634.exe