File name:

yuki.exe

Full analysis: https://app.any.run/tasks/a3d0b327-9fee-4437-86c9-bd9f8c5e1782
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: November 07, 2024, 07:34:59
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
pyinstaller
github
discord
arch-doc
ims-api
generic
discordgrabber
stealer
susp-powershell
python
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 6 sections
MD5:

75F2C40C5FD05B5824D88867C17AFB49

SHA1:

9E29B9A694B3010DEF637B18F245CA8635723649

SHA256:

1C0D63ED602D3C5B4C7FEA32E801AB1B2610F7E9D50C3CCB7CA9550810EA2E0A

SSDEEP:

393216:zJkIR1w4GGeqdCpDv//6dcjY+0bnd2AnRxvKO4BQ4L8nWTGS:1F64GvqdCpD35jYhbnd2AnRD4BXeS

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Create files in the Startup directory

      • yuki.exe (PID: 5980)

    • Actions looks like stealing of personal data

      • yuki.exe (PID: 5980)

    • Changes settings for protection against network attacks (IPS)

      • powershell.exe (PID: 6112)

    • Changes settings for checking scripts for malicious actions

      • powershell.exe (PID: 6112)

    • Changes settings for sending potential threat samples to Microsoft servers

      • powershell.exe (PID: 6112)

    • Changes Controlled Folder Access settings

      • powershell.exe (PID: 6112)

    • Changes antivirus protection settings for downloading files from the Internet (IOAVProtection)

      • powershell.exe (PID: 6112)

    • Changes settings for real-time protection

      • powershell.exe (PID: 6112)

    • Changes settings for reporting to Microsoft Active Protection Service (MAPS)

      • powershell.exe (PID: 6112)

    • Adds extension to the Windows Defender exclusion list

      • yuki.exe (PID: 5980)
      • cmd.exe (PID: 6368)

    • DISCORDGRABBER has been detected (YARA)

      • yuki.exe (PID: 5980)

    • Adds path to the Windows Defender exclusion list

      • cmd.exe (PID: 6368)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • yuki.exe (PID: 6936)
      • yuki.exe (PID: 5980)

    • Application launched itself

      • yuki.exe (PID: 6936)

    • Process drops legitimate windows executable

      • yuki.exe (PID: 6936)

    • The process drops C-runtime libraries

      • yuki.exe (PID: 6936)

    • Starts CMD.EXE for commands execution

      • yuki.exe (PID: 5980)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 7120)
      • cmd.exe (PID: 6368)

    • Script disables Windows Defender's IPS

      • cmd.exe (PID: 7120)

    • Script disables Windows Defender's real-time protection

      • cmd.exe (PID: 7120)

    • Possible usage of Discord/Telegram API has been detected (YARA)

      • yuki.exe (PID: 5980)

    • The process hide an interactive prompt from the user

      • cmd.exe (PID: 6368)

    • Script adds exclusion path to Windows Defender

      • cmd.exe (PID: 6368)

    • Uses ATTRIB.EXE to modify file attributes

      • cmd.exe (PID: 1784)

    • Script adds exclusion extension to Windows Defender

      • cmd.exe (PID: 6368)

    • Executable content was dropped or overwritten

      • yuki.exe (PID: 6936)

    • Process drops python dynamic module

      • yuki.exe (PID: 6936)

    • Loads Python modules

      • yuki.exe (PID: 5980)

  • INFO

    • Create files in a temporary directory

      • yuki.exe (PID: 5980)
      • yuki.exe (PID: 6936)

    • Reads the computer name

      • yuki.exe (PID: 5980)
      • yuki.exe (PID: 6936)

    • Checks proxy server information

      • yuki.exe (PID: 5980)

    • Checks supported languages

      • yuki.exe (PID: 6936)
      • yuki.exe (PID: 5980)

    • Creates files or folders in the user directory

      • yuki.exe (PID: 5980)

    • Found Base64 encoded access to Windows Defender via PowerShell (YARA)

      • yuki.exe (PID: 5980)

    • Manual execution by a user

      • notepad.exe (PID: 6460)
      • WINWORD.EXE (PID: 7132)
      • WINWORD.EXE (PID: 7148)
      • WINWORD.EXE (PID: 5532)
      • notepad.exe (PID: 5784)
      • notepad.exe (PID: 204)
      • notepad.exe (PID: 7076)

    • PyInstaller has been detected (YARA)

      • yuki.exe (PID: 6936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

ims-api

(PID) Process(5980) yuki.exe
Discord-Webhook-Tokens (1)1303879104483037328/x163Q7rIAq_QJSEfjIAIn2-LmGhM7BogAgD74pxvkReWBemMpVraA2Fkx80lRhDXpKTS
Discord-Info-Links
1303879104483037328/x163Q7rIAq_QJSEfjIAIn2-LmGhM7BogAgD74pxvkReWBemMpVraA2Fkx80lRhDXpKTS
Get Webhook Infohttps://discord.com/api/webhooks/1303879104483037328/x163Q7rIAq_QJSEfjIAIn2-LmGhM7BogAgD74pxvkReWBemMpVraA2Fkx80lRhDXpKTS
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (87.3)
.exe | Generic Win/DOS Executable (6.3)
.exe | DOS Executable Generic (6.3)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2024:11:07 01:23:04+00:00
ImageFileCharacteristics: Executable, Large address aware
PEType: PE32+
LinkerVersion: 14.41
CodeSize: 172032
InitializedDataSize: 185856
UninitializedDataSize: -
EntryPoint: 0xcdb0
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 10.0.22621.3296
ProductVersionNumber: 10.0.22621.3296
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft® Group Policy Update Utility
FileVersion: 10.0.22621.3296 (WinBuild.160101.0800)
InternalName: GPUpdate.exe
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: GPUpdate.exe
ProductName: Microsoft® Windows® Operating System
ProductVersion: 10.0.22621.3296
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
21
Malicious processes
5
Suspicious processes
0

Behavior graph

Click at the process to see the details
start THREAT yuki.exe THREAT yuki.exe cmd.exe no specs conhost.exe no specs powershell.exe no specs cmd.exe no specs conhost.exe no specs attrib.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs notepad.exe no specs winword.exe winword.exe winword.exe no specs ai.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
204"C:\WINDOWS\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\clipboard.txtC:\Windows\System32\notepad.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\notepad.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\user32.dll
1784C:\WINDOWS\system32\cmd.exe /c attrib +h +s "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\   ‏​.scr"C:\Windows\System32\cmd.exe—yuki.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
2736attrib +h +s "C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\   ‏​.scr"C:\Windows\System32\attrib.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Attribute Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\attrib.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ulib.dll
c:\windows\system32\fsutilext.dll
3276\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3644powershell.exe -command "Set-MpPreference -ExclusionExtension '.exe','.py'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
3832\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4516powershell.exe -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath C:\Users\admin\Local" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
5532\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5532"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\Desktop\sharescore.rtf /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
5596"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "B1EDA62D-C76C-4546-B754-60CED048CA68" "09DBDDCE-7E4B-4166-838B-23DB6A711E62" "7148"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
Total events
43 620
Read events
43 124
Write events
455
Delete events
41

Modification events

(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E01000000000000000500000000000000
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932
Operation:delete valueName:0
Value:
ซ괐殺ࠆꯞꝅ莼跳⏺䘅헉꾍樁င$梅摝麨…ީ湕湫睯쥮௅賙ᒳ೅肫
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5932
Operation:delete keyName:(default)
Value:
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7132
Operation:writeName:0
Value:
0B0E104C5A3DED7F9539408345FDE2B777BEBD230046C2ED9DD6FB9CCCED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511DC37D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(7132) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
Executable files
102
Suspicious files
728
Text files
116
Unknown types
2

Dropped files

PID
Process
Filename
Type
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_Salsa20.pydexecutable
MD5:3F6E73B2151A1529EF30763ACBD63189
SHA256:3000A4E4B6D62ED2AA8FC3ACA1BEE21E03D7EEFE961DB8E0872D51F7F8FB094B
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_chacha20.pydexecutable
MD5:58FDF64B67A7AF0FEBAFA9BE53094C66
SHA256:4B94B9A948C626E34ACCCE67C09524972719E7D82865B6981BF668E976F616F6
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_raw_arc2.pydexecutable
MD5:0072BBD2B1AAA845C289884C3FC3E6CA
SHA256:784751702CCAEE36641973C5B40990993341AA0FB42B45526930DC9823B14D21
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_raw_aes.pydexecutable
MD5:D4606F55CFDAB1FA41BC4A69AA0F5F91
SHA256:DF26C8E5052CB05A96D6FAB0824BB4E4C04A10EA45AD3B56DB3FE00B695E7156
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_ARC4.pydexecutable
MD5:111EEC367590B8ABB73825FB77232995
SHA256:5F2F2122D5DEAF302D0795A0C942F29306350B607AE8E5ABDFC96E08E287B632
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_pkcs1_decode.pydexecutable
MD5:BE4016AB120672923BF3C01240B87DF0
SHA256:0541E52B4EFA3DD911C14A67A104FE1207EA15A33BB8F94A928395BCA9B32AF2
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_raw_aesni.pydexecutable
MD5:77EB782D3A1C0BA6134D3C74093058A9
SHA256:098082E71F5A88F72AA478296D533A6F14F4966DF05DB2DC7014910146BA9C48
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_raw_blowfish.pydexecutable
MD5:3AAFD580A6EB129D6FA81676AEDC17AF
SHA256:8035581ED2F8BD52C747EE78E8739C9353C00020A7CF6B352B91741B2D83E2A0
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_raw_ctr.pydexecutable
MD5:D9AA56216FD9B7443B5431E3964668F3
SHA256:06B9A3AC04E09F51296261F1E3178DEE84038FEA11A33EFC76E71430506BDFD7
6936yuki.exeC:\Users\admin\AppData\Local\Temp\_MEI69362\Cryptodome\Cipher\_raw_cbc.pydexecutable
MD5:E116F8C6A7376154E6610A6B9BBD7D87
SHA256:6A44880996AEBA9B04ACF3383E9A5ACC93682FE66644A9E2BC3EA5DEFC08E09B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
89
DNS requests
16
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6944
svchost.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6944
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5488
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.50.131.85:443
https://omex.cdn.office.net/addinclassifier/officesharedentities
unknown
text
314 Kb
whitelisted
—
—
GET
200
23.53.43.83:443
https://metadata.templates.cdn.office.net/client/templates/gallery?lcid=1033&syslcid=1033&uilcid=1033&app=0&ver=16&tl=2&build=16.0.16026&gtype=0%2C1%2C2%2C5%2C
unknown
xml
10.7 Kb
whitelisted
—
—
GET
200
52.111.236.7:443
https://messaging.lifecycle.office.com/getcustommessage16?app=0&ui=en-US&src=BizBar&messagetype=BizBar&hwid=04111-083-043729&ver=16.0.16026&lc=en-US&platform=10%3A0%3A19045%3A2%3A0%3A0%3A256%3A1%3A&productid=%7B1717C1E0-47D3-4899-A6D3-1022DB7415E0%7D%3A00411-10830-43729-AA720%3AOffice%2019%2C%20Office19Professional2019R_Retail%20edition&clientsessionid=%7B61E80058-6FCC-4707-86FF-1A631FB14E83%7D&datapropertybag=%7B%22Audience%22%3A%22Production%22%2C%22AudienceGroup%22%3A%22Production%22%2C%22AudienceChannel%22%3A%22CC%22%2C%22Flight%22%3A%22ofsh6c2b1tla1a31%2Cofcrui4yvdulbf31%2Cofhpex3jznepoo31%2Cofpioygfqmufst31%2Cofjhlwlmoc1pz531%22%7D
unknown
text
542 b
whitelisted
—
—
GET
200
52.113.194.132:443
https://ecs.office.com/config/v2/Office/word/16.0.16026.20146/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=word&Platform=win32&Version=16.0.16026.20146&MsoVersion=16.0.16026.20002&SDX=fa000000002.2.0.1907.31003&SDX=fa000000005.1.0.1909.30011&SDX=fa000000006.1.0.1909.13002&SDX=fa000000008.1.0.1908.16006&SDX=fa000000009.1.0.1908.6002&SDX=fa000000016.1.0.1810.13001&SDX=fa000000029.1.0.1906.25001&SDX=fa000000033.1.0.1908.24001&SDX=wa104381125.1.0.1810.9001&ProcessName=winword.exe&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=6&LicenseSKU=Professional2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7bED3D5A4C-957F-4039-8345-FDE2B777BEBD%7d&LabMachine=false
unknown
binary
381 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6944
svchost.exe
23.216.77.21:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.216.77.21:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.216.77.21:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6944
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5488
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.32
  • 23.216.77.25
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
gstatic.com
  • 142.250.185.99
whitelisted
raw.githubusercontent.com
  • 185.199.110.133
  • 185.199.108.133
  • 185.199.111.133
  • 185.199.109.133
shared
discord.com
  • 162.159.135.232
  • 162.159.137.232
  • 162.159.136.232
  • 162.159.128.233
  • 162.159.138.232
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
omex.cdn.office.net
  • 23.50.131.71
  • 23.50.131.74
  • 23.50.131.92
  • 23.50.131.94
  • 23.50.131.85
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Attempting to access raw user content on GitHub
2172
svchost.exe
Misc activity
ET INFO Observed Discord Domain in DNS Lookup (discord .com)
5980
yuki.exe
Misc activity
ET INFO Observed Discord Domain (discord .com in TLS SNI)
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
yuki.exe