File name:

document.docx

Full analysis: https://app.any.run/tasks/8cc444b7-23d2-453b-8f0b-f6705f20878b
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 00:42:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ole-embedded
arch-exec
stealer
tightvnc
rmm-tool
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

9D8B94FA5951885510AA5457BB1534F3

SHA1:

9CD20E15F20BB587AF8CC3910FA34489F4C9CA75

SHA256:

22D12B18A0D72BB23698E8996A5380C4175621D4D46D13FB6C0770CFDC50CC74

SSDEEP:

98304:I5J6RQQOKNDfke6p1T8o4IgnYkHJ9Lu6XAQEj5wzvUzf6p2bMNLUGV3uL0jkejD3:DljsVTY7TTHq5AZYad+MD23gciI+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 720)

    • Generic archive extractor

      • WINWORD.EXE (PID: 720)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 7036)
      • svchost.exe (PID: 7668)

    • Creates or modifies Windows services

      • svchost.exe (PID: 8132)

    • Changes firewall settings

      • svchost.exe (PID: 8132)

  • SUSPICIOUS

    • The process executes via Task Scheduler

      • cmd.exe (PID: 7336)
      • cmd.exe (PID: 7344)

    • The process creates files with name similar to system file names

      • document.exe (PID: 6592)

    • Executes as Windows Service

      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 6080)

    • Application launched itself

      • svchost.exe (PID: 8064)
      • svchost.exe (PID: 7036)
      • document.exe (PID: 1676)

    • Creates or modifies Windows services

      • svchost.exe (PID: 8132)

    • The process verifies whether the antivirus software is installed

      • svchost.exe (PID: 7036)
      • svchost.exe (PID: 7668)

    • Connects to unusual port

      • svchost.exe (PID: 7672)

    • Reads security settings of Internet Explorer

      • document.exe (PID: 1676)

    • Executable content was dropped or overwritten

      • document.exe (PID: 6592)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7604)
      • splwow64.exe (PID: 7440)
      • BackgroundTransferHost.exe (PID: 7624)
      • BackgroundTransferHost.exe (PID: 7540)
      • BackgroundTransferHost.exe (PID: 7340)
      • BackgroundTransferHost.exe (PID: 8156)

    • TIGHTVNC has been detected

      • document.exe (PID: 6592)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 8156)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 8156)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 8156)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7996)

    • Reads the computer name

      • document.exe (PID: 1676)
      • document.exe (PID: 6592)
      • svchost.exe (PID: 8064)
      • svchost.exe (PID: 7420)
      • svchost.exe (PID: 7036)
      • svchost.exe (PID: 7672)

    • Checks supported languages

      • document.exe (PID: 1676)
      • svchost.exe (PID: 7036)
      • svchost.exe (PID: 7668)
      • svchost.exe (PID: 8132)
      • svchost.exe (PID: 8064)
      • svchost.exe (PID: 7672)

    • The sample compiled with english language support

      • document.exe (PID: 6592)

    • Creates files in the program directory

      • document.exe (PID: 6592)
      • svchost.exe (PID: 7672)

    • The sample compiled with chinese language support

      • document.exe (PID: 6592)

    • Process checks computer location settings

      • document.exe (PID: 1676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:03:25 00:24:34
ZipCRC: 0xe6a584bf
ZipCompressedSize: 375
ZipUncompressedSize: 1487
ZipFileName: [Content_Types].xml

XML

Template: Normal.dotm
TotalEditTime: 39 minutes
Pages: 1
Words: 8
Characters: 48
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: -
LinksUpToDate: No
CharactersWithSpaces: 55
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
Keywords: -
LastModifiedBy: vBAWGNEOQV
RevisionNumber: 92
CreateDate: 2025:01:06 21:20:00Z
ModifyDate: 2025:03:24 19:41:00Z

XMP

Title: -
Subject: -
Creator: BBDAhlxYVq
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
156
Monitored processes
23
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe ai.exe no specs splwow64.exe no specs backgroundtransferhost.exe no specs winrar.exe backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs document.exe no specs document.exe cmd.exe no specs svchost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs svchost.exe conhost.exe no specs svchost.exe svchost.exe no specs svchost.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
720"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\AppData\Local\Temp\document.docx /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
1676"C:\Users\admin\AppData\Local\Temp\Rar$EXa7996.19402\document.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7996.19402\document.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7996.19402\document.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2148"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "278FC4CC-5D8F-41E2-9645-9A4D665C9F30" "632BA148-F608-4571-AEE8-2582A8D47557" "720"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ucrtbase.dll
6080cmd /c start C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24eC:\Windows\System32\cmd.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
6592"C:\Users\admin\AppData\Local\Temp\Rar$EXa7996.19402\document.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa7996.19402\document.exe
document.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7996.19402\document.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7036C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24bC:\ProgramData\Windows\svchost.exe
cmd.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\windows\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
7316\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7336"cmd.exe" /c start C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24cC:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
7340"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
7344"cmd.exe" /c start C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24bC:\Windows\System32\cmd.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
Total events
23 457
Read events
23 027
Write events
394
Delete events
36

Modification events

(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\720
Operation:writeName:0
Value:
0B0E101B709EE0647D5940A5317FA43C059D18230046DEBC9CD0ECA3E7ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511D005D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(720) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
44
Suspicious files
133
Text files
18
Unknown types
0

Dropped files

PID
Process
Filename
Type
720WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\msoC19C.tmp —
MD5:—
SHA256:—
720WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:37E56E502F43AF7637E0536A53634FF7
SHA256:4AE4FE5D7E716C6C3B0B27850AD90F290D76D96444B79E125F9FBEEE5F525D40
720WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
720WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$cument.docxbinary
MD5:31361AEF4FB6B0ED3CAC86EC315FC327
SHA256:798415F06713D2BF2737986F149244441CE766C77E01080A8C35CEF85A4526EE
720WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\416D21A0-FFED-4EFB-9CA6-881DAA6A2D58xml
MD5:20934A51E3E55D38A22E018CC348A5E7
SHA256:5B0C73CC8B3A446926A2AFFD05C3E7B83C3BD8584056E447B394CD09E320FA2F
720WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E6DE34E2.emfbinary
MD5:F67AA04294F1688A1A626B392C8E9EA0
SHA256:5E043792980704DD508B7AF78C913334B853A068664E6EAB8640FC60929EC80F
720WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:D9D93E5A9E8B27A1AD5DB69CD4B1FC1D
SHA256:8937D2075CAFDBCBB314749A0C097F7C421A1BE28C61DC04DDC1FF5FAF6E1DCD
720WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:7D763B61EDA785BA14E26F4100A4FF69
SHA256:4E041651313CF09842B81524CE0D38C6C20A4E630AF5F3E45367193BF2817EBD
720WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.json.tmpbinary
MD5:6F840ADEC4EC1D8DACF9B285F3A77CAC
SHA256:50B1F2E1D741F590B47B7696B79FC0D143D72E5DD02884D194217A80148BDF4E
720WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-msbinary
MD5:E4A1661C2C886EBB688DEC494532431C
SHA256:B76875C50EF704DBBF7F02C982445971D1BBD61AEBE2E4B28DDC58A1D66317D5
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
63
DNS requests
29
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.168.199:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
720
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
720
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
7224
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8156
BackgroundTransferHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7224
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
720
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
664
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
720
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
2.16.168.199:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
720
WINWORD.EXE
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
720
WINWORD.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
720
WINWORD.EXE
2.16.168.203:443
omex.cdn.office.net
Akamai International B.V.
RU
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.129:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 2.16.168.199
  • 2.16.168.200
  • 88.221.110.122
  • 88.221.110.114
whitelisted
google.com
  • 142.250.185.174
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
omex.cdn.office.net
  • 2.16.168.203
  • 2.16.168.209
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.129
  • 40.126.31.130
  • 40.126.31.67
  • 20.190.159.131
  • 40.126.31.3
  • 20.190.159.130
  • 40.126.31.128
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 2.23.77.188
whitelisted
messaging.engagement.office.com
  • 52.111.243.8
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
document.docx