File name:

document.docx

Full analysis: https://app.any.run/tasks/b08980b5-e963-467c-8d38-3e17f42a5250
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: March 25, 2025, 00:43:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
ole-embedded
arch-exec
stealer
tightvnc
rmm-tool
Indicators:
MIME: application/vnd.openxmlformats-officedocument.wordprocessingml.document
File info: Microsoft Word 2007+
MD5:

9D8B94FA5951885510AA5457BB1534F3

SHA1:

9CD20E15F20BB587AF8CC3910FA34489F4C9CA75

SHA256:

22D12B18A0D72BB23698E8996A5380C4175621D4D46D13FB6C0770CFDC50CC74

SSDEEP:

98304:I5J6RQQOKNDfke6p1T8o4IgnYkHJ9Lu6XAQEj5wzvUzf6p2bMNLUGV3uL0jkejD3:DljsVTY7TTHq5AZYad+MD23gciI+

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WINWORD.EXE (PID: 7444)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 7444)

    • Creates or modifies Windows services

      • svchost.exe (PID: 4336)

    • Changes firewall settings

      • svchost.exe (PID: 4336)

    • Actions looks like stealing of personal data

      • svchost.exe (PID: 7416)
      • svchost.exe (PID: 2420)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 1180)
      • document.exe (PID: 8056)

    • Application launched itself

      • document.exe (PID: 8056)
      • svchost.exe (PID: 5756)
      • svchost.exe (PID: 2420)

    • Executable content was dropped or overwritten

      • document.exe (PID: 4108)

    • Executes as Windows Service

      • cmd.exe (PID: 1912)
      • cmd.exe (PID: 5332)

    • The process creates files with name similar to system file names

      • document.exe (PID: 4108)

    • The process executes via Task Scheduler

      • cmd.exe (PID: 7388)
      • cmd.exe (PID: 7396)

    • The process verifies whether the antivirus software is installed

      • svchost.exe (PID: 7416)
      • svchost.exe (PID: 2420)

    • Creates or modifies Windows services

      • svchost.exe (PID: 4336)

    • Connects to unusual port

      • svchost.exe (PID: 7308)

  • INFO

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7296)
      • splwow64.exe (PID: 4488)
      • BackgroundTransferHost.exe (PID: 7876)
      • BackgroundTransferHost.exe (PID: 6744)
      • BackgroundTransferHost.exe (PID: 7440)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 7296)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 7296)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 7296)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 1180)

    • Checks supported languages

      • document.exe (PID: 8056)
      • document.exe (PID: 4108)
      • svchost.exe (PID: 2420)
      • svchost.exe (PID: 7416)
      • svchost.exe (PID: 7308)
      • svchost.exe (PID: 4336)

    • Reads the computer name

      • document.exe (PID: 8056)
      • svchost.exe (PID: 5756)
      • svchost.exe (PID: 7276)
      • svchost.exe (PID: 7416)
      • svchost.exe (PID: 2420)
      • svchost.exe (PID: 7308)

    • TIGHTVNC has been detected

      • document.exe (PID: 4108)

    • The sample compiled with english language support

      • document.exe (PID: 4108)

    • The sample compiled with chinese language support

      • document.exe (PID: 4108)

    • Creates files in the program directory

      • document.exe (PID: 4108)
      • svchost.exe (PID: 7308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.docx | Word Microsoft Office Open XML Format document (52.2)
.zip | Open Packaging Conventions container (38.8)
.zip | ZIP compressed archive (8.8)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2025:03:25 00:24:34
ZipCRC: 0xe6a584bf
ZipCompressedSize: 375
ZipUncompressedSize: 1487
ZipFileName: [Content_Types].xml

XML

Template: Normal.dotm
TotalEditTime: 39 minutes
Pages: 1
Words: 8
Characters: 48
Application: Microsoft Office Word
DocSecurity: None
Lines: 1
Paragraphs: 1
ScaleCrop: No
Company: -
LinksUpToDate: No
CharactersWithSpaces: 55
SharedDoc: No
HyperlinksChanged: No
AppVersion: 16
Keywords: -
LastModifiedBy: vBAWGNEOQV
RevisionNumber: 92
CreateDate: 2025:01:06 21:20:00Z
ModifyDate: 2025:03:24 19:41:00Z

XMP

Title: -
Subject: -
Creator: BBDAhlxYVq
Description: -
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
25
Malicious processes
6
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe sppextcomobj.exe no specs slui.exe no specs ai.exe no specs splwow64.exe no specs winrar.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs document.exe no specs document.exe cmd.exe no specs svchost.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs cmd.exe no specs svchost.exe conhost.exe no specs svchost.exe svchost.exe no specs svchost.exe svchost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1180"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\{44F69226-CA51-4A6D-8926-F885BF5A7C1D}\{47604FF2-9916-44C6-A1CE-37AEC59CCA7D}\document.zip"C:\Program Files\WinRAR\WinRAR.exe
WINWORD.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
1280\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1912cmd /c start C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24eC:\Windows\System32\cmd.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
2420C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24bC:\ProgramData\Windows\svchost.exe
cmd.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\windows\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4108"C:\Users\admin\AppData\Local\Temp\{44F69226-CA51-4A6D-8926-F885BF5A7C1D}\{47604FF2-9916-44C6-A1CE-37AEC59CCA7D}\document\document.exe" C:\Users\admin\AppData\Local\Temp\{44F69226-CA51-4A6D-8926-F885BF5A7C1D}\{47604FF2-9916-44C6-A1CE-37AEC59CCA7D}\document\document.exe
document.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\{44f69226-ca51-4a6d-8926-f885bf5a7c1d}\{47604ff2-9916-44c6-a1ce-37aec59cca7d}\document\document.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4180\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4336C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24dC:\ProgramData\Windows\svchost.exe—svchost.exe
User:
SYSTEM
Integrity Level:
SYSTEM
Exit code:
0
Modules
Images
c:\programdata\windows\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
4488C:\WINDOWS\splwow64.exe 8192C:\Windows\splwow64.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5332cmd /c start C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24aC:\Windows\System32\cmd.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5756C:\ProgramData\Windows\svchost.exe C:\ProgramData\Windows\svchost.db channel-8df91be7c24cC:\ProgramData\Windows\svchost.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\programdata\windows\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
Total events
23 698
Read events
23 268
Write events
394
Delete events
36

Modification events

(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems
Operation:writeName:ax-
Value:
61782D00141D00000400000000000000852DEDF71E9DDB018C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7444
Operation:writeName:0
Value:
0B0E10EBE85AD8480268419C9D97CBED32F19D230046F3AAA0BDEFA3E7ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511943AD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(7444) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
Executable files
43
Suspicious files
134
Text files
19
Unknown types
1

Dropped files

PID
Process
Filename
Type
7444WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\msoC361.tmp —
MD5:—
SHA256:—
7444WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$cument.docxbinary
MD5:8170FF3ACB7DFDB74DB45EDFFDABC925
SHA256:DDE9231C3B7F98CBDCDF927C32B987921C37BE9948EB6924F0A5E0998094AA38
7444WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:B5E2915B1772B31E8C683DFB250A6E44
SHA256:1C3C5B7869F679AB394BAA2D7C4F5B358873E117FAE2AF24557F0D8457C869FA
7444WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CCE8D83E-EE55-437C-A889-C481DFDF8995xml
MD5:8D62A11619C851E94095350341583298
SHA256:5E0E301C7EECBD091FFAAE6DFC223D786A4A015FAC470BD6E1735F2FF9C02563
7444WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:B047BEBAAA9A2671BEF2D5E15C64671A
SHA256:118F46F3D4ED0FD886A39DE7A62CAD1F7521B9DB2A185A74A3504B95BD0F7764
7296BackgroundTransferHost.exeC:\Users\admin\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\d92407db-75ab-430e-b238-b91837c429eb.down_data —
MD5:—
SHA256:—
7444WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:1891FA32EFC0DC0D5430E9B66EE16A2C
SHA256:37982AE9FF59C271BA5D3F0F5D37BBE8103A1CBC4D16D5D9D5409A08FDA098CF
7444WINWORD.EXEC:\Users\admin\AppData\Local\Temp\{44F69226-CA51-4A6D-8926-F885BF5A7C1D}\{47604FF2-9916-44C6-A1CE-37AEC59CCA7D}\document.zip:Zone.Identifiertext
MD5:FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA256:EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
7444WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:EBFB4BA023214E47A1E29F78CA6803AF
SHA256:9F248AB4262D6C4BC4C5D93E7A50D67D55370CE27B119C899D898D2539A63706
7444WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\CloudFonts\DengXian\54497409372.ttf —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
63
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7296
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
8044
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7444
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8180
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
8180
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
7444
WINWORD.EXE
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
7444
WINWORD.EXE
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
7444
WINWORD.EXE
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6700
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
7444
WINWORD.EXE
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
2112
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7444
WINWORD.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7444
WINWORD.EXE
23.48.23.30:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
  • 40.127.240.158
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
omex.cdn.office.net
  • 23.48.23.30
  • 23.48.23.18
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.160.67
  • 40.126.32.140
  • 20.190.160.131
  • 20.190.160.3
  • 20.190.160.14
  • 40.126.32.133
  • 20.190.160.20
  • 40.126.32.134
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
fs.microsoft.com
  • 23.212.222.21
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
document.docx