File name:

1 (534)

Full analysis: https://app.any.run/tasks/582d7210-3f93-4229-8c35-e9d7268e9286
Verdict: Malicious activity
Analysis date: March 25, 2025, 00:17:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

31CA8E6336746F945A8A45FF27237040

SHA1:

43BEA399F006EF56E10C22EA7A5E16391FD91B32

SHA256:

3790EC8884871907FD470B428AD71F1B755DF543E1C3358D98BF407500345541

SSDEEP:

768:WXvEV9LcQm/JQe7laODTbiasD6h5Nz5/8cLcxb5YCgEGInKR2SR:W0kiepdDSasufb0cIGCgtIKlR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the login/logoff helper path in the registry

      • SPOOLSV.EXE (PID: 7180)
      • CTFMON.EXE (PID: 7320)
      • 1 (534).exe (PID: 4652)
      • SVCHOST.EXE (PID: 6456)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 1 (534).exe (PID: 4652)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 1 (534).exe (PID: 4652)

    • The process creates files with name similar to system file names

      • 1 (534).exe (PID: 4652)

    • Executable content was dropped or overwritten

      • 1 (534).exe (PID: 4652)

    • Starts itself from another location

      • 1 (534).exe (PID: 4652)
      • SVCHOST.EXE (PID: 6456)
      • CTFMON.EXE (PID: 7320)
      • SPOOLSV.EXE (PID: 7180)

    • Application launched itself

      • SVCHOST.EXE (PID: 6456)
      • CTFMON.EXE (PID: 7320)
      • SPOOLSV.EXE (PID: 7180)

    • Reads security settings of Internet Explorer

      • 1 (534).exe (PID: 4652)
      • ShellExperienceHost.exe (PID: 6872)

  • INFO

    • Checks supported languages

      • 1 (534).exe (PID: 4652)
      • SVCHOST.EXE (PID: 1196)
      • SVCHOST.EXE (PID: 6456)
      • SPOOLSV.EXE (PID: 7180)
      • SVCHOST.EXE (PID: 7212)
      • SPOOLSV.EXE (PID: 7236)
      • SPOOLSV.EXE (PID: 7372)
      • CTFMON.EXE (PID: 7320)
      • CTFMON.EXE (PID: 7420)
      • SVCHOST.EXE (PID: 7356)
      • CTFMON.EXE (PID: 7472)
      • SPOOLSV.EXE (PID: 7492)
      • ShellExperienceHost.exe (PID: 6872)
      • CTFMON.EXE (PID: 7516)

    • Create files in a temporary directory

      • 1 (534).exe (PID: 4652)
      • SVCHOST.EXE (PID: 1196)
      • SVCHOST.EXE (PID: 6456)
      • SPOOLSV.EXE (PID: 7180)
      • SVCHOST.EXE (PID: 7212)
      • SPOOLSV.EXE (PID: 7236)
      • CTFMON.EXE (PID: 7320)
      • SVCHOST.EXE (PID: 7356)
      • SPOOLSV.EXE (PID: 7372)
      • CTFMON.EXE (PID: 7420)
      • CTFMON.EXE (PID: 7472)
      • SPOOLSV.EXE (PID: 7492)
      • CTFMON.EXE (PID: 7516)

    • Failed to create an executable file in Windows directory

      • SVCHOST.EXE (PID: 6456)
      • 1 (534).exe (PID: 4652)
      • SPOOLSV.EXE (PID: 7180)
      • CTFMON.EXE (PID: 7320)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 2392)

    • Process checks computer location settings

      • 1 (534).exe (PID: 4652)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7568)
      • BackgroundTransferHost.exe (PID: 2392)
      • BackgroundTransferHost.exe (PID: 6676)
      • BackgroundTransferHost.exe (PID: 1228)
      • BackgroundTransferHost.exe (PID: 4464)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 2392)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 2392)
      • slui.exe (PID: 7740)

    • Reads the computer name

      • ShellExperienceHost.exe (PID: 6872)
      • 1 (534).exe (PID: 4652)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:08:06 18:34:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7.1
CodeSize: 61440
InitializedDataSize: 20480
UninitializedDataSize: -
EntryPoint: 0x15001
OSVersion: 4
ImageVersion: 10
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
24
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 1 (534).exe svchost.exe svchost.exe no specs spoolsv.exe svchost.exe no specs spoolsv.exe no specs ctfmon.exe svchost.exe no specs spoolsv.exe no specs ctfmon.exe no specs ctfmon.exe no specs spoolsv.exe no specs ctfmon.exe no specs winword.exe sppextcomobj.exe no specs slui.exe ai.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs shellexperiencehost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1196C:\recycled\SVCHOST.EXE :agentC:\Recycled\SVCHOST.EXE—SVCHOST.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
11.0.5604
Modules
Images
c:\recycled\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1228"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1228C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2392"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4464"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4652"C:\Users\admin\AppData\Local\Temp\1 (534).exe" C:\Users\admin\AppData\Local\Temp\1 (534).exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
11.0.5604
Modules
Images
c:\users\admin\appdata\local\temp\1 (534).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6456C:\recycled\SVCHOST.EXE :agentC:\Recycled\SVCHOST.EXE
1 (534).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Version:
11.0.5604
Modules
Images
c:\recycled\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6644"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "2ABF6996-90E2-4049-A383-88E073F71DD6" "51393974-1773-4427-B440-70C06426D7F2" "7616"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
6676"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6872"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
Total events
19 902
Read events
19 232
Write events
630
Delete events
40

Modification events

(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) 1 (534).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
Explorer.exe "C:\recycled\SVCHOST.exe"
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Operation:writeName:UncheckedValue
Value:
1
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Operation:writeName:CheckedValue
Value:
1
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
Operation:writeName:CheckedValue
Value:
0
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
Operation:writeName:UncheckedValue
Value:
0
(PID) Process:(4652) 1 (534).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
Value:
010000000000000099F002581B9DDB01
Executable files
38
Suspicious files
142
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
46521 (534).exeC:\Users\admin\AppData\Local\Temp\Flu Burung.txttext
MD5:1A1DCE35D60D2C70CA8894954FD5D384
SHA256:2661C05273F33EFA4B7FAA6ED8A6F7E69A13AD86077F69EE285ECE9CBA57E44C
46521 (534).exeC:\Recycled\SMSS.EXEexecutable
MD5:18CD0269ACA9BEB4C5C8E91B381E1DBE
SHA256:7F0907ECBFF6A5287C7134278373B3BE4B695D6C7C2F951651BCC33C5020BBD2
46521 (534).exeC:\Recycled\SPOOLSV.EXEexecutable
MD5:91D8E471BA05F07AB02480C788EC180D
SHA256:B4BB9E746BE75150C6B9E3F080CC93ACC2033A456AD39732B98630923E26D2EA
7212SVCHOST.EXEC:\Users\admin\AppData\Local\Temp\~DF445D12236A8D3AAE.TMPbinary
MD5:3BF8A5CE981B981F54A27A4094A86250
SHA256:AD24DDCFEDC7F3B3F7361FDFAEC93D6D6D82243E4E6D110DCCD1199C3165ED88
7320CTFMON.EXEC:\Users\admin\AppData\Local\Temp\~DF00661AAEE54E9A8F.TMPbinary
MD5:95060949D9EDEEB66D2D978B24B731C6
SHA256:196E8780AD4E9F75992E0B038DA6101356BF0BB651DA416F6D5F2A566B133A72
1196SVCHOST.EXEC:\Users\admin\AppData\Local\Temp\~DF11314587D22D6A15.TMPbinary
MD5:E96879132D2C96ED1763633D81476C27
SHA256:48DE69C818A17773274F520B60D4403A7A1DD93567423E057526B4FEF1DE55F4
7236SPOOLSV.EXEC:\Users\admin\AppData\Local\Temp\~DFEDA6BC4E5F9FEE51.TMPbinary
MD5:73FDD3B3B2B3CC377722BF82D3778E27
SHA256:69B9EBD18CA0ED18FB4E6653B2FDA3817951F7F2C2102E0E0A63BC0086F0C51D
6456SVCHOST.EXEC:\Users\admin\AppData\Local\Temp\~DFB39DF6B80DFE23B8.TMPbinary
MD5:13A0B5A2910FC6D9E1FA3606C753879F
SHA256:B133424170AB2FE566CE96804A3FAA454B49EE5EEDE5746F3AC84103349C5364
7372SPOOLSV.EXEC:\Users\admin\AppData\Local\Temp\~DF418C1EC0F391E7A3.TMPbinary
MD5:A8358F2C6B3692A360C311EDE788B27C
SHA256:B3CA3DF726CCDAA6D6965E3BF4A39904AF31186033B2FB31BB2F0ADC951AAE69
7420CTFMON.EXEC:\Users\admin\AppData\Local\Temp\~DF482DAD5187D6CB99.TMPbinary
MD5:178F3DBFEAC2D7F0836A2E983DD8ED91
SHA256:2D90B4A28A1EDD3E2E591F14F9E7E9DF2B9FF929EAC95E07ACEA12B1C9CE269C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
65
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
7412
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
2392
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6456
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7616
WINWORD.EXE
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7616
WINWORD.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 88.221.110.122
  • 88.221.110.114
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.68
  • 40.126.31.3
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
roaming.officeapps.live.com
  • 52.109.76.243
whitelisted
omex.cdn.office.net
  • 2.22.242.90
  • 2.22.242.130
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (534)