File name:

1 (534)

Full analysis: https://app.any.run/tasks/582d7210-3f93-4229-8c35-e9d7268e9286
Verdict: Malicious activity
Analysis date: March 25, 2025, 00:17:39
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

31CA8E6336746F945A8A45FF27237040

SHA1:

43BEA399F006EF56E10C22EA7A5E16391FD91B32

SHA256:

3790EC8884871907FD470B428AD71F1B755DF543E1C3358D98BF407500345541

SSDEEP:

768:WXvEV9LcQm/JQe7laODTbiasD6h5Nz5/8cLcxb5YCgEGInKR2SR:W0kiepdDSasufb0cIGCgtIKlR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes the login/logoff helper path in the registry

      • SPOOLSV.EXE (PID: 7180)
      • CTFMON.EXE (PID: 7320)
      • 1 (534).exe (PID: 4652)
      • SVCHOST.EXE (PID: 6456)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • 1 (534).exe (PID: 4652)

    • Write to the desktop.ini file (may be used to cloak folders)

      • 1 (534).exe (PID: 4652)

    • The process creates files with name similar to system file names

      • 1 (534).exe (PID: 4652)

    • Starts itself from another location

      • 1 (534).exe (PID: 4652)
      • SVCHOST.EXE (PID: 6456)
      • SPOOLSV.EXE (PID: 7180)
      • CTFMON.EXE (PID: 7320)

    • Application launched itself

      • SVCHOST.EXE (PID: 6456)
      • SPOOLSV.EXE (PID: 7180)
      • CTFMON.EXE (PID: 7320)

    • Executable content was dropped or overwritten

      • 1 (534).exe (PID: 4652)

    • Reads security settings of Internet Explorer

      • 1 (534).exe (PID: 4652)
      • ShellExperienceHost.exe (PID: 6872)

  • INFO

    • Checks supported languages

      • 1 (534).exe (PID: 4652)
      • SPOOLSV.EXE (PID: 7236)
      • SVCHOST.EXE (PID: 1196)
      • SVCHOST.EXE (PID: 6456)
      • SPOOLSV.EXE (PID: 7180)
      • SVCHOST.EXE (PID: 7212)
      • SVCHOST.EXE (PID: 7356)
      • SPOOLSV.EXE (PID: 7372)
      • CTFMON.EXE (PID: 7420)
      • CTFMON.EXE (PID: 7320)
      • CTFMON.EXE (PID: 7472)
      • ShellExperienceHost.exe (PID: 6872)
      • SPOOLSV.EXE (PID: 7492)
      • CTFMON.EXE (PID: 7516)

    • Create files in a temporary directory

      • 1 (534).exe (PID: 4652)
      • SVCHOST.EXE (PID: 6456)
      • SVCHOST.EXE (PID: 1196)
      • SPOOLSV.EXE (PID: 7180)
      • SVCHOST.EXE (PID: 7212)
      • SPOOLSV.EXE (PID: 7236)
      • SVCHOST.EXE (PID: 7356)
      • SPOOLSV.EXE (PID: 7372)
      • CTFMON.EXE (PID: 7420)
      • CTFMON.EXE (PID: 7472)
      • CTFMON.EXE (PID: 7320)
      • SPOOLSV.EXE (PID: 7492)
      • CTFMON.EXE (PID: 7516)

    • Failed to create an executable file in Windows directory

      • 1 (534).exe (PID: 4652)
      • SVCHOST.EXE (PID: 6456)
      • SPOOLSV.EXE (PID: 7180)
      • CTFMON.EXE (PID: 7320)

    • Reads the computer name

      • 1 (534).exe (PID: 4652)
      • ShellExperienceHost.exe (PID: 6872)

    • Process checks computer location settings

      • 1 (534).exe (PID: 4652)

    • Reads security settings of Internet Explorer

      • BackgroundTransferHost.exe (PID: 7568)
      • BackgroundTransferHost.exe (PID: 2392)
      • BackgroundTransferHost.exe (PID: 6676)
      • BackgroundTransferHost.exe (PID: 4464)
      • BackgroundTransferHost.exe (PID: 1228)

    • Creates files or folders in the user directory

      • BackgroundTransferHost.exe (PID: 2392)

    • Reads the software policy settings

      • BackgroundTransferHost.exe (PID: 2392)
      • slui.exe (PID: 7740)

    • Checks proxy server information

      • BackgroundTransferHost.exe (PID: 2392)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2003:08:06 18:34:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 7.1
CodeSize: 61440
InitializedDataSize: 20480
UninitializedDataSize: -
EntryPoint: 0x15001
OSVersion: 4
ImageVersion: 10
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
166
Monitored processes
24
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start 1 (534).exe svchost.exe svchost.exe no specs spoolsv.exe svchost.exe no specs spoolsv.exe no specs ctfmon.exe svchost.exe no specs spoolsv.exe no specs ctfmon.exe no specs ctfmon.exe no specs spoolsv.exe no specs ctfmon.exe no specs winword.exe sppextcomobj.exe no specs slui.exe ai.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs backgroundtransferhost.exe no specs shellexperiencehost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1196C:\recycled\SVCHOST.EXE :agentC:\Recycled\SVCHOST.EXE—SVCHOST.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
11.0.5604
Modules
Images
c:\recycled\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
1228"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
1228C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
2392"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4464"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
4652"C:\Users\admin\AppData\Local\Temp\1 (534).exe" C:\Users\admin\AppData\Local\Temp\1 (534).exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
11.0.5604
Modules
Images
c:\users\admin\appdata\local\temp\1 (534).exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6456C:\recycled\SVCHOST.EXE :agentC:\Recycled\SVCHOST.EXE
1 (534).exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Version:
11.0.5604
Modules
Images
c:\recycled\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvbvm60.dll
6644"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "2ABF6996-90E2-4049-A383-88E073F71DD6" "51393974-1773-4427-B440-70C06426D7F2" "7616"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
6676"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1C:\Windows\System32\BackgroundTransferHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Download/Upload Host
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\backgroundtransferhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\bcryptprimitives.dll
6872"C:\WINDOWS\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mcaC:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Shell Experience Host
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\systemapps\shellexperiencehost_cw5n1h2txyewy\shellexperiencehost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\dxgi.dll
Total events
19 902
Read events
19 232
Write events
630
Delete events
40

Modification events

(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config\command
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\config
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install\command
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\scrfile\shell\install
Operation:delete keyName:(default)
Value:
(PID) Process:(4652) 1 (534).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Operation:writeName:Shell
Value:
Explorer.exe "C:\recycled\SVCHOST.exe"
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Operation:writeName:UncheckedValue
Value:
1
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\HideFileExt
Operation:writeName:CheckedValue
Value:
1
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
Operation:writeName:CheckedValue
Value:
0
(PID) Process:(4652) 1 (534).exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden
Operation:writeName:UncheckedValue
Value:
0
(PID) Process:(4652) 1 (534).exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{97E467B4-98C6-4F19-9588-161B7773D6F6} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
Value:
010000000000000099F002581B9DDB01
Executable files
38
Suspicious files
142
Text files
17
Unknown types
0

Dropped files

PID
Process
Filename
Type
46521 (534).exeC:\Recycled\SMSS.EXEexecutable
MD5:18CD0269ACA9BEB4C5C8E91B381E1DBE
SHA256:7F0907ECBFF6A5287C7134278373B3BE4B695D6C7C2F951651BCC33C5020BBD2
46521 (534).exeC:\Users\admin\AppData\Local\Temp\Flu Burung.txttext
MD5:1A1DCE35D60D2C70CA8894954FD5D384
SHA256:2661C05273F33EFA4B7FAA6ED8A6F7E69A13AD86077F69EE285ECE9CBA57E44C
46521 (534).exeC:\Recycled\SPOOLSV.EXEexecutable
MD5:91D8E471BA05F07AB02480C788EC180D
SHA256:B4BB9E746BE75150C6B9E3F080CC93ACC2033A456AD39732B98630923E26D2EA
46521 (534).exeC:\Recycled\desktop.initext
MD5:AD0B0B4416F06AF436328A3C12DC491B
SHA256:23521DE51CA1DB2BC7B18E41DE7693542235284667BF85F6C31902547A947416
46521 (534).exeC:\Recycled\CTFMON.EXEexecutable
MD5:E64DE31F75A2A20AE695B08FF55FB63C
SHA256:1339ABE9C941D66EFADC8894332D1700B08AE6A8EA874293068EBD1897A2724A
7616WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:0E28D248064B300545667A6CC9835B88
SHA256:0351C726152622DD7DB1CD708856FCCDECE3193C9DDAC5B85BA09D87496B0207
6456SVCHOST.EXEC:\Users\admin\AppData\Local\Temp\~DFB39DF6B80DFE23B8.TMPbinary
MD5:13A0B5A2910FC6D9E1FA3606C753879F
SHA256:B133424170AB2FE566CE96804A3FAA454B49EE5EEDE5746F3AC84103349C5364
7472CTFMON.EXEC:\Users\admin\AppData\Local\Temp\~DFFA9B627965C87C0C.TMPbinary
MD5:92E881F152AB019830F363272ABCF56A
SHA256:699005CCF431DD4D0DBE730714A76FECDF6A639A8E58D207F2D48179F2DC12F9
7516CTFMON.EXEC:\Users\admin\AppData\Local\Temp\~DF680F03FC28825918.TMPbinary
MD5:35602582F2D7E5790014C551ABCB7D62
SHA256:8431E6E1C98969FB623090E03AAFC25B8C68412DB01EA08A0339C753B875D549
1196SVCHOST.EXEC:\Users\admin\AppData\Local\Temp\~DF11314587D22D6A15.TMPbinary
MD5:E96879132D2C96ED1763633D81476C27
SHA256:48DE69C818A17773274F520B60D4403A7A1DD93567423E057526B4FEF1DE55F4
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
15
TCP/UDP connections
65
DNS requests
28
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7412
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
—
—
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
2392
BackgroundTransferHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7616
WINWORD.EXE
GET
200
88.221.110.122:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6456
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7616
WINWORD.EXE
52.109.76.240:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
7616
WINWORD.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.110
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
  • 88.221.110.122
  • 88.221.110.114
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.68
  • 40.126.31.3
  • 20.190.159.2
  • 20.190.159.0
  • 20.190.159.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
officeclient.microsoft.com
  • 52.109.76.240
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
roaming.officeapps.live.com
  • 52.109.76.243
whitelisted
omex.cdn.office.net
  • 2.22.242.90
  • 2.22.242.130
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
1 (534)