File name:

INVOICE-No03-09456.vbs

Full analysis: https://app.any.run/tasks/1eaaace8-e422-4fd7-b03d-e15c4a4cb0f1
Verdict: Malicious activity
Analysis date: May 21, 2025, 08:30:52
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
netreactor
auto-reg
Indicators:
MIME: text/plain
File info: ASCII text, with very long lines (65323), with CRLF, LF line terminators
MD5:

098C5BC534F0E305BD5C5DC609252B37

SHA1:

ABDAB3D8F283FE829AB7E298E0280B79501F2E97

SHA256:

B0732EC283691F9CB4BDDFB8546ABFA934344A190C7CA75590397F420222014A

SSDEEP:

24576:p4zxRhV4dpor5nt6IEHR/4fBQsBSy/W1uy3aNvgqGXc4kLP5xEEfVXdmWf8:Bmtx33fVXdA

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Uses base64 encoding (SCRIPT)

      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)

    • Gets path to any of the special folders (SCRIPT)

      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)

    • Detects the decoding of a binary file from Base64 (SCRIPT)

      • wscript.exe (PID: 7668)

    • Changes the autorun value in the registry

      • reg.exe (PID: 2152)

  • SUSPICIOUS

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)

    • Creates a Stream, which may work with files, input/output devices, pipes, or TCP/IP sockets (SCRIPT)

      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)

    • Sets XML DOM element text (SCRIPT)

      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)
      • splwow64.exe (PID: 7600)

    • The process executes JS scripts

      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7612)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)

    • Application launched itself

      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7612)

    • Writes binary data to a Stream object (SCRIPT)

      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)

    • Saves data to a binary file (SCRIPT)

      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7512)
      • wscript.exe (PID: 7668)

    • Creates XML DOM element (SCRIPT)

      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)

    • Script creates XML DOM node (SCRIPT)

      • wscript.exe (PID: 7612)
      • wscript.exe (PID: 7668)

    • Hides command output

      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 2600)

    • The process creates files with name similar to system file names

      • wscript.exe (PID: 7668)
      • cmd.exe (PID: 2600)

    • Executable content was dropped or overwritten

      • wscript.exe (PID: 7668)
      • cmd.exe (PID: 2600)

    • Starts CMD.EXE for commands execution

      • svchost.exe (PID: 7808)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 7984)
      • cmd.exe (PID: 2600)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7984)

  • INFO

    • Reads the computer name

      • svchost.exe (PID: 7808)

    • Checks supported languages

      • svchost.exe (PID: 7808)

    • Reads the machine GUID from the registry

      • svchost.exe (PID: 7808)

    • .NET Reactor protector has been detected

      • svchost.exe (PID: 7808)

    • Auto-launch of the file from Registry key

      • reg.exe (PID: 2152)

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 7600)

    • Reads the software policy settings

      • slui.exe (PID: 7884)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
151
Monitored processes
17
Malicious processes
4
Suspicious processes
3

Behavior graph

Click at the process to see the details
start wscript.exe no specs wscript.exe no specs wscript.exe excel.exe svchost.exe no specs sppextcomobj.exe no specs slui.exe cmd.exe no specs conhost.exe no specs ping.exe no specs cmd.exe conhost.exe no specs ping.exe no specs reg.exe slui.exe no specs splwow64.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1072\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2152REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "svchost.exe" /t REG_SZ /d "C:\Users\admin\update\svchost.exe"C:\Windows\SysWOW64\reg.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
2600"cmd" /c ping 127.0.0.1 -n 47 > nul && copy "C:\Users\admin\AppData\Local\Temp\svchost.exe" "C:\Users\admin\update\svchost.exe" && ping 127.0.0.1 -n 47 > nul && "C:\Users\admin\update\svchost.exe"C:\Windows\SysWOW64\cmd.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
2852ping 127.0.0.1 -n 47 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
4812C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7512"C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\INVOICE-No03-09456.vbsC:\Windows\System32\wscript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7600C:\WINDOWS\splwow64.exe 8192C:\Windows\splwow64.exe—EXCEL.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Print driver host for applications
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\splwow64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7612"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\WONOPMI.js" C:\Windows\System32\wscript.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7668"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\audiodg.js" C:\Windows\System32\wscript.exe
wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7692ping 127.0.0.1 -n 47 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
TCP/IP Ping Command
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
Total events
10 382
Read events
10 112
Write events
244
Delete events
26

Modification events

(PID) Process:(7668) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
43BB100000000000
(PID) Process:(7512) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.js\OpenWithProgids
Operation:writeName:JSFile
Value:
(PID) Process:(7612) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.js\OpenWithProgids
Operation:writeName:JSFile
Value:
(PID) Process:(7612) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xlsx\OpenWithProgids
Operation:writeName:Excel.Sheet.12
Value:
(PID) Process:(7612) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached
Operation:writeName:{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF
Value:
0100000000000000B20D14AE2ACADB01
(PID) Process:(7612) wscript.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\wscript.exe
Operation:writeName:JScriptSetScriptStateStarted
Value:
97BA100000000000
(PID) Process:(7716) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:1
Value:
01D014000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(7716) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\7716
Operation:writeName:0
Value:
0B0E10C25D7EF8B9AC19439DF1B8708B5286F7230046F38A809EABC5F2ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511A43CD2120965007800630065006C002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7716) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(7716) EXCEL.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
Executable files
2
Suspicious files
17
Text files
5
Unknown types
0

Dropped files

PID
Process
Filename
Type
7668wscript.exeC:\Users\admin\AppData\Local\Temp\svchost.exeexecutable
MD5:117718D605FC83BF300615D0198726CC
SHA256:AAD37A211A4B5C84D1A07881C707726ED142DBB43CAB0397A4717C0251565917
7612wscript.exeC:\Users\admin\AppData\Local\Temp\xls.xlsxdocument
MD5:8819EB3BEF38F374D00DEE0F6294757F
SHA256:B54F5D7EA99A77651B650F8F7807CF4107D2A58540BC726C63E6244551E96DF4
7716EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\236858BE-D821-4B2D-BBCB-7E123698EE41xml
MD5:028A4BF34A102E00773DAFD8BBF46D81
SHA256:BDD31FC00867ADA71BF2680F2A219C269C28D04F3D52CABFA04D7988D7484F0F
7716EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:2E06FC71162E5219FEF0FF8181B041D0
SHA256:3F0EC80472C4FA046766E1BDC3CD0BBDF6084C86A9E1020BC20DB142CAF0EC09
7716EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Wef\CustomFunctions\v1.7\hostproperties.jsonbinary
MD5:7A29F1E157244591277E3C25F29A8029
SHA256:05EEBA4D6CA7148DCD0A6317A45241A49A4C8D88D628B27D8B19889EF6E70771
7716EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:30F431F30C91134492375966AC4B7F0C
SHA256:F0A6BA95AA1D9864ECAF413D1B5341DF4361433453BA62F7A42607DDDFC4F6DC
7612wscript.exeC:\Users\admin\AppData\Local\Temp\audiodg.jstext
MD5:5ED1793F3E672CE92B402F93F64CB91E
SHA256:B2FD4515EB793B36B3C166483FD7C86266842480F72697BBC01EF5E70F7D1386
7716EXCEL.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Excel\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:AF2B7CB842E0C2D5BE0275363D6DE95A
SHA256:A32D924E93EC04E1056248D5164EA4CE21FB1AF9058A2888D17E25B7D07B72D3
7716EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9binary
MD5:1B7F5FB13EA6090C5B885368060FABC3
SHA256:11989342C7238865B49D0FFD972F9BBCAE315111A7F5D154089810B8F5220EFB
7716EXCEL.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9der
MD5:E9FC76B304F6EDEA24A1913A23365802
SHA256:9BEDEA1FE2636F65474515EE234C6EB6F1E8E820C65D1086C84193F5DBA0A746
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
35
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.117.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
2.19.117.22:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7716
EXCEL.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7716
EXCEL.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
unknown
—
—
whitelisted
4400
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4400
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6404
RUXIMICS.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.117.22:80
crl.microsoft.com
Akamai International B.V.
GB
whitelisted
2104
svchost.exe
2.19.117.22:80
crl.microsoft.com
Akamai International B.V.
GB
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
2104
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.19.117.22
  • 2.19.117.18
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
login.live.com
  • 20.190.160.128
  • 20.190.160.3
  • 40.126.32.138
  • 20.190.160.65
  • 20.190.160.131
  • 20.190.160.2
  • 20.190.160.14
  • 20.190.160.5
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
roaming.officeapps.live.com
  • 52.109.68.129
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
INVOICE-No03-09456.vbs