File name:

OneLogin.doc

Full analysis: https://app.any.run/tasks/246ee5b3-e667-463f-9ca2-fdf7c6182481
Verdict: Malicious activity
Analysis date: April 21, 2025, 09:02:43
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
macros
macros-on-open
Indicators:
MIME: application/msword
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, Code page: 1252, Author: User, Template: Normal.dotm, Last Saved By: User, Revision Number: 17, Name of Creating Application: Microsoft Office Word, Total Editing Time: 03:00, Create Time/Date: Thu Feb 11 19:21:00 2021, Last Saved Time/Date: Thu Feb 11 19:25:00 2021, Number of Pages: 3, Number of Words: 1059, Number of Characters: 6040, Security: 0
MD5:

6F221679BECEFEADCCC96C8DF632DFA5

SHA1:

EA9797A3D93073DF56FAA1C5079FB46BF543CE2D

SHA256:

FC80D65E8EF4DB33D50C75E610F304E942E448CD55C1125E8D4ED918CA090017

SSDEEP:

12288:snlavB4uG4t62bsSAhMn7vL9BEo1bplrXs16HOUobNJJwV2K5lMg8jk1F3FsiFqW:snYRobNJJwV2G2go8JFsmRkI2y

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Gets context to execute command-line operations (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • Gets or sets visibliity for the scheduled task (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • Access Task Scheduler's settings (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • Creates a new scheduled task (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 4784)

    • Gets security context of the user (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

  • SUSPICIOUS

    • Gets context to manipulate scheduled tasks (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • Accesses object representing scheduled task trigger (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • Gets context to manipulate triggers of a scheduled task (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • Gets a folder of registered tasks (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 4784)
      • WINWORD.EXE (PID: 6068)

    • Accesses Scheduled Task settings (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • Gets or sets the principal for the task (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • Gets scheduled task context (SCRIPT)

      • WINWORD.EXE (PID: 7888)
      • WINWORD.EXE (PID: 7292)
      • WINWORD.EXE (PID: 6068)
      • WINWORD.EXE (PID: 4784)

    • The process executes via Task Scheduler

      • cmd.exe (PID: 7244)
      • cmd.exe (PID: 5156)
      • cmd.exe (PID: 7184)
      • cmd.exe (PID: 3896)
      • cmd.exe (PID: 6852)

  • INFO

    • Reads the software policy settings

      • slui.exe (PID: 7836)
      • slui.exe (PID: 6036)

    • Checks proxy server information

      • slui.exe (PID: 6036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.doc | Microsoft Word document (54.2)
.doc | Microsoft Word document (old ver.) (32.2)

EXIF

FlashPix

Identification: Word 8.0
LanguageCode: English (US)
DocFlags: Has picture, 1Table, ExtChar
System: Windows
Word97: No
Title: -
Subject: -
Author: User
Keywords: -
Comments: -
Template: Normal.dotm
LastModifiedBy: User
Software: Microsoft Office Word
CreateDate: 2021:02:11 19:21:00
ModifyDate: 2021:02:11 19:25:00
Security: None
Company: -
CharCountWithSpaces: 7085
AppVersion: 16
ScaleCrop: No
LinksUpToDate: No
SharedDoc: No
HyperlinksChanged: No
TitleOfParts: -
HeadingPairs:
  • Title
  • 1
CodePage: Windows Latin 1 (Western European)
Hyperlinks:
  • https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010511
  • https://onelogin.service-now.com/support?id=kb_category&kb_category=48d569fcdbd45340d5505eea4b96191a&spa=1
  • https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010293
  • https://www.onelogin.com/downloads/browser-extensions
  • https://onelogin.service-now.com/kb_view_customer.do?sysparm_article=KB0010358
CompObjUserTypeLen: 32
CompObjUserType: Microsoft Word 97-2003 Document
LastPrinted: 0000:00:00 00:00:00
RevisionNumber: 17
TotalEditTime: 3 minutes
Words: 1059
Characters: 6040
Pages: 3
Paragraphs: 14
Lines: 50
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
162
Monitored processes
26
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe sppextcomobj.exe no specs slui.exe winword.exe ai.exe no specs ai.exe no specs cmd.exe no specs conhost.exe no specs explorer.exe no specs slui.exe cmd.exe no specs conhost.exe no specs explorer.exe no specs winword.exe ai.exe no specs cmd.exe no specs conhost.exe no specs explorer.exe no specs winword.exe ai.exe no specs cmd.exe no specs conhost.exe no specs explorer.exe no specs cmd.exe no specs conhost.exe no specs explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1116explorer.exeC:\Windows\explorer.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
3332\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3896"c:\windows\system32\cmd.exe" /c explorer.exeC:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
3968\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4220"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "1AA69513-A9C3-44D6-AF93-A2423C1B334C" "CFAE347D-DA03-4470-A985-264D3DAC57C5" "7292"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\msvcrt.dll
4784"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /Automation -EmbeddingC:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
4844explorer.exeC:\Windows\explorer.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\twinapi.dll
5156"c:\windows\system32\cmd.exe" /c explorer.exeC:\Windows\System32\cmd.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
5404\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5452explorer.exeC:\Windows\explorer.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
Total events
32 758
Read events
31 343
Write events
1 258
Delete events
157

Modification events

(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:0
Value:
017012000000001000B24E9A3E02000000000000000600000000000000
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7292
Operation:writeName:0
Value:
0B0E106D5A50B16757C449AF78EB09E434962B230046BBF8BCD8C2D3ECED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511FC38D2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(7292) WINWORD.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
Executable files
33
Suspicious files
162
Text files
20
Unknown types
0

Dropped files

PID
Process
Filename
Type
7292WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\CFDCA64D-70BC-4B78-A0E6-3E5DDDFFFE1Fxml
MD5:280D4F20251489729E21C0EF2FA81DE6
SHA256:B8632485FEA1C062657ABC7721948886C270F83E3E0957C0F0EC8E2FA0FE22C2
7292WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
7292WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:DA2ECF7375EAED3EA59049E8CA7CB34C
SHA256:ED13367DDA369792F573A589630B12733139D63B7E2F130468E0CDBB1787D34C
7292WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:1C71814093B5F394FA9F3F33298DA3D8
SHA256:D3BCE8736313816E4AECBDAAB329D729E5CE66D6F6CF2E40124E30229C4625A7
7888WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRC0000.tmpdocument
MD5:0E9C55101E6B16C873D90F10AAE5021B
SHA256:8DAD18478AAA0E09CD3691E721694D13E8CED9D654EFD4984F3234D97CB7B5FB
7888WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.json.tmpbinary
MD5:60CC2B077278B1B4D31D354DE5FA3E87
SHA256:E13A534586B29AA08A9AD3E4BF336A84BE545FACC433F9AF88984A66EBA9F309
7292WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:7F43E35D0C35EBE83BEDC497F2442C44
SHA256:97CE1915C60880CB81D4CF488C078A7ED8D5C4D7AFCC390215BCE6111EB36992
7292WINWORD.EXEC:\Users\admin\AppData\Local\Temp\~$eLogin.docbinary
MD5:5FDA2A9D7142532ACDC2C9B22D9366D6
SHA256:A1DE22090244E71A8E65E26B66A5CB19EAB679A40EC5A0B6DDAAC18152A0F763
7888WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.jsonbinary
MD5:60CC2B077278B1B4D31D354DE5FA3E87
SHA256:E13A534586B29AA08A9AD3E4BF336A84BE545FACC433F9AF88984A66EBA9F309
7292WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:1234F99B3D2AAE41247011129D55FC2E
SHA256:4F70636EE387E22D671D76A616C7557BE9DA535B7A535DE332187DD680E19A08
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
72
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7888
WINWORD.EXE
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
7292
WINWORD.EXE
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
—
—
whitelisted
7292
WINWORD.EXE
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
—
—
whitelisted
7292
WINWORD.EXE
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_08-31-2010.crl
unknown
—
—
whitelisted
7292
WINWORD.EXE
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7292
WINWORD.EXE
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
7292
WINWORD.EXE
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
2.16.164.32:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7292
WINWORD.EXE
52.109.28.46:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted
7292
WINWORD.EXE
52.123.129.14:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7292
WINWORD.EXE
2.16.168.119:443
omex.cdn.office.net
Akamai International B.V.
RU
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7888
WINWORD.EXE
52.109.68.130:443
odc.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.164.32
  • 2.16.164.43
  • 2.16.164.50
  • 2.16.164.113
  • 2.16.164.98
  • 2.16.164.17
  • 2.16.164.49
  • 2.16.164.58
  • 2.16.164.34
  • 23.216.77.28
  • 23.216.77.6
whitelisted
google.com
  • 172.217.23.110
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 184.30.21.171
whitelisted
officeclient.microsoft.com
  • 52.109.28.46
whitelisted
ecs.office.com
  • 52.123.129.14
  • 52.123.128.14
whitelisted
omex.cdn.office.net
  • 2.16.168.119
  • 2.16.168.101
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
odc.officeapps.live.com
  • 52.109.68.130
whitelisted
messaging.engagement.office.com
  • 52.111.231.13
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
OneLogin.doc