File name:

Office-Tool-v8.0.zip

Full analysis: https://app.any.run/tasks/846c553e-2a1a-4966-9795-efa3d07af096
Verdict: Malicious activity
Analysis date: September 17, 2020, 15:28:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract
MD5:

6A5777FEBA7A09489332495385AE7583

SHA1:

B11738F051D97CB4D407955B85E751329B3E03FF

SHA256:

13F290FBB5DD72BCEB938D0C871DD1BA9DF52171F4561456E0D25140D2536151

SSDEEP:

196608:TqikhON1OVlhZrPvFRQ7R6w73/H8BXLoiX2CewkUX:TqGKVPZrPjExj/WGCewka

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • WinRAR.exe (PID: 3412)

    • Application was dropped or rewritten from another process

      • setup.exe (PID: 1440)
      • Office Tool Plus.exe (PID: 2796)
      • Office Tool Plus.exe (PID: 3832)
      • Office Tool Plus.exe (PID: 3488)
      • Office Tool Plus.exe (PID: 3504)
      • cleanospp.exe (PID: 2124)
      • vlmcs.exe (PID: 2060)

    • Loads dropped or rewritten executable

      • SearchProtocolHost.exe (PID: 2168)
      • cleanospp.exe (PID: 2124)

  • SUSPICIOUS

    • Reads Internet Cache Settings

      • setup.exe (PID: 1440)

    • Executable content was dropped or overwritten

      • Office Tool Plus.exe (PID: 3488)
      • WinRAR.exe (PID: 3412)

    • Starts Internet Explorer

      • Office Tool Plus.exe (PID: 3504)
      • cmd.exe (PID: 3256)

    • Executes scripts

      • WinRAR.exe (PID: 3412)

    • Creates files in the program directory

      • firefox.exe (PID: 3568)

  • INFO

    • Manual execution by user

      • Office Tool Plus.exe (PID: 3832)
      • Office Tool Plus.exe (PID: 3488)
      • Office Tool Plus.exe (PID: 3504)
      • Office Tool Plus.exe (PID: 2796)
      • firefox.exe (PID: 1144)
      • cmd.exe (PID: 3256)
      • cleanospp.exe (PID: 2124)
      • WScript.exe (PID: 3272)
      • vlmcs.exe (PID: 2060)
      • WINWORD.EXE (PID: 1332)

    • Dropped object may contain Bitcoin addresses

      • Office Tool Plus.exe (PID: 3488)

    • Changes internet zones settings

      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 2648)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 3276)
      • iexplore.exe (PID: 3640)
      • firefox.exe (PID: 3568)
      • pingsender.exe (PID: 652)
      • pingsender.exe (PID: 3484)
      • pingsender.exe (PID: 3784)
      • iexplore.exe (PID: 2648)
      • iexplore.exe (PID: 2452)

    • Application launched itself

      • iexplore.exe (PID: 3276)
      • firefox.exe (PID: 1144)
      • firefox.exe (PID: 3568)
      • iexplore.exe (PID: 2648)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3640)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3640)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3640)

    • Reads CPU info

      • firefox.exe (PID: 3568)

    • Creates files in the user directory

      • firefox.exe (PID: 3568)
      • WINWORD.EXE (PID: 1332)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3640)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 1332)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2020:08:09 09:26:27
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Office Tool/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
82
Monitored processes
26
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start winrar.exe setup.exe wscript.exe no specs office tool plus.exe no specs office tool plus.exe searchprotocolhost.exe no specs office tool plus.exe no specs office tool plus.exe iexplore.exe iexplore.exe firefox.exe no specs firefox.exe firefox.exe no specs firefox.exe firefox.exe firefox.exe pingsender.exe pingsender.exe pingsender.exe cmd.exe no specs iexplore.exe no specs iexplore.exe cleanospp.exe no specs wscript.exe no specs vlmcs.exe winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
652"C:\Program Files\Mozilla Firefox\pingsender.exe" https://incoming.telemetry.mozilla.org/submit/telemetry/2d9fb232-5a70-490c-b84e-455ff3172f5d/event/Firefox/68.0.1/release/20190717172542?v=4 C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\qldyz51w.default\saved-telemetry-pings\2d9fb232-5a70-490c-b84e-455ff3172f5dC:\Program Files\Mozilla Firefox\pingsender.exe
firefox.exe
User:
admin
Company:
Mozilla Foundation
Integrity Level:
MEDIUM
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\pingsender.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1144"C:\Program Files\Mozilla Firefox\firefox.exe" C:\Program Files\Mozilla Firefox\firefox.exe—explorer.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
MEDIUM
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
1332"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
1420"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3568.13.1686628164\1673356913" -childID 2 -isForBrowser -prefsHandle 2940 -prefMapHandle 2944 -prefsLen 5996 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3568 "\\.\pipe\gecko-crash-server-pipe.3568" 2956 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\windows\system32\advapi32.dll
c:\windows\system32\cryptbase.dll
c:\users\admin\appdata\local\temp\rar$exa3412.36112\office tool\files\setup.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
1440"C:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\setup.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\setup.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office
Exit code:
0
Version:
16.0.12827.20258
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3412.36112\office tool\files\setup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1952"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3568.3.1211928071\1130710152" -childID 1 -isForBrowser -prefsHandle 1712 -prefMapHandle 1708 -prefsLen 1 -prefMapSize 191824 -parentBuildID 20190717172542 -greomni "C:\Program Files\Mozilla Firefox\omni.ja" -appomni "C:\Program Files\Mozilla Firefox\browser\omni.ja" -appdir "C:\Program Files\Mozilla Firefox\browser" - 3568 "\\.\pipe\gecko-crash-server-pipe.3568" 1732 tabC:\Program Files\Mozilla Firefox\firefox.exe
firefox.exe
User:
admin
Company:
Mozilla Corporation
Integrity Level:
LOW
Description:
Firefox
Exit code:
0
Version:
68.0.1
Modules
Images
c:\program files\mozilla firefox\firefox.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\mozilla firefox\mozglue.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dbghelp.dll
2060"C:\Users\admin\Desktop\Office Tool\files\activate\vlmcs.exe" C:\Users\admin\Desktop\Office Tool\files\activate\vlmcs.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
1
Modules
Images
c:\users\admin\desktop\office tool\files\activate\vlmcs.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\dnsapi.dll
c:\windows\system32\ws2_32.dll
2124"C:\Users\admin\Desktop\Office Tool\files\clean\x86\cleanospp.exe" C:\Users\admin\Desktop\Office Tool\files\clean\x86\cleanospp.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\office tool\files\clean\x86\cleanospp.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\desktop\office tool\files\clean\x86\msvcr100.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2168"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe5_ Global\UsGthrCtrlFltPipeMssGthrPipe5 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" C:\Windows\System32\SearchProtocolHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2452"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2648 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
Total events
2 974
Read events
2 418
Write events
384
Delete events
172

Modification events

(PID) Process:(3412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3412) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Office-Tool-v8.0.zip
(PID) Process:(3412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3412) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\139\52C64B7E
Operation:writeName:@C:\Windows\System32\acppage.dll,-6002
Value:
Windows Batch File
(PID) Process:(3412) WinRAR.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
Executable files
46
Suspicious files
63
Text files
57
Unknown types
42

Dropped files

PID
Process
Filename
Type
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\activate\OSPP.VBStext
MD5:—
SHA256:—
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\activate\SLERROR_1028.XMLtext
MD5:—
SHA256:—
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\activate\SLERROR_2052.XMLtext
MD5:—
SHA256:—
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\activate\SLERROR.XMLtext
MD5:36F7DADFE84E62DA00292D0569C3F523
SHA256:B3378A3178F3E52094DB20E8A828011CD8882017919522A544BAEF3057BD11D3
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\clean\o15-ctrremove.diagcabcompressed
MD5:12C5F94E8331135421747648E4A1ECFE
SHA256:D5BC74378FC81155A99CEA2A5099E66B4FB43F74C8651BCA57658D6E480E2820
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\clean\x86\cleanospp.exeexecutable
MD5:5FD363D52D04AC200CD24F3BCC903200
SHA256:3FDEFE2AD092A9A7FE0EDF0AC4DC2DE7E5B9CE6A0804F6511C06564194966CF9
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\clean\x64\cleanospp.exeexecutable
MD5:162AB955CB2F002A73C1530AA796477F
SHA256:5CE462E5F34065FC878362BA58617FAB28C22D631B9D836DDDCF43FB1AD4DE6E
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\setup.exeexecutable
MD5:AA34268704AA22C7E67F542211AC765D
SHA256:AEF9900B79CC6FCC43D75E4FAB01A1E52130B5F433C6B0C55D1C07E075B1D0D6
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\Thunder\download_engine.dllexecutable
MD5:C818DF90F4EDA9A4A048DD656D0A4EA7
SHA256:677596B043CFE0BCACF19D60BA202696B95830ADECDEB2A3054FC625479623EC
3412WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3412.36112\Office Tool\files\activate\OSPPREARM.EXEexecutable
MD5:0425533B09F71EE34B65F60219A26F8F
SHA256:877811F5FEB1E7B1A6A0EA692B3B13C8351C08E01883C9A64E0A67E1F571CC55
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
51
DNS requests
70
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3640
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
3640
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D
US
der
1.47 Kb
whitelisted
3640
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAiIzVJfGSRETRSlgpHeuVI%3D
US
der
1.47 Kb
whitelisted
3640
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAtqs7A%2Bsan2xGCSaqjN%2FrM%3D
US
der
1.47 Kb
whitelisted
3640
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
3640
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
3640
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEAtqs7A%2Bsan2xGCSaqjN%2FrM%3D
US
der
1.47 Kb
whitelisted
3640
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
3568
firefox.exe
POST
200
93.184.220.29:80
http://ocsp.digicert.com/
US
der
471 b
whitelisted
3276
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3276
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
3640
iexplore.exe
2.16.186.27:443
img-prod-cms-rt-microsoft-com.akamaized.net
Akamai International B.V.
—
whitelisted
3640
iexplore.exe
2.16.186.10:443
statics-marketingsites-wcus-ms-com.akamaized.net
Akamai International B.V.
—
whitelisted
3640
iexplore.exe
172.217.23.142:443
www.google-analytics.com
Google Inc.
US
whitelisted
3640
iexplore.exe
152.199.21.175:443
az416426.vo.msecnd.net
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3640
iexplore.exe
172.217.23.104:443
www.googletagmanager.com
Google Inc.
US
suspicious
3568
firefox.exe
52.25.93.75:443
push.services.mozilla.com
Amazon.com, Inc.
US
unknown
3640
iexplore.exe
23.210.248.233:443
uhf.microsoft.com
Akamai International B.V.
NL
whitelisted
3568
firefox.exe
52.13.211.193:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3568
firefox.exe
13.224.193.80:443
snippets.cdn.mozilla.net
—
US
suspicious

DNS requests

Domain
IP
Reputation
ecs.office.com
  • 52.113.194.132
whitelisted
aka.ms
  • 104.125.79.182
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.47.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
dotnet.microsoft.com
  • 13.107.246.10
whitelisted
www.microsoft.com
  • 23.210.249.93
whitelisted
statics-marketingsites-wcus-ms-com.akamaized.net
  • 2.16.186.10
  • 2.16.186.32
whitelisted
c.s-microsoft.com
  • 23.210.249.93
whitelisted
img-prod-cms-rt-microsoft-com.akamaized.net
  • 2.16.186.27
  • 2.16.186.40
whitelisted

Threats

PID
Process
Class
Message
1048
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1048
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
Process
Message
Office Tool Plus.exe
A fatal error occurred. The required library hostfxr.dll could not be found. If this is a self-contained application, that library should exist in [C:\Users\admin\AppData\Local\Temp\.net\Office Tool Plus\idfffs5q.bq2\]. If this is a framework-dependent application, install the runtime in the global location [C:\Program Files\dotnet] or use the DOTNET_ROOT environment variable to specify the runtime location or register the runtime location in [HKLM\SOFTWARE\dotnet\Setup\InstalledVersions\x86\InstallLocation].
Office Tool Plus.exe
- https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win7-x86
Office Tool Plus.exe
The .NET Core runtime can be found at:
Office Tool Plus.exe
- https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win7-x86
Office Tool Plus.exe
The .NET Core runtime can be found at:
Office Tool Plus.exe
The .NET Core runtime can be found at:
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Office-Tool-v8.0.zip