File name:

setup32.exe

Full analysis: https://app.any.run/tasks/9cb24231-c515-417b-b3b3-870f95ef5335
Verdict: Malicious activity
Analysis date: February 14, 2024, 21:15:12
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

767AAB2D10C673DE0A65E016CAF2EE7F

SHA1:

A5991F7D8536E45631AC67B8DE4FE9BBA7B85930

SHA256:

1CE1BDB84A08C1225B382C2043820091004EFE76452833B6BDCE54365E20BA56

SSDEEP:

98304:O82xhpZSVg/2cj15DM20cor3NFsdL7NZ3YKkrH94WjEZj+MFPUO6PpiHU8g8hQzh:u7jWh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • setup32.exe (PID: 3700)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Process drops legitimate windows executable

      • setup32.exe (PID: 3700)

    • Reads the Internet Settings

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Reads security settings of Internet Explorer

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Reads settings of System Certificates

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Application launched itself

      • setup32.exe (PID: 3700)

    • Checks Windows Trust Settings

      • setup32.exe (PID: 3428)

  • INFO

    • Reads the computer name

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)
      • wmpnscfg.exe (PID: 1880)

    • Create files in a temporary directory

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Reads the machine GUID from the registry

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Process checks computer location settings

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Process checks whether UAC notifications are on

      • setup32.exe (PID: 3700)

    • Checks supported languages

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)
      • wmpnscfg.exe (PID: 1880)

    • Checks proxy server information

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Reads Microsoft Office registry keys

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Reads the software policy settings

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)

    • Application launched itself

      • msedge.exe (PID: 3724)
      • msedge.exe (PID: 1368)

    • Manual execution by a user

      • WINWORD.EXE (PID: 3588)
      • wmpnscfg.exe (PID: 1880)
      • msedge.exe (PID: 1368)

    • Creates files or folders in the user directory

      • setup32.exe (PID: 3428)
      • setup32.exe (PID: 3700)

    • Reads CPU info

      • setup32.exe (PID: 3700)
      • setup32.exe (PID: 3428)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable (generic) (52.9)
.exe | Generic Win/DOS Executable (23.5)
.exe | DOS Executable Generic (23.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:08:15 03:20:24+00:00
ImageFileCharacteristics: Executable, 32-bit, Removable run from swap, Net run from swap
PEType: PE32
LinkerVersion: 14
CodeSize: 1485312
InitializedDataSize: 1388544
UninitializedDataSize: -
EntryPoint: 0xccda3
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 16.0.4266.1003
ProductVersionNumber: 16.0.4266.0
FileFlagsMask: 0x003f
FileFlags: Pre-release, Special build
FileOS: Windows NT 32-bit
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Microsoft Corporation
FileDescription: Microsoft Office
FileVersion: 16.0.4266.1003
InternalName: Bootstrapper.exe
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName: Bootstrapper.exe
ProductName: Microsoft Office 2016
ProductVersion: 16.0.4266.1003
MOSEVersion: BETA
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
22
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start setup32.exe setup32.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winword.exe no specs wmpnscfg.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
296"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2200 --field-trial-handle=1248,i,14156865570947845107,11006992641039199381,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
572"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3736 --field-trial-handle=1248,i,14156865570947845107,11006992641039199381,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1124"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1540 --field-trial-handle=1248,i,14156865570947845107,11006992641039199381,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1316"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3736 --field-trial-handle=1248,i,14156865570947845107,11006992641039199381,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1336"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xf0,0x6bb8f598,0x6bb8f5a8,0x6bb8f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1352"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1320 --field-trial-handle=1344,i,17092693551243132121,6443685947363192018,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1368"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate http://officeredir.microsoft.com/r/rlidOfficeWebHelp?p1=OCSAC2RClickToRun&ver=16&clid=1033&helpid=%221-BOOTSTRAPPER_PREREQ-windowsversion%22&app=webviewC:\Program Files\Microsoft\Edge\Application\msedge.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1740"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=109.0.5414.149 "--annotation=exe=C:\Program Files\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win32 "--annotation=prod=Microsoft Edge" --annotation=ver=109.0.1518.115 --initial-client-data=0xc8,0xcc,0xd0,0x9c,0xd8,0x6bb8f598,0x6bb8f5a8,0x6bb8f5b4C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1880"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2268"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3680 --field-trial-handle=1248,i,14156865570947845107,11006992641039199381,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
28 241
Read events
27 565
Write events
330
Delete events
346

Modification events

(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\Common
Operation:writeName:UID
Value:
320A68C1D424A7449CF72AAC10B26877
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Registration\USER-PC
Operation:writeName:ProPlusRetail.AttemptGetKey
Value:
1
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(3700) setup32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
Executable files
2
Suspicious files
37
Text files
62
Unknown types
35

Dropped files

PID
Process
Filename
Type
3428setup32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850der
MD5:BB4A853340557135BC2CB0BBE27A54AD
SHA256:FD5FE2BCCB5AEB89D438EC681F0E907AF9341F792D04B047854D149190DB7A5A
3428setup32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0B8A20E1F3F4D73D52A19929F922C892der
MD5:46592A57C6064F33888C7E81C224EA77
SHA256:E534E076C4CB4EFC6D51FCD5EFF4635BFB5A02121AD6CA3D6DAA3032D42FAA1A
3428setup32.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:2F0F77E3C7B552E5A94028AA9B2A03CF
SHA256:A75440E4266C300AEE5A5518723E29A4F04E2D87FD08B5763821434ED87300C5
3700setup32.exeC:\Users\admin\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xmlxml
MD5:72A24C04E49852DD55F5EBDD0029AC3A
SHA256:88507148DBC0B45EF9466837357A14DD650667462C2B15E41393F0A0C5C57B5E
3428setup32.exeC:\Users\admin\AppData\Local\Temp\OfficeC2R7CA14464-1008-40FB-A4FD-D749F660FED7OfficeC2R44D26A4B-23E0-48D8-991F-A5886A6A9A0F\VersionDescriptor.xmlxml
MD5:B047220F8BDBF51DF4542A83F784ECB0
SHA256:BF4B73EE8BDB7C89BE667D9690D06DED7009DC650C0DEB1EAC79793DEB310C00
3428setup32.exeC:\Users\admin\AppData\Local\Temp\OfficeC2R7CA14464-1008-40FB-A4FD-D749F660FED7\VersionDescriptor.xmlxml
MD5:B047220F8BDBF51DF4542A83F784ECB0
SHA256:BF4B73EE8BDB7C89BE667D9690D06DED7009DC650C0DEB1EAC79793DEB310C00
1740msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pmabinary
MD5:886E82F2CA62ECCCE64601B30592078A
SHA256:E5E13D53601100FF3D6BB71514CBCCC4C73FE9B7EF5E930100E644187B42948E
3428setup32.exeC:\Users\admin\AppData\Local\Temp\OfficeC2R7CA14464-1008-40FB-A4FD-D749F660FED7\v32.cabcompressed
MD5:DA8729E4BCED97F121AC0B311E076C3F
SHA256:58CA5C2313657DB45B277E586DE039461566D30D2A772ED40328FD04CBD9715F
3428setup32.exeC:\Users\admin\AppData\Local\Temp\OfficeC2R7CA14464-1008-40FB-A4FD-D749F660FED7OfficeC2R44D26A4B-23E0-48D8-991F-A5886A6A9A0F\v32.hashtext
MD5:9EF5515AD69DB49D1FC5B2C4F0776BD9
SHA256:FAF6327DA5760EA9A1D3DE5FAE992D7E7C29D0F134C8F746B152C7C781C9DE1A
1336msedge.exe —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
34
DNS requests
20
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3428
setup32.exe
HEAD
200
72.247.154.139:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
unknown
—
—
unknown
3428
setup32.exe
GET
200
72.247.154.139:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32.cab
unknown
compressed
11.1 Kb
unknown
3428
setup32.exe
GET
200
2.22.242.90:80
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl
unknown
binary
767 b
unknown
3428
setup32.exe
GET
200
2.22.242.90:80
http://crl.microsoft.com/pki/crl/products/MicrosoftTimeStampPCA.crl
unknown
binary
519 b
unknown
3428
setup32.exe
GET
200
2.22.242.90:80
http://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl
unknown
binary
557 b
unknown
3428
setup32.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Time-Stamp%20PCA%202010(1).crl
unknown
binary
814 b
unknown
3428
setup32.exe
GET
304
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?a65c765d39622c71
unknown
—
—
unknown
1080
svchost.exe
GET
200
93.184.221.240:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?fc91d912a85a08d5
unknown
compressed
65.2 Kb
unknown
3428
setup32.exe
GET
200
2.22.242.90:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
binary
824 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3700
setup32.exe
52.111.236.24:443
nexus.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
3700
setup32.exe
52.111.229.43:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3428
setup32.exe
52.111.236.24:443
nexus.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
3428
setup32.exe
72.247.154.139:80
officecdn.microsoft.com
Akamai International B.V.
DE
unknown
3428
setup32.exe
93.184.221.240:80
ctldl.windowsupdate.com
EDGECAST
GB
whitelisted
3428
setup32.exe
52.111.229.43:443
nexusrules.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3428
setup32.exe
2.22.242.90:80
crl.microsoft.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
nexus.officeapps.live.com
  • 52.111.236.24
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
officecdn.microsoft.com
  • 72.247.154.139
  • 72.247.154.195
whitelisted
ctldl.windowsupdate.com
  • 93.184.221.240
whitelisted
crl.microsoft.com
  • 2.22.242.90
  • 2.22.242.121
whitelisted
www.microsoft.com
  • 88.221.169.152
whitelisted
vortex-win.data.microsoft.com
  • 20.189.173.3
  • 13.70.79.200
whitelisted
officeredir.microsoft.com
  • 52.109.89.118
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
config.edge.skype.com
  • 13.107.43.16
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup32.exe