File name:

OInstall.exe

Full analysis: https://app.any.run/tasks/ea14ccad-2044-4e7c-a2a4-e95b67cc8381
Verdict: Malicious activity
Analysis date: January 30, 2025, 07:47:45
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
upx
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

F71556138C9EB716330063156DB4A6BC

SHA1:

BD91945D407CBEEE830C15280C8324459F0FF61A

SHA256:

41FF83C380B958E918C4061C02A6077590D7630A01D7F2F0F448DC1A6FBF284A

SSDEEP:

196608:vp1crEM65aqMLvUcm+oz3BkeBTAUW24t13Dr7m0mitn2xe7gXQZ+3jeRBTfYNCH1:hurEzabjm+4keB0vt1Dr7m0mc2xe7gAN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 5304)

  • SUSPICIOUS

    • Starts application with an unusual extension

      • cmd.exe (PID: 6440)

    • Executable content was dropped or overwritten

      • OInstall.exe (PID: 6292)
      • files.dat (PID: 6492)
      • OfficeClickToRun.exe (PID: 3700)

    • Process drops legitimate windows executable

      • files.dat (PID: 6492)
      • OInstall.exe (PID: 6292)
      • OfficeClickToRun.exe (PID: 3700)

    • Starts CMD.EXE for commands execution

      • OInstall.exe (PID: 6292)

    • The process drops C-runtime libraries

      • files.dat (PID: 6492)
      • OfficeClickToRun.exe (PID: 3700)

    • Starts a Microsoft application from unusual location

      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)

    • Checks Windows Trust Settings

      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)

    • Searches for installed software

      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)

    • Drops 7-zip archiver for unpacking

      • OInstall.exe (PID: 6292)

    • Starts POWERSHELL.EXE for commands execution

      • setup.exe (PID: 4244)

    • The process hide an interactive prompt from the user

      • setup.exe (PID: 4244)

    • The process bypasses the loading of PowerShell profile settings

      • setup.exe (PID: 4244)

  • INFO

    • Reads Environment values

      • OInstall.exe (PID: 6292)

    • Checks supported languages

      • OInstall.exe (PID: 6292)
      • files.dat (PID: 6492)
      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)
      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with english language support

      • files.dat (PID: 6492)
      • OInstall.exe (PID: 6292)
      • OfficeClickToRun.exe (PID: 3700)

    • Create files in a temporary directory

      • files.dat (PID: 6492)
      • OInstall.exe (PID: 6292)
      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)
      • OfficeClickToRun.exe (PID: 3700)

    • UPX packer has been detected

      • OInstall.exe (PID: 6292)

    • Reads the computer name

      • setup.exe (PID: 6408)
      • OInstall.exe (PID: 6292)
      • setup.exe (PID: 4244)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)
      • OfficeClickToRun.exe (PID: 3700)

    • Creates files or folders in the user directory

      • setup.exe (PID: 6408)
      • OfficeClickToRun.exe (PID: 3700)

    • Reads the software policy settings

      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)

    • Reads CPU info

      • setup.exe (PID: 6408)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)
      • OfficeClickToRun.exe (PID: 3700)

    • Process checks computer location settings

      • setup.exe (PID: 4244)
      • setup.exe (PID: 6408)

    • Checks proxy server information

      • setup.exe (PID: 6408)
      • setup.exe (PID: 4244)
      • OfficeClickToRun.exe (PID: 3700)

    • Creates files in the program directory

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with german language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with spanish language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with Italian language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with japanese language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with Indonesian language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with russian language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with portuguese language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with slovak language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with chinese language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with czech language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with turkish language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with polish language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with french language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with swedish language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with korean language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with arabic language support

      • OfficeClickToRun.exe (PID: 3700)

    • The sample compiled with bulgarian language support

      • OfficeClickToRun.exe (PID: 3700)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (76)
.exe | Win32 Executable (generic) (12.6)
.exe | Generic Win/DOS Executable (5.6)
.exe | DOS Executable Generic (5.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:08:30 04:58:12+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 2.5
CodeSize: 9842688
InitializedDataSize: 90112
UninitializedDataSize: 8626176
EntryPoint: 0x119d630
OSVersion: 4
ImageVersion: -
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 6.4.4.0
ProductVersionNumber: 6.4.4.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Unknown (0)
ObjectFileType: Unknown
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
ProductName: Office 2013-2016 C2R Install
FileDescription: Office 2013-2016 C2R Install
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
145
Monitored processes
17
Malicious processes
4
Suspicious processes
2

Behavior graph

Click at the process to see the details
start oinstall.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs files.dat cmd.exe no specs conhost.exe no specs setup.exe cmd.exe no specs conhost.exe no specs setup.exe powershell.exe no specs conhost.exe no specs officeclicktorun.exe Delivery Optimization User no specs oinstall.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
396\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1480"C:\WINDOWS\Sysnative\cmd.exe" /D /c C:\Users\admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xmlC:\Windows\System32\cmd.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1603
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
1544"C:\Users\admin\AppData\Local\Temp\OInstall.exe" C:\Users\admin\AppData\Local\Temp\OInstall.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Office 2013-2016 C2R Install
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\oinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3420"C:\WINDOWS\Sysnative\cmd.exe" /D /c C:\Users\admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xmlC:\Windows\System32\cmd.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
3700OfficeClickToRun.exe deliverymechanism=492350f6-3a01-4f97-b9c0-c7c6ddf67d60 platform=x64 productreleaseid=none forcecentcheck= culture=en-us defaultplatform=False storeid= lcid=1033 b= productstoadd=ProplusRetail.16_en-us_x-none scenario=CLIENTUPDATE acceptalleulas=True updatesenabled=False cdnbaseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 version=16.0.18429.20132 mediatype=CDN proplusretail.excludedapps=access,publisher,groove,lync,onenote,outlook,powerpoint,onedrive baseurl=http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60 flt.useexptransportinplacepl=unknown flt.useaddons=unknown flt.useofficehelperaddon=unknown flt.useonedriveclientaddon=unknown flt.useoutlookshareaddon=unknownC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office Click-to-Run (SxS)
Version:
16.0.16026.20140
Modules
Images
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
3820\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4244C:\Users\admin\AppData\Local\Temp\files\Setup.exe /configure Configure.xmlC:\Users\admin\AppData\Local\Temp\files\setup.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office
Version:
16.0.10810.33603
Modules
Images
c:\users\admin\appdata\local\temp\files\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
5304"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -WindowStyle Hidden -Command "& { $isOfficeInstalled = Get-AppxPackage Microsoft.Office.Desktop -allusers; if ($isOfficeInstalled -eq $null) { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Centennial.Detection.IsCentennialOfficeInstalled.scratch' -InputObject '0' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\admin\AppData\Local\Temp\Centennial.Detection.IsCentennialOfficeInstalled.scratch' -InputObject '1' -Encoding ascii } }"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe—setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6292"C:\Users\admin\AppData\Local\Temp\OInstall.exe" C:\Users\admin\AppData\Local\Temp\OInstall.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
Office 2013-2016 C2R Install
Modules
Images
c:\users\admin\appdata\local\temp\oinstall.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
6372"C:\WINDOWS\Sysnative\cmd.exe" /D /c copy C:\WINDOWS\system32\Tasks\OInstall "C:\WINDOWS\Temp\OInstall.tmp" /YC:\Windows\System32\cmd.exe—OInstall.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
Total events
21 700
Read events
20 523
Write events
1 082
Delete events
95

Modification events

(PID) Process:(6292) OInstall.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaResources\DirectSound\Speaker Configuration
Operation:writeName:Speaker Configuration
Value:
4
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:pt-br
Value:
2
(PID) Process:(6408) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ru-ru
Value:
2
Executable files
253
Suspicious files
32
Text files
39
Unknown types
0

Dropped files

PID
Process
Filename
Type
6492files.datC:\Users\admin\AppData\Local\Temp\files\Configure.xmltext
MD5:AC6BE84084E31DBB0E08D188B6C86EC8
SHA256:1879F7DE537C2AA70292C61EBEF9C6477D36E25B2E6A639E318B159E0A22B0FC
6492files.datC:\Users\admin\AppData\Local\Temp\files\x86\msvcr100.dllexecutable
MD5:BF38660A9125935658CFA3E53FDC7D65
SHA256:60C06E0FA4449314DA3A0A87C1A9D9577DF99226F943637E06F61188E5862EFA
6292OInstall.exeC:\Users\admin\AppData\Local\Temp\files\setup.exeexecutable
MD5:D4A7C7C3C92C4E9BC9BDEE1C660E60DB
SHA256:B95AC36A49E79C3E63E23ECA86EAC3D22ACD80363D0F0AA83BA7EE7799ACF2A5
6492files.datC:\Users\admin\AppData\Local\Temp\files\x64\msvcr100.dllexecutable
MD5:DF3CA8D16BDED6A54977B30E66864D33
SHA256:1D1A1AE540BA132F998D60D3622F0297B6E86AE399332C3B47462D7C0F560A36
6492files.datC:\Users\admin\AppData\Local\Temp\files\x64\cleanospp.exeexecutable
MD5:162AB955CB2F002A73C1530AA796477F
SHA256:5CE462E5F34065FC878362BA58617FAB28C22D631B9D836DDDCF43FB1AD4DE6E
6408setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\696F3DE637E6DE85B458996D49D759ADbinary
MD5:6872FAE8288DB34207D9E7EE350157F4
SHA256:50795B027E2BC566D3B7ACB89913F8EFD23B70615C9DB9BF5B23323AD3132A7D
6292OInstall.exeC:\Users\admin\AppData\Local\Temp\files\files.datexecutable
MD5:BB81E763AB0E673B3C1AF2FEA2586A9A
SHA256:4D45C64B244C8F997358635C3B5CB9A65743FAC473D65C455D3BA8A25E50D5F9
6408setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76binary
MD5:E95AF9B03513D729D28FD890CFF4EBE9
SHA256:B19F80A5970542F71E1728CDEEE5D4534598329BA22FABF5BBD2280EBD6BA629
6292OInstall.exeC:\Users\admin\AppData\Local\Temp\files\Configure.xmltext
MD5:423B57427D709D53B6647A12F10E852D
SHA256:7FCCB678CCD4097E9201B1BA5AA346D578AA5F892420DA650B5180EE61D8E3E8
6408setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A583E2A51BFBDC1E492A57B7C8325850binary
MD5:BB148187A85E826D9F04F30A242F8647
SHA256:569FD129CDDBCD13CA12E73C48D326043C5E4649C4B6DB82757E10EEE6E27595
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
58
TCP/UDP connections
57
DNS requests
35
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
95.101.78.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
95.101.78.32:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6408
setup.exe
HEAD
200
23.50.131.75:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16026.20146.cab
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6408
setup.exe
HEAD
200
23.50.131.75:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.18429.20132.cab
unknown
—
—
whitelisted
6408
setup.exe
HEAD
200
23.50.131.75:80
http://officecdn.microsoft.com/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.18429.20132.cab
unknown
—
—
whitelisted
6408
setup.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
184.86.251.19:443
—
Akamai International B.V.
DE
unknown
4712
MoUsoCoreWorker.exe
95.101.78.32:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
95.101.78.32:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4300
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
184.86.251.10:443
—
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
google.com
  • 172.217.18.110
whitelisted
crl.microsoft.com
  • 95.101.78.32
  • 95.101.78.42
whitelisted
www.microsoft.com
  • 23.52.120.96
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
login.live.com
  • 20.190.159.4
  • 40.126.31.73
  • 20.190.159.23
  • 40.126.31.131
  • 20.190.159.2
  • 20.190.159.71
  • 40.126.31.130
  • 40.126.31.128
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.43
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
client-office365-tas.msedge.net
  • 13.107.5.88
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
OInstall.exe