File name:

SetupProd_OffScrub.exe

Full analysis: https://app.any.run/tasks/749d03be-c774-417d-ad9d-ffc7b02cbae1
Verdict: Malicious activity
Analysis date: February 23, 2024, 19:41:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

A9A189E7C270B711628D3E8C546700BC

SHA1:

A236FFD2C90D5F4E9CEBBC53FA60B17949950CC8

SHA256:

6895CE7DFAFE88CB01C8017E1BAFE31D6B311E72C151D20EDF27BF779C3868BB

SSDEEP:

3072:VA/cdv7411xlZ9bxAZLi7+T6e0Q2vKH2wlh:V44T4VPAci2wlh

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • SetupProd_OffScrub.exe (PID: 3892)
      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 3352)
      • Setup.exe (PID: 1044)

    • Changes powershell execution policy (Unrestricted)

      • powershell.exe (PID: 2120)
      • Microsoft.Sara.exe (PID: 3352)

    • Gets %windir% folder path (SCRIPT)

      • cscript.exe (PID: 3788)

    • Accesses environment variables (SCRIPT)

      • cscript.exe (PID: 3788)

    • Gets TEMP folder path (SCRIPT)

      • cscript.exe (PID: 3788)

    • Gets %appdata% folder path (SCRIPT)

      • cscript.exe (PID: 3788)

    • Creates a new folder (SCRIPT)

      • cscript.exe (PID: 3788)

    • Checks whether a specified folder exists (SCRIPT)

      • cscript.exe (PID: 3788)

    • Copies file to a new location (SCRIPT)

      • cscript.exe (PID: 3788)

    • Opens a text file (SCRIPT)

      • cscript.exe (PID: 3788)

    • Actions looks like stealing of personal data

      • cscript.exe (PID: 3788)

    • Uses sleep, probably for evasion detection (SCRIPT)

      • cscript.exe (PID: 3788)

  • SUSPICIOUS

    • Uses RUNDLL32.EXE to load library

      • SetupProd_OffScrub.exe (PID: 3892)
      • SetupProd_OffScrub.exe (PID: 1972)
      • Microsoft.Sara.exe (PID: 2248)

    • Starts a Microsoft application from unusual location

      • SetupProd_OffScrub.exe (PID: 3668)
      • SetupProd_OffScrub.exe (PID: 3892)
      • SetupProd_OffScrub.exe (PID: 1972)
      • SetupProd_OffScrub.exe (PID: 3996)

    • Process drops legitimate windows executable

      • SetupProd_OffScrub.exe (PID: 3892)
      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 3352)
      • Setup.exe (PID: 1044)

    • Reads the Internet Settings

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • dfsvc.exe (PID: 3504)
      • Microsoft.Sara.exe (PID: 3352)
      • powershell.exe (PID: 3564)
      • powershell.exe (PID: 1492)

    • Reads security settings of Internet Explorer

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • dfsvc.exe (PID: 3504)
      • Microsoft.Sara.exe (PID: 3352)

    • Reads settings of System Certificates

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • dfsvc.exe (PID: 3504)
      • Microsoft.Sara.exe (PID: 3352)

    • Executable content was dropped or overwritten

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 3352)
      • cscript.exe (PID: 3788)
      • Setup.exe (PID: 1044)

    • Reads Internet Explorer settings

      • dfsvc.exe (PID: 2844)

    • The process creates files with name similar to system file names

      • dfsvc.exe (PID: 2844)

    • The process drops C-runtime libraries

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 3352)

    • Searches for installed software

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • Microsoft.Sara.exe (PID: 3352)

    • Creates a software uninstall entry

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)

    • Reads the Windows owner or organization settings

      • Microsoft.Sara.exe (PID: 2248)
      • Microsoft.Sara.exe (PID: 3352)

    • Reads Microsoft Outlook installation path

      • Microsoft.Sara.exe (PID: 2248)
      • Microsoft.Sara.exe (PID: 3352)

    • Starts POWERSHELL.EXE for commands execution

      • Microsoft.Sara.exe (PID: 3352)
      • powershell.exe (PID: 2120)

    • Using PowerShell to operate with local accounts

      • powershell.exe (PID: 3564)
      • powershell.exe (PID: 1492)

    • Application launched itself

      • powershell.exe (PID: 2120)

    • The process executes Powershell scripts

      • powershell.exe (PID: 2120)
      • Microsoft.Sara.exe (PID: 3352)

    • Executing commands from a ".bat" file

      • Microsoft.Sara.exe (PID: 3352)

    • Starts CMD.EXE for commands execution

      • Microsoft.Sara.exe (PID: 3352)

    • Accesses language version of the operating system installed via WMI (SCRIPT)

      • cscript.exe (PID: 3788)

    • Accesses ComputerSystem(Win32_ComputerSystem) via WMI (SCRIPT)

      • cscript.exe (PID: 3788)

    • Creates FileSystem object to access computer's file system (SCRIPT)

      • cscript.exe (PID: 3788)

    • Uses WMI to retrieve WMI-managed resources (SCRIPT)

      • cscript.exe (PID: 3788)

    • The process executes VB scripts

      • Microsoft.Sara.exe (PID: 3352)

    • Accesses operating system name via WMI (SCRIPT)

      • cscript.exe (PID: 3788)

    • Executes WMI query (SCRIPT)

      • cscript.exe (PID: 3788)

    • Accesses OperatingSystem(Win32_OperatingSystem) via WMI (SCRIPT)

      • cscript.exe (PID: 3788)

    • Accesses WMI object caption (SCRIPT)

      • cscript.exe (PID: 3788)

    • Writes binary data to a Stream object (SCRIPT)

      • cscript.exe (PID: 3788)

    • Creates a Folder object (SCRIPT)

      • cscript.exe (PID: 3788)

    • Gets computer name (SCRIPT)

      • cscript.exe (PID: 3788)

    • Checks whether a specific file exists (SCRIPT)

      • cscript.exe (PID: 3788)

    • Accesses computer name via WMI (SCRIPT)

      • cscript.exe (PID: 3788)

    • Accesses current user name via WMI (SCRIPT)

      • cscript.exe (PID: 3788)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2780)

  • INFO

    • Checks supported languages

      • dfsvc.exe (PID: 2844)
      • SetupProd_OffScrub.exe (PID: 3892)
      • SetupProd_OffScrub.exe (PID: 1972)
      • Microsoft.Sara.exe (PID: 2248)
      • wmpnscfg.exe (PID: 2644)
      • Microsoft.Sara.exe (PID: 3352)
      • dfsvc.exe (PID: 3504)

    • Reads the machine GUID from the registry

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • dfsvc.exe (PID: 3504)
      • Microsoft.Sara.exe (PID: 3352)

    • Reads the computer name

      • dfsvc.exe (PID: 2844)
      • wmpnscfg.exe (PID: 2644)
      • Microsoft.Sara.exe (PID: 2248)
      • Microsoft.Sara.exe (PID: 3352)
      • dfsvc.exe (PID: 3504)

    • Create files in a temporary directory

      • SetupProd_OffScrub.exe (PID: 3892)
      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • dfsvc.exe (PID: 3504)
      • Microsoft.Sara.exe (PID: 3352)
      • cscript.exe (PID: 3788)

    • Reads Environment values

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • Microsoft.Sara.exe (PID: 3352)
      • dfsvc.exe (PID: 3504)

    • Checks proxy server information

      • dfsvc.exe (PID: 2844)
      • dfsvc.exe (PID: 3504)
      • Microsoft.Sara.exe (PID: 3352)

    • Reads the software policy settings

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • dfsvc.exe (PID: 3504)
      • Microsoft.Sara.exe (PID: 3352)

    • Process checks whether UAC notifications are on

      • dfsvc.exe (PID: 2844)

    • Manual execution by a user

      • SetupProd_OffScrub.exe (PID: 3996)
      • SetupProd_OffScrub.exe (PID: 1972)
      • wmpnscfg.exe (PID: 2644)

    • Creates files or folders in the user directory

      • dfsvc.exe (PID: 2844)
      • Microsoft.Sara.exe (PID: 2248)
      • dfsvc.exe (PID: 3504)
      • Microsoft.Sara.exe (PID: 3352)

    • Dropped object may contain TOR URL's

      • dfsvc.exe (PID: 2844)

    • Creates files in the program directory

      • Microsoft.Sara.exe (PID: 2248)

    • Reads CPU info

      • Microsoft.Sara.exe (PID: 2248)
      • Microsoft.Sara.exe (PID: 3352)

    • Reads Microsoft Office registry keys

      • Microsoft.Sara.exe (PID: 2248)
      • Microsoft.Sara.exe (PID: 3352)

    • Reads product name

      • Microsoft.Sara.exe (PID: 2248)
      • Microsoft.Sara.exe (PID: 3352)

    • Gets the execution policy for the powershell session

      • Microsoft.Sara.exe (PID: 3352)

    • Reads security settings of Internet Explorer

      • cscript.exe (PID: 3788)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:30 03:39:47+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 14.12
CodeSize: 74752
InitializedDataSize: 114688
UninitializedDataSize: -
EntryPoint: 0x2b03
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Support and Recovery Assistant for Office 365
FileVersion: 1.0.0.0
LegalCopyright: © Microsoft Corporation. All rights reserved.
ProductName: Microsoft Support and Recovery Assistant for Office 365
ProductVersion: 1.0.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
86
Monitored processes
25
Malicious processes
8
Suspicious processes
2

Behavior graph

Click at the process to see the details
start setupprod_offscrub.exe rundll32.exe no specs dfsvc.exe setupprod_offscrub.exe no specs setupprod_offscrub.exe rundll32.exe no specs wmpnscfg.exe no specs microsoft.sara.exe rundll32.exe dfsvc.exe microsoft.sara.exe powershell.exe no specs powershell.exe no specs systeminfo.exe no specs powershell.exe no specs powershell.exe no specs powershell.exe no specs cmd.exe no specs net.exe no specs net1.exe no specs cscript.exe setup.exe vssvc.exe no specs SPPSurrogate no specs setupprod_offscrub.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
668"powershell.exe" (systeminfo /fo csv | ConvertFrom-Csv | Select-Object OS*)C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Microsoft.Sara.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
956"cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\tmpDF60.tmp.bat"C:\Windows\System32\cmd.exe—Microsoft.Sara.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
984C:\Windows\system32\DllHost.exe /Processid:{F32D97DF-E3E5-4CB9-9E3E-0EB5B4E49801}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
1044"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\setup.exe" /uninstall OMUI.DE-DE /config "C:\Users\admin\AppData\Local\Temp\OffScrub10\config.xml" /dll OSETUP.DLLC:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe
cscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Setup Bootstrapper
Exit code:
0
Version:
14.0.6010.1000
1492"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted -File C:\Users\admin\AppData\Local\Temp\c124cb395d33416bb67f39ce272453d0.ps1C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1636"C:\Windows\System32\rundll32.exe" dfshim.dll, ShOpenVerbApplication https://outlookdiagnostics.azureedge.net/sarafiles/Microsoft.Sara.Prod.application?usergroup=Prod&Ring=Prod&runasadmin=trueC:\Windows\System32\rundll32.exe
Microsoft.Sara.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
1972"C:\Users\admin\Desktop\SetupProd_OffScrub.exe" C:\Users\admin\Desktop\SetupProd_OffScrub.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Support and Recovery Assistant for Office 365
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\setupprod_offscrub.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2120"powershell.exe" PowerShell.exe -ExecutionPolicy UnRestricted -File "C:\Users\admin\AppData\Local\Temp\c124cb395d33416bb67f39ce272453d0.ps1"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—Microsoft.Sara.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2184NET FILE C:\Windows\System32\net.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Net Command
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\net.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\netutils.dll
c:\windows\system32\browcli.dll
2248"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\micr..tion_ac9f5adfc2cecd90_0011.0001_0965ff758e4fcdba\Microsoft.Sara.exe"C:\Users\admin\AppData\Local\Apps\2.0\OQVLXTZK.4P5\AK6KX289.K1P\micr..tion_ac9f5adfc2cecd90_0011.0001_0965ff758e4fcdba\Microsoft.Sara.exe
dfsvc.exe
User:
admin
Company:
Microsoft Corporation.
Integrity Level:
MEDIUM
Description:
Microsoft Support and Recovery Assistant
Exit code:
0
Version:
17.01.1440.000
Modules
Images
c:\users\admin\appdata\local\apps\2.0\oqvlxtzk.4p5\ak6kx289.k1p\micr..tion_ac9f5adfc2cecd90_0011.0001_0965ff758e4fcdba\microsoft.sara.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
Total events
75 635
Read events
69 126
Write events
5 533
Delete events
976

Modification events

(PID) Process:(2844) dfsvc.exeKey:HKEY_CLASSES_ROOT\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager
Operation:writeName:StateStore_RandomString
Value:
AW0N8K6CRDZWK0BPZHEXW968
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:FileTracingMask
Value:
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:MaxFileSize
Value:
1048576
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASAPI32
Operation:writeName:FileDirectory
Value:
%windir%\tracing
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(2844) dfsvc.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\dfsvc_RASMANCS
Operation:writeName:FileTracingMask
Value:
Executable files
559
Suspicious files
100
Text files
521
Unknown types
107

Dropped files

PID
Process
Filename
Type
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\VTEN99RQ.2B2\TQ2CDN41.L0M\en\excel.crashes.config.xmlxml
MD5:18DE8EB6DDFDCADF929D0CEDD963BA6D
SHA256:D8117328E9020E3623AE144BAB81412B189C72D0A8C28BAFDFE8D49933B2FE65
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\VTEN99RQ.2B2\TQ2CDN41.L0M\Microsoft.Sara.exe.manifestxml
MD5:E25AFCCC4E391C271DBD9BB2A27DC119
SHA256:CD0208DF034A90A186659721811B715D27356D18A072CBDAAD2E381225DACCA0
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\3PR7LTP0.EVQ\KB01VMMW.AC7.applicationxml
MD5:9B213711124DBFFDFF31CEACB5655A8A
SHA256:CDD0A53ADCDA4BC804273C4E75BE4E3A7AAA13346E348308C6698705B541F23C
2844dfsvc.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\3NQLP1OM.logtext
MD5:A6CACCCAB1232E7A984DD0F353DEB4D2
SHA256:47E95355E984CA886E3729F9908745196767F87C3B864E31E5A1C4726CE64CD5
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\VTEN99RQ.2B2\TQ2CDN41.L0M\Microsoft.IdentityModel.Clients.ActiveDirectory.WindowsForms.dllexecutable
MD5:DAD75B06FCDBA45BC622BAF0582E806A
SHA256:C24A11C0E4AE4BD202DBC2002CBA4E29B18A5008063DCE2ABC922B7078E7519B
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\VTEN99RQ.2B2\TQ2CDN41.L0M\SaraEULA.txttext
MD5:A811F7A46C12ED29C5713A64F528569A
SHA256:30AFE28070DD647EFB545549CBDDCBBF9D40C7424BC93FECC8E7AE51A668D7EB
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\VTEN99RQ.2B2\TQ2CDN41.L0M\en\access.config.xmlxml
MD5:39E98A49311231F92ADF4FAF229B8E0B
SHA256:BF42C275185C0F4C15705F30A2429461EEC6B0005688C5D33C44DF4FAA628443
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\VTEN99RQ.2B2\TQ2CDN41.L0M\en\lync.config.xmlxml
MD5:C9AED8918515A0B7D64080E75E55705D
SHA256:2CA2FD970AABE2682C3D851C41F0A4058246BC39CCAA98BA6B6136CB9979D072
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\VTEN99RQ.2B2\TQ2CDN41.L0M\en\publisher.crashes.config.xmlxml
MD5:6A46AEA92080C7190A38D54FC59C5469
SHA256:10182233F5D8F3E808F3C9170B093BEDD718D6BEDA28F8EA242A84F20706B599
2844dfsvc.exeC:\Users\admin\AppData\Local\Temp\Deployment\VTEN99RQ.2B2\TQ2CDN41.L0M\en\roiscan.config.xmlxml
MD5:7936522251318CDCFFDB9A75C879FF34
SHA256:D152B95508CF08BEB65A6C85E5B779CAFCFB59C778411B0DBD431828C09428A9
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
20
DNS requests
5
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2844
dfsvc.exe
152.199.19.160:443
outlookdiagnostics.azureedge.net
EDGECAST
US
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2248
Microsoft.Sara.exe
20.84.169.20:443
sara.api.support.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3504
dfsvc.exe
152.199.19.160:443
outlookdiagnostics.azureedge.net
EDGECAST
US
whitelisted
3352
Microsoft.Sara.exe
20.84.169.20:443
sara.api.support.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
3352
Microsoft.Sara.exe
152.199.19.160:443
outlookdiagnostics.azureedge.net
EDGECAST
US
whitelisted
3352
Microsoft.Sara.exe
20.120.45.53:443
sara.api.support.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown

DNS requests

Domain
IP
Reputation
outlookdiagnostics.azureedge.net
  • 152.199.19.160
whitelisted
sara.api.support.microsoft.com
  • 20.84.169.20
  • 20.120.45.53
whitelisted

Threats

No threats detected
Process
Message
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe
Number of uninstallRootKey is 0
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe
C:\Windows\system32\rundll32.exe dfshim.dll, ShOpenVerbApplication https://outlookdiagnostics.azureedge.net/sarafiles/Microsoft.Sara.Prod.application?usergroup=Prod&Ring=Prod&symptomid=3a1b3aa0-0969-4860-a9b8-ad13e3c81cf8
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe
Start to install Office 365 Support and Recovery Assistant
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe
Version verficiation success
SetupProd_OffScrub.exe
SetupProd_OffScrub.exe
Current .net version is 528049
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
SetupProd_OffScrub.exe