File name:

WINWORD.EXE

Full analysis: https://app.any.run/tasks/7eec0c8c-8ba6-40bd-9080-8d9ff23610b5
Verdict: Malicious activity
Analysis date: January 10, 2024, 10:40:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

CEAA5817A65E914AA178B28F12359A46

SHA1:

534A7EA9C67BAB3E8F2D41977BF43D41DFE951CF

SHA256:

6C959CFB001FBB900958441DFD8B262FB33E052342948BAB338775D3E83EF7F7

SSDEEP:

6144:tlsHe0BivO39zYpmH+kAzkA7ZUgbc6AYJ8rEdrEbAgMMV6NX5ZNeVgjYf3:InIO39YAeNLFjAYarEdrEb5P6VxYP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • The DLL Hijacking

      • WINWORD.EXE (PID: 2044)
      • msiexec.exe (PID: 2080)

  • SUSPICIOUS

    • Checks Windows Trust Settings

      • Setup.exe (PID: 1356)

    • Reads security settings of Internet Explorer

      • Setup.exe (PID: 1356)

    • Reads settings of System Certificates

      • Setup.exe (PID: 1356)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 2080)

    • Reads the Internet Settings

      • msiexec.exe (PID: 1392)
      • Setup.exe (PID: 1356)
      • msiexec.exe (PID: 1928)
      • msiexec.exe (PID: 376)
      • msiexec.exe (PID: 2348)
      • msiexec.exe (PID: 2520)
      • msiexec.exe (PID: 2848)
      • msiexec.exe (PID: 880)
      • msiexec.exe (PID: 2688)
      • msiexec.exe (PID: 3052)
      • msiexec.exe (PID: 3220)
      • msiexec.exe (PID: 3172)
      • msiexec.exe (PID: 2104)
      • msiexec.exe (PID: 3672)
      • msiexec.exe (PID: 3884)
      • msiexec.exe (PID: 1772)

    • Searches for installed software

      • Setup.exe (PID: 1356)

    • Creates/Modifies COM task schedule object

      • msiexec.exe (PID: 2080)
      • MSOHTMED.EXE (PID: 2056)

    • Disables SEHOP

      • msiexec.exe (PID: 2080)

    • Changes default file association

      • MSOHTMED.EXE (PID: 2056)
      • msiexec.exe (PID: 2080)

  • INFO

    • Drops the executable file immediately after the start

      • WINWORD.EXE (PID: 2044)
      • Setup.exe (PID: 1356)
      • msiexec.exe (PID: 2080)
      • msiexec.exe (PID: 1392)
      • msiexec.exe (PID: 376)
      • msiexec.exe (PID: 2348)
      • msiexec.exe (PID: 2688)
      • msiexec.exe (PID: 3220)
      • msiexec.exe (PID: 3172)
      • msiexec.exe (PID: 3672)
      • msiexec.exe (PID: 3884)
      • msiexec.exe (PID: 1772)

    • Reads Environment values

      • WINWORD.EXE (PID: 2044)
      • msiexec.exe (PID: 2080)

    • Process drops legitimate windows executable

      • WINWORD.EXE (PID: 2044)
      • Setup.exe (PID: 1356)
      • msiexec.exe (PID: 1392)
      • msiexec.exe (PID: 2080)
      • msiexec.exe (PID: 376)
      • msiexec.exe (PID: 2348)
      • msiexec.exe (PID: 2688)
      • msiexec.exe (PID: 3220)
      • msiexec.exe (PID: 3172)
      • msiexec.exe (PID: 3672)
      • msiexec.exe (PID: 3884)
      • msiexec.exe (PID: 1772)

    • Reads the computer name

      • WINWORD.EXE (PID: 2044)
      • msiexec.exe (PID: 2080)
      • msiexec.exe (PID: 1392)
      • Setup.exe (PID: 1356)
      • msiexec.exe (PID: 1836)
      • msiexec.exe (PID: 1928)
      • msiexec.exe (PID: 2348)
      • msiexec.exe (PID: 632)
      • msiexec.exe (PID: 2580)
      • msiexec.exe (PID: 376)
      • msiexec.exe (PID: 2688)
      • msiexec.exe (PID: 2672)
      • msiexec.exe (PID: 2848)
      • msiexec.exe (PID: 2520)
      • msiexec.exe (PID: 880)
      • msiexec.exe (PID: 3052)
      • msiexec.exe (PID: 3220)
      • msiexec.exe (PID: 3152)
      • msiexec.exe (PID: 3172)
      • msiexec.exe (PID: 3312)
      • msiexec.exe (PID: 2104)
      • msiexec.exe (PID: 3672)
      • msiexec.exe (PID: 3820)
      • msiexec.exe (PID: 3884)
      • msiexec.exe (PID: 4056)
      • msiexec.exe (PID: 1772)
      • msiexec.exe (PID: 2328)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2044)
      • msiexec.exe (PID: 2080)
      • Setup.exe (PID: 1356)
      • msiexec.exe (PID: 1772)
      • MSOHTMED.EXE (PID: 2056)

    • Reads the machine GUID from the registry

      • WINWORD.EXE (PID: 2044)
      • Setup.exe (PID: 1356)
      • msiexec.exe (PID: 2080)
      • msiexec.exe (PID: 1392)
      • msiexec.exe (PID: 1836)
      • msiexec.exe (PID: 1928)
      • msiexec.exe (PID: 2348)
      • msiexec.exe (PID: 632)
      • msiexec.exe (PID: 376)
      • msiexec.exe (PID: 2580)
      • msiexec.exe (PID: 2688)
      • msiexec.exe (PID: 2672)
      • msiexec.exe (PID: 2520)
      • msiexec.exe (PID: 2848)
      • msiexec.exe (PID: 880)
      • msiexec.exe (PID: 3052)
      • msiexec.exe (PID: 3220)
      • msiexec.exe (PID: 3152)
      • msiexec.exe (PID: 3172)
      • msiexec.exe (PID: 3312)
      • msiexec.exe (PID: 2104)
      • msiexec.exe (PID: 3672)
      • msiexec.exe (PID: 3820)
      • msiexec.exe (PID: 3884)
      • msiexec.exe (PID: 4056)
      • msiexec.exe (PID: 1772)
      • msiexec.exe (PID: 2328)
      • addinutil.exe (PID: 1984)
      • addinutil.exe (PID: 2260)

    • Checks supported languages

      • Setup.exe (PID: 1356)
      • WINWORD.EXE (PID: 2044)
      • msiexec.exe (PID: 2080)
      • msiexec.exe (PID: 1392)
      • msiexec.exe (PID: 1836)
      • msiexec.exe (PID: 1928)
      • msiexec.exe (PID: 2348)
      • msiexec.exe (PID: 376)
      • msiexec.exe (PID: 2580)
      • msiexec.exe (PID: 2688)
      • msiexec.exe (PID: 632)
      • msiexec.exe (PID: 2672)
      • msiexec.exe (PID: 880)
      • msiexec.exe (PID: 2848)
      • msiexec.exe (PID: 2520)
      • msiexec.exe (PID: 3220)
      • msiexec.exe (PID: 3172)
      • msiexec.exe (PID: 3152)
      • msiexec.exe (PID: 3052)
      • msiexec.exe (PID: 3312)
      • msiexec.exe (PID: 2104)
      • msiexec.exe (PID: 3672)
      • msiexec.exe (PID: 3820)
      • msiexec.exe (PID: 3884)
      • msiexec.exe (PID: 4056)
      • msiexec.exe (PID: 1772)
      • msiexec.exe (PID: 2328)
      • MSICC3F.tmp (PID: 2424)
      • addinutil.exe (PID: 1984)
      • addinutil.exe (PID: 2260)
      • MSOHTMED.EXE (PID: 2056)

    • Create files in a temporary directory

      • Setup.exe (PID: 1356)
      • msiexec.exe (PID: 2080)

    • Application launched itself

      • msiexec.exe (PID: 2080)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2080)

    • Starts application with an unusual extension

      • msiexec.exe (PID: 2080)

    • Creates files or folders in the user directory

      • WINWORD.EXE (PID: 2044)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2006:10:27 23:54:48+02:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 8
CodeSize: 5120
InitializedDataSize: 334848
UninitializedDataSize: -
EntryPoint: 0x10cc
OSVersion: 4
ImageVersion: 10
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 12.0.4518.1014
ProductVersionNumber: 12.0.4518.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
CompanyName: Microsoft Corporation
FileDescription: Microsoft Office Word
FileVersion: 12.0.4518.1014
InternalName: WinWord
LegalCopyright: © 2006 Microsoft Corporation. All rights reserved.
LegalTrademarks1: Microsoft® is a registered trademark of Microsoft Corporation.
LegalTrademarks2: Windows® is a registered trademark of Microsoft Corporation.
OriginalFileName: WinWord.exe
ProductName: 2007 Microsoft Office system
ProductVersion: 12.0.4518.1014
No data.
screenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
66
Monitored processes
31
Malicious processes
4
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winword.exe no specs setup.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs msohtmed.exe no specs msicc3f.tmp no specs addinutil.exe addinutil.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
376C:\Windows\system32\MsiExec.exe -Embedding CFCFA25CCE33B1278ED4D4C1895EFC4FC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
632C:\Windows\system32\MsiExec.exe -Embedding A10504DBAD53544753570D49C078486A E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
880C:\Windows\system32\MsiExec.exe -Embedding E0802B0355920F961567BB15C924E9C7C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1356"C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe" -EmbeddingC:\Program Files\Common Files\Microsoft Shared\OFFICE14\Office Setup Controller\Setup.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Setup Bootstrapper
Exit code:
0
Version:
14.0.6010.1000
Modules
Images
c:\program files\common files\microsoft shared\office14\office setup controller\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
1392C:\Windows\system32\MsiExec.exe -Embedding 0E4629F8F4AD8C15201743D9FCB7A886C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1772C:\Windows\system32\MsiExec.exe -Embedding CE33664D124CA9CDBAB39DB7DFBFE177C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1836C:\Windows\system32\MsiExec.exe -Embedding 52925EE971A317DEADDF2EBAC729C03C E Global\MSI0000C:\Windows\System32\msiexec.exe—msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1928C:\Windows\system32\MsiExec.exe -Embedding A4E681F11C51BB91DB067D0042A47485C:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1984"C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -RebuildC:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe
msiexec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
AddInUtil.exe
Exit code:
0
Version:
3.5.30729.5420 built by: Win7SP1
Modules
Images
c:\windows\microsoft.net\framework\v3.5\addinutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2044"C:\Users\admin\AppData\Local\Temp\WINWORD.EXE" C:\Users\admin\AppData\Local\Temp\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Office Word
Exit code:
0
Version:
12.0.4518.1014
Modules
Images
c:\users\admin\appdata\local\temp\winword.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_d08cc06a442b34fc\msvcr80.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
84 629
Read events
79 023
Write events
4 693
Delete events
913

Modification events

(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(2044) WINWORD.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
210
Suspicious files
131
Text files
6
Unknown types
0

Dropped files

PID
Process
Filename
Type
2044WINWORD.EXEC:\Users\admin\AppData\Local\Temp\CVR12F7.tmp.cvr —
MD5:—
SHA256:—
1356Setup.exeC:\Users\admin\AppData\Local\Temp\Setup0000054c\OSETUPUI.DLLexecutable
MD5:196A884E700B7EB09B2CD0A48ECCBC3A
SHA256:12BABD301AB2F5A0CD35226D4939E1E200D5FCF90694A25690DF7AD0EA28B55A
2080msiexec.exeC:\Windows\Installer\MSI21FB.tmpexecutable
MD5:CB6AAB53E5D4893327ADE765CFF283F2
SHA256:A0DBBA68F7B3FBFF7FE368F5478AE60D2D840158ED0E70FF0A1C48C305D8F986
2080msiexec.exeC:\Windows\Installer\MSI22A8.tmpexecutable
MD5:CB6AAB53E5D4893327ADE765CFF283F2
SHA256:A0DBBA68F7B3FBFF7FE368F5478AE60D2D840158ED0E70FF0A1C48C305D8F986
1356Setup.exeC:\Users\admin\AppData\Local\Temp\Setup0000054c\SETUP.CHMbinary
MD5:CB8F14C8B37BA69F361E33E30E8EBC74
SHA256:C777301E71BFE4AE0D7355D5D4DF8ED4DDC437D59079C214173F1A29EE312210
2080msiexec.exeC:\Users\admin\AppData\Local\Temp\~DF38C4AC21EF5F3F2F.TMPbinary
MD5:187F58A576B1D4AEB78672A830A92A19
SHA256:F4BE5F7A050431CEE430DD276F34C766A0419CE27BB0FCA0132A92FAB107F246
2080msiexec.exeC:\Windows\Installer\e22f6.ipibinary
MD5:37DE734ABB0FF16E3BF15159E7D8EA29
SHA256:404EBAFBCB1443A04C2F83E4208C2ADAC8FFECE052626197F6D9DA2DB3E2BA56
1356Setup.exeC:\Users\admin\AppData\Local\Temp\SetupExe(2024011010404554C).logtext
MD5:7D1C16D1D3A6EE2DC40601CF4500529E
SHA256:4AFA1F6E738AB197CB475C4C02A36CACDD286FFCFF04EDA7BA98BB1016CBE2BA
1356Setup.exeC:\Users\admin\AppData\Local\Temp\Setup0000054c\BRANDING.XMLxml
MD5:10B211A922F7CA1A15B98F595A10A7BD
SHA256:01B34D2E5BE5247D802D5E1EEC1C641B55B8959243C27163500511D55FF51DA0
2080msiexec.exeC:\Windows\Installer\MSI2607.tmpexecutable
MD5:9F0B9BC54BB73DFB7CF85520DA1A08CB
SHA256:0D44D40E8BDA72A3D6CA26665100B256848E2183029A6728C18AD97CD650547F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
1
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted

DNS requests

No data

Threats

No threats detected
Process
Message
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR originated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\copyout.cpp, line 1302
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
addinutil.exe
*** HR propagated: -2147024774 *** Source File: d:\iso_whid\x86fre\base\isolation\com\enumidentityattribute.cpp, line 144
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WINWORD.EXE