File name:

ProjectOnlineDesktopClient.exe

Full analysis: https://app.any.run/tasks/e302b548-6cb3-4b9b-9f96-702758d015c5
Verdict: Malicious activity
Analysis date: January 15, 2025, 13:45:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32+ executable (GUI) x86-64, for MS Windows, 5 sections
MD5:

2BEEC840DC451666A6465043C7908720

SHA1:

4906A5E21B74409B47BCCC310845EE07F1185570

SHA256:

8F17FDECF0C98FBDD657FBEE8340FB04875F4FFAC3CE9763B7E60A5DDB936F63

SSDEEP:

98304:8yogGvOtNnWHEoRn/1t1ZFwakhQkxPuIMa2gPys/jjBB42iuWZRCyVWtDq5UdrQK:WRx/RG3NF3FyKjr

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Process drops legitimate windows executable

      • ProjectOnlineDesktopClient.exe (PID: 6480)
      • OfficeClickToRun.exe (PID: 6860)
      • OfficeClickToRun.exe (PID: 6184)

    • Executing commands from a ".bat" file

      • ProjectOnlineDesktopClient.exe (PID: 6480)

    • Executable content was dropped or overwritten

      • ProjectOnlineDesktopClient.exe (PID: 6480)
      • OfficeClickToRun.exe (PID: 6860)
      • OfficeClickToRun.exe (PID: 6184)

    • Starts CMD.EXE for commands execution

      • ProjectOnlineDesktopClient.exe (PID: 6480)

    • Starts a Microsoft application from unusual location

      • setup.exe (PID: 6564)

    • The executable file from the user directory is run by the CMD process

      • setup.exe (PID: 6564)

    • Reads security settings of Internet Explorer

      • setup.exe (PID: 6564)

    • Checks Windows Trust Settings

      • setup.exe (PID: 6564)

    • The process drops C-runtime libraries

      • OfficeClickToRun.exe (PID: 6860)

  • INFO

    • Checks supported languages

      • ProjectOnlineDesktopClient.exe (PID: 6480)
      • setup.exe (PID: 6564)
      • OfficeClickToRun.exe (PID: 6860)

    • Reads Microsoft Office registry keys

      • setup.exe (PID: 6564)
      • OfficeClickToRun.exe (PID: 6860)

    • Process checks computer location settings

      • setup.exe (PID: 6564)

    • Checks proxy server information

      • setup.exe (PID: 6564)

    • Reads the machine GUID from the registry

      • setup.exe (PID: 6564)

    • Create files in a temporary directory

      • ProjectOnlineDesktopClient.exe (PID: 6480)

    • Creates files in the program directory

      • OfficeClickToRun.exe (PID: 6860)

    • Reads the software policy settings

      • OfficeClickToRun.exe (PID: 6860)
      • setup.exe (PID: 6564)

    • The sample compiled with Indonesian language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with english language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with bulgarian language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with german language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with spanish language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with french language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with polish language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with Italian language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with japanese language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with russian language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with portuguese language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with slovak language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with swedish language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with korean language support

      • OfficeClickToRun.exe (PID: 6860)

    • Executes as Windows Service

      • OfficeClickToRun.exe (PID: 6184)

    • The sample compiled with turkish language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with chinese language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with arabic language support

      • OfficeClickToRun.exe (PID: 6860)

    • The sample compiled with czech language support

      • OfficeClickToRun.exe (PID: 6860)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Generic Win/DOS Executable (50)
.exe | DOS Executable Generic (49.9)

EXIF

EXE

MachineType: AMD AMD64
TimeStamp: 2011:12:22 20:35:23+00:00
ImageFileCharacteristics: No relocs, Executable, Large address aware
PEType: PE32+
LinkerVersion: 9
CodeSize: 84992
InitializedDataSize: 7653888
UninitializedDataSize: -
EntryPoint: 0x10940
OSVersion: 5.2
ImageVersion: -
SubsystemVersion: 5.2
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.1
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Windows, Latin1
Comments: -
CompanyName: UNISYS CORPORATION
FileDescription: Project Online
FileVersion: 1. 0. 0. 1
LegalCopyright: UNISYS CORPORATION
ProductName: Project Online
ProductVersion: 1. 0. 0. 1
No data.
screenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
137
Monitored processes
9
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start projectonlinedesktopclient.exe cmd.exe no specs conhost.exe no specs setup.exe officeclicktorun.exe Delivery Optimization User no specs officeclicktorun.exe officeclicktorun.exe projectonlinedesktopclient.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5880OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=ProjectProRetail.16_en-us_x-none cdnbaseurl.16=http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6 baseurl.16=http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6 version.16=16.0.18227.20222 mediatype.16=CDN sourcetype.16=CDN updatesenabled.16=True acceptalleulas.16=True displaylevel=True bitnessmigration=False deliverymechanism=55336b82-a18d-4dd6-b5f6-9e5095c314a6 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True besteffortcultureinstall=TrueC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office Click-to-Run (SxS)
Version:
16.0.18227.20222
Modules
Images
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6184"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /serviceC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Click-to-Run (SxS)
Version:
16.0.18227.20222
Modules
Images
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\gdi32.dll
6312"C:\Users\admin\AppData\Local\Temp\ProjectOnlineDesktopClient.exe" C:\Users\admin\AppData\Local\Temp\ProjectOnlineDesktopClient.exe—explorer.exe
User:
admin
Company:
UNISYS CORPORATION
Integrity Level:
MEDIUM
Description:
Project Online
Exit code:
3221226540
Version:
1. 0. 0. 1
Modules
Images
c:\users\admin\appdata\local\temp\projectonlinedesktopclient.exe
c:\windows\system32\ntdll.dll
6480"C:\Users\admin\AppData\Local\Temp\ProjectOnlineDesktopClient.exe" C:\Users\admin\AppData\Local\Temp\ProjectOnlineDesktopClient.exe
explorer.exe
User:
admin
Company:
UNISYS CORPORATION
Integrity Level:
HIGH
Description:
Project Online
Version:
1. 0. 0. 1
Modules
Images
c:\users\admin\appdata\local\temp\projectonlinedesktopclient.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
6504C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\ProjectOnline.bat" > NUL"C:\Windows\System32\cmd.exe—ProjectOnlineDesktopClient.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
6512\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6564"C:\Users\admin\AppData\Local\Temp\setup.exe" /configure "C:\Users\admin\AppData\Local\Temp\ProjectOnline.xml"C:\Users\admin\AppData\Local\Temp\setup.exe
cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft 365 and Office
Version:
16.0.17830.20162
Modules
Images
c:\users\admin\appdata\local\temp\setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
6860OfficeClickToRun.exe platform=x64 culture=en-us productstoadd=ProjectProRetail.16_en-us_x-none cdnbaseurl=http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6 baseurl=http://officecdn.microsoft.com/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6 version=16.0.18227.20222 mediatype=CDN sourcetype=CDN updatesenabled=True acceptalleulas=True displaylevel=True bitnessmigration=False deliverymechanism=55336b82-a18d-4dd6-b5f6-9e5095c314a6 flt.useoutlookshareaddon=unknown flt.useofficehelperaddon=unknown flt.UseTeamsOnInstallConsumer=unknown flt.UseTeamsOnUpdateConsumer=unknown uninstallcentennial=True besteffortcultureinstall=True scenario=CLIENTUPDATEC:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
setup.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Office Click-to-Run (SxS)
Exit code:
0
Version:
16.0.16026.20140
Modules
Images
c:\program files\common files\microsoft shared\clicktorun\officeclicktorun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6992C:\WINDOWS\system32\DllHost.exe /Processid:{338B40F9-9D68-4B53-A793-6B9AA0C5F63B}C:\Windows\System32\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\kernel.appcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\bcryptprimitives.dll
Total events
23 842
Read events
23 489
Write events
159
Delete events
194

Modification events

(PID) Process:(6564) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Registration
Operation:writeName:AcceptAllEulas
Value:
1
(PID) Process:(6564) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Registration
Operation:writeName:AcceptAllEulas
Value:
1
(PID) Process:(6564) setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\16.0\Common\General
Operation:writeName:ShownFirstRunOptin
Value:
1
(PID) Process:(6564) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:en-US
Value:
2
(PID) Process:(6564) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:de-de
Value:
2
(PID) Process:(6564) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:fr-fr
Value:
2
(PID) Process:(6564) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:es-es
Value:
2
(PID) Process:(6564) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:it-it
Value:
2
(PID) Process:(6564) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ja-jp
Value:
2
(PID) Process:(6564) setup.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages
Operation:writeName:ko-kr
Value:
2
Executable files
386
Suspicious files
47
Text files
66
Unknown types
10

Dropped files

PID
Process
Filename
Type
6480ProjectOnlineDesktopClient.exeC:\Users\admin\AppData\Local\Temp\setup.exeexecutable
MD5:2BA6246A85064DB4978F19EC71C347F7
SHA256:335932E68D7A8BFA4FA00BBCDEA09256ED6ECAB2BEDD640E2580B0B43E3B7744
6564setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\36AC0BE60E1243344AE145F746D881FEbinary
MD5:308CB430482682D6435224F3172D5C85
SHA256:F85E47E980B7526B2B818B1E6C83DA26364D007FA3754AFD4B637B2C6F586A68
6564setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\E7D501D2-F8C1-488A-B618-39189D33D287xml
MD5:5AAB540A18C055EDCE2A26D6D9CD5727
SHA256:ED89369A8DD38F0B62624DEC3D7BC2518D2E884AEFC6CC88782FE1B0374D0CE0
6564setup.exeC:\Users\admin\AppData\Local\Temp\OfficeC2RA5DF0A4A-239C-4CB4-982D-418AAE0B193DOfficeC2R6049C45E-319E-4554-85BB-C5AF8A8FC28A\v64.hashbinary
MD5:4D27B8814AB19369B472B9BDD1B96146
SHA256:C0FB41BF277C0BCE5AB24B7464921FFF63B73C5DBCAF6537AD90DFCBC64EA049
6480ProjectOnlineDesktopClient.exeC:\Users\admin\AppData\Local\Temp\ProjectOnline.xmltext
MD5:9E758837C0B477ADE857C90748CD340A
SHA256:EE222E979D269A0D52366C5CAFC7F6FB58A9A6B1CC9168E450B18C79BE57AF39
6564setup.exeC:\Users\admin\AppData\Local\Microsoft\Office\OTele\setup.exe.db-journalbinary
MD5:DB48C0CF10AD8736B1FD04D7E28886F4
SHA256:33C0765711727EF3689202FE1464380914782A9DFD43E57389E2E91C0F7DF295
6564setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0B8A20E1F3F4D73D52A19929F922C892binary
MD5:930C50C27FFA88FAD93A989B842DC12B
SHA256:68B98DDEA270D34B572424618D037E780A7715D2F81A8EF67D3CB76EE6E0EF41
6564setup.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0B8A20E1F3F4D73D52A19929F922C892binary
MD5:4BB71C446533E3B735C069A975FDEC3A
SHA256:D854D6E3CFD975FB2B6E7BEF5B32815F18F2128C1892584383500C14D3B0BAAC
6564setup.exeC:\Users\admin\AppData\Local\Temp\OfficeC2RA5DF0A4A-239C-4CB4-982D-418AAE0B193D\v64.hashbinary
MD5:4D27B8814AB19369B472B9BDD1B96146
SHA256:C0FB41BF277C0BCE5AB24B7464921FFF63B73C5DBCAF6537AD90DFCBC64EA049
6564setup.exeC:\Users\admin\AppData\Local\Temp\OfficeC2RA5DF0A4A-239C-4CB4-982D-418AAE0B193D\VersionDescriptor.xmlxml
MD5:7828BDC7F34247AF0DD37F29B868D5BD
SHA256:842792033677BDEEC816C9E765C89FBC00549B69859803C6F7CA0BB23AE57D0F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
91
TCP/UDP connections
78
DNS requests
48
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6564
setup.exe
HEAD
200
23.48.23.48:80
http://f.c2r.ts.cdn.office.net/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6/Office/Data/v64_16.0.18227.20222.cab
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6564
setup.exe
HEAD
400
23.48.23.48:80
http://f.c2r.ts.cdn.office.net/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6/Office/Data/v64_16.0.16026.20146.cab
unknown
—
—
whitelisted
6564
setup.exe
HEAD
200
23.48.23.48:80
http://f.c2r.ts.cdn.office.net/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6/Office/Data/v64_16.0.18227.20222.cab
unknown
—
—
whitelisted
6680
svchost.exe
HEAD
200
23.48.23.48:80
http://f.c2r.ts.cdn.office.net/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6/Office/Data/v64_16.0.18227.20222.cab
unknown
—
—
whitelisted
6680
svchost.exe
HEAD
200
23.48.23.48:80
http://f.c2r.ts.cdn.office.net/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6/Office/Data/v64_16.0.18227.20222.cab
unknown
—
—
whitelisted
6564
setup.exe
GET
200
23.48.23.166:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6680
svchost.exe
GET
206
23.48.23.48:80
http://f.c2r.ts.cdn.office.net/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6/Office/Data/v64_16.0.18227.20222.cab
unknown
—
—
whitelisted
6680
svchost.exe
GET
200
23.48.23.48:80
http://f.c2r.ts.cdn.office.net/pr/55336b82-a18d-4dd6-b5f6-9e5095c314a6/Office/Data/v64_16.0.18227.20222.cab
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5064
SearchApp.exe
104.126.37.128:443
www.bing.com
Akamai International B.V.
DE
whitelisted
—
—
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
4712
MoUsoCoreWorker.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1176
svchost.exe
40.126.32.72:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6564
setup.exe
52.109.89.18:443
officeclient.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1076
svchost.exe
69.192.162.125:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
6564
setup.exe
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
6564
setup.exe
52.109.89.117:443
mrodevicemgr.officeapps.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 104.126.37.128
  • 104.126.37.186
  • 104.126.37.130
  • 104.126.37.178
  • 104.126.37.179
  • 104.126.37.144
  • 104.126.37.177
  • 104.126.37.137
  • 104.126.37.185
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 184.30.131.245
whitelisted
login.live.com
  • 40.126.32.72
  • 40.126.32.140
  • 20.190.160.17
  • 20.190.160.14
  • 40.126.32.134
  • 40.126.32.76
  • 40.126.32.133
  • 20.190.160.22
whitelisted
officeclient.microsoft.com
  • 52.109.89.18
whitelisted
go.microsoft.com
  • 69.192.162.125
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
mrodevicemgr.officeapps.live.com
  • 52.109.89.117
whitelisted
f.c2r.ts.cdn.office.net
  • 23.48.23.48
  • 23.48.23.41
  • 23.48.23.50
  • 23.48.23.40
  • 23.48.23.32
  • 23.48.23.37
  • 23.48.23.42
  • 23.48.23.43
  • 23.48.23.35
  • 23.48.23.54
  • 23.48.23.44
  • 23.48.23.46
  • 23.48.23.61
  • 23.48.23.59
  • 23.48.23.58
  • 23.48.23.51
whitelisted
geo.prod.do.dsp.mp.microsoft.com
  • 52.158.246.138
whitelisted
kv501.prod.do.dsp.mp.microsoft.com
  • 23.32.101.112
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
ProjectOnlineDesktopClient.exe