What is EOWP.22.2.49.0.EXE and why is it opened from office files?

Ricardo 20 Reputation points
2023-03-30T09:48:07.4133333+00:00

After running Microsoft office 365 online repair in our environment:

User's image

last tuesday night our security software (sentinel one and Rapid 7) are detecting suspicious activity from word and excel. They see that word and excel where opening a file called EOWP.22.2.49.0.EXE This is on existing files, so not any malicious attachments or anything.

The exact location is: \Device\HarddiskVolume4\Users%Username%\AppData\Local\Temp\18\eowp.22.2.49.0.exe

Could anyone tell me what EOWP.22.2.49.0.EXE is?

Here is some diagnostics from virustotal.com on the file: Here is some diagnostics from virustotal.com on the file: https://www.virustotal.com/gui/file/fdffdd1f1b3839a1cfdd66dc05d1c382e80e3a874ec32fae2a15e6b332657fb0

Thanks in advance!

 

Office
Office
A suite of Microsoft productivity software that supports common business tasks, including word processing, email, presentations, and data management and analysis.
1,363 questions
0 comments No comments
{count} votes