Windows 10: taskhostw.exe tries to delete MsoIrmProtector.doc

Hello, I'm a SOC Analyst We have recieved a block alert in our EDR about a windows11 pro got block on taskhostw.exe however I couldn't find any resource or document about that its a natural behavior of windows. We also accrossed this behavior in 2 devices between 1500 devices which made me more suspicious on this caseparentchild process is belowwininit.exe > services.exe > svchost.exe with arguements -k netsvcs -p -s Schedule > taskhostw.exe --- attempts to delete --> MsoIrmProtector.docI have checked the hashes of all process in tree in case of a malicious program copies name a

:)

 

taskhostw tying to access your WebCam?!

I did a search for taskhostw exe and found the following:





That's a lot of 'em!

 

Deleting Docs

Hi sudable,



Word documents in the Office Hub on your phone can be deleted with the following steps:

• On Start, flick left to the App list, and then tap Office.
• Flick to Locations, tap Phone, and then tap and hold the document that you want to delete.
• Tap Delete.
• Tap Delete in the Confirm delete? message box, or press the
  Back button to cancel.

These instructions are accurate as of today, but the most current information on this (and other) processes can be found on the Windows Phone

website.



Regards,

Greg

• 
  
  

 

Deleting Docs

windows phone 7. word docs that I created. I tried to delete but ended producing duplicates