File name:

Windows Loader 3.1 [Daz].rar

Full analysis: https://app.any.run/tasks/10a6ecd2-6c62-4510-bbdd-3b81fba358ce
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 01, 2025, 21:16:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
inno
installer
upx
delphi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E169E32D0968D865B0FD6447E6868A70

SHA1:

42377634FA2B17A1B9315CA2423A3CE7CFA4ECB7

SHA256:

5221A843A3FFAECE09B6C527748ED17F3B535396AAFB67AC4D26F8FBE8A2636A

SSDEEP:

98304:TOeTxdkWc2vfT+PpJj5Uvu8Ch2fKtK12Y0zBDekVpvhwgJI++fXAjK6VANahSVpJ:42Mv8Lyepio1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Registry_Activation.exe (PID: 5972)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 1572)
      • Registry_Activation.exe (PID: 5972)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6284)
      • WinRAR.exe (PID: 1572)
      • Registry_Activation.exe (PID: 5972)
      • Windows Loader 3.1.exe (PID: 6268)

    • Executable content was dropped or overwritten

      • Windows Loader 3.1.exe (PID: 6268)

    • Executing commands from a ".bat" file

      • Windows Loader 3.1.exe (PID: 6268)

    • Starts CMD.EXE for commands execution

      • Windows Loader 3.1.exe (PID: 6268)

    • Reads the BIOS version

      • Registry_Activation.exe (PID: 5972)

    • Reads Microsoft Outlook installation path

      • Registry_Activation.exe (PID: 5972)

    • Reads Internet Explorer settings

      • Registry_Activation.exe (PID: 5972)

    • There is functionality for taking screenshot (YARA)

      • Windows Loader 3.1.exe (PID: 6268)
      • Registry_Activation.exe (PID: 5972)

  • INFO

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6284)

    • The sample compiled with english language support

      • Windows Loader 3.1.exe (PID: 6268)

    • Checks supported languages

      • Windows Loader 3.1.exe (PID: 6268)
      • WindowsLoader.exe (PID: 6376)
      • Registry_Activation.exe (PID: 5972)
      • Registry_Activation.exe (PID: 6580)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6284)

    • Reads the computer name

      • Windows Loader 3.1.exe (PID: 6268)
      • WindowsLoader.exe (PID: 6376)
      • Registry_Activation.exe (PID: 5972)
      • Registry_Activation.exe (PID: 6580)

    • Creates files in the program directory

      • Windows Loader 3.1.exe (PID: 6268)

    • Create files in a temporary directory

      • Windows Loader 3.1.exe (PID: 6268)
      • Registry_Activation.exe (PID: 5972)

    • Reads the machine GUID from the registry

      • WindowsLoader.exe (PID: 6376)
      • Registry_Activation.exe (PID: 5972)

    • Reads Environment values

      • Registry_Activation.exe (PID: 5972)

    • Process checks whether UAC notifications are on

      • Registry_Activation.exe (PID: 5972)

    • Reads Windows Product ID

      • Registry_Activation.exe (PID: 5972)

    • Reads CPU info

      • Registry_Activation.exe (PID: 5972)

    • Checks proxy server information

      • Registry_Activation.exe (PID: 5972)

    • UPX packer has been detected

      • Registry_Activation.exe (PID: 5972)

    • Detects InnoSetup installer (YARA)

      • Registry_Activation.exe (PID: 5972)

    • Compiled with Borland Delphi (YARA)

      • Registry_Activation.exe (PID: 5972)

    • Process checks computer location settings

      • Windows Loader 3.1.exe (PID: 6268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 3188433
UncompressedSize: 3375104
OperatingSystem: Win32
ArchivedFileName: Windows Loader 3.1 [Daz].iso
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
13
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe winword.exe ai.exe no specs windows loader 3.1.exe no specs windows loader 3.1.exe cmd.exe no specs conhost.exe no specs windowsloader.exe no specs registry_activation.exe registry_activation.exe no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1572"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Windows Loader 3.1 [Daz].rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3552C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\deldll.bat" "C:\Windows\SysWOW64\cmd.exe—Windows Loader 3.1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3664"C:\Users\admin\AppData\Local\Temp\Rar$EXa6284.45521\Windows Loader 3.1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6284.45521\Windows Loader 3.1.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6284.45521\windows loader 3.1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4740"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "D35D8585-A43C-4C7D-8CF9-E415945E1808" "C5D09A9F-F61D-4D52-B60A-55FE2A1248FE" "7012"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
5752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5972"Registry_Activation.exe"C:\Program Files (x86)\KMSPico 10.2.1 Final\Registry_Activation.exe
cmd.exe
User:
admin
Company:
Teg
Integrity Level:
HIGH
Description:
Rocen Setup
Version:
Modules
Images
c:\program files (x86)\kmspico 10.2.1 final\registry_activation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6240C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files (x86)\KMSPico 10.2.1 Final\WINLOADER_SETUP.BAT""C:\Windows\SysWOW64\cmd.exe—Windows Loader 3.1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6244\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6268"C:\Users\admin\AppData\Local\Temp\Rar$EXa6284.45521\Windows Loader 3.1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6284.45521\Windows Loader 3.1.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6284.45521\windows loader 3.1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6284"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa1572.43217\Windows Loader 3.1 [Daz].iso"C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
14 072
Read events
13 776
Write events
271
Delete events
25

Modification events

(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Windows Loader 3.1 [Daz].rar
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
11
Suspicious files
37
Text files
75
Unknown types
0

Dropped files

PID
Process
Filename
Type
7012WINWORD.EXEC:\Users\admin\AppData\Local\Temp\msoAEC1.tmpimage
MD5:ED3C1C40B68BA4F40DB15529D5443DEC
SHA256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
6284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6284.44510\Install.docxcompressed
MD5:ACB198EF9D5EE52989EC9B9A88494898
SHA256:91FFE789B239F28B47FF99601A6732596574025ED1D0851BD6010852C8B9597F
7012WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Rar$DIa6284.44510\~$nstall.docxbinary
MD5:2388F7BEDD32B0DA8C04D9DD554F267B
SHA256:DFA3FD08D3FDB9AD58EF336BA5AB9AE688D9295BD3B0F9A0058BFEB4BF036C33
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.jsonbinary
MD5:A96EC438616C1FFC35ACB118098CAC3D
SHA256:FDEB14ED9F62A696E89D932FC844909F7B9B82041E18A833E9C088D30D2BC947
7012WINWORD.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotmbinary
MD5:0813F15ABFE6ED7F7B8C6925912E4BE3
SHA256:41D67DF949D93BDB47C12F1916773D9C9CA9DD3C585C9ED7C2D9B2CCFB4CB8B5
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:186FAABE8CBB890ACE1F0D8260EA5F45
SHA256:192F8BEBC84E41E2EF654F98319C6162A55F8E25792C449A5CC6E16C92B925C2
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:8451381E8A7F59235E5B3B1861C30CAC
SHA256:F361474E272327A8BA2A758D6F2D02A2B31DC8D26D4A9F38D81D9FC15C4F35C7
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\Personalization\Governance\Anonymous\floodgatecampaigns.json.tmpbinary
MD5:A96EC438616C1FFC35ACB118098CAC3D
SHA256:FDEB14ED9F62A696E89D932FC844909F7B9B82041E18A833E9C088D30D2BC947
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Word\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.Sbinary
MD5:A5E091697D7ED38A4D743FDA3E7246DD
SHA256:2BA7DE60E58AA37CB8FF7425D3F0589E6FF2F0C87D80CFDB5DACA846DE8C05ED
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\FontCache\4\CloudFonts\Iskoola Pota\38011673001.ttfbinary
MD5:BAB2FDC5DC9368D290D49031536964DA
SHA256:7E25E70831B81EAA17F50F1ED416BDF13241A0B865EF4A0F4B2F3B20A2E9C1EE
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
39
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
7012
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
4624
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4624
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6672
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1536
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.16.204.141:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 2.16.253.202
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.16.204.141
  • 2.16.204.160
  • 2.16.204.138
  • 2.16.204.134
  • 2.16.204.135
  • 2.16.204.161
  • 2.16.204.153
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.1
  • 40.126.31.0
  • 40.126.31.71
  • 40.126.31.2
  • 20.190.159.128
  • 20.190.159.4
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
roaming.officeapps.live.com
  • 52.109.89.19
whitelisted
omex.cdn.office.net
  • 23.53.40.82
  • 23.53.40.25
whitelisted

Threats

No threats detected
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Windows Loader 3.1 [Daz].rar