File name:

Windows Loader 3.1 [Daz].rar

Full analysis: https://app.any.run/tasks/10a6ecd2-6c62-4510-bbdd-3b81fba358ce
Verdict: Malicious activity
Threats:

Stealers are a group of malicious software that are intended for gaining unauthorized access to users’ information and transferring it to the attacker. The stealer malware category includes various types of programs that focus on their particular kind of data, including files, passwords, and cryptocurrency. Stealers are capable of spying on their targets by recording their keystrokes and taking screenshots. This type of malware is primarily distributed as part of phishing campaigns.

Malware Trends Tracker     >>>
Analysis date: February 01, 2025, 21:16:53
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
stealer
inno
installer
upx
delphi
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

E169E32D0968D865B0FD6447E6868A70

SHA1:

42377634FA2B17A1B9315CA2423A3CE7CFA4ECB7

SHA256:

5221A843A3FFAECE09B6C527748ED17F3B535396AAFB67AC4D26F8FBE8A2636A

SSDEEP:

98304:TOeTxdkWc2vfT+PpJj5Uvu8Ch2fKtK12Y0zBDekVpvhwgJI++fXAjK6VANahSVpJ:42Mv8Lyepio1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Actions looks like stealing of personal data

      • Registry_Activation.exe (PID: 5972)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6284)
      • WinRAR.exe (PID: 1572)
      • Registry_Activation.exe (PID: 5972)
      • Windows Loader 3.1.exe (PID: 6268)

    • Application launched itself

      • WinRAR.exe (PID: 1572)
      • Registry_Activation.exe (PID: 5972)

    • Executable content was dropped or overwritten

      • Windows Loader 3.1.exe (PID: 6268)

    • Executing commands from a ".bat" file

      • Windows Loader 3.1.exe (PID: 6268)

    • Reads Microsoft Outlook installation path

      • Registry_Activation.exe (PID: 5972)

    • Reads the BIOS version

      • Registry_Activation.exe (PID: 5972)

    • Reads Internet Explorer settings

      • Registry_Activation.exe (PID: 5972)

    • There is functionality for taking screenshot (YARA)

      • Windows Loader 3.1.exe (PID: 6268)
      • Registry_Activation.exe (PID: 5972)

    • Starts CMD.EXE for commands execution

      • Windows Loader 3.1.exe (PID: 6268)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 6284)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6284)

    • Checks supported languages

      • Windows Loader 3.1.exe (PID: 6268)
      • WindowsLoader.exe (PID: 6376)
      • Registry_Activation.exe (PID: 5972)
      • Registry_Activation.exe (PID: 6580)

    • Reads the computer name

      • Windows Loader 3.1.exe (PID: 6268)
      • Registry_Activation.exe (PID: 5972)
      • Registry_Activation.exe (PID: 6580)
      • WindowsLoader.exe (PID: 6376)

    • Creates files in the program directory

      • Windows Loader 3.1.exe (PID: 6268)

    • Create files in a temporary directory

      • Windows Loader 3.1.exe (PID: 6268)
      • Registry_Activation.exe (PID: 5972)

    • Reads Environment values

      • Registry_Activation.exe (PID: 5972)

    • Process checks whether UAC notifications are on

      • Registry_Activation.exe (PID: 5972)

    • Reads the machine GUID from the registry

      • Registry_Activation.exe (PID: 5972)
      • WindowsLoader.exe (PID: 6376)

    • UPX packer has been detected

      • Registry_Activation.exe (PID: 5972)

    • Detects InnoSetup installer (YARA)

      • Registry_Activation.exe (PID: 5972)

    • Reads Windows Product ID

      • Registry_Activation.exe (PID: 5972)

    • Reads CPU info

      • Registry_Activation.exe (PID: 5972)

    • Checks proxy server information

      • Registry_Activation.exe (PID: 5972)

    • Compiled with Borland Delphi (YARA)

      • Registry_Activation.exe (PID: 5972)

    • Process checks computer location settings

      • Windows Loader 3.1.exe (PID: 6268)

    • The sample compiled with english language support

      • Windows Loader 3.1.exe (PID: 6268)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)

EXIF

ZIP

FileVersion: RAR v5
CompressedSize: 3188433
UncompressedSize: 3375104
OperatingSystem: Win32
ArchivedFileName: Windows Loader 3.1 [Daz].iso
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
143
Monitored processes
13
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe winword.exe ai.exe no specs windows loader 3.1.exe no specs windows loader 3.1.exe cmd.exe no specs conhost.exe no specs windowsloader.exe no specs registry_activation.exe registry_activation.exe no specs cmd.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1572"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\Windows Loader 3.1 [Daz].rar"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
3552C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\deldll.bat" "C:\Windows\SysWOW64\cmd.exe—Windows Loader 3.1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
3664"C:\Users\admin\AppData\Local\Temp\Rar$EXa6284.45521\Windows Loader 3.1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6284.45521\Windows Loader 3.1.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6284.45521\windows loader 3.1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4740"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "D35D8585-A43C-4C7D-8CF9-E415945E1808" "C5D09A9F-F61D-4D52-B60A-55FE2A1248FE" "7012"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—WINWORD.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
0
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\ucrtbase.dll
5752\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5972"Registry_Activation.exe"C:\Program Files (x86)\KMSPico 10.2.1 Final\Registry_Activation.exe
cmd.exe
User:
admin
Company:
Teg
Integrity Level:
HIGH
Description:
Rocen Setup
Version:
Modules
Images
c:\program files (x86)\kmspico 10.2.1 final\registry_activation.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6240C:\WINDOWS\system32\cmd.exe /c ""C:\Program Files (x86)\KMSPico 10.2.1 Final\WINLOADER_SETUP.BAT""C:\Windows\SysWOW64\cmd.exe—Windows Loader 3.1.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
6244\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6268"C:\Users\admin\AppData\Local\Temp\Rar$EXa6284.45521\Windows Loader 3.1.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa6284.45521\Windows Loader 3.1.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Exit code:
2
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa6284.45521\windows loader 3.1.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6284"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa1572.43217\Windows Loader 3.1 [Daz].iso"C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
14 072
Read events
13 776
Write events
271
Delete events
25

Modification events

(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Windows Loader 3.1 [Daz].rar
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(1572) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6284) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
Executable files
11
Suspicious files
37
Text files
75
Unknown types
0

Dropped files

PID
Process
Filename
Type
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:8451381E8A7F59235E5B3B1861C30CAC
SHA256:F361474E272327A8BA2A758D6F2D02A2B31DC8D26D4A9F38D81D9FC15C4F35C7
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:186FAABE8CBB890ACE1F0D8260EA5F45
SHA256:192F8BEBC84E41E2EF654F98319C6162A55F8E25792C449A5CC6E16C92B925C2
6284WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa6284.44510\Install.docxcompressed
MD5:ACB198EF9D5EE52989EC9B9A88494898
SHA256:91FFE789B239F28B47FF99601A6732596574025ED1D0851BD6010852C8B9597F
1572WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DIa1572.43217\Windows Loader 3.1 [Daz].isocompressed
MD5:F6552638B285FE8504157183F70371E6
SHA256:49D39A9C320A3CFFC6B00A4C77CF9488B318778B47F954A10ECD71FE534A2110
7012WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:57F94FD8D8AA6BD2314C4CC1174C7DFC
SHA256:2DF3957314473F45B9C5A82FB4770044615ED5F3A855CCD613546DFFF05585F0
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\388E1F9A-52B8-4138-A546-3996A4FF26CDxml
MD5:1F83C51F08130467A02F8E631101A562
SHA256:610C2F868C7DF0D6F0955F99C225A279F9C331EFA63447A3F5226051525E7061
7012WINWORD.EXEC:\Users\admin\AppData\Local\Temp\Rar$DIa6284.44510\~$nstall.docxbinary
MD5:2388F7BEDD32B0DA8C04D9DD554F267B
SHA256:DFA3FD08D3FDB9AD58EF336BA5AB9AE688D9295BD3B0F9A0058BFEB4BF036C33
7012WINWORD.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_363582827213C09529A76F35FB615187binary
MD5:B32BBC828178440565B12D507542CA43
SHA256:EAB70042BA65F43E6B7073BC4CE82BC0AE837CF4583310E25CACBF347B7BCFC6
7012WINWORD.EXEC:\Users\admin\AppData\Local\Temp\msoAEC1.tmpimage
MD5:ED3C1C40B68BA4F40DB15529D5443DEC
SHA256:039FE79B74E6D3D561E32D4AF570E6CA70DB6BB3718395BE2BF278B9E601279A
7012WINWORD.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
39
DNS requests
33
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
4624
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4624
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7012
WINWORD.EXE
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6672
backgroundTaskHost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
2.16.253.202:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1536
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5064
SearchApp.exe
2.16.204.141:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1076
svchost.exe
23.213.166.81:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
www.microsoft.com
  • 2.16.253.202
  • 95.101.149.131
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.16.204.141
  • 2.16.204.160
  • 2.16.204.138
  • 2.16.204.134
  • 2.16.204.135
  • 2.16.204.161
  • 2.16.204.153
whitelisted
login.live.com
  • 20.190.159.71
  • 40.126.31.1
  • 40.126.31.0
  • 40.126.31.71
  • 40.126.31.2
  • 20.190.159.128
  • 20.190.159.4
  • 20.190.159.130
whitelisted
ocsp.digicert.com
  • 2.17.190.73
  • 2.23.77.188
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
officeclient.microsoft.com
  • 52.109.32.97
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
roaming.officeapps.live.com
  • 52.109.89.19
whitelisted
omex.cdn.office.net
  • 23.53.40.82
  • 23.53.40.25
whitelisted

Threats

No threats detected
Process
Message
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
WINWORD.EXE
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Windows Loader 3.1 [Daz].rar