File name:

Microsoft_Office_Starter_2010_italiano_gratis.zip

Full analysis: https://app.any.run/tasks/3c5e3496-e41c-4088-8fca-e116df02d1d5
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: October 29, 2020, 08:48:30
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract
MD5:

EB1C6A568D5A09FCEFE7E35A1AECA901

SHA1:

D659A4CC16F2BECBA49EB78D0586026D942F8024

SHA256:

96D131BB40941476EBDDF354CA109B5A5C2EF79471C5AE55400B4457ABC67CD0

SSDEEP:

24576:MD9ib/I+986epSBffJA//Fl3ufH4F4vyVj2CIfySdSRP/Uk5:O9iLR2TpSlSXFMfYfh2Km4

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • OfficeStarter2010_online_installer.exe (PID: 3064)
      • sftvsa.exe (PID: 1968)
      • sftlist.exe (PID: 3476)
      • CVHSVC.EXE (PID: 1164)
      • OfficeVirt.exe (PID: 3152)

    • Changes settings of System certificates

      • OfficeStarter2010_online_installer.exe (PID: 3064)

    • Loads dropped or rewritten executable

      • sftlist.exe (PID: 3476)
      • CVHSVC.EXE (PID: 1164)
      • SearchFilterHost.exe (PID: 380)
      • OfficeVirt.exe (PID: 3152)

  • SUSPICIOUS

    • Creates files in the user directory

      • OfficeStarter2010_online_installer.exe (PID: 3064)

    • Adds / modifies Windows certificates

      • OfficeStarter2010_online_installer.exe (PID: 3064)

    • Creates files in the Windows directory

      • msiexec.exe (PID: 2248)
      • MsiExec.exe (PID: 2704)
      • sftlist.exe (PID: 3476)
      • CVHSVC.EXE (PID: 1164)

    • Creates COM task schedule object

      • msiexec.exe (PID: 2248)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 2248)
      • sftlist.exe (PID: 3476)

    • Executable content was dropped or overwritten

      • MsiExec.exe (PID: 2704)
      • msiexec.exe (PID: 2248)

    • Removes files from Windows directory

      • MsiExec.exe (PID: 2704)
      • CVHSVC.EXE (PID: 1164)
      • sftlist.exe (PID: 3476)

    • Creates files in the driver directory

      • MsiExec.exe (PID: 2704)

    • Executed as Windows Service

      • SearchIndexer.exe (PID: 3832)
      • CVHSVC.EXE (PID: 1164)
      • sftlist.exe (PID: 3476)
      • sftvsa.exe (PID: 1968)
      • SearchIndexer.exe (PID: 2352)

    • Creates files in the program directory

      • SearchIndexer.exe (PID: 3832)
      • sftlist.exe (PID: 3476)
      • CVHSVC.EXE (PID: 1164)
      • SearchIndexer.exe (PID: 2352)

    • Creates a software uninstall entry

      • CVHSVC.EXE (PID: 1164)
      • OfficeStarter2010_online_installer.exe (PID: 3064)

    • Searches for installed software

      • CVHSVC.EXE (PID: 1164)

  • INFO

    • Manual execution by user

      • OfficeStarter2010_online_installer.exe (PID: 3064)
      • WINWORD.EXE (PID: 1024)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1596)
      • MsiExec.exe (PID: 2704)
      • msiexec.exe (PID: 2248)
      • MsiExec.exe (PID: 1324)
      • MsiExec.exe (PID: 3724)

    • Creates files in the program directory

      • MsiExec.exe (PID: 2704)
      • msiexec.exe (PID: 2248)

    • Application launched itself

      • msiexec.exe (PID: 2248)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2248)

    • Creates or modifies windows services

      • MsiExec.exe (PID: 2704)

    • Reads Microsoft Office registry keys

      • CVHSVC.EXE (PID: 1164)
      • WINWORD.EXE (PID: 1024)

    • Reads settings of System Certificates

      • sftlist.exe (PID: 3476)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 1024)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: -
ZipCompression: Deflated
ZipModifyDate: 2014:06:07 12:57:07
ZipCRC: 0xcc31d6fe
ZipCompressedSize: 1003415
ZipUncompressedSize: 1632200
ZipFileName: OfficeStarter2010_online_installer.exe
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
62
Monitored processes
20
Malicious processes
6
Suspicious processes
2

Behavior graph

Click at the process to see the details
start winrar.exe no specs officestarter2010_online_installer.exe msiexec.exe msiexec.exe no specs msiexec.exe mofcomp.exe no specs searchindexer.exe no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs sftvsa.exe no specs sftlist.exe cvhsvc.exe searchprotocolhost.exe no specs msiexec.exe no specs msiexec.exe no specs officevirt.exe no specs searchindexer.exe no specs searchprotocolhost.exe no specs searchfilterhost.exe no specs winword.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
380"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524 C:\Windows\system32\SearchFilterHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Filter Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchfilterhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1024"C:\Program Files\Microsoft Office\Office14\WINWORD.EXE" C:\Program Files\Microsoft Office\Office14\WINWORD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Word
Exit code:
0
Version:
14.0.6024.1000
Modules
Images
c:\program files\microsoft office\office14\winword.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.17514_none_ec83dffa859149af\comctl32.dll
1164"C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Office Client Virtualization Service
Exit code:
0
Version:
14.0.6117.5000
Modules
Images
c:\program files\common files\microsoft shared\virtualization handler\cvhsvc.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\secur32.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
1324C:\Windows\system32\MsiExec.exe -Embedding 0EDF5AD04ED086968C15B615F48CADD0C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1596C:\Windows\system32\MsiExec.exe -Embedding A474C47154C1AA766E9151DC632710C0C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1748"C:\Windows\system32\SearchFilterHost.exe" 0 516 520 528 65536 524 C:\Windows\system32\SearchFilterHost.exe—SearchIndexer.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Filter Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchfilterhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1912"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10001_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1302019708-1500728564-335382590-10001 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"C:\Windows\system32\SearchProtocolHost.exe—SearchIndexer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Windows Search Protocol Host
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchprotocolhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1968"C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe"C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Application Virtualization Virtual Service Agent
Exit code:
0
Version:
4.6.2.22610
Modules
Images
c:\program files\microsoft application virtualization client\sftvsa.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2248C:\Windows\system32\msiexec.exe /VC:\Windows\system32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2352C:\Windows\system32\SearchIndexer.exe /EmbeddingC:\Windows\system32\SearchIndexer.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft Windows Search Indexer
Exit code:
0
Version:
7.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\searchindexer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
12 915
Read events
5 462
Write events
6 648
Delete events
805

Modification events

(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(2604) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\13B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\Microsoft_Office_Starter_2010_italiano_gratis.zip
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\MainWin
Operation:writeName:Placement
Value:
2C0000000000000001000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF42000000420000000204000037020000
(PID) Process:(2604) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\General
Operation:writeName:LastFolder
Value:
C:\Users\admin\AppData\Local\Temp
Executable files
79
Suspicious files
78
Text files
108
Unknown types
13

Dropped files

PID
Process
Filename
Type
2604WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa2604.17123\OfficeStarter2010_online_installer.exe —
MD5:—
SHA256:—
3064OfficeStarter2010_online_installer.exeC:\Users\admin\AppData\Roaming\TP\{BFC5F7B9-7D85-46C7-8113-9F7229013DAD}\click2run.msi —
MD5:—
SHA256:—
2248msiexec.exeC:\Windows\Installer\1586be.msi —
MD5:—
SHA256:—
2248msiexec.exeC:\Windows\Installer\MSI8863.tmp —
MD5:—
SHA256:—
2248msiexec.exeC:\Windows\Installer\MSI88E1.tmp —
MD5:—
SHA256:—
2248msiexec.exeC:\Windows\Installer\MSI8940.tmp —
MD5:—
SHA256:—
2248msiexec.exeC:\Windows\Installer\MSI8951.tmp —
MD5:—
SHA256:—
2248msiexec.exeC:\Windows\Installer\MSI8961.tmp —
MD5:—
SHA256:—
2248msiexec.exeC:\Windows\Installer\MSI8B29.tmp —
MD5:—
SHA256:—
3064OfficeStarter2010_online_installer.exeC:\Users\admin\AppData\Roaming\TP\{BFC5F7B9-7D85-46C7-8113-9F7229013DAD}\descriptor.xmltext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
85
TCP/UDP connections
8
DNS requests
5
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3476
sftlist.exe
GET
206
2.16.106.187:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/ConsumerC2R.it-it_14.0.7261.5000.sft
unknown
binary
370 Kb
whitelisted
3476
sftlist.exe
GET
206
2.16.106.187:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/ConsumerC2R.it-it_14.0.7261.5000.sft
unknown
sft
167 b
whitelisted
3064
OfficeStarter2010_online_installer.exe
GET
200
2.16.106.147:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/descriptor.xml
unknown
text
28.6 Kb
whitelisted
3064
OfficeStarter2010_online_installer.exe
GET
200
2.16.106.147:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/click2run.msi
unknown
executable
25.4 Mb
whitelisted
3064
OfficeStarter2010_online_installer.exe
GET
200
2.16.106.147:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/72615000.cab
unknown
compressed
2.64 Mb
whitelisted
3064
OfficeStarter2010_online_installer.exe
GET
206
2.16.106.147:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/ConsumerC2R.it-it_14.0.7261.5000.sft
unknown
binary
370 Kb
whitelisted
3064
OfficeStarter2010_online_installer.exe
GET
206
2.16.106.147:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/ConsumerC2R.it-it_14.0.7261.5000.sft
unknown
sft
227 Kb
whitelisted
1164
CVHSVC.EXE
GET
200
2.16.106.147:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/descriptor.xml
unknown
text
28.6 Kb
whitelisted
3064
OfficeStarter2010_online_installer.exe
GET
206
2.16.106.147:80
http://c2r.microsoft.com/ConsumerC2R/it-it/14.0.4763.1000/ConsumerC2R.it-it_14.0.7261.5000.sft
unknown
binary
1019 Kb
whitelisted
3476
sftlist.exe
GET
200
2.16.186.120:80
http://crl.microsoft.com/pki/crl/products/Microsoft%20Code%20Signing%20PCA(2).crl
unknown
der
555 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3064
OfficeStarter2010_online_installer.exe
2.16.106.147:80
c2r.microsoft.com
Akamai International B.V.
—
whitelisted
1164
CVHSVC.EXE
2.16.106.147:80
c2r.microsoft.com
Akamai International B.V.
—
whitelisted
3476
sftlist.exe
2.16.186.120:80
crl.microsoft.com
Akamai International B.V.
—
whitelisted
3476
sftlist.exe
2.16.106.187:80
c2r.microsoft.com
Akamai International B.V.
—
whitelisted
1164
CVHSVC.EXE
2.22.119.33:80
crl.microsoft.com
Akamai International B.V.
GB
whitelisted

DNS requests

Domain
IP
Reputation
c2r.microsoft.com
  • 2.16.106.147
  • 2.16.106.187
whitelisted
crl.microsoft.com
  • 2.22.119.33
  • 2.22.119.98
  • 2.16.186.120
  • 2.16.186.74
whitelisted

Threats

Found threats are available for the paid subscriptions
1 ETPRO signatures available at the full report
Process
Message
sftlist.exe
ReadOnly == false
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Microsoft_Office_Starter_2010_italiano_gratis.zip