home

Windows Loader.exe

This is a setup program which is used to install the application. The file has been seen being downloaded from doc-0k-00-docs.googleusercontent.com and multiple other hosts.
Version:
2.2.2.0

MD5:
323c0fd51071400b51eedb1be90a8188

SHA-1:
0efc35935957c25193bbe9a83ab6caa25a487ada

SHA-256:
2f2aba1e074f5f4baa08b524875461889f8f04d4ffc43972ac212e286022ab94

Scanner detections:
4 / 68

Status:
Clean  (4 false positive detections)

False Positives:
A number of engines detected this file but were erroneous detections (false positives).

Analysis date:
4/26/2024 9:05:08 AM UTC  (today)

Scan engine
Detection
Engine version

Emsisoft Anti-Malware
Riskware.Win32.Keygen
11.5.0.6191

F-Secure
Riskware.Application.Crack.PEP
5.15.154

Microsoft Security Essentials
HackTool:Win32/Keygen
1.237.1214.0

Norman
Application.Crack.PEP
19.05.2016 01:04:49

File size:
3.8 MB (4,021,049 bytes)

Original file name:
Windows Loader.exe

File type:
Executable application (Win32 EXE)

Language:
English (United States)

Common path:
C:\users\{user}\appdata\local\temp\{random}.tmp\windows loader\windows loader.exe

File PE Metadata
Compilation timestamp:
10/31/2007 5:53:19 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
49152:cEYCFEvlmOmTgtFM3uK5m3imrHuiff+puWV355FXw/+zuWV355FXw/+DuWV355FP:cEYzEFTgtFM3ukm3imPnt

Entry address:
0x21A9A0

Entry point:
60, BE, 00, B0, 58, 00, 8D, BE, 00, 60, E7, FF, 57, 89, E5, 8D, 9C, 24, 80, C1, FF, FF, 31, C0, 50, 39, DC, 75, FB, 46, 46, 53, 68, 77, 80, 21, 00, 57, 83, C3, 04, 53, 68, 94, F9, 08, 00, 56, 83, C3, 04, 53, 50, C7, 03, 03, 00, 02, 00, 90, 90, 90, 90, 90, 55, 57, 56, 53, 83, EC, 7C, 8B, 94, 24, 90, 00, 00, 00, C7, 44, 24, 74, 00, 00, 00, 00, C6, 44, 24, 73, 00, 8B, AC, 24, 9C, 00, 00, 00, 8D, 42, 04, 89, 44, 24, 78, B8, 01, 00, 00, 00, 0F, B6, 4A, 02, 89, C3, D3, E3, 89, D9, 49, 89, 4C, 24, 6C, 0F, B6, 4A...
 
[+]

Code size:
580 KB (593,920 bytes)

The file Windows Loader.exe has been seen being distributed by the following 40 URLs.

https://doc-0k-00-docs.googleusercontent.com/docs/securesc/ll5550ji5vnhl2moc9pudo4llstkop95/unjeu6sdnk1a9p1a8to7dcrsr8a4gd2h/1484848800000/.../16186423767192634044/0B2-a77PfiK2JUkR2ZHBOX3dtbWs?e=download

http://www16.zippyshare.com/d/LxM7ZptP/.../Windows 7 Activation.exe

https://doc-0o-0c-docs.googleusercontent.com/docs/securesc/kqmtpd8eaca6nd2nu5c1asahq3l6klcd/3o4ij4j8el37p7tsiqqcrb1beji9h70h/1470837600000/.../03824199574262853048/0BzkyLK05dBJ4RENJcGpwSjFqV3M?e=download

https://dl-mail.ymail.com/ws/download/mailboxes/@.id==VjJ-HN8Kpl8idSpiZQCJWgkDraG9yhoYCCfNYTPU_JUO12zHozqitFqVopICRAes2WQCyqtsdt-jko-uK0ko8KHOrw/messages/@.id==AC2vCmoAABkCV-4juQS68IzX2Ks/content/parts/@.id==2/raw?appid=YahooMailNeo&token=zitEzqOML3j84e6ealFTT5U7-km5qEQF52lp7AcCuBYHda7tPoxtGFVQ31PZsQfKcLrUbjEp60vF-lfaMhuZRocrruc4Eh9JuukerYfwwYboXrvqWXAmKM0cYz1HHvee&error=https://mg.mail.yahoo.com/.../iframemsg?id=62adfdc1-458c-7ab7-12ef-506aae19f445&ymreqid=1d4b8c23-b058-329d-01c6-35001b010000

https://ssdblq-ch3302.files.1drv.com/.../Windows Loader.exe

https://content-na.drive.amazonaws.com/cdproxy/.../arQfYjSGXrluf7ddDHRNsAeK2EHeJZ27d96fdA5LI-kLAYspN?download=true

https://doc-0s-a0-docs.googleusercontent.com/docs/securesc/2p8tbnoqrn8irpkt0ng8i0o9edofmco5/c1jrd01h4f8qpaelhhkanh1rlbjske64/1476468000000/.../16395162360023996320/0B0l1Q_Qc8_aNWDdPLWFZR1pKREE?e=download

https://doc-10-7c-docs.googleusercontent.com/docs/securesc/jigod9ocffoaaf5tpl1e2ou9oupqlkd0/4min6nhtsn2oc6uvou7i6j4639tbok55/1481212800000/.../18353764356127518746/0B-LXQ_2rhs8xdmp5andKUklDNDg?e=download

chrome-extension://bigefpfhnfcobdlfbedofhhaibnlghod/persistent/.../LYAXDCia

https://mega.co.nz/temporary/.../jYIxgbxB

https://cdn.discordapp.com/attachments/160225178004094976/.../Windows_Loader_2.2.2.exe

http://www.file-upload.net/download5.php?valid=301.98105822125&id=11098968&name=Windows7Loader.exe

https://docviewer.yandex.com.tr/source?id=10map-36epl7sryjtd5rmrr2ga2i8235sryyw3bzc3ju3fpqzt5ua0hk265er6kd2ntf7qe88pnpjmrg05i7m928d0ib16u3698nskqw0&archive-path=//.../Windows Loader.exe&ts=15828ec8ae4&token=ZU kYz27XCb9BVlJ1q8dMA==&name=ldr.rar

https://docviewer.yandex.com.tr/source?id=10map-36epl7sryjtd5rmrr2ga2i8235sryyw3bzc3ju3fpqzt5ua0hk265er6kd2ntf7qe88pnpjmrg05i7m928d0ib16u3698nskqw0&archive-path=//WL_2.2.2/.../lCUaw==&name=ldr.rar

https://app.box.com/index.php?rm=box_download_shared_file&shared_name=1qj81o8th4khi66tb5qs22t7nn7bk363&file_id=f_75333852830

https://dl-web.dropbox.com/get/.../Windows Loader.exe

http://download1932.mediafire.com/qqdlhvd63spg/.../Windows Loader.exe

https://doc-0o-bg-docs.googleusercontent.com/docs/securesc/id9pl9c0u7k3lp3v817ern7c4eeugsnu/43d3c74s76rb06hm45glqd6ich1579p8/1469527200000/.../06279908017802182480/0B1h_i3kc6Q9tU0E0Tkd4TEtYLTQ?e=download

https://doc-0s-c0-docs.googleusercontent.com/docs/securesc/qv16quckv1j6ijmhno50b0di7mdvccuj/entb4b2i7qv1q1t14dggr2phl9e7mahs/1471708800000/.../13836120887634746139/0B8udzgMlJOZrY1k0WUhaRVlObmM?e=download

https://mega.nz/temporary/.../OI9iQIaJ

https://doc-14-14-docs.googleusercontent.com/docs/securesc/e3eir3sjgfsmkmbvrt41n9ta9udth4qk/bqalt1rkpqe83gmfu20ijk87i4hp9bu6/1462003200000/.../16262149467996854755/0B5SfL_irH_H1Y2k0R25rNGladjA?e=download

https://mega.co.nz/temporary/.../TEkgnKjT

http://www.xn--b1aonbn.xn--p1ai/iso/Microsoft Windows Server 2008 R2/MiniKMS/Loaders/.../Windows Loader.exe

https://doc-0g-74-docs.googleusercontent.com/docs/securesc/ikjicq8hmnn4eia8ok910mc3mtder79q/iico5c4preq4joqqnkb0uv6hq4hhecrd/1467727200000/.../11227299983895804750/0B-dAJAa931ElUkxYNGhZM2pjQkk?e=download

http://online.b1.org/rest/online/download/.../Windows Loader.exe

https://docviewer.yandex.com.tr/source?id=10map-36epl7sryjtd5rmrr2ga2i8235sryyw3bzc3ju3fpqzt5ua0hk265er6kd2ntf7qe88pnpjmrg05i7m928d0ib16u3698nskqw0&archive-path=//.../Windows Loader.exe&ts=15563ac79b8&token=PYeBWNQYNR90LLLJ6WqsLg==&name=ldr.rar

https://mega.nz/persistent/.../CdNDkSQB

http://s6.picofile.com/d/.../Windows_Loader.exe

https://doc-0s-c8-docs.googleusercontent.com/docs/securesc/q1odrduuac4md8pkoegsi5e1uh6j9l1s/t04srlti0tr5gb5hfipoacmgi6irkcaq/1461672000000/.../04903101921005601741/0B5OLGrT6i3ehY3g2dVV5UEYxLXc?e=download

https://messagerie-12.sfr.fr/webmail/.../Download.html?IDMSG=107338&PJRANG=2&NAME=Windows Loader.exe&FOLDER=INBOX

Latest 30 of 40 download URLs

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.