File name:

AutoWorkInstaller-14.1.0-win.exe

Full analysis: https://app.any.run/tasks/23e12022-ec80-457e-85da-11023cd83b1c
Verdict: Malicious activity
Analysis date: April 11, 2024, 13:27:51
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, Nullsoft Installer self-extracting archive
MD5:

4CFE6DD870201DED7BE7ABB09D474053

SHA1:

23BE704FA177D1F2548DD1D690154C0C9009FD90

SHA256:

12AB00A7960F7E9567C41B36BB63BEDB31B92D83AD3C442CFB9F0C39423855A9

SSDEEP:

6144:gDZR0H8+ogwEkLOi2O25TgJfnDTBv4nCl3pJAbAfkvcjs9Rq72xS0+tl5N6Ju59H:2ZR0H8+el3z6AfXls1hX0rIXXSzj

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

  • SUSPICIOUS

    • Creates a software uninstall entry

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

    • Searches for installed software

      • AutoWorkInstaller-14.1.0-win.exe (PID: 4012)
      • AutoWorkInstaller-14.1.0-win.exe (PID: 1072)

    • Executable content was dropped or overwritten

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

    • Reads the Internet Settings

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

    • Reads security settings of Internet Explorer

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

    • The process creates files with name similar to system file names

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

  • INFO

    • Create files in a temporary directory

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

    • Checks proxy server information

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

    • Manual execution by a user

      • explorer.exe (PID: 2728)
      • AutoWorkInstaller-14.1.0-win.exe (PID: 1072)
      • AutoWorkInstaller-14.1.0-win.exe (PID: 4012)
      • notepad++.exe (PID: 2228)
      • chrome.exe (PID: 3708)

    • Reads the computer name

      • AutoWorkInstaller-14.1.0-win.exe (PID: 4012)
      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)
      • AutoWorkInstaller-14.1.0-win.exe (PID: 1072)

    • Reads the machine GUID from the registry

      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)

    • Checks supported languages

      • AutoWorkInstaller-14.1.0-win.exe (PID: 4012)
      • AutoWorkInstaller-14.1.0-win.exe (PID: 2408)
      • AutoWorkInstaller-14.1.0-win.exe (PID: 1072)

    • Application launched itself

      • chrome.exe (PID: 3708)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:08:29 19:32:12+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit, No debug
PEType: PE32
LinkerVersion: 2.34
CodeSize: 37888
InitializedDataSize: 40960
UninitializedDataSize: 131072
EntryPoint: 0x4446
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 14.1.0.0
ProductVersionNumber: 14.1.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Федеральное казначейство
FileDescription: Настройка рабочего места ЕИС
FileVersion: 14.1.0
LegalCopyright: Copyright © 2020 Федеральное казначейство
ProductName: AutoWorkInstaller
ProductVersion: 14.1.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
78
Monitored processes
26
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start autoworkinstaller-14.1.0-win.exe explorer.exe no specs autoworkinstaller-14.1.0-win.exe notepad++.exe autoworkinstaller-14.1.0-win.exe chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs autoworkinstaller-14.1.0-win.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1072"C:\Users\admin\AppData\Local\Temp\AutoWorkInstaller-14.1.0-win.exe" C:\Users\admin\AppData\Local\Temp\AutoWorkInstaller-14.1.0-win.exe
explorer.exe
User:
admin
Company:
Федеральное казначейство
Integrity Level:
HIGH
Description:
Настройка рабочего места ЕИС
Exit code:
0
Version:
14.1.0
Modules
Images
c:\users\admin\appdata\local\temp\autoworkinstaller-14.1.0-win.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\gdi32.dll
1336"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=3964 --field-trial-handle=1144,i,16373125728582896282,12967163426401652013,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1692"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --mojo-platform-channel-handle=1328 --field-trial-handle=1144,i,16373125728582896282,12967163426401652013,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe
chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
MEDIUM
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1696"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1080 --field-trial-handle=1144,i,16373125728582896282,12967163426401652013,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:2C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1792"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2320 --field-trial-handle=1144,i,16373125728582896282,12967163426401652013,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1892"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4040 --field-trial-handle=1144,i,16373125728582896282,12967163426401652013,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2056"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3356 --field-trial-handle=1144,i,16373125728582896282,12967163426401652013,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2124"C:\Users\admin\AppData\Local\Temp\AutoWorkInstaller-14.1.0-win.exe" C:\Users\admin\AppData\Local\Temp\AutoWorkInstaller-14.1.0-win.exe—explorer.exe
User:
admin
Company:
Федеральное казначейство
Integrity Level:
MEDIUM
Description:
Настройка рабочего места ЕИС
Exit code:
3221226540
Version:
14.1.0
Modules
Images
c:\users\admin\appdata\local\temp\autoworkinstaller-14.1.0-win.exe
c:\windows\system32\ntdll.dll
2208"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --mojo-platform-channel-handle=3476 --field-trial-handle=1144,i,16373125728582896282,12967163426401652013,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
2228"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\AppData\Local\Temp\AutoWorkInstaller-14.1.0-win.exe"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.24483_none_2b200f664577e14b\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
11 383
Read events
11 272
Write events
105
Delete events
6

Modification events

(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyServer
Value:
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:ProxyOverride
Value:
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoConfigURL
Value:
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:delete valueName:AutoDetect
Value:
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005C010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2408) AutoWorkInstaller-14.1.0-win.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
Executable files
4
Suspicious files
23
Text files
37
Unknown types
23

Dropped files

PID
Process
Filename
Type
2408AutoWorkInstaller-14.1.0-win.exeC:\Users\admin\AppData\Local\Temp\nso23A1.tmp\INetC.dllexecutable
MD5:—
SHA256:—
2408AutoWorkInstaller-14.1.0-win.exeC:\Users\admin\AppData\Local\Temp\nso23A1.tmp\System.dllexecutable
MD5:—
SHA256:—
2408AutoWorkInstaller-14.1.0-win.exeC:\Users\admin\AppData\Local\Temp\nso23A1.tmp\nsJSON.dllexecutable
MD5:—
SHA256:—
2408AutoWorkInstaller-14.1.0-win.exeC:\AutotuningWorkplace\uninstall.exeexecutable
MD5:—
SHA256:—
2408AutoWorkInstaller-14.1.0-win.exeC:\Users\admin\Desktop\АРМ.lnkbinary
MD5:—
SHA256:—
2228notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\config.xmlxml
MD5:—
SHA256:—
2228notepad++.exeC:\Users\admin\AppData\Roaming\Notepad++\session.xmltext
MD5:—
SHA256:—
3708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.datbinary
MD5:—
SHA256:—
3708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Variationsbinary
MD5:—
SHA256:—
3708chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Last Versiontext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
39
DNS requests
37
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
856
svchost.exe
HEAD
200
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
1692
chrome.exe
GET
204
172.217.23.99:80
http://www.gstatic.com/generate_204
unknown
—
—
unknown
856
svchost.exe
GET
206
34.104.35.123:80
http://edgedl.me.gvt1.com/edgedl/release2/chrome_component/k4ldha5kevpu7qn7k4s3mznvgu_4.10.2710.0/oimompecagnajdejgnnjijobebaeigek_4.10.2710.0_win32_ad2kbvs6jks3au5dsxn7cqflsiiq.crx3
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
2408
AutoWorkInstaller-14.1.0-win.exe
95.167.245.92:443
zakupki.gov.ru
Rostelecom
RU
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1692
chrome.exe
142.250.181.227:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
3708
chrome.exe
239.255.255.250:1900
—
—
—
unknown
1692
chrome.exe
74.125.206.84:443
accounts.google.com
GOOGLE
US
whitelisted
1692
chrome.exe
142.250.186.132:443
www.google.com
GOOGLE
US
whitelisted
1692
chrome.exe
172.217.23.99:443
www.gstatic.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
zakupki.gov.ru
  • 95.167.245.92
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
clientservices.googleapis.com
  • 142.250.181.227
whitelisted
accounts.google.com
  • 74.125.206.84
shared
www.google.com
  • 142.250.186.132
whitelisted
www.gstatic.com
  • 172.217.23.99
whitelisted
apis.google.com
  • 142.250.181.238
whitelisted
update.googleapis.com
  • 142.250.185.163
  • 142.250.186.131
whitelisted
encrypted-tbn0.gstatic.com
  • 142.250.186.78
whitelisted
lh5.googleusercontent.com
  • 142.250.185.129
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
AutoWorkInstaller-14.1.0-win.exe