URL:

https://base64.guru/converter/decode/file

Full analysis: https://app.any.run/tasks/6698d5eb-d81f-411f-b21b-2e0a983f1891
Verdict: Malicious activity
Analysis date: February 26, 2020, 13:47:18
OS: Windows Vista Business Service Pack 2 (build: 6002, 32 bit)
Indicators:
MD5:

BEAE4DD9059DE2544CC61218E113C092

SHA1:

A43A0AB999266128CF8E36DE24BE98540FAC6FBB

SHA256:

1EE4E6664B6A404CF62FA6433E878D9C3098E8CB749EE9BEBEAEEA6A9C794170

SSDEEP:

3:N8ldGAk2Kxn:2TX6

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • application.com (PID: 788)
      • application.exe (PID: 2812)
      • Services.1.exe (PID: 3656)
      • Services.2.exe (PID: 2940)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • firefox.exe (PID: 3432)
      • application.com (PID: 788)
      • application.exe (PID: 2812)
      • notepad++.exe (PID: 712)
      • Services.2.exe (PID: 2940)
      • Services.1.exe (PID: 3656)

    • Creates files in the user directory

      • application.com (PID: 788)
      • application.exe (PID: 2812)
      • Services.2.exe (PID: 2940)
      • Services.1.exe (PID: 3656)
      • notepad++.exe (PID: 712)

    • Uses RUNDLL32.EXE to load library

      • application.com (PID: 788)
      • application.exe (PID: 2812)
      • Services.2.exe (PID: 2940)
      • explorer.exe (PID: 3696)
      • Services.1.exe (PID: 3656)

    • Starts CMD.EXE for commands execution

      • rundll32.exe (PID: 2696)

    • Application launched itself

      • notepad++.exe (PID: 712)

  • INFO

    • Application launched itself

      • firefox.exe (PID: 3432)

    • Manual execution by user

      • verclsid.exe (PID: 2724)
      • verclsid.exe (PID: 2956)
      • verclsid.exe (PID: 2708)
      • verclsid.exe (PID: 3724)
      • verclsid.exe (PID: 2152)
      • verclsid.exe (PID: 3268)
      • verclsid.exe (PID: 2480)
      • application.com (PID: 788)
      • verclsid.exe (PID: 3656)
      • application.exe (PID: 2812)
      • verclsid.exe (PID: 2552)
      • Services.2.exe (PID: 2940)
      • notepad++.exe (PID: 2692)
      • notepad++.exe (PID: 2088)

    • Reads CPU info

      • firefox.exe (PID: 3264)
      • firefox.exe (PID: 3432)

    • Creates files in the user directory

      • firefox.exe (PID: 3432)

    • Modifies the open verb of a shell class

      • rundll32.exe (PID: 2696)
      • rundll32.exe (PID: 4088)
      • rundll32.exe (PID: 2352)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
28
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start firefox.exe firefox.exe verclsid.exe no specs verclsid.exe no specs verclsid.exe no specs verclsid.exe no specs verclsid.exe no specs verclsid.exe no specs verclsid.exe no specs verclsid.exe no specs application.com rundll32.exe no specs wordpad.exe no specs application.exe rundll32.exe no specs notepad++.exe notepad++.exe notepad++.exe verclsid.exe no specs services.2.exe rundll32.exe no specs explorer.exe no specs rundll32.exe no specs cmd.exe no specs conime.exe no specs services.1.exe rundll32.exe no specs notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
348C:\Windows\system32\conime.exeC:\Windows\system32\conime.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console IME
Exit code:
0
Version:
6.0.6002.18005 (lh_sp2rtm.090410-1830)
Modules
Images
c:\windows\system32\conime.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
712"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\AppData\Roaming\Services"C:\Program Files\Notepad++\notepad++.exe
rundll32.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.54
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\shlwapi.dll
788"C:\Users\admin\Downloads\application.com" C:\Users\admin\Downloads\application.com
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\downloads\application.com
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2088"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Downloads\application.exe"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.54
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\shlwapi.dll
2152"C:\Windows\system32\verclsid.exe" /S /C {596AB062-B4D2-4215-9F74-E9109B0A8153} /I {000214E9-0000-0000-C000-000000000046} /X 0x401C:\Windows\system32\verclsid.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extension CLSID Verification Host
Exit code:
0
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\windows\system32\verclsid.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
2348"C:\Windows\System32\cmd.exe" "C:\Users\admin\AppData\Roaming\Services"C:\Windows\System32\cmd.exe—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\conime.exe
c:\windows\system32\apphelp.dll
2352"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\admin\AppData\Roaming\ServicesC:\Windows\system32\rundll32.exe—Services.2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
c:\windows\system32\shimeng.dll
2360"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\admin\AppData\Roaming\Services"C:\Program Files\Windows NT\Accessories\WORDPAD.EXE—rundll32.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Wordpad Application
Exit code:
0
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\program files\windows nt\accessories\wordpad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\mfc42u.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
2480"C:\Windows\system32\verclsid.exe" /S /C {513D916F-2A8E-4F51-AEAB-0CBC76FB1AF8} /I {000214E9-0000-0000-C000-000000000046} /X 0x401C:\Windows\system32\verclsid.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extension CLSID Verification Host
Exit code:
0
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\windows\system32\verclsid.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
2552"C:\Windows\system32\verclsid.exe" /S /C {7EFA68C6-086B-43E1-A2D2-55A113531240} /I {000214E9-0000-0000-C000-000000000046} /X 0x401C:\Windows\system32\verclsid.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extension CLSID Verification Host
Exit code:
3
Version:
6.0.6000.16386 (vista_rtm.061101-2205)
Modules
Images
c:\windows\system32\verclsid.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\user32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\imm32.dll
Total events
3 907
Read events
3 254
Write events
642
Delete events
11

Modification events

(PID) Process:(3432) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9da96397-48b9-11e8-bb1b-806e6f6e6963}
Operation:writeName:BaseClass
Value:
Drive
(PID) Process:(3432) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:MigrateProxy
Value:
1
(PID) Process:(3432) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(3432) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000002F000000010000000000000000000000000000000000000000000000A064E98E49DCD301000000000000000000000000030000001700000000000000FE800000000000008C79D8E2DC06194A0800000070C7E77580C7E775B0F1E875F8C7E775010000005044393800000000000000000000000000000000000000000000000000000000000000000800000000000000E8DB1900E0A65C0400080000020000000000006000000020F00A000040595D04020000001700000000000000FE8000000000000000005EFEC0A801F80900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002C00000020000000C8000000000000000000000000000000000000000000000000000000070000000000000000000000000000000000000002000000C0A801F8000000000000000000000000000000000000000000000000181002C00000000000000000000000000000000001000000485F4C040000000000000000000000000100000000000000FFFFFFFFFFFFFFFF00000000000000000000000000000000000000000000000000000000000000000000001C00000000
(PID) Process:(3432) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3432) firefox.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(788) application.comKey:HKEY_CURRENT_USER
Operation:writeName:di
Value:
!
(PID) Process:(3776) rundll32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{9da96397-48b9-11e8-bb1b-806e6f6e6963}
Operation:writeName:BaseClass
Value:
Drive
(PID) Process:(3776) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\Windows\system32\mspaint.exe
Value:
Paint
(PID) Process:(3776) rundll32.exeKey:HKEY_CLASSES_ROOT\Local Settings\Software\Microsoft\Windows\Shell\MuiCache
Operation:writeName:C:\PROGRA~1\MICROS~1\Office12\OIS.EXE
Value:
Microsoft Office Picture Manager
Executable files
7
Suspicious files
343
Text files
153
Unknown types
57

Dropped files

PID
Process
Filename
Type
3432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\xdgwq2fe.default\sessionCheckpoints.json.tmp —
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\xdgwq2fe.default\pluginreg.dat.tmp —
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\xdgwq2fe.default\cache2\entries\80D1F25ED342E3C154179F51AB4EDC92CDE0B9E6image
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\xdgwq2fe.default\cache2\entries\83ADFCCE347FF814DA819C7A0C210EB9DD08B641image
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\xdgwq2fe.default\cache2\entries\5909FBB54D48BF4ABD4BE077EB3363C63410C935binary
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\xdgwq2fe.default\safebrowsing-backup —
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\xdgwq2fe.default\cache2\entries\DDC6770BCF19C5611D819DBDC678F583C57A388Bimage
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\xdgwq2fe.default\cache2\entries\3E7A452AE8430347D35E76CD2A05CAFBE0283F99binary
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\xdgwq2fe.default\cache2\entries\E50000862DC7658EDA5FA0586761A1D3E643CCF5image
MD5:—
SHA256:—
3432firefox.exeC:\Users\admin\AppData\Local\Mozilla\Firefox\Profiles\xdgwq2fe.default\cache2\entries\D77083F11ACBD9A279D652E9178CD431E7A4F044image
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
464
TCP/UDP connections
322
DNS requests
435
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3432
firefox.exe
GET
200
104.27.142.51:443
https://base64.guru/converter/decode/file
US
html
48.1 Kb
malicious
3432
firefox.exe
GET
200
52.11.143.45:443
https://search.services.mozilla.com/1/firefox/50.0.2/esr/en-US/DE/default/default
US
text
152 b
whitelisted
3432
firefox.exe
GET
200
104.27.142.51:443
https://static.base64.guru/js/form_base64.min.js?1.0.37
US
text
4.35 Kb
whitelisted
3432
firefox.exe
GET
200
172.217.16.136:443
https://www.googletagmanager.com/gtag/js?id=UA-134607367-1
US
text
74.4 Kb
whitelisted
3432
firefox.exe
GET
200
104.27.142.51:443
https://static.base64.guru/css/style.min.css?1.0.60
US
text
11.1 Kb
whitelisted
3432
firefox.exe
GET
200
104.27.142.51:443
https://static.base64.guru/js/comments.min.js?1.0.37
US
text
2.79 Kb
whitelisted
3432
firefox.exe
GET
200
172.217.16.194:443
https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
US
text
105 Kb
whitelisted
3432
firefox.exe
GET
200
104.27.142.51:443
https://static.base64.guru/img/favicon.ico
US
image
1.12 Kb
whitelisted
3432
firefox.exe
GET
200
104.27.142.51:443
https://static.base64.guru/uploads/blog/base64-encryption-is-a-lie.jpg
US
image
34.6 Kb
whitelisted
3432
firefox.exe
GET
200
104.27.142.51:443
https://static.base64.guru/uploads/blog/validate-base64-using-notepad-plus-plus.jpg
US
image
41.3 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3432
firefox.exe
52.11.143.45:443
search.services.mozilla.com
Amazon.com, Inc.
US
unknown
3432
firefox.exe
216.58.210.2:443
adservice.google.com
Google Inc.
US
whitelisted
3432
firefox.exe
172.217.22.66:443
adservice.google.fr
Google Inc.
US
whitelisted
3432
firefox.exe
172.217.18.162:443
googleads.g.doubleclick.net
Google Inc.
US
whitelisted
3432
firefox.exe
216.58.207.46:443
www.google-analytics.com
Google Inc.
US
whitelisted
3432
firefox.exe
64.233.167.156:443
stats.g.doubleclick.net
Google Inc.
US
whitelisted
3432
firefox.exe
172.217.23.142:443
safebrowsing.google.com
Google Inc.
US
whitelisted
3432
firefox.exe
143.204.202.50:443
tracking-protection.cdn.mozilla.net
—
US
malicious
3432
firefox.exe
52.43.22.113:443
shavar.services.mozilla.com
Amazon.com, Inc.
US
unknown
3432
firefox.exe
216.58.205.226:443
adservice.google.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
search.services.mozilla.com
  • 52.11.143.45
  • 52.38.153.3
  • 54.149.124.142
whitelisted
search.r53-2.services.mozilla.com
  • 54.149.124.142
  • 52.38.153.3
  • 52.11.143.45
whitelisted
tiles.services.mozilla.com
  • —
whitelisted
base64.guru
  • 104.27.142.51
  • 104.27.143.51
malicious
static.base64.guru
  • 104.27.142.51
  • 104.27.143.51
  • 13.35.253.69
  • 13.35.253.124
  • 13.35.253.12
  • 13.35.253.15
whitelisted
pagead2.googlesyndication.com
  • 172.217.16.194
whitelisted
www.googletagmanager.com
  • 172.217.16.136
whitelisted
pagead46.l.doubleclick.net
  • 172.217.16.194
whitelisted
www-googletagmanager.l.google.com
  • 104.111.236.128
whitelisted
adservice.google.fr
  • 172.217.22.66
whitelisted

Threats

PID
Process
Class
Message
1240
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
1240
svchost.exe
Potentially Bad Traffic
ET INFO Observed DNS Query to .cloud TLD
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://base64.guru/converter/decode/file