File name:

steam-praxis-adder-v60_667435.exe

Full analysis: https://app.any.run/tasks/a6b95410-93c0-4ee1-970f-f4cafe451eff
Verdict: Malicious activity
Analysis date: November 27, 2020, 14:27:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

82E07C0E0646AF56D96662643F8EC496

SHA1:

F986F5C48F5A4EA2FC2C6FE300DE8B5878462297

SHA256:

29132C5D74319E0BD0634F2B018FD250121D1CD1ECD9BD4F65C4BC0623E365FB

SSDEEP:

24576:aQA7B5Vr4UY/TQ2QatYNTfDfVtykR3CGpRJmu+:Q30UiQ2QaSNDDtQcyGrJm/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • steam-praxis-adder-v60_667435.exe (PID: 2444)
      • notepad++.exe (PID: 2360)
      • notepad++.exe (PID: 2508)
      • gup.exe (PID: 1116)

    • Registers / Runs the DLL via REGSVR32.EXE

      • steam-praxis-adder-v60_667435.exe (PID: 2444)

    • Loads dropped or rewritten executable

      • notepad++.exe (PID: 2508)
      • regsvr32.exe (PID: 2532)
      • notepad++.exe (PID: 2360)
      • steam-praxis-adder-v60_667435.exe (PID: 2444)

  • SUSPICIOUS

    • Creates files in the user directory

      • steam-praxis-adder-v60_667435.exe (PID: 2408)
      • steam-praxis-adder-v60_667435.exe (PID: 2920)
      • steam-praxis-adder-v60_667435.exe (PID: 2444)

    • Starts CMD.EXE for commands execution

      • steam-praxis-adder-v60_667435.exe (PID: 2408)
      • cmd.exe (PID: 1968)
      • cmd.exe (PID: 3060)

    • Creates files in the program directory

      • steam-praxis-adder-v60_667435.exe (PID: 2408)
      • steam-praxis-adder-v60_667435.exe (PID: 2920)
      • steam-praxis-adder-v60_667435.exe (PID: 2444)

    • Executable content was dropped or overwritten

      • steam-praxis-adder-v60_667435.exe (PID: 2408)
      • steam-praxis-adder-v60_667435.exe (PID: 2444)

    • Application launched itself

      • cmd.exe (PID: 1968)
      • steam-praxis-adder-v60_667435.exe (PID: 2920)
      • cmd.exe (PID: 3060)

    • Creates a directory in Program Files

      • steam-praxis-adder-v60_667435.exe (PID: 2408)
      • steam-praxis-adder-v60_667435.exe (PID: 2444)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2532)

    • Executed via COM

      • explorer.exe (PID: 1236)

    • Creates a software uninstall entry

      • steam-praxis-adder-v60_667435.exe (PID: 2444)

    • Drops a file that was compiled in debug mode

      • steam-praxis-adder-v60_667435.exe (PID: 2444)

    • Drops a file with a compile date too recent

      • steam-praxis-adder-v60_667435.exe (PID: 2444)

  • INFO

    • Manual execution by user

      • explorer.exe (PID: 2756)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:20 18:32:18+02:00
PEType: PE32
LinkerVersion: 11
CodeSize: 544768
InitializedDataSize: 944640
UninitializedDataSize: -
EntryPoint: 0x5dba1
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.7.7.1
ProductVersionNumber: 1.7.7.1
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription: Ammi Setup Native
FileVersion: 1.7.7.1
InternalName: AmmiSetupNative.exe
LegalCopyright: Copyright 2020
OriginalFileName: AmmiSetupNative.exe
ProductName: AmmiSetupNative
ProductVersion: 1.7.7.1

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 20-May-2020 16:32:18
Detected languages:
  • English - United States
FileDescription: Ammi Setup Native
FileVersion: 1.7.7.1
InternalName: AmmiSetupNative.exe
LegalCopyright: Copyright 2020
OriginalFilename: AmmiSetupNative.exe
ProductName: AmmiSetupNative
ProductVersion: 1.7.7.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 20-May-2020 16:32:18
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00084B12
0x00084C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.61941
.gfp4
0x00086000
0x000002F0
0x00000400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
4.80508
.rdata
0x00087000
0x0001794E
0x00017A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.40145
.data
0x0009F000
0x00003E78
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.62712
.rsrc
0x000A3000
0x000BF1D0
0x000BF200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.76376
.reloc
0x00163000
0x0000BC4A
0x0000BE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.17775

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.3298
822
UNKNOWN
English - United States
RT_MANIFEST
2
3.47539
744
UNKNOWN
English - United States
RT_ICON
3
3.01654
296
UNKNOWN
English - United States
RT_ICON
4
5.48554
3752
UNKNOWN
English - United States
RT_ICON
5
5.94421
2216
UNKNOWN
English - United States
RT_ICON
6
4.38883
1384
UNKNOWN
English - United States
RT_ICON
7
7.99566
104079
UNKNOWN
English - United States
RT_ICON
8
4.69967
67624
UNKNOWN
English - United States
RT_ICON
9
4.88299
16936
UNKNOWN
English - United States
RT_ICON
10
5.04599
9640
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WLDAP32.dll
WS2_32.dll
WTSAPI32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
13
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start drop and start steam-praxis-adder-v60_667435.exe no specs steam-praxis-adder-v60_667435.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs steam-praxis-adder-v60_667435.exe regsvr32.exe no specs explorer.exe no specs explorer.exe no specs notepad++.exe gup.exe notepad++.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
656"C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"C:\Windows\explorer.exe—steam-praxis-adder-v60_667435.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1116"C:\Program Files\Notepad++\updater\gup.exe" -v7.91C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
WinGup for Notepad++
Exit code:
0
Version:
5.11
Modules
Images
c:\program files\notepad++\updater\gup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\notepad++\updater\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
1236C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1968C:\Windows\system32\cmd.exe /d /c cmd /d /c cmd /d /c start "" "C:\Program Files\AmmiSetupzjsNative\steam-praxis-adder-v60_667435.exe" 16822378356713 ws7dQ1f1HtTFS04Pjv/kgw+ZXDHHtHjzrpkXlFRqBySalb1Uphadny6x0u52ItlYCUGDEiwcS8vcD0aoBwnJJdlkBGpF2P+AbbH5XWja/x/QZE5GptDRNCA8EyzAkmkqlj5CdbgUnb6iYEBG+jesphymhmZbFrF1srIkqmQOHg2OgBMcr7SWr0oR3ZQZm3MiTaAn+m366OifATsQiZlommGJ8lTafLxlnBvMwc9HdzM=C:\Windows\system32\cmd.exe—steam-praxis-adder-v60_667435.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2360"C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log" C:\Program Files\Notepad++\notepad++.exe
steam-praxis-adder-v60_667435.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2408"C:\Users\admin\AppData\Local\Temp\steam-praxis-adder-v60_667435.exe" -uacC:\Users\admin\AppData\Local\Temp\steam-praxis-adder-v60_667435.exe
steam-praxis-adder-v60_667435.exe
User:
admin
Integrity Level:
HIGH
Description:
Ammi Setup Native
Exit code:
0
Version:
1.7.7.1
Modules
Images
c:\users\admin\appdata\local\temp\steam-praxis-adder-v60_667435.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\pcwum.dll
c:\windows\system32\ws2_32.dll
2444"C:\Program Files\AmmiSetupzjsNative\steam-praxis-adder-v60_667435.exe" 16822378356713 ws7dQ1f1HtTFS04Pjv/kgw+ZXDHHtHjzrpkXlFRqBySalb1Uphadny6x0u52ItlYCUGDEiwcS8vcD0aoBwnJJdlkBGpF2P+AbbH5XWja/x/QZE5GptDRNCA8EyzAkmkqlj5CdbgUnb6iYEBG+jesphymhmZbFrF1srIkqmQOHg2OgBMcr7SWr0oR3ZQZm3MiTaAn+m366OifATsQiZlommGJ8lTafLxlnBvMwc9HdzM=C:\Program Files\AmmiSetupzjsNative\steam-praxis-adder-v60_667435.exe
cmd.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.9.1.0
Modules
Images
c:\program files\ammisetupzjsnative\steam-praxis-adder-v60_667435.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
2508"C:\Program Files\Notepad++\notepad++.exe" C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2532regsvr32 /s "C:\Program Files\Notepad++\NppShell_06.dll"C:\Windows\system32\regsvr32.exe—steam-praxis-adder-v60_667435.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2756"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
Total events
1 140
Read events
906
Write events
230
Delete events
4

Modification events

(PID) Process:(2920) steam-praxis-adder-v60_667435.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2920) steam-praxis-adder-v60_667435.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(2532) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ANotepad++
Operation:delete keyName:(default)
Value:
(PID) Process:(2532) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(2532) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\Settings
Operation:delete keyName:(default)
Value:
(PID) Process:(2532) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}
Operation:delete keyName:(default)
Value:
(PID) Process:(2532) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}
Operation:writeName:(default)
Value:
ANotepad++
(PID) Process:(2532) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:writeName:(default)
Value:
C:\Program Files\Notepad++\NppShell_06.dll
(PID) Process:(2532) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(2532) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\Settings
Operation:writeName:Title
Value:
Edit with &Notepad++
Executable files
16
Suspicious files
4
Text files
180
Unknown types
1

Dropped files

PID
Process
Filename
Type
2408steam-praxis-adder-v60_667435.exeC:\Program Files\AmmiSetupzjsNative\steam-praxis-adder-v60_667435.exeexecutable
MD5:—
SHA256:—
2444steam-praxis-adder-v60_667435.exeC:\Users\admin\AppData\Local\Temp\nspFE33.tmp\ioSpecial.initext
MD5:—
SHA256:—
2920steam-praxis-adder-v60_667435.exeC:\ProgramData\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
2408steam-praxis-adder-v60_667435.exeC:\ProgramData\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
2444steam-praxis-adder-v60_667435.exeC:\Users\admin\AppData\Local\Temp\nspFE33.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
2444steam-praxis-adder-v60_667435.exeC:\Users\admin\AppData\Local\Temp\nspFE33.tmp\InstallOptions.dllexecutable
MD5:05BF02DA51E717F79F6B5CBEA7BC0710
SHA256:CA092BA7F275B0C9000098CDD1A9876FE8DC050FCB40A0E8A1AB8335236E9DC5
2444steam-praxis-adder-v60_667435.exeC:\Users\admin\AppData\Local\Temp\nspFE33.tmp\modern-header.bmpimage
MD5:56DA15FDB8D96F8F5C649DCB5E79D775
SHA256:BB90D4338D2474138473E6B16E94B0237EE847BEA45019ED0DD4439C71BD233E
2444steam-praxis-adder-v60_667435.exeC:\Users\admin\AppData\Local\Temp\nspFE33.tmp\nsDialogs.dllexecutable
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01
SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172
2444steam-praxis-adder-v60_667435.exeC:\Users\admin\AppData\Local\Temp\nspFE33.tmp\modern-wizard.bmpimage
MD5:C2CF6928A3AB574A5548B4DC1C38B6C0
SHA256:2125550C12FA512782F2016E802D70BC51F4A06017CFBD4176B4A994EB2542F0
2444steam-praxis-adder-v60_667435.exeC:\Program Files\Notepad++\autoCompletion\rc.xmlxml
MD5:12B972B69130E664E50AC111D298379B
SHA256:12AD067AA1227B92141BBF9FACA8EFA74549CFF6DABDE85899DB9272EB7E2DFF
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
4
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1116
gup.exe
172.67.218.84:443
notepad-plus-plus.org
—
US
malicious
2408
steam-praxis-adder-v60_667435.exe
172.67.73.185:443
allstandardsoftware.com
—
US
unknown

DNS requests

Domain
IP
Reputation
allstandardsoftware.com
  • 172.67.73.185
  • 104.26.6.32
  • 104.26.7.32
malicious
notepad-plus-plus.org
  • 172.67.218.84
  • 104.31.89.28
  • 104.31.88.28
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\plugins\Config\nppPluginList.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
steam-praxis-adder-v60_667435.exe