File name:

mdm.jpg

Full analysis: https://app.any.run/tasks/5f3c7629-b368-408f-b747-3ee8161bf9fc
Verdict: Malicious activity
Threats:

AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.

Malware Trends Tracker     >>>
Analysis date: June 17, 2025, 01:59:11
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
psloramyra
loader
asyncrat
rat
Indicators:
MIME: text/plain
File info: Unicode text, UTF-8 (with BOM) text, with very long lines (65514), with CRLF line terminators
MD5:

99C23706A4BD973EBDA4BDB88B87C834

SHA1:

672A6A80BD7484229111364C73CA1973E76803F3

SHA256:

83BABEE77DB36512C0EAB8EA6B35E981AA4288A4095985D69B3841F8B684FE11

SSDEEP:

3072:RGLx9EwczhNbwXibYsKk/1g3/cNvTGFJgdqoZ3zKSGd7qfuQTUfWwLC5ImBK5W9N:RGLx9EPzhNbwXQYsKkpGyTUOwqYyfbT

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 6004)
      • powershell.exe (PID: 2148)
      • powershell.exe (PID: 6220)

    • PSLORAMYRA has been detected

      • wscript.exe (PID: 4088)
      • wscript.exe (PID: 1480)

    • Changes powershell execution policy (Bypass)

      • cmd.exe (PID: 6460)
      • cmd.exe (PID: 2804)

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2148)
      • powershell.exe (PID: 6220)

    • ASYNCRAT has been detected (MUTEX)

      • RegSvcs.exe (PID: 5248)
      • RegSvcs.exe (PID: 4080)

    • ASYNCRAT has been detected (YARA)

      • RegSvcs.exe (PID: 5248)

  • SUSPICIOUS

    • Writes data into a file (POWERSHELL)

      • powershell.exe (PID: 6004)

    • Uses sleep to delay execution (POWERSHELL)

      • powershell.exe (PID: 6004)

    • Likely accesses (executes) a file from the Public directory

      • wscript.exe (PID: 4088)
      • cmd.exe (PID: 6460)
      • powershell.exe (PID: 2148)
      • wscript.exe (PID: 1480)
      • cmd.exe (PID: 2804)
      • powershell.exe (PID: 6220)
      • notepad++.exe (PID: 3888)
      • notepad++.exe (PID: 1236)

    • Executing commands from a ".bat" file

      • wscript.exe (PID: 4088)
      • wscript.exe (PID: 1480)

    • Runs shell command (SCRIPT)

      • wscript.exe (PID: 4088)
      • wscript.exe (PID: 1480)

    • Starts CMD.EXE for commands execution

      • wscript.exe (PID: 4088)
      • wscript.exe (PID: 1480)

    • The process executes via Task Scheduler

      • wscript.exe (PID: 4088)
      • wscript.exe (PID: 1480)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 6460)
      • cmd.exe (PID: 2804)

    • The process executes Powershell scripts

      • cmd.exe (PID: 6460)
      • cmd.exe (PID: 2804)

    • The process bypasses the loading of PowerShell profile settings

      • cmd.exe (PID: 6460)
      • cmd.exe (PID: 2804)

    • Converts a specified value to an integer (POWERSHELL)

      • powershell.exe (PID: 2148)
      • powershell.exe (PID: 6220)

    • Connects to unusual port

      • RegSvcs.exe (PID: 5248)

  • INFO

    • Manual execution by a user

      • cmd.exe (PID: 5284)
      • notepad++.exe (PID: 3888)
      • notepad++.exe (PID: 1236)

    • Gets the hash of the file via CERTUTIL.EXE

      • certutil.exe (PID: 1816)
      • certutil.exe (PID: 2792)
      • certutil.exe (PID: 4576)

    • Reads the software policy settings

      • slui.exe (PID: 6796)

    • Checks proxy server information

      • slui.exe (PID: 6796)

    • Reads the computer name

      • RegSvcs.exe (PID: 5248)
      • RegSvcs.exe (PID: 4080)

    • Checks supported languages

      • RegSvcs.exe (PID: 5248)
      • RegSvcs.exe (PID: 4080)

    • Reads the machine GUID from the registry

      • RegSvcs.exe (PID: 5248)
      • RegSvcs.exe (PID: 4080)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.txt | Text - UTF-8 encoded (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
22
Malicious processes
7
Suspicious processes
2

Behavior graph

Click at the process to see the details
start powershell.exe no specs conhost.exe no specs rundll32.exe no specs cmd.exe no specs conhost.exe no specs slui.exe certutil.exe no specs certutil.exe no specs certutil.exe no specs #PSLORAMYRA wscript.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs #ASYNCRAT regsvcs.exe svchost.exe #PSLORAMYRA wscript.exe no specs cmd.exe no specs conhost.exe no specs powershell.exe no specs #ASYNCRAT regsvcs.exe no specs notepad++.exe notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
1236"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Public\Conted.ps1"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
c:\windows\system32\msvcp_win.dll
1480C:\WINDOWS\System32\WScript.exe "C:\Users\Public\Conted.vbs" C:\Windows\System32\wscript.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.812.10240.16384
Modules
Images
c:\windows\system32\wscript.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1816certutil -hashfile Conted.bat sha256C:\Windows\System32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2148powershell.exe -NoProfile -WindowStyle Hidden -ExecutionPolicy Bypass -Command "& 'C:\Users\Public\Conted.ps1'"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\atl.dll
c:\windows\system32\combase.dll
2200C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2232\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2460\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2792certutil -hashfile Conted.ps1 sha256C:\Windows\System32\certutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
CertUtil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\crypt32.dll
2804C:\WINDOWS\system32\cmd.exe /c ""C:\Users\Public\Conted.bat" "C:\Windows\System32\cmd.exe—wscript.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
3888"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\Public\Conted.bat"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
Total events
15 680
Read events
15 680
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
4
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
6004powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dxccypxm.4fo.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6004powershell.exeC:\Users\Public\Conted.ps1text
MD5:089315EBEAC43E1A45DA3014F56C5006
SHA256:3A0A477030EABA84883193EDE461D8595C3CA4345811632E295D9C2D136C1593
6004powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF1755d0.TMPbinary
MD5:00A03B286E6E0EBFF8D9C492365D5EC2
SHA256:4DBFC417D053BA6867308671F1C61F4DCAFC61F058D4044DB532DA6D3BDE3615
6220powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_tahdzjlz.4yd.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6220powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_4upeysyg.5de.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6004powershell.exeC:\Users\admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PUMD05QVZFBYHEFQU1Z9.tempbinary
MD5:B199A4A0465B9EF6CF9ACFB98B2D3FF5
SHA256:E8FDDA9F18754319B7B8146F7CE29996946564578B741A9E2F58B96225BDAD38
2148powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_m0p4x5fc.it3.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
6004powershell.exeC:\Users\Public\Conted.battext
MD5:759278DD3DC3679BF7EFD1EC681C0AA1
SHA256:CBA344447D8228D88C93D64FFDCDA1DE8562EF41ADC4901191548E00BBFC5F19
6004powershell.exeC:\Users\Public\Conted.vbstext
MD5:110DA9D3474BA64FA1A18C173685C25D
SHA256:A31DBD6F7416F150403C19BE69F02D5E8608F5E7FAE88A29831D40DB15849B60
2148powershell.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_dxsaltje.dyp.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
57
DNS requests
27
Threats
12

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
104.85.1.163:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
NL
binary
868 b
whitelisted
1268
svchost.exe
GET
200
23.216.77.42:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
6304
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
QA
binary
420 b
whitelisted
6304
SIHClient.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
QA
binary
408 b
whitelisted
6232
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D
DE
binary
471 b
whitelisted
2320
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
2940
svchost.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
ID
binary
734 b
whitelisted
1200
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
5944
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
592
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1268
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1268
svchost.exe
23.216.77.42:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
104.85.1.163:80
www.microsoft.com
AKAMAI-AS
NL
whitelisted
5944
MoUsoCoreWorker.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6304
SIHClient.exe
172.202.163.200:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
GB
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 172.217.18.14
whitelisted
crl.microsoft.com
  • 23.216.77.42
  • 23.216.77.28
whitelisted
www.microsoft.com
  • 104.85.1.163
  • 2.23.246.101
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
login.live.com
  • 40.126.32.138
  • 20.190.160.5
  • 40.126.32.74
  • 40.126.32.68
  • 20.190.160.4
  • 20.190.160.130
  • 20.190.160.131
  • 20.190.160.65
  • 40.126.31.0
  • 40.126.31.69
  • 20.190.159.68
  • 40.126.31.71
  • 20.190.159.128
  • 40.126.31.1
  • 20.190.159.2
  • 20.190.159.73
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted

Threats

PID
Process
Class
Message
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
2200
svchost.exe
Potentially Bad Traffic
ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain
2200
svchost.exe
Misc activity
ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: error while getting certificate informations
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
mdm.jpg