analyze malware
  • Huge database of samples and IOCs
  • Custom VM setup
  • Unlimited submissions
  • Interactive approach
Sign up, it’s free
File name:

scripthack_232_927087.exe

Full analysis: https://app.any.run/tasks/48d4ee78-1411-4c60-99a5-d40bbe4c4199
Verdict: Malicious activity
Analysis date: November 30, 2020, 00:15:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C393E1863063EE6546C7108C73CCAE6D

SHA1:

5F43FC499E2FC18EC0E556DD204567DDF0E5A542

SHA256:

9941D688B5F73420891C87D90A6D6B7C59355A7A964AD1DE7519E7E01BED9392

SSDEEP:

24576:kOFo4F2qsze+XMhQatYNTfDfVtykR3CGpRJmuaL:ySEzzMhQaSNDDtQcyGrJmX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • scripthack_232_927087.exe (PID: 3092)
      • notepad++.exe (PID: 3008)
      • regsvr32.exe (PID: 4024)
      • notepad++.exe (PID: 3624)

    • Application was dropped or rewritten from another process

      • scripthack_232_927087.exe (PID: 3092)
      • notepad++.exe (PID: 3624)
      • gup.exe (PID: 3332)
      • notepad++.exe (PID: 3008)

    • Drops executable file immediately after starts

      • scripthack_232_927087.exe (PID: 3092)

    • Registers / Runs the DLL via REGSVR32.EXE

      • scripthack_232_927087.exe (PID: 3092)

    • Loads the Task Scheduler COM API

      • CCleaner.exe (PID: 3152)
      • CCleaner.exe (PID: 1760)

    • Actions looks like stealing of personal data

      • CCleaner.exe (PID: 1760)

  • SUSPICIOUS

    • Creates a directory in Program Files

      • scripthack_232_927087.exe (PID: 1996)
      • scripthack_232_927087.exe (PID: 3092)

    • Application launched itself

      • cmd.exe (PID: 1196)
      • scripthack_232_927087.exe (PID: 2180)
      • cmd.exe (PID: 2724)

    • Creates files in the program directory

      • scripthack_232_927087.exe (PID: 2180)
      • scripthack_232_927087.exe (PID: 1996)
      • scripthack_232_927087.exe (PID: 3092)

    • Creates files in the user directory

      • scripthack_232_927087.exe (PID: 1996)
      • scripthack_232_927087.exe (PID: 2180)
      • scripthack_232_927087.exe (PID: 3092)
      • CCleaner.exe (PID: 1760)

    • Executable content was dropped or overwritten

      • scripthack_232_927087.exe (PID: 1996)
      • scripthack_232_927087.exe (PID: 3092)

    • Starts CMD.EXE for commands execution

      • scripthack_232_927087.exe (PID: 1996)
      • cmd.exe (PID: 1196)
      • cmd.exe (PID: 2724)

    • Drops a file that was compiled in debug mode

      • scripthack_232_927087.exe (PID: 3092)

    • Drops a file with a compile date too recent

      • scripthack_232_927087.exe (PID: 3092)

    • Executed via COM

      • explorer.exe (PID: 3852)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 4024)

    • Executed via Task Scheduler

      • CCleaner.exe (PID: 1760)

    • Creates a software uninstall entry

      • scripthack_232_927087.exe (PID: 3092)

    • Low-level read access rights to disk partition

      • CCleaner.exe (PID: 1760)

    • Reads internet explorer settings

      • CCleaner.exe (PID: 1760)

    • Executed as Windows Service

      • taskhost.exe (PID: 3272)
      • taskhost.exe (PID: 2020)
      • taskhost.exe (PID: 1708)

    • Starts Internet Explorer

      • CCleaner.exe (PID: 1760)

  • INFO

    • Manual execution by user

      • CCleaner.exe (PID: 3152)
      • explorer.exe (PID: 2144)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3492)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3492)

    • Application launched itself

      • iexplore.exe (PID: 464)

    • Creates files in the user directory

      • iexplore.exe (PID: 3492)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3492)

    • Changes internet zones settings

      • iexplore.exe (PID: 464)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3492)

    • Dropped object may contain Bitcoin addresses

      • taskhost.exe (PID: 2020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:20 18:33:43+02:00
PEType: PE32
LinkerVersion: 11
CodeSize: 543744
InitializedDataSize: 944640
UninitializedDataSize: -
EntryPoint: 0x5d794
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.7.7.1
ProductVersionNumber: 1.7.7.1
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription: Ammi Setup Native
FileVersion: 1.7.7.1
InternalName: AmmiSetupNative.exe
LegalCopyright: Copyright 2020
OriginalFileName: AmmiSetupNative.exe
ProductName: AmmiSetupNative
ProductVersion: 1.7.7.1

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 20-May-2020 16:33:43
Detected languages:
  • English - United States
FileDescription: Ammi Setup Native
FileVersion: 1.7.7.1
InternalName: AmmiSetupNative.exe
LegalCopyright: Copyright 2020
OriginalFilename: AmmiSetupNative.exe
ProductName: AmmiSetupNative
ProductVersion: 1.7.7.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 20-May-2020 16:33:43
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00084722
0x00084800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62054
.gfp4
0x00086000
0x000002F0
0x00000400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
4.81358
.rdata
0x00087000
0x0001794E
0x00017A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.39998
.data
0x0009F000
0x00003E78
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.62769
.rsrc
0x000A3000
0x000BF1D0
0x000BF200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.76376
.reloc
0x00163000
0x0000BC4A
0x0000BE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.18269

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.3298
822
UNKNOWN
English - United States
RT_MANIFEST
2
3.47539
744
UNKNOWN
English - United States
RT_ICON
3
3.01654
296
UNKNOWN
English - United States
RT_ICON
4
5.48554
3752
UNKNOWN
English - United States
RT_ICON
5
5.94421
2216
UNKNOWN
English - United States
RT_ICON
6
4.38883
1384
UNKNOWN
English - United States
RT_ICON
7
7.99566
104079
UNKNOWN
English - United States
RT_ICON
8
4.69967
67624
UNKNOWN
English - United States
RT_ICON
9
4.88299
16936
UNKNOWN
English - United States
RT_ICON
10
5.04599
9640
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WLDAP32.dll
WS2_32.dll
WTSAPI32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
20
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start scripthack_232_927087.exe no specs scripthack_232_927087.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs scripthack_232_927087.exe regsvr32.exe no specs explorer.exe no specs explorer.exe no specs notepad++.exe gup.exe notepad++.exe explorer.exe no specs ccleaner.exe no specs ccleaner.exe iexplore.exe no specs iexplore.exe taskhost.exe no specs taskhost.exe no specs taskhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2180"C:\Users\admin\AppData\Local\Temp\scripthack_232_927087.exe" C:\Users\admin\AppData\Local\Temp\scripthack_232_927087.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Ammi Setup Native
Exit code:
0
Version:
1.7.7.1
1996"C:\Users\admin\AppData\Local\Temp\scripthack_232_927087.exe" -uacC:\Users\admin\AppData\Local\Temp\scripthack_232_927087.exe
scripthack_232_927087.exe
User:
admin
Integrity Level:
HIGH
Description:
Ammi Setup Native
Exit code:
0
Version:
1.7.7.1
1196C:\Windows\system32\cmd.exe /d /c cmd /d /c cmd /d /c start "" "C:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exe" 30057219203613 hye/rH1cwMt5irah3PTxn7fCAaPTns60L3/mwI2w5c9uqepDexoC6bOJRTc3RdMZ5ns3M/aAhWoHd6/4RjBZme92TpbvRJ+M65TBPalh+9xB7GrqUj3+LufTDICPRTWjgT8QJb6Kk18brtV6plBZi5XbdTsqB55pjAk8hVz0EFGJVgecDRjJhdDlaMwpcWB3dmWUJYeo1EXGGmhiHo7hmQ==C:\Windows\system32\cmd.exe—scripthack_232_927087.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2724cmd /d /c cmd /d /c start "" "C:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exe" 30057219203613 hye/rH1cwMt5irah3PTxn7fCAaPTns60L3/mwI2w5c9uqepDexoC6bOJRTc3RdMZ5ns3M/aAhWoHd6/4RjBZme92TpbvRJ+M65TBPalh+9xB7GrqUj3+LufTDICPRTWjgT8QJb6Kk18brtV6plBZi5XbdTsqB55pjAk8hVz0EFGJVgecDRjJhdDlaMwpcWB3dmWUJYeo1EXGGmhiHo7hmQ==C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
2744cmd /d /c start "" "C:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exe" 30057219203613 hye/rH1cwMt5irah3PTxn7fCAaPTns60L3/mwI2w5c9uqepDexoC6bOJRTc3RdMZ5ns3M/aAhWoHd6/4RjBZme92TpbvRJ+M65TBPalh+9xB7GrqUj3+LufTDICPRTWjgT8QJb6Kk18brtV6plBZi5XbdTsqB55pjAk8hVz0EFGJVgecDRjJhdDlaMwpcWB3dmWUJYeo1EXGGmhiHo7hmQ==C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
3092"C:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exe" 30057219203613 hye/rH1cwMt5irah3PTxn7fCAaPTns60L3/mwI2w5c9uqepDexoC6bOJRTc3RdMZ5ns3M/aAhWoHd6/4RjBZme92TpbvRJ+M65TBPalh+9xB7GrqUj3+LufTDICPRTWjgT8QJb6Kk18brtV6plBZi5XbdTsqB55pjAk8hVz0EFGJVgecDRjJhdDlaMwpcWB3dmWUJYeo1EXGGmhiHo7hmQ==C:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exe
cmd.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.9.1.0
4024regsvr32 /s "C:\Program Files\Notepad++\NppShell_06.dll"C:\Windows\system32\regsvr32.exe—scripthack_232_927087.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3020"C:\Windows\explorer.exe" "C:\Program Files\Notepad++\notepad++.exe"C:\Windows\explorer.exe—scripthack_232_927087.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3852C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
3624"C:\Program Files\Notepad++\notepad++.exe" C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Total events
2 408
Read events
1 860
Write events
0
Delete events
0

Modification events

No data
Executable files
16
Suspicious files
56
Text files
203
Unknown types
17

Dropped files

PID
Process
Filename
Type
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\modern-wizard.bmpimage
MD5:C2CF6928A3AB574A5548B4DC1C38B6C0
SHA256:2125550C12FA512782F2016E802D70BC51F4A06017CFBD4176B4A994EB2542F0
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\modern-header.bmpimage
MD5:56DA15FDB8D96F8F5C649DCB5E79D775
SHA256:BB90D4338D2474138473E6B16E94B0237EE847BEA45019ED0DD4439C71BD233E
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\ioSpecial.initext
MD5:982037037BD70FD407823DE1067EB52E
SHA256:8D75CB1995B97D7490B0B35BB853E39A943017EF40F53AFBACA5C469A84050E0
1996scripthack_232_927087.exeC:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exeexecutable
MD5:FBB950C5EF01F7E57079C096F888791A
SHA256:F7EA8518E21E42F500684C3BE35BFA10D1DFF17D7343A67D310FF0AFCC465621
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
2180scripthack_232_927087.exeC:\Users\admin\AppData\Roaming\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
1996scripthack_232_927087.exeC:\ProgramData\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
1996scripthack_232_927087.exeC:\Users\admin\AppData\Roaming\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
2180scripthack_232_927087.exeC:\ProgramData\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\LangDLL.dllexecutable
MD5:AB1DB56369412FE8476FEFFFD11E4CC0
SHA256:6F14C8F01F50A30743DAC68C5AC813451463DFB427EB4E35FCDFE2410E1A913B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
43
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1760
CCleaner.exe
GET
301
151.101.192.64:80
http://www.piriform.com/auto?a=0&p=cc&v=5.35.6210&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&o=6.1W3&au=1&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127
US
—
—
whitelisted
3492
iexplore.exe
GET
301
151.101.192.64:80
http://www.piriform.com/ccleaner/update?a=0&v=5.35.6210&l=1033&o=6.1W3&t=4&au=1
US
—
—
whitelisted
3492
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDliVAU%2F6ZWzwIAAAAAgFX%2B
US
der
472 b
whitelisted
3492
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3492
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
1760
CCleaner.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
1760
CCleaner.exe
GET
200
151.101.2.109:80
http://license.piriform.com/verify/?p=ccpro&c=cc&cv=5.35.6210&l=1033&lk=CJ9T-J7CU-SPNV-GWMB-WBEC&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127
US
text
14 b
whitelisted
3492
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDa2MTpyZrzlQgAAAAAYth4
US
der
472 b
whitelisted
3492
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3492
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1996
scripthack_232_927087.exe
172.67.73.185:443
allstandardsoftware.com
—
US
unknown
1760
CCleaner.exe
151.101.2.109:443
license.piriform.com
Fastly
US
suspicious
3492
iexplore.exe
172.217.22.36:443
www.google.com
Google Inc.
US
whitelisted
—
—
104.31.89.28:443
notepad-plus-plus.org
Cloudflare Inc
US
shared
1760
CCleaner.exe
104.18.20.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared
1760
CCleaner.exe
151.101.194.202:443
www.ccleaner.com
Fastly
US
suspicious
1760
CCleaner.exe
151.101.192.64:80
www.piriform.com
Fastly
US
suspicious
1760
CCleaner.exe
151.101.2.109:80
license.piriform.com
Fastly
US
suspicious
1760
CCleaner.exe
151.101.192.64:443
www.piriform.com
Fastly
US
suspicious
3492
iexplore.exe
151.101.192.64:80
www.piriform.com
Fastly
US
suspicious

DNS requests

Domain
IP
Reputation
allstandardsoftware.com
  • 172.67.73.185
  • 104.26.6.32
  • 104.26.7.32
malicious
notepad-plus-plus.org
  • 104.31.89.28
  • 172.67.218.84
  • 104.31.88.28
whitelisted
www.piriform.com
  • 151.101.192.64
  • 151.101.64.64
  • 151.101.0.64
  • 151.101.128.64
whitelisted
www.ccleaner.com
  • 151.101.194.202
  • 151.101.130.202
  • 151.101.2.202
  • 151.101.66.202
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
license.piriform.com
  • 151.101.2.109
  • 151.101.66.109
  • 151.101.130.109
  • 151.101.194.109
whitelisted
s1.pir.fm
  • 151.139.237.73
suspicious
www.google.com
  • 172.217.22.36
whitelisted
s7.addthis.com
  • 104.75.88.112
whitelisted
fonts.googleapis.com
  • 172.217.11.42
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\Š
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2024 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
scripthack_232_927087.exe