File name:

scripthack_232_927087.exe

Full analysis: https://app.any.run/tasks/48d4ee78-1411-4c60-99a5-d40bbe4c4199
Verdict: Malicious activity
Analysis date: November 30, 2020, 00:15:42
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

C393E1863063EE6546C7108C73CCAE6D

SHA1:

5F43FC499E2FC18EC0E556DD204567DDF0E5A542

SHA256:

9941D688B5F73420891C87D90A6D6B7C59355A7A964AD1DE7519E7E01BED9392

SSDEEP:

24576:kOFo4F2qsze+XMhQatYNTfDfVtykR3CGpRJmuaL:ySEzzMhQaSNDDtQcyGrJmX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • scripthack_232_927087.exe (PID: 3092)
      • regsvr32.exe (PID: 4024)
      • notepad++.exe (PID: 3624)
      • notepad++.exe (PID: 3008)

    • Application was dropped or rewritten from another process

      • scripthack_232_927087.exe (PID: 3092)
      • notepad++.exe (PID: 3624)
      • gup.exe (PID: 3332)
      • notepad++.exe (PID: 3008)

    • Registers / Runs the DLL via REGSVR32.EXE

      • scripthack_232_927087.exe (PID: 3092)

    • Drops executable file immediately after starts

      • scripthack_232_927087.exe (PID: 3092)

    • Loads the Task Scheduler COM API

      • CCleaner.exe (PID: 3152)
      • CCleaner.exe (PID: 1760)

    • Actions looks like stealing of personal data

      • CCleaner.exe (PID: 1760)

  • SUSPICIOUS

    • Creates files in the user directory

      • scripthack_232_927087.exe (PID: 2180)
      • scripthack_232_927087.exe (PID: 1996)
      • scripthack_232_927087.exe (PID: 3092)
      • CCleaner.exe (PID: 1760)

    • Application launched itself

      • scripthack_232_927087.exe (PID: 2180)
      • cmd.exe (PID: 1196)
      • cmd.exe (PID: 2724)

    • Creates files in the program directory

      • scripthack_232_927087.exe (PID: 2180)
      • scripthack_232_927087.exe (PID: 1996)
      • scripthack_232_927087.exe (PID: 3092)

    • Creates a directory in Program Files

      • scripthack_232_927087.exe (PID: 1996)
      • scripthack_232_927087.exe (PID: 3092)

    • Executable content was dropped or overwritten

      • scripthack_232_927087.exe (PID: 1996)
      • scripthack_232_927087.exe (PID: 3092)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 2724)
      • scripthack_232_927087.exe (PID: 1996)
      • cmd.exe (PID: 1196)

    • Drops a file with a compile date too recent

      • scripthack_232_927087.exe (PID: 3092)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 4024)

    • Executed via COM

      • explorer.exe (PID: 3852)

    • Drops a file that was compiled in debug mode

      • scripthack_232_927087.exe (PID: 3092)

    • Starts Internet Explorer

      • CCleaner.exe (PID: 1760)

    • Executed via Task Scheduler

      • CCleaner.exe (PID: 1760)

    • Creates a software uninstall entry

      • scripthack_232_927087.exe (PID: 3092)

    • Reads internet explorer settings

      • CCleaner.exe (PID: 1760)

    • Executed as Windows Service

      • taskhost.exe (PID: 2020)
      • taskhost.exe (PID: 3272)
      • taskhost.exe (PID: 1708)

    • Low-level read access rights to disk partition

      • CCleaner.exe (PID: 1760)

  • INFO

    • Manual execution by user

      • explorer.exe (PID: 2144)
      • CCleaner.exe (PID: 3152)

    • Creates files in the user directory

      • iexplore.exe (PID: 3492)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3492)

    • Application launched itself

      • iexplore.exe (PID: 464)

    • Changes internet zones settings

      • iexplore.exe (PID: 464)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 3492)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3492)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3492)

    • Dropped object may contain Bitcoin addresses

      • taskhost.exe (PID: 2020)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2020:05:20 18:33:43+02:00
PEType: PE32
LinkerVersion: 11
CodeSize: 543744
InitializedDataSize: 944640
UninitializedDataSize: -
EntryPoint: 0x5d794
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.7.7.1
ProductVersionNumber: 1.7.7.1
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
FileDescription: Ammi Setup Native
FileVersion: 1.7.7.1
InternalName: AmmiSetupNative.exe
LegalCopyright: Copyright 2020
OriginalFileName: AmmiSetupNative.exe
ProductName: AmmiSetupNative
ProductVersion: 1.7.7.1

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 20-May-2020 16:33:43
Detected languages:
  • English - United States
FileDescription: Ammi Setup Native
FileVersion: 1.7.7.1
InternalName: AmmiSetupNative.exe
LegalCopyright: Copyright 2020
OriginalFilename: AmmiSetupNative.exe
ProductName: AmmiSetupNative
ProductVersion: 1.7.7.1

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000110

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 6
Time date stamp: 20-May-2020 16:33:43
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00084722
0x00084800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.62054
.gfp4
0x00086000
0x000002F0
0x00000400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
4.81358
.rdata
0x00087000
0x0001794E
0x00017A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.39998
.data
0x0009F000
0x00003E78
0x00001A00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
3.62769
.rsrc
0x000A3000
0x000BF1D0
0x000BF200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
7.76376
.reloc
0x00163000
0x0000BC4A
0x0000BE00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
4.18269

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.3298
822
UNKNOWN
English - United States
RT_MANIFEST
2
3.47539
744
UNKNOWN
English - United States
RT_ICON
3
3.01654
296
UNKNOWN
English - United States
RT_ICON
4
5.48554
3752
UNKNOWN
English - United States
RT_ICON
5
5.94421
2216
UNKNOWN
English - United States
RT_ICON
6
4.38883
1384
UNKNOWN
English - United States
RT_ICON
7
7.99566
104079
UNKNOWN
English - United States
RT_ICON
8
4.69967
67624
UNKNOWN
English - United States
RT_ICON
9
4.88299
16936
UNKNOWN
English - United States
RT_ICON
10
5.04599
9640
UNKNOWN
English - United States
RT_ICON

Imports

ADVAPI32.dll
CRYPT32.dll
KERNEL32.dll
OLEAUT32.dll
SHELL32.dll
SHLWAPI.dll
USER32.dll
WLDAP32.dll
WS2_32.dll
WTSAPI32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
65
Monitored processes
20
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start scripthack_232_927087.exe no specs scripthack_232_927087.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs scripthack_232_927087.exe regsvr32.exe no specs explorer.exe no specs explorer.exe no specs notepad++.exe gup.exe notepad++.exe explorer.exe no specs ccleaner.exe no specs ccleaner.exe iexplore.exe no specs iexplore.exe taskhost.exe no specs taskhost.exe no specs taskhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
464"C:\Program Files\Internet Explorer\iexplore.exe" http://www.piriform.com/ccleaner/update?a=0&v=5.35.6210&l=1033&o=6.1W3&t=4&au=1C:\Program Files\Internet Explorer\iexplore.exe—CCleaner.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1196C:\Windows\system32\cmd.exe /d /c cmd /d /c cmd /d /c start "" "C:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exe" 30057219203613 hye/rH1cwMt5irah3PTxn7fCAaPTns60L3/mwI2w5c9uqepDexoC6bOJRTc3RdMZ5ns3M/aAhWoHd6/4RjBZme92TpbvRJ+M65TBPalh+9xB7GrqUj3+LufTDICPRTWjgT8QJb6Kk18brtV6plBZi5XbdTsqB55pjAk8hVz0EFGJVgecDRjJhdDlaMwpcWB3dmWUJYeo1EXGGmhiHo7hmQ==C:\Windows\system32\cmd.exe—scripthack_232_927087.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1708"taskhost.exe"C:\Windows\system32\taskhost.exe—services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1760"C:\Program Files\CCleaner\CCleaner.exe" /uacC:\Program Files\CCleaner\CCleaner.exe
taskeng.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
HIGH
Description:
CCleaner
Exit code:
0
Version:
5, 35, 0, 6210
Modules
Images
c:\program files\ccleaner\ccleaner.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
1996"C:\Users\admin\AppData\Local\Temp\scripthack_232_927087.exe" -uacC:\Users\admin\AppData\Local\Temp\scripthack_232_927087.exe
scripthack_232_927087.exe
User:
admin
Integrity Level:
HIGH
Description:
Ammi Setup Native
Exit code:
0
Version:
1.7.7.1
Modules
Images
c:\users\admin\appdata\local\temp\scripthack_232_927087.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\pcwum.dll
c:\windows\system32\ws2_32.dll
2020"taskhost.exe"C:\Windows\system32\taskhost.exe—services.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Host Process for Windows Tasks
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2144"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2180"C:\Users\admin\AppData\Local\Temp\scripthack_232_927087.exe" C:\Users\admin\AppData\Local\Temp\scripthack_232_927087.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Ammi Setup Native
Exit code:
0
Version:
1.7.7.1
Modules
Images
c:\users\admin\appdata\local\temp\scripthack_232_927087.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\pcwum.dll
c:\windows\system32\ws2_32.dll
2724cmd /d /c cmd /d /c start "" "C:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exe" 30057219203613 hye/rH1cwMt5irah3PTxn7fCAaPTns60L3/mwI2w5c9uqepDexoC6bOJRTc3RdMZ5ns3M/aAhWoHd6/4RjBZme92TpbvRJ+M65TBPalh+9xB7GrqUj3+LufTDICPRTWjgT8QJb6Kk18brtV6plBZi5XbdTsqB55pjAk8hVz0EFGJVgecDRjJhdDlaMwpcWB3dmWUJYeo1EXGGmhiHo7hmQ==C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2744cmd /d /c start "" "C:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exe" 30057219203613 hye/rH1cwMt5irah3PTxn7fCAaPTns60L3/mwI2w5c9uqepDexoC6bOJRTc3RdMZ5ns3M/aAhWoHd6/4RjBZme92TpbvRJ+M65TBPalh+9xB7GrqUj3+LufTDICPRTWjgT8QJb6Kk18brtV6plBZi5XbdTsqB55pjAk8hVz0EFGJVgecDRjJhdDlaMwpcWB3dmWUJYeo1EXGGmhiHo7hmQ==C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
2 408
Read events
1 860
Write events
506
Delete events
42

Modification events

(PID) Process:(2180) scripthack_232_927087.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2180) scripthack_232_927087.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(4024) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ANotepad++
Operation:delete keyName:(default)
Value:
(PID) Process:(4024) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(4024) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\Settings
Operation:delete keyName:(default)
Value:
(PID) Process:(4024) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}
Operation:delete keyName:(default)
Value:
(PID) Process:(4024) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}
Operation:writeName:(default)
Value:
ANotepad++
(PID) Process:(4024) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:writeName:(default)
Value:
C:\Program Files\Notepad++\NppShell_06.dll
(PID) Process:(4024) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(4024) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\Settings
Operation:writeName:Title
Value:
Edit with &Notepad++
Executable files
16
Suspicious files
56
Text files
203
Unknown types
17

Dropped files

PID
Process
Filename
Type
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\ioSpecial.initext
MD5:—
SHA256:—
1996scripthack_232_927087.exeC:\Program Files\AmmiSetuplviNative\scripthack_232_927087.exeexecutable
MD5:—
SHA256:—
2180scripthack_232_927087.exeC:\ProgramData\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
1996scripthack_232_927087.exeC:\Users\admin\AppData\Roaming\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
1996scripthack_232_927087.exeC:\ProgramData\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
2180scripthack_232_927087.exeC:\Users\admin\AppData\Roaming\folder\Buffertempphobinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\InstallOptions.dllexecutable
MD5:05BF02DA51E717F79F6B5CBEA7BC0710
SHA256:CA092BA7F275B0C9000098CDD1A9876FE8DC050FCB40A0E8A1AB8335236E9DC5
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\LangDLL.dllexecutable
MD5:AB1DB56369412FE8476FEFFFD11E4CC0
SHA256:6F14C8F01F50A30743DAC68C5AC813451463DFB427EB4E35FCDFE2410E1A913B
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
3092scripthack_232_927087.exeC:\Users\admin\AppData\Local\Temp\nsz2CDD.tmp\modern-wizard.bmpimage
MD5:C2CF6928A3AB574A5548B4DC1C38B6C0
SHA256:2125550C12FA512782F2016E802D70BC51F4A06017CFBD4176B4A994EB2542F0
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
19
TCP/UDP connections
43
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1760
CCleaner.exe
GET
301
151.101.192.64:80
http://www.piriform.com/auto?a=0&p=cc&v=5.35.6210&l=1033&lk=&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&o=6.1W3&au=1&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127
US
—
—
whitelisted
3492
iexplore.exe
GET
301
151.101.192.64:80
http://www.piriform.com/ccleaner/update?a=0&v=5.35.6210&l=1033&o=6.1W3&t=4&au=1
US
—
—
whitelisted
1760
CCleaner.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
US
der
1.49 Kb
whitelisted
3492
iexplore.exe
GET
200
172.217.18.99:80
http://ocsp.pki.goog/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDa2MTpyZrzlQgAAAAAYth4
US
der
472 b
whitelisted
1760
CCleaner.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/ME8wTTBLMEkwRzAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDkbwjNvPLFRm7zMB3V80
US
der
1.49 Kb
whitelisted
1760
CCleaner.exe
GET
200
151.101.2.109:80
http://license.piriform.com/verify/?p=ccpro&c=cc&cv=5.35.6210&l=1033&lk=CJ9T-J7CU-SPNV-GWMB-WBEC&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-HZ8S&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gu=00000000-0000-4000-8000-d6f7f2be5127
US
text
14 b
whitelisted
3492
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
3492
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
3492
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAtb9ltrp%2FvQiykNkEU33uA%3D
US
der
471 b
whitelisted
3492
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEATh56TcXPLzbcArQrhdFZ8%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1996
scripthack_232_927087.exe
172.67.73.185:443
allstandardsoftware.com
—
US
unknown
—
—
104.31.89.28:443
notepad-plus-plus.org
Cloudflare Inc
US
shared
1760
CCleaner.exe
151.101.192.64:80
www.piriform.com
Fastly
US
suspicious
1760
CCleaner.exe
151.101.192.64:443
www.piriform.com
Fastly
US
suspicious
1760
CCleaner.exe
151.101.194.202:443
www.ccleaner.com
Fastly
US
suspicious
1760
CCleaner.exe
104.18.20.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared
1760
CCleaner.exe
151.101.2.109:443
license.piriform.com
Fastly
US
suspicious
1760
CCleaner.exe
151.101.2.109:80
license.piriform.com
Fastly
US
suspicious
3492
iexplore.exe
151.101.194.202:443
www.ccleaner.com
Fastly
US
suspicious
3492
iexplore.exe
151.101.192.64:80
www.piriform.com
Fastly
US
suspicious

DNS requests

Domain
IP
Reputation
allstandardsoftware.com
  • 172.67.73.185
  • 104.26.6.32
  • 104.26.7.32
malicious
notepad-plus-plus.org
  • 104.31.89.28
  • 172.67.218.84
  • 104.31.88.28
whitelisted
www.piriform.com
  • 151.101.192.64
  • 151.101.64.64
  • 151.101.0.64
  • 151.101.128.64
whitelisted
www.ccleaner.com
  • 151.101.194.202
  • 151.101.130.202
  • 151.101.2.202
  • 151.101.66.202
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
license.piriform.com
  • 151.101.2.109
  • 151.101.66.109
  • 151.101.130.109
  • 151.101.194.109
whitelisted
s1.pir.fm
  • 151.139.237.73
suspicious
www.google.com
  • 172.217.22.36
malicious
s7.addthis.com
  • 104.75.88.112
whitelisted
fonts.googleapis.com
  • 172.217.11.42
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\Š
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
scripthack_232_927087.exe