File name:

[www.gigapurbalingga.net]_CClenr5436520.rar

Full analysis: https://app.any.run/tasks/ce04d51e-4907-4d0e-bb87-7dbeb45c79ad
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 23, 2019, 23:21:15
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
opendir
Indicators:
MIME: application/x-rar
File info: RAR archive data, v4, os: Win32
MD5:

730CBC68037E4B62F35FB3DBE830E234

SHA1:

A89BFBDF9C3547DE259FCFA0A44F1666F06DAD6A

SHA256:

D4675D188D7FE6FCC82FBF79964CA8B6119B473E9E5CB7B47B45EDCED1A866A6

SSDEEP:

393216:UkSw8wAnDObmT/Xt577K6rqANLlKvHzn27h:UkSw8/Ym7Xr7O6V6vTn2t

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • ccsetup543_pro.exe (PID: 2524)
      • ccsetup543_pro.exe (PID: 3400)
      • ns2BD9.tmp (PID: 2764)
      • CCleaner.exe (PID: 3068)
      • CCUpdate.exe (PID: 1004)
      • CCUpdate.exe (PID: 992)
      • CCUpdate.exe (PID: 2552)
      • CCleaner.exe (PID: 3804)
      • Keygen.exe (PID: 2288)

    • Changes settings of System certificates

      • ccsetup543_pro.exe (PID: 3400)

    • Loads dropped or rewritten executable

      • ccsetup543_pro.exe (PID: 3400)
      • CCleaner.exe (PID: 3068)
      • CCUpdate.exe (PID: 2552)
      • CCleaner.exe (PID: 3804)

    • Loads the Task Scheduler COM API

      • CCUpdate.exe (PID: 1004)
      • CCleaner.exe (PID: 3068)
      • CCUpdate.exe (PID: 992)

    • Downloads executable files from the Internet

      • CCUpdate.exe (PID: 1004)

  • SUSPICIOUS

    • Low-level read access rights to disk partition

      • ccsetup543_pro.exe (PID: 3400)
      • CCUpdate.exe (PID: 1004)
      • CCUpdate.exe (PID: 992)
      • CCUpdate.exe (PID: 2552)
      • CCleaner.exe (PID: 3804)

    • Executable content was dropped or overwritten

      • ccsetup543_pro.exe (PID: 3400)
      • WinRAR.exe (PID: 3064)
      • WinRAR.exe (PID: 4052)
      • CCUpdate.exe (PID: 1004)
      • CCUpdate.exe (PID: 992)

    • Modifies the open verb of a shell class

      • ccsetup543_pro.exe (PID: 3400)

    • Starts application with an unusual extension

      • ccsetup543_pro.exe (PID: 3400)

    • Searches for installed software

      • ccsetup543_pro.exe (PID: 3400)

    • Adds / modifies Windows certificates

      • ccsetup543_pro.exe (PID: 3400)

    • Creates a software uninstall entry

      • ccsetup543_pro.exe (PID: 3400)

    • Creates files in the program directory

      • ccsetup543_pro.exe (PID: 3400)
      • CCUpdate.exe (PID: 1004)
      • CCUpdate.exe (PID: 992)

    • Starts Internet Explorer

      • ccsetup543_pro.exe (PID: 3400)

    • Application launched itself

      • CCUpdate.exe (PID: 1004)

    • Creates files in the user directory

      • notepad++.exe (PID: 2212)

  • INFO

    • Manual execution by user

      • WinRAR.exe (PID: 4052)
      • ccsetup543_pro.exe (PID: 2524)
      • ccsetup543_pro.exe (PID: 3400)
      • NOTEPAD.EXE (PID: 1724)
      • msinfo32.exe (PID: 2752)
      • Keygen.exe (PID: 2288)
      • notepad.exe (PID: 1204)
      • explorer.exe (PID: 3884)
      • notepad++.exe (PID: 2212)

    • Application launched itself

      • iexplore.exe (PID: 3428)

    • Changes internet zones settings

      • iexplore.exe (PID: 3428)

    • Reads internet explorer settings

      • iexplore.exe (PID: 4036)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 4036)

    • Changes settings of System certificates

      • iexplore.exe (PID: 4036)

    • Creates files in the user directory

      • iexplore.exe (PID: 4036)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 4036)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v-4.x) (58.3)
.rar | RAR compressed archive (gen) (41.6)

EXIF

ZIP

CompressedSize: 300
UncompressedSize: 252
OperatingSystem: Win32
ModifyDate: 2017:09:05 14:45:20
PackingMethod: Normal
ArchivedFileName: [www.gigapurbalingga.net]_CClenr5436520\Android Mania.url
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
71
Monitored processes
20
Malicious processes
6
Suspicious processes
1

Behavior graph

Click at the process to see the details
start drop and start drop and start drop and start drop and start drop and start drop and start winrar.exe ccsetup543_pro.exe no specs ccsetup543_pro.exe ns2bd9.tmp no specs ping.exe no specs winrar.exe ccleaner.exe ccupdate.exe iexplore.exe ccupdate.exe iexplore.exe ccleaner.exe ccupdate.exe keygen.exe no specs notepad.exe no specs msinfo32.exe no specs notepad++.exe gup.exe notepad.exe explorer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
992dummy /emupdaterC:\Program Files\CCleaner\CCUpdate.exe
CCUpdate.exe
User:
admin
Company:
Piriform Software Ltd
Integrity Level:
HIGH
Description:
CCleaner emergency updater
Exit code:
0
Version:
19.2.566.0
Modules
Images
c:\program files\ccleaner\ccupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1004"C:\Program Files\CCleaner\CCUpdate.exe" /regC:\Program Files\CCleaner\CCUpdate.exe
ccsetup543_pro.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
HIGH
Description:
CCleaner emergency updater
Exit code:
1237
Version:
18.3.370.0
Modules
Images
c:\program files\ccleaner\ccupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
1204"C:\Windows\system32\notepad.exe" C:\Windows\system32\notepad.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1724"C:\Windows\system32\NOTEPAD.EXE" C:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\Keygen\Read Me!!!.txtC:\Windows\system32\NOTEPAD.EXE—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Notepad
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\notepad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2212"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\Keygen\CORE.NFO"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2288"C:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\Keygen\Keygen.exe" C:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\Keygen\Keygen.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\[www.gigapurbalingga.net]_cclenr5436520\keygen\keygen.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-crt-heap-l1-1-0.dll
c:\windows\system32\ucrtbase.dll
2524"C:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\ccsetup543_pro.exe" C:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\ccsetup543_pro.exe—explorer.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
MEDIUM
Description:
CCleaner Installer
Exit code:
3221226540
Version:
5.43.150.6520
Modules
Images
c:\users\admin\desktop\[www.gigapurbalingga.net]_cclenr5436520\ccsetup543_pro.exe
c:\systemroot\system32\ntdll.dll
2552CCUpdate.exe /emupdater /applydll "C:\Program Files\CCleaner\Setup\cb77a3a0-c603-4003-acc2-e7d3bdfb70d4.dll"C:\Program Files\CCleaner\CCUpdate.exe
CCUpdate.exe
User:
admin
Company:
Piriform Ltd
Integrity Level:
HIGH
Description:
CCleaner emergency updater
Exit code:
0
Version:
18.3.370.0
Modules
Images
c:\program files\ccleaner\ccupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
2752"C:\Windows\system32\msinfo32.exe" "C:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\Keygen\CORE.NFO"C:\Windows\system32\msinfo32.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
System Information
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msinfo32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2764"C:\Users\admin\AppData\Local\Temp\nss1FB2.tmp\ns2BD9.tmp" ping -n 1 -w 1000 www.ccleaner.comC:\Users\admin\AppData\Local\Temp\nss1FB2.tmp\ns2BD9.tmp—ccsetup543_pro.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nss1fb2.tmp\ns2bd9.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
Total events
2 298
Read events
1 943
Write events
346
Delete events
9

Modification events

(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3064) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\62\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\[www.gigapurbalingga.net]_CClenr5436520.rar
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3064) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3400) ccsetup543_pro.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Piriform\CCleaner
Operation:delete valueName:GUID
Value:
00000000-0000-4000-8000-d6f7f2be5127
(PID) Process:(4052) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
Executable files
79
Suspicious files
9
Text files
66
Unknown types
14

Dropped files

PID
Process
Filename
Type
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3064.26746\[www.gigapurbalingga.net]_CClenr5436520\GigaPurbalingga.Net_Free Download Software Full Version.urltext
MD5:—
SHA256:—
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3064.26746\[www.gigapurbalingga.net]_CClenr5436520\ccsetup543_pro.exeexecutable
MD5:—
SHA256:—
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3064.26746\[www.gigapurbalingga.net]_CClenr5436520\Read Me!!!.txttext
MD5:—
SHA256:—
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3064.26746\[www.gigapurbalingga.net]_CClenr5436520\Keygen.rarcompressed
MD5:—
SHA256:—
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3064.26746\[www.gigapurbalingga.net]_CClenr5436520\Tutorial Video.urltext
MD5:—
SHA256:—
3064WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$DRa3064.26746\[www.gigapurbalingga.net]_CClenr5436520\Android Mania.urltext
MD5:—
SHA256:—
3400ccsetup543_pro.exeC:\Users\admin\AppData\Local\Temp\nss1FB2.tmp\UserInfo.dllexecutable
MD5:C1F778A6D65178D34BDE4206161A98E0
SHA256:9CAF7A78F750713180CF64D18967A2B803B5580E636E59279DCAAF18BA0DAA87
4052WinRAR.exeC:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\Keygen\Android Mania.urltext
MD5:—
SHA256:—
3400ccsetup543_pro.exeC:\Users\admin\AppData\Local\Temp\CheckUpdate.log —
MD5:—
SHA256:—
4052WinRAR.exeC:\Users\admin\Desktop\[www.gigapurbalingga.net]_CClenr5436520\Keygen\GigaPurbalingga.Net_Free Download Software Full Version.urltext
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
56
TCP/UDP connections
57
DNS requests
43
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
992
CCUpdate.exe
HEAD
200
2.16.186.73:80
http://emupdate.avcdn.net/files/emupdate/pong.txt
unknown
—
—
whitelisted
3400
ccsetup543_pro.exe
GET
200
151.101.0.64:80
http://service.piriform.com/installcheck.aspx?p=1&v=5.43.6520&vx=5.35.6210&l=1033&b=2&o=6.1W3&g=0&i=1&a=3&e=0&n=ccsetup543_pro.exe&id=300&mk=IJR6-W5SV-5KYR-QBZD-6BY4-RN5Z-WAV9-RVK2-VJCA&mx=97B7721C4994E2556FF6A439510F665DB45337A341A47E15F4997584423BF714&gd=c04c547a-7e24-4c77-bfdd-aa46a56f8b03
US
text
4 b
whitelisted
2552
CCUpdate.exe
GET
200
5.62.38.21:80
http://ip-info.ff.avast.com/v2/info
NL
text
354 b
whitelisted
992
CCUpdate.exe
GET
200
5.62.38.21:80
http://ip-info.ff.avast.com/v2/info
NL
text
354 b
whitelisted
4036
iexplore.exe
GET
200
151.101.2.202:80
http://www.ccleaner.com/go/app_releasenotes?p=1&v=5.43.6520&l=1033&b=2&a=3
US
html
1.83 Kb
whitelisted
1004
CCUpdate.exe
GET
200
2.16.186.59:80
http://ccleaner.tools.avcdn.net/tools/ccleaner/update/updates.xml
unknown
xml
1.55 Kb
whitelisted
1004
CCUpdate.exe
GET
200
2.16.186.59:80
http://ccleaner.tools.avcdn.net/tools/ccleaner/update/20180205.dll
unknown
executable
469 Kb
whitelisted
2552
CCUpdate.exe
GET
200
216.58.208.46:80
http://www.google-analytics.com/collect?v=1&tid=UA-58120669-26&t=event&cid=97b7721c4994e2556ff6a439510f665db45337a341a47e15f4997584423bf714&ec=20180910&ea=edition&el=Pro&ev=0
US
image
35 b
whitelisted
2552
CCUpdate.exe
GET
200
216.58.208.46:80
http://www.google-analytics.com/collect?v=1&tid=UA-58120669-26&t=event&cid=97b7721c4994e2556ff6a439510f665db45337a341a47e15f4997584423bf714&ec=20180910&ea=executed&el=1&ev=0
US
image
35 b
whitelisted
1004
CCUpdate.exe
GET
200
2.16.186.59:80
http://ccleaner.tools.avcdn.net/tools/ccleaner/update/ccupdate10.cab
unknown
compressed
317 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3400
ccsetup543_pro.exe
151.101.2.202:443
www.ccleaner.com
Fastly
US
suspicious
3400
ccsetup543_pro.exe
151.101.0.64:80
service.piriform.com
Fastly
US
whitelisted
1004
CCUpdate.exe
2.16.186.59:80
ccleaner.tools.avcdn.net
Akamai International B.V.
—
whitelisted
1004
CCUpdate.exe
5.62.38.21:80
ip-info.ff.avast.com
AVAST Software s.r.o.
NL
suspicious
1004
CCUpdate.exe
2.16.186.73:80
emupdate.avcdn.net
Akamai International B.V.
—
whitelisted
3068
CCleaner.exe
93.184.221.240:80
www.download.windowsupdate.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
2552
CCUpdate.exe
5.62.38.21:80
ip-info.ff.avast.com
AVAST Software s.r.o.
NL
suspicious
2552
CCUpdate.exe
216.58.208.46:80
www.google-analytics.com
Google Inc.
US
whitelisted
4036
iexplore.exe
151.101.2.202:80
www.ccleaner.com
Fastly
US
suspicious
3428
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.ccleaner.com
  • 151.101.2.202
  • 151.101.66.202
  • 151.101.130.202
  • 151.101.194.202
whitelisted
service.piriform.com
  • 151.101.0.64
  • 151.101.64.64
  • 151.101.128.64
  • 151.101.192.64
whitelisted
ip-info.ff.avast.com
  • 5.62.38.20
  • 5.62.38.21
whitelisted
emupdate.avcdn.net
  • 2.16.186.51
  • 2.16.186.73
whitelisted
ccleaner.tools.avcdn.net
  • 2.16.186.56
  • 2.16.186.59
whitelisted
www.download.windowsupdate.com
  • 93.184.221.240
whitelisted
www.google-analytics.com
  • 216.58.208.46
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
cdn.mxpnl.com
  • 130.211.5.208
  • 35.186.235.23
whitelisted
www.googletagmanager.com
  • 216.58.208.40
whitelisted

Threats

PID
Process
Class
Message
1004
CCUpdate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
[www.gigapurbalingga.net]_CClenr5436520.rar