download:

/npp.exe

Full analysis: https://app.any.run/tasks/8841d4de-0736-425e-9921-1375d013c333
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: November 28, 2024, 18:37:48
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
phorpiex
loader
miner
xor-url
generic
xmrig
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

08DAFE3BB2654C06EAD4BB33FB793DF8

SHA1:

D1D93023F1085EED136C6D225D998ABF2D5A5BF0

SHA256:

FC16C0BF09002C93723B8AB13595DB5845A50A1B6A133237AC2D148B0BB41700

SSDEEP:

96:/FKn3eGXuNYFz4YSMgSjGUa1HPVd1n1i15iKEt8pBqiJkC7tCEgwrY:tcOGXlLSwGUyA5i/OpgiJFgOY

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHORPIEX has been detected (SURICATA)

      • svchost.exe (PID: 2192)
      • sysnldcvmr.exe (PID: 6920)

    • Changes the autorun value in the registry

      • 167914860.exe (PID: 6404)
      • reg.exe (PID: 5604)
      • reg.exe (PID: 2756)

    • Connects to the CnC server

      • sysnldcvmr.exe (PID: 6920)
      • dwm.exe (PID: 6344)

    • PHORPIEX has been detected (YARA)

      • sysnldcvmr.exe (PID: 6920)

    • XMRIG has been detected (YARA)

      • dwm.exe (PID: 6344)

    • XORed URL has been found (YARA)

      • dwm.exe (PID: 6344)

    • MINER has been detected (SURICATA)

      • dwm.exe (PID: 6344)

  • SUSPICIOUS

    • Potential Corporate Privacy Violation

      • npp.exe (PID: 2728)
      • 239375400.exe (PID: 1596)
      • dwm.exe (PID: 6344)
      • 61091195.exe (PID: 6276)

    • Reads security settings of Internet Explorer

      • npp.exe (PID: 2728)
      • sysnldcvmr.exe (PID: 6920)
      • 3171317145.exe (PID: 7024)
      • 239375400.exe (PID: 1596)
      • 2155625709.exe (PID: 3060)
      • 61091195.exe (PID: 6276)

    • Executable content was dropped or overwritten

      • npp.exe (PID: 2728)
      • 167914860.exe (PID: 6404)
      • 239375400.exe (PID: 1596)
      • 1053027972.exe (PID: 536)
      • winupsecvmgr.exe (PID: 1064)
      • 61091195.exe (PID: 6276)
      • 3947427137.exe (PID: 3996)

    • Starts itself from another location

      • 167914860.exe (PID: 6404)

    • Connects to the server without a host name

      • sysnldcvmr.exe (PID: 6920)
      • 239375400.exe (PID: 1596)
      • 2155625709.exe (PID: 3060)
      • 61091195.exe (PID: 6276)

    • Reads the date of Windows installation

      • 3171317145.exe (PID: 7024)

    • Starts CMD.EXE for commands execution

      • 3171317145.exe (PID: 7024)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 7076)

    • Deletes scheduled task without confirmation

      • schtasks.exe (PID: 6300)

    • Process requests binary or script from the Internet

      • 239375400.exe (PID: 1596)
      • 61091195.exe (PID: 6276)

    • Drops a system driver (possible attempt to evade defenses)

      • winupsecvmgr.exe (PID: 1064)

    • Connects to unusual port

      • dwm.exe (PID: 6344)
      • sysnldcvmr.exe (PID: 6920)

    • Crypto Currency Mining Activity Detected

      • dwm.exe (PID: 6344)

  • INFO

    • Checks supported languages

      • npp.exe (PID: 2728)
      • 167914860.exe (PID: 6404)
      • sysnldcvmr.exe (PID: 6920)
      • 3171317145.exe (PID: 7024)
      • 239375400.exe (PID: 1596)
      • 1053027972.exe (PID: 536)
      • 2155625709.exe (PID: 3060)
      • 842713246.exe (PID: 3536)
      • winupsecvmgr.exe (PID: 1064)
      • 3947427137.exe (PID: 3996)
      • 61091195.exe (PID: 6276)

    • Create files in a temporary directory

      • npp.exe (PID: 2728)

    • Creates files or folders in the user directory

      • npp.exe (PID: 2728)

    • Reads the computer name

      • npp.exe (PID: 2728)
      • sysnldcvmr.exe (PID: 6920)
      • 3171317145.exe (PID: 7024)
      • 239375400.exe (PID: 1596)
      • 2155625709.exe (PID: 3060)
      • 61091195.exe (PID: 6276)

    • Checks proxy server information

      • npp.exe (PID: 2728)
      • sysnldcvmr.exe (PID: 6920)
      • 239375400.exe (PID: 1596)
      • 2155625709.exe (PID: 3060)
      • 61091195.exe (PID: 6276)

    • The process uses the downloaded file

      • 167914860.exe (PID: 6404)

    • Process checks computer location settings

      • 3171317145.exe (PID: 7024)

    • Manual execution by a user

      • reg.exe (PID: 5604)
      • winupsecvmgr.exe (PID: 1064)
      • dwm.exe (PID: 6344)
      • reg.exe (PID: 2756)
      • conhost.exe (PID: 4640)
      • Taskmgr.exe (PID: 1416)
      • Taskmgr.exe (PID: 6844)

    • Reads the machine GUID from the registry

      • sysnldcvmr.exe (PID: 6920)

    • Reads security settings of Internet Explorer

      • Taskmgr.exe (PID: 1416)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:11:24 16:21:06+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 3584
InitializedDataSize: 5632
UninitializedDataSize: -
EntryPoint: 0x16e1
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
152
Monitored processes
27
Malicious processes
7
Suspicious processes
4

Behavior graph

Click at the process to see the details
start npp.exe 167914860.exe #PHORPIEX svchost.exe #PHORPIEX sysnldcvmr.exe 3171317145.exe no specs cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs reg.exe no specs schtasks.exe no specs 239375400.exe 1053027972.exe 2155625709.exe reg.exe conhost.exe no specs winupsecvmgr.exe 842713246.exe no specs reg.exe conhost.exe no specs conhost.exe no specs #MINER dwm.exe 61091195.exe 3947427137.exe taskmgr.exe no specs taskmgr.exe rundll32.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
536C:\Users\admin\AppData\Local\Temp\1053027972.exeC:\Users\admin\AppData\Local\Temp\1053027972.exe
239375400.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\1053027972.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
1064C:\Users\admin\Microsoft Windows Security\winupsecvmgr.exeC:\Users\admin\Microsoft Windows Security\winupsecvmgr.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\microsoft windows security\winupsecvmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
1416"C:\WINDOWS\system32\taskmgr.exe" /4C:\Windows\System32\Taskmgr.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Task Manager
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\taskmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\powrprof.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1596C:\Users\admin\AppData\Local\Temp\239375400.exeC:\Users\admin\AppData\Local\Temp\239375400.exe
sysnldcvmr.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\239375400.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2192C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2728"C:\Users\admin\Desktop\npp.exe" C:\Users\admin\Desktop\npp.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\desktop\npp.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
2756C:\WINDOWS\System32\reg.exe add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Windows Security" /t REG_SZ /f /d "C:\Users\admin\Microsoft Windows Security\winupsecvmgr.exe"C:\Windows\System32\reg.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ws2_32.dll
3060C:\Users\admin\AppData\Local\Temp\2155625709.exeC:\Users\admin\AppData\Local\Temp\2155625709.exe
sysnldcvmr.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\2155625709.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
3536C:\Users\admin\AppData\Local\Temp\842713246.exeC:\Users\admin\AppData\Local\Temp\842713246.exe—sysnldcvmr.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\842713246.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
3996C:\Users\admin\AppData\Local\Temp\3947427137.exeC:\Users\admin\AppData\Local\Temp\3947427137.exe
61091195.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\appdata\local\temp\3947427137.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\shlwapi.dll
Total events
12 015
Read events
11 993
Write events
20
Delete events
2

Modification events

(PID) Process:(2728) npp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2728) npp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2728) npp.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(6404) 167914860.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows Settings
Value:
C:\Users\admin\sysnldcvmr.exe
(PID) Process:(6920) sysnldcvmr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(6920) sysnldcvmr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(6920) sysnldcvmr.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(5388) reg.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:delete valueName:Windows Upgrade Manager
Value:
(PID) Process:(1596) 239375400.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1596) 239375400.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
Executable files
13
Suspicious files
12
Text files
1
Unknown types
0

Dropped files

PID
Process
Filename
Type
2728npp.exeC:\Users\admin\AppData\Local\Temp\167914860.exeexecutable
MD5:0C883B1D66AFCE606D9830F48D69D74B
SHA256:D921FC993574C8BE76553BCF4296D2851E48EE39B958205E69BDFD7CF661D2B1
6920sysnldcvmr.exeC:\Users\admin\AppData\Local\Temp\239375400.exebinary
MD5:2266F0AECD351E1B4092E82B941211EA
SHA256:CBBAD0AB02CD973C9C4E73336E3BCD0849AEB2232A7BDBC38F0B50696B5C28C3
6920sysnldcvmr.exeC:\Users\admin\AppData\Local\Temp\2155625709.exebinary
MD5:4770D41752F66A70BFC7FDAC3D3FF9AF
SHA256:96F20FC5DCD47244A3ED3FE9137D9226A9DAFB8C758DCD3839C60CE097EF80B0
1596239375400.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\nxmr[1].exeexecutable
MD5:13B26B2C7048A92D6A843C1302618FAD
SHA256:1753AD35ECE25AB9A19048C70062E9170F495E313D7355EBBBA59C38F5D90256
6920sysnldcvmr.exeC:\Users\admin\AppData\Local\Temp\3171317145.exebinary
MD5:39F45EDB23427EBF63197CA138DDB282
SHA256:77FBB0D8630024634880C37DA59CE57D1B38C7E85BDCC14C697DB9E79C24E0DE
6920sysnldcvmr.exeC:\Users\admin\AppData\Local\Temp\842713246.exebinary
MD5:6EEB3A61EA7F8C560BA8580AD03C7F4F
SHA256:5E9CF6BB5E09411196A31E750E8CD3028EE3ECCE24B97F010255B701B11E4AE6
5361053027972.exeC:\Users\admin\Microsoft Windows Security\winupsecvmgr.exeexecutable
MD5:13B26B2C7048A92D6A843C1302618FAD
SHA256:1753AD35ECE25AB9A19048C70062E9170F495E313D7355EBBBA59C38F5D90256
1064winupsecvmgr.exeC:\Users\admin\AppData\Roaming\Google\Libs\WR64.sysexecutable
MD5:0C0195C48B6B8582FA6F6373032118DA
SHA256:11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
6920sysnldcvmr.exeC:\Users\admin\AppData\Local\Temp\61091195.exebinary
MD5:0DB3B04022406C96FD1D684DB9425CDA
SHA256:EB680FCB5325ABFA473CC7CEC80788BEA7EE12446105E13544346F5186197345
1596239375400.exeC:\Users\admin\AppData\Local\Temp\1053027972.exeexecutable
MD5:13B26B2C7048A92D6A843C1302618FAD
SHA256:1753AD35ECE25AB9A19048C70062E9170F495E313D7355EBBBA59C38F5D90256
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
29
TCP/UDP connections
110
DNS requests
22
Threats
74

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
svchost.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
880
svchost.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
2728
npp.exe
GET
200
185.215.113.66:80
http://twizt.net/newtpp.exe
unknown
—
—
malicious
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2728
npp.exe
GET
200
185.215.113.66:80
http://twizt.net/peinstall.php
unknown
—
—
malicious
6920
sysnldcvmr.exe
GET
200
185.215.113.66:80
http://185.215.113.66/1
unknown
—
—
malicious
6920
sysnldcvmr.exe
GET
200
185.215.113.66:80
http://185.215.113.66/2
unknown
—
—
malicious
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
880
svchost.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
880
svchost.exe
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4712
MoUsoCoreWorker.exe
2.19.217.218:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
23.212.110.162:443
www.bing.com
Akamai International B.V.
CZ
whitelisted
2728
npp.exe
185.215.113.66:80
twizt.net
1337team Limited
SC
unknown
1176
svchost.exe
20.190.159.71:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.145
  • 23.48.23.180
  • 23.48.23.164
  • 23.48.23.159
  • 23.48.23.141
whitelisted
www.microsoft.com
  • 2.19.217.218
  • 88.221.169.152
whitelisted
google.com
  • 142.250.181.238
whitelisted
www.bing.com
  • 23.212.110.162
  • 23.212.110.160
  • 23.212.110.154
  • 23.212.110.161
  • 23.212.110.170
  • 23.212.110.163
  • 23.212.110.168
  • 23.212.110.155
  • 23.212.110.169
whitelisted
twizt.net
  • 185.215.113.66
unknown
login.live.com
  • 20.190.159.71
  • 20.190.159.68
  • 40.126.31.67
  • 40.126.31.69
  • 20.190.159.75
  • 40.126.31.71
  • 40.126.31.73
  • 20.190.159.23
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.170.81
whitelisted
arc.msn.com
  • 20.199.58.43
whitelisted

Threats

PID
Process
Class
Message
2728
npp.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2728
npp.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
1596
239375400.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 33
1596
239375400.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
1596
239375400.exe
Potentially Bad Traffic
ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response
1596
239375400.exe
Misc activity
ET INFO Packed Executable Download
1596
239375400.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3060
2155625709.exe
Misc Attack
ET DROP Spamhaus DROP Listed Traffic Inbound group 13
6344
dwm.exe
Potential Corporate Privacy Violation
ET POLICY Cryptocurrency Miner Checkin
6276
61091195.exe
Potentially Bad Traffic
ET INFO Executable Download from dotted-quad Host
17 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
/npp.exe