File name:

AutoHotkey_2.0.19_setup.exe

Full analysis: https://app.any.run/tasks/76e51a1d-0505-492a-9947-c9b58c5d81a8
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: June 16, 2025, 17:43:13
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
upx
arch-exec
ahk
loader
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed, 3 sections
MD5:

34979CF8AB65E09D738FD6B95365CEFB

SHA1:

0AFD36786EEB45BBE7DB1CF2A6D2251C10DA303C

SHA256:

FD55129CBD356F49D2151E0A8B9662D90D2DBBB9579CC2410FDE38DF94787A3A

SSDEEP:

98304:/Rv3DwxUAtz2eVhxkk/7wIvycwI0mm/H7Krd6dV9zXv8E2d4J1KD3B+yfaXDFcd2:WmxZCp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • AHK has been detected (YARA)

      • Ahk2Exe.exe (PID: 1512)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • AutoHotkey_2.0.19_setup.exe (PID: 1604)
      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 1132)
      • AutoHotkeyUX.exe (PID: 984)

    • Application launched itself

      • AutoHotkey_2.0.19_setup.exe (PID: 1604)
      • AutoHotkeyUX.exe (PID: 6656)
      • AutoHotkeyUX.exe (PID: 1132)

    • Creates a software uninstall entry

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)

    • Executable content was dropped or overwritten

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 984)
      • Ahk2Exe.exe (PID: 1512)

    • Adds/modifies Windows certificates

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)

    • Reads the date of Windows installation

      • AutoHotkeyUX.exe (PID: 1132)

    • Reads Internet Explorer settings

      • AutoHotkeyUX.exe (PID: 984)

    • Reads Microsoft Outlook installation path

      • AutoHotkeyUX.exe (PID: 984)

    • There is functionality for taking screenshot (YARA)

      • AutoHotkeyUX.exe (PID: 6656)
      • Ahk2Exe.exe (PID: 1512)

    • Starts CMD.EXE for commands execution

      • Ahk2Exe.exe (PID: 1512)

  • INFO

    • Process checks computer location settings

      • AutoHotkey_2.0.19_setup.exe (PID: 1604)
      • AutoHotkeyUX.exe (PID: 1132)

    • The sample compiled with english language support

      • AutoHotkey_2.0.19_setup.exe (PID: 1604)
      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 984)
      • Ahk2Exe.exe (PID: 1512)

    • Reads the computer name

      • AutoHotkey_2.0.19_setup.exe (PID: 1604)
      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 6656)
      • AutoHotkeyUX.exe (PID: 1132)
      • AutoHotkeyUX.exe (PID: 984)
      • Ahk2Exe.exe (PID: 1512)

    • Checks supported languages

      • AutoHotkey_2.0.19_setup.exe (PID: 1604)
      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 6656)
      • AutoHotkeyUX.exe (PID: 6360)
      • AutoHotkeyUX.exe (PID: 1132)
      • AutoHotkeyUX.exe (PID: 984)
      • Ahk2Exe.exe (PID: 1512)

    • AutoHotkey executable

      • AutoHotkey_2.0.19_setup.exe (PID: 1604)
      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 1132)
      • AutoHotkeyUX.exe (PID: 6656)
      • cmd.exe (PID: 5896)

    • Creates files in the program directory

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 984)

    • Reads the machine GUID from the registry

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 984)

    • Creates files or folders in the user directory

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 984)

    • Reads the software policy settings

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 984)

    • Detects AutoHotkey samples (YARA)

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)
      • AutoHotkeyUX.exe (PID: 6656)
      • Ahk2Exe.exe (PID: 1512)

    • UPX packer has been detected

      • AutoHotkey_2.0.19_setup.exe (PID: 6980)

    • Manual execution by a user

      • AutoHotkeyUX.exe (PID: 6656)
      • Ahk2Exe.exe (PID: 1512)
      • notepad++.exe (PID: 5780)

    • Checks proxy server information

      • AutoHotkeyUX.exe (PID: 984)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | UPX compressed Win32 Executable (64.2)
.dll | Win32 Dynamic Link Library (generic) (15.6)
.exe | Win32 Executable (generic) (10.6)
.exe | Generic Win/DOS Executable (4.7)
.exe | DOS Executable Generic (4.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:25 08:00:28+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.39
CodeSize: 2994176
InitializedDataSize: 40960
UninitializedDataSize: 2527232
EntryPoint: 0x544000
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.19.0
ProductVersionNumber: 2.0.19.0
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: AutoHotkey installer
FileVersion: 2.0.19
ProductName: AutoHotkey Setup
ProductVersion: 2.0.19
InternalName: AutoHotkey Setup
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
14
Malicious processes
2
Suspicious processes
3

Behavior graph

Click at the process to see the details
start autohotkey_2.0.19_setup.exe no specs autohotkey_2.0.19_setup.exe autohotkeyux.exe no specs autohotkeyux.exe no specs autohotkeyux.exe no specs autohotkeyux.exe #AHK ahk2exe.exe cmd.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs autohotkey32.exe no specs notepad++.exe slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
984"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" /restart /script "C:\Program Files\AutoHotkey\UX\install-ahk2exe.ahk" /YC:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
AutoHotkeyUX.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
HIGH
Description:
AutoHotkey 64-bit
Exit code:
0
Version:
2.0.19
Modules
Images
c:\program files\autohotkey\ux\autohotkeyux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1132"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" /script "C:\Program Files\AutoHotkey\UX\install-ahk2exe.ahk"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe—AutoHotkeyUX.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey 64-bit
Exit code:
0
Version:
2.0.19
Modules
Images
c:\program files\autohotkey\ux\autohotkeyux.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\psapi.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
1512"C:\Program Files\AutoHotkey\Compiler\Ahk2Exe.exe" C:\Program Files\AutoHotkey\Compiler\Ahk2Exe.exe
explorer.exe
User:
admin
Company:
AutoHotkey
Integrity Level:
MEDIUM
Description:
AutoHotkey Script Compiler
Version:
1.1.37.02a0
Modules
Images
c:\program files\autohotkey\compiler\ahk2exe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
1604"C:\Users\admin\AppData\Local\Temp\AutoHotkey_2.0.19_setup.exe" C:\Users\admin\AppData\Local\Temp\AutoHotkey_2.0.19_setup.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AutoHotkey installer
Exit code:
0
Version:
2.0.19
Modules
Images
c:\users\admin\appdata\local\temp\autohotkey_2.0.19_setup.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\advapi32.dll
2348\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2648"C:\WINDOWS\system32\cmd.exe" /c echo 1C:\Windows\SysWOW64\cmd.exe—Ahk2Exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2764\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5716"C:\Program Files\AutoHotkey\v2\AutoHotkey32.exe" /iLib "C:\Users\admin\AppData\Local\Temp\~Ahk2Exe~SwarmStart~ilib~5586404920.tmp" /ErrorStdOut "C:\Users\admin\Desktop\SwarmStart.ahk" C:\Program Files\AutoHotkey\v2\AutoHotkey32.exe—cmd.exe
User:
admin
Company:
AutoHotkey Foundation LLC
Integrity Level:
MEDIUM
Description:
AutoHotkey 32-bit
Exit code:
0
Version:
2.0.19
Modules
Images
c:\program files\autohotkey\v2\autohotkey32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\psapi.dll
5780"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\SwarmStart.ahk"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO [email protected]
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.19041.3636_none_60b6a03d71f818d5\comctl32.dll
5896"C:\WINDOWS\system32\cmd.exe" /c ""C:\Program Files\AutoHotkey\v2\AutoHotkey32.exe" /iLib "C:\Users\admin\AppData\Local\Temp\~Ahk2Exe~SwarmStart~ilib~5586404920.tmp" /ErrorStdOut "C:\Users\admin\Desktop\SwarmStart.ahk" 2>"C:\Users\admin\AppData\Local\Temp\~Ahk2Exe~SwarmStart~ilib~5586404920.tmpE""C:\Windows\SysWOW64\cmd.exe—Ahk2Exe.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
Total events
11 440
Read events
11 407
Write events
28
Delete events
5

Modification events

(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:DisplayName
Value:
AutoHotkey
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:UninstallString
Value:
"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\ui-uninstall.ahk"
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:QuietUninstallString
Value:
"C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe" "C:\Program Files\AutoHotkey\UX\install.ahk" /uninstall /silent
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:NoModify
Value:
1
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:DisplayIcon
Value:
C:\Program Files\AutoHotkey\UX\AutoHotkeyUX.exe
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:DisplayVersion
Value:
2.0.19
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:URLInfoAbout
Value:
https://autohotkey.com
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:Publisher
Value:
AutoHotkey Foundation LLC
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AutoHotkey
Operation:writeName:InstallLocation
Value:
C:\Program Files\AutoHotkey
(PID) Process:(6980) AutoHotkey_2.0.19_setup.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\AutoHotkey
Operation:writeName:InstallDir
Value:
C:\Program Files\AutoHotkey
Executable files
17
Suspicious files
8
Text files
70
Unknown types
12

Dropped files

PID
Process
Filename
Type
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\AutoHotkey64.exeexecutable
MD5:38746D44ECA1F41D1F8E16746EB182F5
SHA256:3880F9EC464DFE78C16BBD8B9F30560227154C292280337346A30C8FD92871FE
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\install-ahk2exe.ahktext
MD5:C90BED0679B789B74E4865AE6F2709A3
SHA256:C242EBB51241ACAB13152D95CDB05BE5382FFB97F3DCA2DA3A4E5A084C2E3FF4
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\license.txttext
MD5:E3F2AD7733F3166FE770E4DC00AF6C45
SHA256:B27C1A7C92686E47F8740850AD24877A50BE23FD3DBD44EDEE50AC1223135E38
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\launcher.ahktext
MD5:596B69069BBBCC9A22AC26BBA6EFE546
SHA256:830DB4BE4C8320F23FF32316DAC933D4E72D9056EA5A819CC12C38614DA6E06F
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\install-version.ahktext
MD5:30B87FBFADC592C38BE9D82EDF597FA3
SHA256:1E59921BCDDB3C41651EB01605CDEFCDEE3C6ADEC5DB6B7CAFB7AB801EAD5E1E
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-dash.ahkhtml
MD5:669BD791C5AAFB60EE0885EF064D3622
SHA256:E8C0B4E149AD58C57E77AAC12041F1FA8BC9F25C6D642D12837EFC5FD97B8D21
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\install.ahktext
MD5:A3CAA9963C9133C2A14A4E36D62761E3
SHA256:F628EDFECE15DB0061FDFE96724266A3CFAAEC396524A94B574E22E6E3970C40
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\reload-v1.ahktext
MD5:35F4753A58432446B99BF89A9E930BF5
SHA256:E4659306A755B583E9CEF5FDBA3B3EB102D8939FB028AFD91AAD4496E758FAD5
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-launcherconfig.ahktext
MD5:57DCC5F7853CFD0BDD49F35D1F86897B
SHA256:179C96D787FAE5DD26CDF832E5226142AB3E4F1FF53E3B1F24CECDDCF3E79947
6980AutoHotkey_2.0.19_setup.exeC:\Program Files\AutoHotkey\.staging\AutoHotkey_2.0.19_setup.exe\UX\ui-editor.ahktext
MD5:82EB574294FF4E2E7461B95F5BAD0A87
SHA256:7263286EB3A42ECCF5EDC39B43C74A8BF7C82F2671204D1AE654236C1DE3F05D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
30
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1268
svchost.exe
GET
200
23.216.77.26:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2668
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
984
AutoHotkeyUX.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEFZnHQTqT5lMbxCBR1nSdZQ%3D
unknown
—
—
whitelisted
984
AutoHotkeyUX.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBSr83eyJy3njhjVpn5bEpfc6MXawQQUOuEJhtTPGcKWdnRJdtzgNcZjY5oCEQDzZE5rbgBQI34JRr174fUd
unknown
—
—
whitelisted
984
AutoHotkeyUX.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CECoW9cIBGAf3CpJj3Tw5qfI%3D
unknown
—
—
whitelisted
7032
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
984
AutoHotkeyUX.exe
GET
200
104.18.38.233:80
http://ocsp.sectigo.com/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTPlNxcMEqnlIVyH5VuZ4lawhZX3QQU9oUKOxGG4QR9DqoLLNLuzGR7e64CEQCrZoa1YnvoBZaCEzAShkn1
unknown
—
—
whitelisted
984
AutoHotkeyUX.exe
GET
200
172.64.149.23:80
http://ocsp.comodoca.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTtU9uFqgVGHhJwXZyWCNXmVR5ngQUoBEKIz6W8Qfs4q8p74Klf9AwpLQCEDlyRDr5IrdR19NsEN0xNZU%3D
unknown
—
—
whitelisted
984
AutoHotkeyUX.exe
GET
200
104.18.38.233:80
http://ocsp.usertrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTNMNJMNDqCqx8FcBWK16EHdimS6QQUU3m%2FWqorSs9UgOHYm8Cd8rIDZssCEH1bUSa0droR23QWC7xTDac%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
1268
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5600
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2336
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2668
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2668
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1268
svchost.exe
23.216.77.26:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
1268
svchost.exe
23.52.120.96:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.110
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.20
  • 20.190.160.132
  • 20.190.160.65
  • 20.190.160.2
  • 40.126.32.72
  • 40.126.32.68
  • 40.126.32.74
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 23.216.77.26
  • 23.216.77.36
  • 23.216.77.31
  • 23.216.77.25
  • 23.216.77.30
  • 23.216.77.28
  • 23.216.77.39
  • 23.216.77.27
  • 23.216.77.33
whitelisted
www.microsoft.com
  • 23.52.120.96
  • 95.101.149.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.227.13
whitelisted
api.github.com
  • 140.82.121.5
whitelisted
ocsp.comodoca.com
  • 172.64.149.23
  • 104.18.38.233
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: error while getting certificate informations
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
AutoHotkey_2.0.19_setup.exe