File name:

Your File Is Ready To Download_978064.exe

Full analysis: https://app.any.run/tasks/722e2aef-bca5-40f5-83cb-89c2f59b2f38
Verdict: Malicious activity
Analysis date: January 28, 2021, 20:54:54
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

2279BD577918F4A163E2856B2D76A7FC

SHA1:

8F4093438EAE4440D4E2BDB1DD812146B978907E

SHA256:

47DC6A32D3B8177EF0A5D3158629259094E87C0C568CB611D6FFD7FD2C8B94B3

SSDEEP:

49152:8DC+qZ5YfxlOaWxv9nD+rWsLVrd8xmeR6ugJRDxf5LZyiVFHdkA9F:8W+KSfxlONxv9niCsLVrd8xmeR6ugJRJ

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • SaserlPurview.exe (PID: 1148)
      • gup.exe (PID: 860)
      • notepad++.exe (PID: 3300)
      • notepad++.exe (PID: 2192)

    • Loads dropped or rewritten executable

      • SaserlPurview.exe (PID: 1148)
      • regsvr32.exe (PID: 3592)
      • notepad++.exe (PID: 3300)
      • gup.exe (PID: 860)
      • notepad++.exe (PID: 2192)

    • Drops executable file immediately after starts

      • SaserlPurview.exe (PID: 1148)

    • Registers / Runs the DLL via REGSVR32.EXE

      • SaserlPurview.exe (PID: 1148)

  • SUSPICIOUS

    • Creates files in the user directory

      • Your File Is Ready To Download_978064.exe (PID: 1500)
      • Your File Is Ready To Download_978064.exe (PID: 3640)
      • SaserlPurview.exe (PID: 1148)

    • Starts CMD.EXE for self-deleting

      • cmd.exe (PID: 1952)
      • Your File Is Ready To Download_978064.exe (PID: 1500)

    • Executable content was dropped or overwritten

      • Your File Is Ready To Download_978064.exe (PID: 1500)
      • SaserlPurview.exe (PID: 1148)

    • Creates a directory in Program Files

      • SaserlPurview.exe (PID: 1148)
      • Your File Is Ready To Download_978064.exe (PID: 1500)

    • Creates files in the program directory

      • Your File Is Ready To Download_978064.exe (PID: 3640)
      • Your File Is Ready To Download_978064.exe (PID: 1500)
      • SaserlPurview.exe (PID: 1148)

    • Starts CMD.EXE for commands execution

      • cmd.exe (PID: 1952)
      • Your File Is Ready To Download_978064.exe (PID: 1500)

    • Application launched itself

      • Your File Is Ready To Download_978064.exe (PID: 3640)
      • cmd.exe (PID: 1952)

    • Executed via COM

      • explorer.exe (PID: 3884)

    • Creates/Modifies COM task schedule object

      • regsvr32.exe (PID: 3592)

    • Drops a file that was compiled in debug mode

      • SaserlPurview.exe (PID: 1148)

    • Creates a software uninstall entry

      • SaserlPurview.exe (PID: 1148)

  • INFO

    • Manual execution by user

      • verclsid.exe (PID: 3024)
      • Your File Is Ready To Download_978064.exe (PID: 3640)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:01:23 18:01:20+01:00
PEType: PE32
LinkerVersion: 14.27
CodeSize: 1902592
InitializedDataSize: 768512
UninitializedDataSize: -
EntryPoint: 0x150f03
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.3.9.6
ProductVersionNumber: 1.3.9.6
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Windows, Latin1
CompanyName: Saser Company
FileDescription: Saser Purview Install
FileVersion: 1.3.9.6
InternalName: SaserPurviewInstall.exe
LegalCopyright: Copyright 2020
OriginalFileName: SaserPurviewInstall.exe
ProductName: SaserPurviewInstall
ProductVersion: 1.3.9.6

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 23-Jan-2021 17:01:20
Detected languages:
  • English - United States
CompanyName: Saser Company
FileDescription: Saser Purview Install
FileVersion: 1.3.9.6
InternalName: SaserPurviewInstall.exe
LegalCopyright: Copyright 2020
OriginalFilename: SaserPurviewInstall.exe
ProductName: SaserPurviewInstall
ProductVersion: 1.3.9.6

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x00000120

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 10
Time date stamp: 23-Jan-2021 17:01:20
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x001CC265
0x001CC400
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.55841
.text1
0x001CE000
0x00000BBA
0x00000C00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.06889
.text2
0x001CF000
0x000017B8
0x00001800
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.93436
.mdata
0x001D1000
0x00000F4B
0x00001000
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.2723
.text3
0x001D2000
0x0000044A
0x00000600
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
4.83839
.fdata
0x001D3000
0x00000837
0x00000A00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
5.48521
.rdata
0x001D4000
0x0006A28C
0x0006A400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.25442
.data
0x0023F000
0x00009F4C
0x00005600
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.66419
.rsrc
0x00249000
0x00021650
0x00021800
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.92845
.reloc
0x0026B000
0x00025D54
0x00025E00
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
6.59386

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.17402
1974
UNKNOWN
English - United States
RT_MANIFEST
2
3.87492
67624
UNKNOWN
English - United States
RT_ICON
3
4.24557
9640
UNKNOWN
English - United States
RT_ICON
4
4.52868
4264
UNKNOWN
English - United States
RT_ICON
5
5.66675
1128
UNKNOWN
English - United States
RT_ICON
102
3.13009
202
UNKNOWN
English - United States
RT_DIALOG
128
2.67841
76
UNKNOWN
English - United States
RT_GROUP_ICON

Imports

ADVAPI32.dll
COMCTL32.dll
CRYPT32.dll
GDI32.dll
IMM32.dll
KERNEL32.dll
MSIMG32.dll
Normaliz.dll
OLEACC.dll
OLEAUT32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
57
Monitored processes
14
Malicious processes
5
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start your file is ready to download_978064.exe no specs verclsid.exe no specs your file is ready to download_978064.exe no specs your file is ready to download_978064.exe saserlpurview.exe cmd.exe no specs timeout.exe no specs cmd.exe no specs regsvr32.exe no specs explorer.exe no specs explorer.exe no specs notepad++.exe gup.exe notepad++.exe

Process information

PID
CMD
Path
Indicators
Parent process
860"C:\Program Files\Notepad++\updater\gup.exe" -v7.91C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
WinGup for Notepad++
Exit code:
4294967295
Version:
5.11
Modules
Images
c:\program files\notepad++\updater\gup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\notepad++\updater\libcurl.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
1148"C:\Program Files\SaserPurviewooiInstall\SaserlPurview.exe" 01908166983016 FowapGhD5vUpKpS4LzNmfsHdv26pFOAZVTz7Oa3jkONl88boFwJtjIc1a7NUORalJGUfYTmCiDkLTeMl0hxmWHeQbMQvlHi51k0tDpzKhsr1697zp+NnLEiqQK0eZm2oKfYx2y578gmOrftgye49az/h3mAEq8kPB3R8yOxalgw260wZrda+WKPlA9ruyJG+tmI/YvbnqX8aYPhe3nqDltL8hyUKGVeymiBlDohx+hQumrF4DBnEqybGpstZvnRF fbypKCHMdmLgUMesEkYgH+I6LMvqImoN4CjLitg6+qTwX8Oun+8qVWbYQLj6MnLg47vD544+KcltA4e0oSALqbkLptU8f7Z1LunWt1r55iY=C:\Program Files\SaserPurviewooiInstall\SaserlPurview.exe
Your File Is Ready To Download_978064.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.9.1.0
Modules
Images
c:\program files\saserpurviewooiinstall\saserlpurview.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
1500"C:\Users\admin\AppData\Local\Temp\Your File Is Ready To Download_978064.exe" -uac fbypKCHMdmLgUMesEkYgH+I6LMvqImoN4CjLitg6+qTwX8Oun+8qVWbYQLj6MnLg47vD544+KcltA4e0oSALqbkLptU8f7Z1LunWt1r55iY=C:\Users\admin\AppData\Local\Temp\Your File Is Ready To Download_978064.exe
Your File Is Ready To Download_978064.exe
User:
admin
Company:
Saser Company
Integrity Level:
HIGH
Description:
Saser Purview Install
Exit code:
100
Version:
1.3.9.6
Modules
Images
c:\users\admin\appdata\local\temp\your file is ready to download_978064.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
1952C:\Windows\system32\cmd.exe /d /c timeout 5 & cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\Your File Is Ready To Download_978064.exe"C:\Windows\system32\cmd.exe—Your File Is Ready To Download_978064.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2192"C:\Program Files\Notepad++\notepad++.exe" "C:\Program Files\Notepad++\change.log" C:\Program Files\Notepad++\notepad++.exe
SaserlPurview.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
HIGH
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\user32.dll
c:\windows\system32\shell32.dll
2540"C:\Users\admin\AppData\Local\Temp\Your File Is Ready To Download_978064.exe" C:\Users\admin\AppData\Local\Temp\Your File Is Ready To Download_978064.exe—explorer.exe
User:
admin
Company:
Saser Company
Integrity Level:
MEDIUM
Description:
Saser Purview Install
Exit code:
100
Version:
1.3.9.6
Modules
Images
c:\users\admin\appdata\local\temp\your file is ready to download_978064.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2616cmd /d /c del /f /q "C:\Users\admin\AppData\Local\Temp\Your File Is Ready To Download_978064.exe"C:\Windows\system32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3024"C:\Windows\system32\verclsid.exe" /S /C {0B2C9183-C9FA-4C53-AE21-C900B0C39965} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401C:\Windows\system32\verclsid.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Extension CLSID Verification Host
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\verclsid.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3300"C:\Program Files\Notepad++\notepad++.exe" C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3352timeout 5 C:\Windows\system32\timeout.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
timeout - pauses command processing
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\timeout.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ws2_32.dll
Total events
1 116
Read events
882
Write events
230
Delete events
4

Modification events

(PID) Process:(3640) Your File Is Ready To Download_978064.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(3640) Your File Is Ready To Download_978064.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(3592) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ANotepad++
Operation:delete keyName:(default)
Value:
(PID) Process:(3592) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:delete keyName:(default)
Value:
(PID) Process:(3592) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\Settings
Operation:delete keyName:(default)
Value:
(PID) Process:(3592) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}
Operation:delete keyName:(default)
Value:
(PID) Process:(3592) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}
Operation:writeName:(default)
Value:
ANotepad++
(PID) Process:(3592) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:writeName:(default)
Value:
C:\Program Files\Notepad++\NppShell_06.dll
(PID) Process:(3592) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\InprocServer32
Operation:writeName:ThreadingModel
Value:
Apartment
(PID) Process:(3592) regsvr32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00F3C2EC-A6EE-11DE-A03A-EF8F55D89593}\Settings
Operation:writeName:Title
Value:
Edit with &Notepad++
Executable files
16
Suspicious files
4
Text files
178
Unknown types
2

Dropped files

PID
Process
Filename
Type
1500Your File Is Ready To Download_978064.exeC:\Program Files\SaserPurviewooiInstall\SaserlPurview.exeexecutable
MD5:—
SHA256:—
1148SaserlPurview.exeC:\Users\admin\AppData\Local\Temp\nsk5252.tmp\ioSpecial.initext
MD5:—
SHA256:—
1148SaserlPurview.exeC:\Users\admin\AppData\Local\Temp\nsk5252.tmp\System.dllexecutable
MD5:0D7AD4F45DC6F5AA87F606D0331C6901
SHA256:3EB38AE99653A7DBC724132EE240F6E5C4AF4BFE7C01D31D23FAF373F9F2EACA
1148SaserlPurview.exeC:\Users\admin\AppData\Local\Temp\nsk5252.tmp\LangDLL.dllexecutable
MD5:AB1DB56369412FE8476FEFFFD11E4CC0
SHA256:6F14C8F01F50A30743DAC68C5AC813451463DFB427EB4E35FCDFE2410E1A913B
1500Your File Is Ready To Download_978064.exeC:\ProgramData\ikfolder\ikonphqbinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
3640Your File Is Ready To Download_978064.exeC:\ProgramData\ikfolder\ikonphqbinary
MD5:00A5033694B6E94D8078EF2535036E09
SHA256:4DD388E61295C6B3F52937C142468B736B18D46EB878C28D15E202E84FD81C6F
1148SaserlPurview.exeC:\Users\admin\AppData\Local\Temp\nsk5252.tmp\nsDialogs.dllexecutable
MD5:466179E1C8EE8A1FF5E4427DBB6C4A01
SHA256:1E40211AF65923C2F4FD02CE021458A7745D28E2F383835E3015E96575632172
1148SaserlPurview.exeC:\Users\admin\AppData\Local\Temp\nsk5252.tmp\InstallOptions.dllexecutable
MD5:05BF02DA51E717F79F6B5CBEA7BC0710
SHA256:CA092BA7F275B0C9000098CDD1A9876FE8DC050FCB40A0E8A1AB8335236E9DC5
1148SaserlPurview.exeC:\Users\admin\AppData\Local\Temp\nsk5252.tmp\modern-wizard.bmpimage
MD5:C2CF6928A3AB574A5548B4DC1C38B6C0
SHA256:2125550C12FA512782F2016E802D70BC51F4A06017CFBD4176B4A994EB2542F0
1148SaserlPurview.exeC:\Users\admin\AppData\Local\Temp\nsk5252.tmp\modern-header.bmpimage
MD5:56DA15FDB8D96F8F5C649DCB5E79D775
SHA256:BB90D4338D2474138473E6B16E94B0237EE847BEA45019ED0DD4439C71BD233E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
5
DNS requests
2
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1500
Your File Is Ready To Download_978064.exe
172.67.74.121:443
buyinstaller.com
—
US
unknown
860
gup.exe
104.21.24.106:443
notepad-plus-plus.org
Cloudflare Inc
US
malicious

DNS requests

Domain
IP
Reputation
buyinstaller.com
  • 172.67.74.121
malicious
notepad-plus-plus.org
  • 104.21.24.106
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Your File Is Ready To Download_978064.exe