File name:

pupdate.exe

Full analysis: https://app.any.run/tasks/b521cf5c-285f-4e08-adb0-591cc86d15c8
Verdict: Malicious activity
Analysis date: April 25, 2019, 08:06:19
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

E8902CBB4A16966510189E51D30C2AB6

SHA1:

1587E6F5B428304F52660AEC8E1A76AA31E20251

SHA256:

859902B41ADA0A113B51439EA4149584299ECFFC2450535AA97E405438D7A025

SSDEEP:

24576:MMQe1A3yTAL7QAAb3MVe1BLkfBCO43u6ZXyR7cIdhhV2Kr7o5g5Ae7Kq4fp2H+yW:MGlh3XDuBChXyRMMo5BXLEF+EO+0R7f

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • AppSync.exe (PID: 1728)
      • AppSync.exe (PID: 3136)
      • AppSync.exe (PID: 1080)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pupdate.exe (PID: 1564)

    • Changes IE settings (feature browser emulation)

      • AppSync.exe (PID: 1728)
      • AppSync.exe (PID: 3136)
      • AppSync.exe (PID: 1080)

    • Creates files in the user directory

      • notepad++.exe (PID: 988)

  • INFO

    • Changes internet zones settings

      • iexplore.exe (PID: 2636)

    • Application launched itself

      • iexplore.exe (PID: 2636)

    • Reads internet explorer settings

      • iexplore.exe (PID: 2460)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2460)
      • iexplore.exe (PID: 2636)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2027:09:18 21:49:23+02:00
PEType: PE32
LinkerVersion: 14.1
CodeSize: 25600
InitializedDataSize: 2037760
UninitializedDataSize: -
EntryPoint: 0x6a60
OSVersion: 10
ImageVersion: 10
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 11.0.15063.0
ProductVersionNumber: 11.0.15063.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Win32 Cabinet Self-Extractor
FileVersion: 11.00.15063.0 (WinBuild.160101.0800)
InternalName: Wextract
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: WEXTRACT.EXE .MUI
ProductName: Internet Explorer
ProductVersion: 11.00.15063.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
53
Monitored processes
10
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start pupdate.exe appsync.exe no specs explorer.exe no specs appsync.exe no specs appsync.exe iexplore.exe iexplore.exe no specs wscript.exe no specs notepad++.exe gup.exe

Process information

PID
CMD
Path
Indicators
Parent process
988"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\install.js"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.51
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1080"C:\Users\admin\AppData\Local\Temp\IXP000.TMP\AppSync.exe" C:\Users\admin\AppData\Local\Temp\IXP000.TMP\AppSync.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
AppSync
Exit code:
0
Version:
18.0.3.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\appsync.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1564"C:\Users\admin\Desktop\pupdate.exe" C:\Users\admin\Desktop\pupdate.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Win32 Cabinet Self-Extractor
Exit code:
0
Version:
11.00.15063.0 (WinBuild.160101.0800)
Modules
Images
c:\users\admin\desktop\pupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1728C:\Users\admin\AppData\Local\Temp\IXP000.TMP\AppSync.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AppSync.exe—pupdate.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AppSync
Exit code:
0
Version:
18.0.3.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\appsync.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\aclayers.dll
c:\windows\system32\sspicli.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
2172"C:\Windows\explorer.exe" C:\Windows\explorer.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2460"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2636 CREDAT:79873C:\Program Files\Internet Explorer\iexplore.exe—iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2636"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\admin\AppData\Local\Temp\IXP000.TMP\uninstall.htmlC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
8.00.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3136"C:\Users\admin\AppData\Local\Temp\IXP000.TMP\AppSync.exe" C:\Users\admin\AppData\Local\Temp\IXP000.TMP\AppSync.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
AppSync
Exit code:
0
Version:
18.0.3.0
Modules
Images
c:\users\admin\appdata\local\temp\ixp000.tmp\appsync.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
3440"C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\IXP000.TMP\install.js" C:\Windows\System32\WScript.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft ® Windows Based Script Host
Exit code:
0
Version:
5.8.7600.16385
Modules
Images
c:\windows\system32\wscript.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
3464"C:\Program Files\Notepad++\updater\gup.exe" -v7.51C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
GUP : a free (LGPL) Generic Updater
Exit code:
0
Version:
4.1
Modules
Images
c:\program files\notepad++\updater\gup.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\notepad++\updater\libcurl.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\windows\system32\wldap32.dll
Total events
617
Read events
517
Write events
99
Delete events
1

Modification events

(PID) Process:(1728) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Operation:writeName:AppSync.exe
Value:
8000
(PID) Process:(1728) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION
Operation:writeName:AppSync.exe
Value:
1
(PID) Process:(1728) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS
Operation:writeName:AppSync.exe
Value:
1
(PID) Process:(1728) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING
Operation:writeName:AppSync.exe
Value:
1
(PID) Process:(1728) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_WEBOC_DOCUMENT_ZOOM
Operation:writeName:AppSync.exe
Value:
1
(PID) Process:(1728) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_NINPUT_LEGACYMODE
Operation:writeName:AppSync.exe
Value:
0
(PID) Process:(3136) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION
Operation:writeName:AppSync.exe
Value:
8000
(PID) Process:(3136) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_ENABLE_CLIPCHILDREN_OPTIMIZATION
Operation:writeName:AppSync.exe
Value:
1
(PID) Process:(3136) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_AJAX_CONNECTIONEVENTS
Operation:writeName:AppSync.exe
Value:
1
(PID) Process:(3136) AppSync.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_GPU_RENDERING
Operation:writeName:AppSync.exe
Value:
1
Executable files
1
Suspicious files
2
Text files
205
Unknown types
1

Dropped files

PID
Process
Filename
Type
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AppSync.exeexecutable
MD5:—
SHA256:—
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\1517130957005_490x60.pngimage
MD5:—
SHA256:—
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\config.txttext
MD5:—
SHA256:—
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\brand.jstext
MD5:—
SHA256:—
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\PdfPro100.icoimage
MD5:—
SHA256:—
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\1517143390278_1512482433840_logo.pngimage
MD5:—
SHA256:—
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\pref.txttext
MD5:—
SHA256:—
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\install.htmlhtml
MD5:5DF42D9DD9FE8B3C98FE3FEABAD67CF7
SHA256:741AAB644ED45961879774546C9B87C3A2E25283E489221469CB6D0DCD39D623
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\bg.jpgimage
MD5:410E67276B4C3A0AD73BC3EECDCD0D6D
SHA256:71C0C7CC191A2CBF3DDF033CA7BA97ADB46A04284F014C667574C1BF1FB0F1F3
1564pupdate.exeC:\Users\admin\AppData\Local\Temp\IXP000.TMP\AppSync.exe.configxml
MD5:2D3D9EDF445C408DD56576D039630FBF
SHA256:D6CA195E9E1531AE1C2016147530E2803BDE68F8CE19B88506E1BDA9F4A272B8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
3
DNS requests
3
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.186.11:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
2636
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
3464
gup.exe
37.59.28.236:443
notepad-plus-plus.org
OVH SAS
FR
whitelisted
2636
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
notepad-plus-plus.org
  • 37.59.28.236
whitelisted
isrg.trustid.ocsp.identrust.com
  • 2.16.186.11
  • 2.16.186.35
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
42C4C5846BB675C74E2B2C90C69AB44366401093
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pupdate.exe