File name:

pdfelement-pro_setup_full5254.exe

Full analysis: https://app.any.run/tasks/a5c01ee1-b118-45c9-9b0e-fbf5f71caf13
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 16, 2024, 15:42:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B79061DE60AAEAC55A834351739FD3E7

SHA1:

3E28E5D7B260956325681A1BA30767E3CE0CD27A

SHA256:

0D13C2A94245B779B352695D94D8D263DA2682C75FAA13BAB5E6BC5E0E71FD73

SSDEEP:

98304:1SfFu4Cy9ZRo0k+ajyWaRduAC7KzhCBwbo/IAACaj/c:eG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • PEShellContextMenu4.exe (PID: 992)
      • PEAddInDeployment.exe (PID: 2620)
      • WSPrtSetup.exe (PID: 1592)
      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Creates a writable file in the system directory

      • pdfelement-pro_full5254.tmp (PID: 2744)
      • WSPrtSetup.exe (PID: 1592)

    • Registers / Runs the DLL via REGSVR32.EXE

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Create files in the Startup directory

      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeployment.exe (PID: 1192)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Reads the Internet Settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3768)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Reads Microsoft Outlook installation path

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Reads settings of System Certificates

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PENotify.exe (PID: 3768)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PDFelement.exe (PID: 4040)

    • Checks Windows Trust Settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Reads Internet Explorer settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PDFelement.exe (PID: 4040)

    • Likely accesses (executes) a file from the Public directory

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Process requests binary or script from the Internet

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PDFelement.exe (PID: 4040)

    • Connects to unusual port

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Executable content was dropped or overwritten

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEShellContextMenu4.exe (PID: 992)
      • PEAddInDeployment.exe (PID: 2620)
      • WSPrtSetup.exe (PID: 1592)

    • Reads the Windows owner or organization settings

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Process drops legitimate windows executable

      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEAddInDeployment.exe (PID: 2620)
      • WSPrtSetup.exe (PID: 1592)

    • Drops 7-zip archiver for unpacking

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • The process drops C-runtime libraries

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Searches for installed software

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Creates/Modifies COM task schedule object

      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 1936)
      • regsvr32.exe (PID: 3256)
      • RegAsm.exe (PID: 3936)

    • Starts itself from another location

      • PEShellContextMenu4.exe (PID: 992)

    • Starts SC.EXE for service management

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 2192)
      • explorer.exe (PID: 2740)
      • explorer.exe (PID: 2152)

    • Reads the BIOS version

      • PDFelement.exe (PID: 4040)

  • INFO

    • Checks supported languages

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2488)
      • PEPreviewDeployment.exe (PID: 2484)
      • zip.exe (PID: 1728)
      • zip.exe (PID: 1484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • PEShellContextMenu4.exe (PID: 1936)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 2024)
      • FileAssociation.exe (PID: 2516)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PENotify.exe (PID: 3768)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PEPreviewDeployment.exe (PID: 3952)
      • RegAsm.exe (PID: 3936)
      • PENotify.exe (PID: 3604)
      • fontlistsave.exe (PID: 1972)
      • PDFelement.exe (PID: 4040)
      • PEPreviewDeployment.exe (PID: 2408)
      • zip.exe (PID: 1192)

    • Reads the computer name

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • PEShellContextMenu4.exe (PID: 1936)
      • FileAssociation.exe (PID: 2516)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 548)
      • PENotify.exe (PID: 3768)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PEPreviewDeployment.exe (PID: 3952)
      • RegAsm.exe (PID: 3936)
      • PENotify.exe (PID: 3604)
      • PEPreviewDeployment.exe (PID: 2408)
      • PDFelement.exe (PID: 4040)

    • Checks proxy server information

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Reads the machine GUID from the registry

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • PEShellContextMenu4.exe (PID: 1936)
      • PEToolDeployment.exe (PID: 2024)
      • FileAssociation.exe (PID: 2516)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeployment.exe (PID: 1192)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 3952)
      • PENotify.exe (PID: 3604)
      • PEPreviewDeployment.exe (PID: 2408)
      • PDFelement.exe (PID: 4040)
      • RegAsm.exe (PID: 3936)

    • Create files in a temporary directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PDFelement.exe (PID: 4040)

    • Reads the software policy settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Creates files in the program directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • zip.exe (PID: 1484)
      • zip.exe (PID: 1728)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PDFelement.exe (PID: 4040)

    • Creates files or folders in the user directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • PEPreviewDeployment.exe (PID: 2484)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEShellContextMenu4.exe (PID: 992)
      • regsvr32.exe (PID: 3256)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3768)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEPreviewDeployment.exe (PID: 3952)
      • PEPreviewDeployment.exe (PID: 2408)
      • fontlistsave.exe (PID: 1972)
      • zip.exe (PID: 1192)
      • PDFelement.exe (PID: 4040)

    • Creates a software uninstall entry

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Reads Microsoft Office registry keys

      • PEAddInDeployment.exe (PID: 2620)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 532)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 1376)

    • Reads the Internet Settings

      • explorer.exe (PID: 532)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 1376)

    • Reads Environment values

      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Reads the time zone

      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Application launched itself

      • chrome.exe (PID: 1548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:01 09:19:03+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 1278976
InitializedDataSize: 918016
UninitializedDataSize: -
EntryPoint: 0x106980
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.0.4.19
ProductVersionNumber: 4.0.4.19
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: wondershare-pdfelement_setup_full5254.exe
FileVersion: 4.0.4.19
LegalCopyright: Copyright©2023 Wondershare. All rights reserved.
ProductName: Wondershare PDFelement
ProductVersion: 10.0.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
47
Malicious processes
12
Suspicious processes
4

Behavior graph

Click at the process to see the details
start pdfelement-pro_setup_full5254.exe pdfelement-pro_full5254.exe pdfelement-pro_full5254.tmp petooldeployment.exe pepreviewdeployment.exe zip.exe no specs zip.exe no specs peaddindeployment.exe peshellcontextmenu4.exe peshellcontextmenu4.exe no specs fileassociation.exe no specs wsprtsetup.exe sc.exe no specs regsvr32.exe no specs petooldeployment.exe explorer.exe no specs petooldeployment.exe explorer.exe no specs petooldeployment.exe explorer.exe no specs petooldeploymentextend.exe penotify.exe explorer.exe no specs petooldeployment.exe penotify.exe pepreviewdeployment.exe regasm.exe pepreviewdeployment.exe fontlistsave.exe no specs explorer.exe no specs chrome.exe explorer.exe no specs chrome.exe no specs pdfelement.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs zip.exe no specs chrome.exe no specs pdfelement-pro_setup_full5254.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" /install /path "C:\Program Files\Wondershare\Wondershare PDFelement\PECaptureTool.exe" /notifydeviceboot 1 /defaultnotifydeviceboot 1 /deviceboot "Wondershare PEScreenshot.lnk" /startup /explorerstartup proxy /entrance DeviceBoot /loggernameend .InstallC:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
532C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
548"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
explorer.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
992"C:\Program Files\Wondershare\Wondershare PDFelement\PEShellContextMenu4.exe"C:\Program Files\Wondershare\Wondershare PDFelement\PEShellContextMenu4.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
PEShellExtension
Exit code:
0
Version:
10.0.0.50
Modules
Images
c:\program files\wondershare\wondershare pdfelement\peshellcontextmenu4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
explorer.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe" x -y -o"C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\Temp\WhatsNew\Pictures" "C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\Temp\WhatsNew\UpdateWindowsPicture.7z"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe—PDFelement.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip 独立命令行
Exit code:
0
Version:
9.20
Modules
Images
c:\program files\wondershare\wondershare pdfelement\zip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1376C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1484"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe" x "C:\Program Files\Wondershare\Wondershare PDFelement\Languages\Uninstall.lng" -y -o"C:\Program Files\Wondershare\Wondershare PDFelement\Languages\Uninstall"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe—pdfelement-pro_full5254.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip 独立命令行
Exit code:
0
Version:
9.20
Modules
Images
c:\program files\wondershare\wondershare pdfelement\zip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1548"C:\Program Files\Google\Chrome\Application\chrome.exe" http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fpdf.wondershare.com.br%2Fthankyou%2Finstall-pdfelement-pro-windows.html&client_sign={0f583826-90cc-429d-9f6a-55f46d6d5d3aG}&m_nProductID=5254&installtime=1708098340&product_version=10.2.7.2639C:\Program Files\Google\Chrome\Application\chrome.exe
pdfelement-pro_setup_full5254.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1592"C:\Program Files\Wondershare\Wondershare PDFelement\WSPrtSetup\WSPrtSetup.exe" /log "C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\log\InstallVirtualPrinter.log" /dvrname "Wondershare PDFelement" /prtname "Wondershare PDFelement" /monname "Wondershare PDFelement Monitor" /monport "Wondershare PDFelement Port" /monfile "PEPrinterMonitor.dll"C:\Program Files\Wondershare\Wondershare PDFelement\WSPrtSetup\WSPrtSetup.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare Software
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\wondershare\wondershare pdfelement\wsprtsetup\wsprtsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winspool.drv
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
44 750
Read events
44 293
Write events
436
Delete events
21

Modification events

(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WafCX
Operation:writeName:5254
Value:
sku-webr
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{0f583826-90cc-429d-9f6a-55f46d6d5d3aG}
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{0f583826-90cc-429d-9f6a-55f46d6d5d3aG}
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
324
Suspicious files
363
Text files
324
Unknown types
214

Dropped files

PID
Process
Filename
Type
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57binary
MD5:00A54E0038AD3EC151798E52F64B425C
SHA256:59C5993922F092F87CFCB21F57C1B8F42F643DDA7554294F0E420FADA5990295
2036pdfelement-pro_setup_full5254.exeC:\Users\Public\Documents\Wondershare\WAE_DOWNTASK_5254.xmlxml
MD5:C15E9FD55D1ABC9C58726BCF1510494E
SHA256:4805296C89D1249BE3478986F2E8829545D373C97ADE9CA7C1BDCB48540DE140
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.logtext
MD5:DFED171AF8BAA389C8A4829DA738C3EF
SHA256:F44BF7D5D152AFE7905238395AB95504E559067EC3DBEDC39736FF174F780818
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Temp\wsduilib.logtext
MD5:F98DC6A18CFADE5BC6023EEAE42733B9
SHA256:4E36E7C049CA8C3DF05B0BBB499F3492B8CDE2768E3DDCFB53B861BAEB7DE639
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57binary
MD5:7E61D2597DCFF4DF10ABDE9D1BF86350
SHA256:A75A101324C414FF5E751014FD1048BD3056C62D9F89E698229346375B3564EC
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3D5B99331D877046E959FD0F21DAAC07
SHA256:2FBE2E4B0606DA3D6579546AC0C7274D86355209797FF5CE1A88824DE397F5DF
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\json2[1].jstext
MD5:E78199FE40036021717F4A18BCDB91CE
SHA256:9DD0F1D3CECD1368D46CD881FF6F6529485F0414BC40F35D2A4D2C08769517F0
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14561BF7422BB6F70A9CB14F5AA8A7DA_6D5FC9FD3617659722A64D73A114DFF7binary
MD5:12EC5337F077341FF5FCB3C0B6B1CAE4
SHA256:4B4DCD86AE2E56C3B2C96FEC19CDAB5EEE1AE3A49287349F485ADAC3C1502F30
2036pdfelement-pro_setup_full5254.exeC:\Users\Public\Documents\Wondershare\pdfelement-pro_full5254.exe.~P2S —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
194
DNS requests
179
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
pdfelement-pro_setup_full5254.exe
HEAD
200
163.181.56.209:80
http://download-pt.wondershare.com/cbs_down/pdfelement-pro_full5254.exe
unknown
—
—
—
2036
pdfelement-pro_setup_full5254.exe
GET
—
8.209.73.211:80
http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign={0f583826-90cc-429d-9f6a-55f46d6d5d3aG}&product_id=5254&wae=4.0.4&platform=win_x86
unknown
—
—
—
2036
pdfelement-pro_setup_full5254.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e5509cffa3aa06fd
unknown
—
—
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D
unknown
binary
471 b
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEA3EQd5SLWy5mr7JXcu5TKw%3D
unknown
binary
727 b
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAKlf1nuem1AlkNvBwxf5A
unknown
binary
472 b
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAch2W18yjrFCctU7xjW0Yc%3D
unknown
binary
471 b
—
2036
pdfelement-pro_setup_full5254.exe
HEAD
200
163.181.56.210:80
http://download-pt.wondershare.com/cbs_down/pdfelement-pro_full5254.exe
unknown
—
—
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2036
pdfelement-pro_setup_full5254.exe
8.209.72.213:443
pc-api.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
8.209.73.211:80
platform.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
47.91.89.51:443
prod-web.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.215:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.216:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.209:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.210:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown

DNS requests

Domain
IP
Reputation
pc-api.wondershare.cc
  • 8.209.72.213
unknown
platform.wondershare.cc
  • 8.209.73.211
unknown
prod-web.wondershare.cc
  • 47.91.89.51
unknown
download-pt.wondershare.com
  • 163.181.56.215
  • 163.181.56.216
  • 163.181.56.209
  • 163.181.56.210
  • 163.181.56.211
  • 163.181.56.212
  • 163.181.56.213
  • 163.181.56.214
unknown
analytics.wondershare.cc
  • 47.91.90.244
unknown
wae.wondershare.cc
  • 163.181.92.234
  • 163.181.92.235
  • 163.181.92.236
  • 163.181.92.237
  • 163.181.92.238
  • 163.181.92.231
  • 163.181.92.232
  • 163.181.92.233
unknown
analytics.300624.com
  • 47.91.74.43
unknown
ctldl.windowsupdate.com
  • 2.19.126.137
  • 2.19.126.163
  • 23.48.23.61
  • 23.48.23.34
  • 23.48.23.50
  • 23.48.23.7
  • 23.48.23.60
  • 23.48.23.43
  • 23.48.23.20
  • 23.48.23.16
  • 23.48.23.51
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
fonts.googleapis.com
  • 216.58.212.170
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
6 ETPRO signatures available at the full report
Process
Message
PEToolDeployment.exe
ProductVersion: 10.2.7.2639
PEToolDeployment.exe
PreviewVersion: 1.0.0.70
PEToolDeployment.exe
EnvironmentVersion: 4.0.30319.42000
PEToolDeployment.exe
EnvironmentBit: 32
PEToolDeployment.exe
InitLogTime: 2024-02-16 15:44:12:238
PEToolDeployment.exe
InitLogTimeSpan: 0.03125s
PEToolDeployment.exe
Args: "C:\Users\admin\AppData\Local\Temp\is-OF69C.tmp\PEToolDeployment.exe" /lastinstallversion /productanothername /loggernameend .Install
PEToolDeployment.exe
ProductName: PDFelement
PEToolDeployment.exe
ExitCode: 0
PEPreviewDeployment.exe
StartExeTime: 2024-02-16 15:44:12:769
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
pdfelement-pro_setup_full5254.exe