File name:

pdfelement-pro_setup_full5254.exe

Full analysis: https://app.any.run/tasks/a5c01ee1-b118-45c9-9b0e-fbf5f71caf13
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 16, 2024, 15:42:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B79061DE60AAEAC55A834351739FD3E7

SHA1:

3E28E5D7B260956325681A1BA30767E3CE0CD27A

SHA256:

0D13C2A94245B779B352695D94D8D263DA2682C75FAA13BAB5E6BC5E0E71FD73

SSDEEP:

98304:1SfFu4Cy9ZRo0k+ajyWaRduAC7KzhCBwbo/IAACaj/c:eG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • WSPrtSetup.exe (PID: 1592)

    • Creates a writable file in the system directory

      • pdfelement-pro_full5254.tmp (PID: 2744)
      • WSPrtSetup.exe (PID: 1592)

    • Registers / Runs the DLL via REGSVR32.EXE

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Create files in the Startup directory

      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)

  • SUSPICIOUS

    • Reads Microsoft Outlook installation path

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Reads security settings of Internet Explorer

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 1192)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Reads the Internet Settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3768)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Connects to unusual port

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Checks Windows Trust Settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Process requests binary or script from the Internet

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PDFelement.exe (PID: 4040)

    • Likely accesses (executes) a file from the Public directory

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Reads settings of System Certificates

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Reads Internet Explorer settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PDFelement.exe (PID: 4040)

    • Executable content was dropped or overwritten

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • WSPrtSetup.exe (PID: 1592)

    • Reads the Windows owner or organization settings

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Process drops legitimate windows executable

      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEAddInDeployment.exe (PID: 2620)
      • WSPrtSetup.exe (PID: 1592)

    • The process drops C-runtime libraries

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Drops 7-zip archiver for unpacking

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Searches for installed software

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Creates/Modifies COM task schedule object

      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 1936)
      • regsvr32.exe (PID: 3256)
      • RegAsm.exe (PID: 3936)

    • Starts itself from another location

      • PEShellContextMenu4.exe (PID: 992)

    • Starts SC.EXE for service management

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 2192)
      • explorer.exe (PID: 2740)
      • explorer.exe (PID: 2152)

    • Reads the BIOS version

      • PDFelement.exe (PID: 4040)

  • INFO

    • Reads the machine GUID from the registry

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • PEShellContextMenu4.exe (PID: 1936)
      • FileAssociation.exe (PID: 2516)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 548)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 1192)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3604)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 3952)
      • PEPreviewDeployment.exe (PID: 2408)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Checks supported languages

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • PEPreviewDeployment.exe (PID: 2484)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2488)
      • zip.exe (PID: 1484)
      • PEAddInDeployment.exe (PID: 2620)
      • zip.exe (PID: 1728)
      • PEShellContextMenu4.exe (PID: 992)
      • WSPrtSetup.exe (PID: 1592)
      • PEShellContextMenu4.exe (PID: 1936)
      • FileAssociation.exe (PID: 2516)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PENotify.exe (PID: 3604)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 1192)
      • PEPreviewDeployment.exe (PID: 3952)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)
      • fontlistsave.exe (PID: 1972)
      • PEPreviewDeployment.exe (PID: 2408)
      • zip.exe (PID: 1192)

    • Create files in a temporary directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PDFelement.exe (PID: 4040)

    • Reads the computer name

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • WSPrtSetup.exe (PID: 1592)
      • PEShellContextMenu4.exe (PID: 1936)
      • FileAssociation.exe (PID: 2516)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PENotify.exe (PID: 3768)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3604)
      • RegAsm.exe (PID: 3936)
      • PEPreviewDeployment.exe (PID: 3952)
      • PEPreviewDeployment.exe (PID: 2408)
      • PDFelement.exe (PID: 4040)

    • Checks proxy server information

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Reads the software policy settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PENotify.exe (PID: 3768)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PDFelement.exe (PID: 4040)

    • Creates files or folders in the user directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEToolDeployment.exe (PID: 2488)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEShellContextMenu4.exe (PID: 992)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 2024)
      • regsvr32.exe (PID: 3256)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3768)
      • PEPreviewDeployment.exe (PID: 3952)
      • PEPreviewDeployment.exe (PID: 2408)
      • fontlistsave.exe (PID: 1972)
      • PDFelement.exe (PID: 4040)
      • zip.exe (PID: 1192)

    • Creates files in the program directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • zip.exe (PID: 1728)
      • zip.exe (PID: 1484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PDFelement.exe (PID: 4040)

    • Creates a software uninstall entry

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Reads Microsoft Office registry keys

      • PEAddInDeployment.exe (PID: 2620)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 532)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 1376)

    • Reads the Internet Settings

      • explorer.exe (PID: 532)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 1376)

    • Reads Environment values

      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Reads the time zone

      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Application launched itself

      • chrome.exe (PID: 1548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:01 09:19:03+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 1278976
InitializedDataSize: 918016
UninitializedDataSize: -
EntryPoint: 0x106980
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.0.4.19
ProductVersionNumber: 4.0.4.19
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: wondershare-pdfelement_setup_full5254.exe
FileVersion: 4.0.4.19
LegalCopyright: Copyright©2023 Wondershare. All rights reserved.
ProductName: Wondershare PDFelement
ProductVersion: 10.0.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
47
Malicious processes
12
Suspicious processes
4

Behavior graph

Click at the process to see the details
start pdfelement-pro_setup_full5254.exe pdfelement-pro_full5254.exe pdfelement-pro_full5254.tmp petooldeployment.exe pepreviewdeployment.exe zip.exe no specs zip.exe no specs peaddindeployment.exe peshellcontextmenu4.exe peshellcontextmenu4.exe no specs fileassociation.exe no specs wsprtsetup.exe sc.exe no specs regsvr32.exe no specs petooldeployment.exe explorer.exe no specs petooldeployment.exe explorer.exe no specs petooldeployment.exe explorer.exe no specs petooldeploymentextend.exe penotify.exe explorer.exe no specs petooldeployment.exe penotify.exe pepreviewdeployment.exe regasm.exe pepreviewdeployment.exe fontlistsave.exe no specs explorer.exe no specs chrome.exe explorer.exe no specs chrome.exe no specs pdfelement.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs zip.exe no specs chrome.exe no specs pdfelement-pro_setup_full5254.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" /install /path "C:\Program Files\Wondershare\Wondershare PDFelement\PECaptureTool.exe" /notifydeviceboot 1 /defaultnotifydeviceboot 1 /deviceboot "Wondershare PEScreenshot.lnk" /startup /explorerstartup proxy /entrance DeviceBoot /loggernameend .InstallC:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
532C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
548"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
explorer.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
992"C:\Program Files\Wondershare\Wondershare PDFelement\PEShellContextMenu4.exe"C:\Program Files\Wondershare\Wondershare PDFelement\PEShellContextMenu4.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
PEShellExtension
Exit code:
0
Version:
10.0.0.50
Modules
Images
c:\program files\wondershare\wondershare pdfelement\peshellcontextmenu4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
explorer.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe" x -y -o"C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\Temp\WhatsNew\Pictures" "C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\Temp\WhatsNew\UpdateWindowsPicture.7z"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe—PDFelement.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip 独立命令行
Exit code:
0
Version:
9.20
Modules
Images
c:\program files\wondershare\wondershare pdfelement\zip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1376C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1484"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe" x "C:\Program Files\Wondershare\Wondershare PDFelement\Languages\Uninstall.lng" -y -o"C:\Program Files\Wondershare\Wondershare PDFelement\Languages\Uninstall"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe—pdfelement-pro_full5254.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip 独立命令行
Exit code:
0
Version:
9.20
Modules
Images
c:\program files\wondershare\wondershare pdfelement\zip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1548"C:\Program Files\Google\Chrome\Application\chrome.exe" http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fpdf.wondershare.com.br%2Fthankyou%2Finstall-pdfelement-pro-windows.html&client_sign={0f583826-90cc-429d-9f6a-55f46d6d5d3aG}&m_nProductID=5254&installtime=1708098340&product_version=10.2.7.2639C:\Program Files\Google\Chrome\Application\chrome.exe
pdfelement-pro_setup_full5254.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1592"C:\Program Files\Wondershare\Wondershare PDFelement\WSPrtSetup\WSPrtSetup.exe" /log "C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\log\InstallVirtualPrinter.log" /dvrname "Wondershare PDFelement" /prtname "Wondershare PDFelement" /monname "Wondershare PDFelement Monitor" /monport "Wondershare PDFelement Port" /monfile "PEPrinterMonitor.dll"C:\Program Files\Wondershare\Wondershare PDFelement\WSPrtSetup\WSPrtSetup.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare Software
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\wondershare\wondershare pdfelement\wsprtsetup\wsprtsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winspool.drv
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
44 750
Read events
44 293
Write events
436
Delete events
21

Modification events

(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WafCX
Operation:writeName:5254
Value:
sku-webr
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{0f583826-90cc-429d-9f6a-55f46d6d5d3aG}
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{0f583826-90cc-429d-9f6a-55f46d6d5d3aG}
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
324
Suspicious files
363
Text files
324
Unknown types
214

Dropped files

PID
Process
Filename
Type
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Temp\wsduilib.logtext
MD5:F98DC6A18CFADE5BC6023EEAE42733B9
SHA256:4E36E7C049CA8C3DF05B0BBB499F3492B8CDE2768E3DDCFB53B861BAEB7DE639
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\css2[1].csstext
MD5:FDEDBC150E0C93F74206062BBD18BAFB
SHA256:9FA428251940904DCB7F598E3D2AB5129B82EEA4F4B402B8637B64014C841DEA
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157binary
MD5:3D5B99331D877046E959FD0F21DAAC07
SHA256:2FBE2E4B0606DA3D6579546AC0C7274D86355209797FF5CE1A88824DE397F5DF
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:4047BC019B30303CC6102DF9CC0D023D
SHA256:D877FE435C2F70E579F94D94AF9F1B440F3589E500650CF7D1226F91951071E6
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\font[1].eotbinary
MD5:4B5AFC906D1ED38C39329452817A9F31
SHA256:4E638C4EEC39DD1C891DF47A351CF5CABBC49056419488B464A3CDB91BF1D686
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\4[1].pngimage
MD5:D131B9EFA13B8744EDD23B0A656B96A0
SHA256:512CA3E085431F5618BCB1B22BDCE04214E2D7AC5C244216D9394D4D77160E03
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\6[1].pngimage
MD5:CCD8B159E19F7EC10CF4082403E03E7E
SHA256:B598322FBF5F8096C5D8204DD639B7E6F74D03835F8BC20C30DFC3EC308EF60A
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\5[1].pngimage
MD5:836253DF58954C1F04B29AD82C7FCE1C
SHA256:C2D6D05E279B178320D78C7E1FECDC4127555D9A1AF867FC0B9FB201790F9810
2036pdfelement-pro_setup_full5254.exeC:\Users\Public\Documents\Wondershare\pdfelement-pro_full5254.exe.~P2S —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
194
DNS requests
179
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
pdfelement-pro_setup_full5254.exe
GET
—
8.209.73.211:80
http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign={0f583826-90cc-429d-9f6a-55f46d6d5d3aG}&product_id=5254&wae=4.0.4&platform=win_x86
unknown
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e5509cffa3aa06fd
unknown
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
HEAD
200
163.181.56.209:80
http://download-pt.wondershare.com/cbs_down/pdfelement-pro_full5254.exe
unknown
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D
unknown
binary
471 b
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEA3EQd5SLWy5mr7JXcu5TKw%3D
unknown
binary
727 b
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAch2W18yjrFCctU7xjW0Yc%3D
unknown
binary
471 b
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAKlf1nuem1AlkNvBwxf5A
unknown
binary
472 b
unknown
2036
pdfelement-pro_setup_full5254.exe
HEAD
200
163.181.56.212:80
http://download-pt.wondershare.com/cbs_down/pdfelement-pro_full5254.exe
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2036
pdfelement-pro_setup_full5254.exe
8.209.72.213:443
pc-api.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
8.209.73.211:80
platform.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
47.91.89.51:443
prod-web.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.215:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.216:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.209:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.210:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown

DNS requests

Domain
IP
Reputation
pc-api.wondershare.cc
  • 8.209.72.213
malicious
platform.wondershare.cc
  • 8.209.73.211
unknown
prod-web.wondershare.cc
  • 47.91.89.51
unknown
download-pt.wondershare.com
  • 163.181.56.215
  • 163.181.56.216
  • 163.181.56.209
  • 163.181.56.210
  • 163.181.56.211
  • 163.181.56.212
  • 163.181.56.213
  • 163.181.56.214
whitelisted
analytics.wondershare.cc
  • 47.91.90.244
unknown
wae.wondershare.cc
  • 163.181.92.234
  • 163.181.92.235
  • 163.181.92.236
  • 163.181.92.237
  • 163.181.92.238
  • 163.181.92.231
  • 163.181.92.232
  • 163.181.92.233
unknown
analytics.300624.com
  • 47.91.74.43
unknown
ctldl.windowsupdate.com
  • 2.19.126.137
  • 2.19.126.163
  • 23.48.23.61
  • 23.48.23.34
  • 23.48.23.50
  • 23.48.23.7
  • 23.48.23.60
  • 23.48.23.43
  • 23.48.23.20
  • 23.48.23.16
  • 23.48.23.51
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fonts.googleapis.com
  • 216.58.212.170
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2036
pdfelement-pro_setup_full5254.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2036
pdfelement-pro_setup_full5254.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6 ETPRO signatures available at the full report
Process
Message
PEToolDeployment.exe
ProductVersion: 10.2.7.2639
PEToolDeployment.exe
PreviewVersion: 1.0.0.70
PEToolDeployment.exe
EnvironmentVersion: 4.0.30319.42000
PEToolDeployment.exe
EnvironmentBit: 32
PEToolDeployment.exe
InitLogTime: 2024-02-16 15:44:12:238
PEToolDeployment.exe
InitLogTimeSpan: 0.03125s
PEToolDeployment.exe
Args: "C:\Users\admin\AppData\Local\Temp\is-OF69C.tmp\PEToolDeployment.exe" /lastinstallversion /productanothername /loggernameend .Install
PEToolDeployment.exe
ProductName: PDFelement
PEToolDeployment.exe
ExitCode: 0
PEPreviewDeployment.exe
StartExeTime: 2024-02-16 15:44:12:769
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pdfelement-pro_setup_full5254.exe