File name:

pdfelement-pro_setup_full5254.exe

Full analysis: https://app.any.run/tasks/a5c01ee1-b118-45c9-9b0e-fbf5f71caf13
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 16, 2024, 15:42:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B79061DE60AAEAC55A834351739FD3E7

SHA1:

3E28E5D7B260956325681A1BA30767E3CE0CD27A

SHA256:

0D13C2A94245B779B352695D94D8D263DA2682C75FAA13BAB5E6BC5E0E71FD73

SSDEEP:

98304:1SfFu4Cy9ZRo0k+ajyWaRduAC7KzhCBwbo/IAACaj/c:eG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • WSPrtSetup.exe (PID: 1592)

    • Creates a writable file in the system directory

      • pdfelement-pro_full5254.tmp (PID: 2744)
      • WSPrtSetup.exe (PID: 1592)

    • Registers / Runs the DLL via REGSVR32.EXE

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Create files in the Startup directory

      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeployment.exe (PID: 1192)
      • PEToolDeployment.exe (PID: 2024)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Reads Internet Explorer settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PDFelement.exe (PID: 4040)

    • Reads the Internet Settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3768)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Reads settings of System Certificates

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Process requests binary or script from the Internet

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PDFelement.exe (PID: 4040)

    • Likely accesses (executes) a file from the Public directory

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Executable content was dropped or overwritten

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • WSPrtSetup.exe (PID: 1592)

    • Connects to unusual port

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Reads the Windows owner or organization settings

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Reads Microsoft Outlook installation path

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Process drops legitimate windows executable

      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEAddInDeployment.exe (PID: 2620)
      • WSPrtSetup.exe (PID: 1592)

    • Checks Windows Trust Settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Drops 7-zip archiver for unpacking

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Searches for installed software

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • The process drops C-runtime libraries

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Creates/Modifies COM task schedule object

      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 1936)
      • regsvr32.exe (PID: 3256)
      • RegAsm.exe (PID: 3936)

    • Starts SC.EXE for service management

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 2192)
      • explorer.exe (PID: 2740)
      • explorer.exe (PID: 2152)

    • Starts itself from another location

      • PEShellContextMenu4.exe (PID: 992)

    • Reads the BIOS version

      • PDFelement.exe (PID: 4040)

  • INFO

    • Checks supported languages

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • PEToolDeployment.exe (PID: 2488)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 2484)
      • zip.exe (PID: 1728)
      • PEAddInDeployment.exe (PID: 2620)
      • zip.exe (PID: 1484)
      • PEShellContextMenu4.exe (PID: 992)
      • PEShellContextMenu4.exe (PID: 1936)
      • FileAssociation.exe (PID: 2516)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3604)
      • PEPreviewDeployment.exe (PID: 3952)
      • RegAsm.exe (PID: 3936)
      • PEPreviewDeployment.exe (PID: 2408)
      • fontlistsave.exe (PID: 1972)
      • PDFelement.exe (PID: 4040)
      • zip.exe (PID: 1192)

    • Reads the computer name

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 1936)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEShellContextMenu4.exe (PID: 992)
      • FileAssociation.exe (PID: 2516)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3604)
      • RegAsm.exe (PID: 3936)
      • PEPreviewDeployment.exe (PID: 3952)
      • PEPreviewDeployment.exe (PID: 2408)
      • PDFelement.exe (PID: 4040)

    • Creates files or folders in the user directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEShellContextMenu4.exe (PID: 992)
      • WSPrtSetup.exe (PID: 1592)
      • regsvr32.exe (PID: 3256)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 1192)
      • PEPreviewDeployment.exe (PID: 3952)
      • PEPreviewDeployment.exe (PID: 2408)
      • fontlistsave.exe (PID: 1972)
      • PDFelement.exe (PID: 4040)
      • zip.exe (PID: 1192)

    • Reads the software policy settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PENotify.exe (PID: 3768)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PDFelement.exe (PID: 4040)

    • Creates files in the program directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • zip.exe (PID: 1728)
      • zip.exe (PID: 1484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PDFelement.exe (PID: 4040)

    • Create files in a temporary directory

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PDFelement.exe (PID: 4040)

    • Reads the machine GUID from the registry

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEShellContextMenu4.exe (PID: 992)
      • PEShellContextMenu4.exe (PID: 1936)
      • PEToolDeployment.exe (PID: 2488)
      • FileAssociation.exe (PID: 2516)
      • PEToolDeployment.exe (PID: 2024)
      • PEAddInDeployment.exe (PID: 2620)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3604)
      • PEPreviewDeployment.exe (PID: 3952)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • RegAsm.exe (PID: 3936)
      • PEPreviewDeployment.exe (PID: 2408)
      • PDFelement.exe (PID: 4040)

    • Checks proxy server information

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Creates a software uninstall entry

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Reads Microsoft Office registry keys

      • PEAddInDeployment.exe (PID: 2620)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 532)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 1376)

    • Reads the Internet Settings

      • explorer.exe (PID: 532)
      • explorer.exe (PID: 1376)
      • explorer.exe (PID: 2824)

    • Reads Environment values

      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Reads the time zone

      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Application launched itself

      • chrome.exe (PID: 1548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:01 09:19:03+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 1278976
InitializedDataSize: 918016
UninitializedDataSize: -
EntryPoint: 0x106980
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.0.4.19
ProductVersionNumber: 4.0.4.19
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: wondershare-pdfelement_setup_full5254.exe
FileVersion: 4.0.4.19
LegalCopyright: Copyright©2023 Wondershare. All rights reserved.
ProductName: Wondershare PDFelement
ProductVersion: 10.0.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
47
Malicious processes
12
Suspicious processes
4

Behavior graph

Click at the process to see the details
start pdfelement-pro_setup_full5254.exe pdfelement-pro_full5254.exe pdfelement-pro_full5254.tmp petooldeployment.exe pepreviewdeployment.exe zip.exe no specs zip.exe no specs peaddindeployment.exe peshellcontextmenu4.exe peshellcontextmenu4.exe no specs fileassociation.exe no specs wsprtsetup.exe sc.exe no specs regsvr32.exe no specs petooldeployment.exe explorer.exe no specs petooldeployment.exe explorer.exe no specs petooldeployment.exe explorer.exe no specs petooldeploymentextend.exe penotify.exe explorer.exe no specs petooldeployment.exe penotify.exe pepreviewdeployment.exe regasm.exe pepreviewdeployment.exe fontlistsave.exe no specs explorer.exe no specs chrome.exe explorer.exe no specs chrome.exe no specs pdfelement.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs zip.exe no specs chrome.exe no specs pdfelement-pro_setup_full5254.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" /install /path "C:\Program Files\Wondershare\Wondershare PDFelement\PECaptureTool.exe" /notifydeviceboot 1 /defaultnotifydeviceboot 1 /deviceboot "Wondershare PEScreenshot.lnk" /startup /explorerstartup proxy /entrance DeviceBoot /loggernameend .InstallC:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
532C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
548"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
explorer.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
992"C:\Program Files\Wondershare\Wondershare PDFelement\PEShellContextMenu4.exe"C:\Program Files\Wondershare\Wondershare PDFelement\PEShellContextMenu4.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
PEShellExtension
Exit code:
0
Version:
10.0.0.50
Modules
Images
c:\program files\wondershare\wondershare pdfelement\peshellcontextmenu4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
explorer.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe" x -y -o"C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\Temp\WhatsNew\Pictures" "C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\Temp\WhatsNew\UpdateWindowsPicture.7z"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe—PDFelement.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip 独立命令行
Exit code:
0
Version:
9.20
Modules
Images
c:\program files\wondershare\wondershare pdfelement\zip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1376C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1484"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe" x "C:\Program Files\Wondershare\Wondershare PDFelement\Languages\Uninstall.lng" -y -o"C:\Program Files\Wondershare\Wondershare PDFelement\Languages\Uninstall"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe—pdfelement-pro_full5254.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip 独立命令行
Exit code:
0
Version:
9.20
Modules
Images
c:\program files\wondershare\wondershare pdfelement\zip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1548"C:\Program Files\Google\Chrome\Application\chrome.exe" http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fpdf.wondershare.com.br%2Fthankyou%2Finstall-pdfelement-pro-windows.html&client_sign={0f583826-90cc-429d-9f6a-55f46d6d5d3aG}&m_nProductID=5254&installtime=1708098340&product_version=10.2.7.2639C:\Program Files\Google\Chrome\Application\chrome.exe
pdfelement-pro_setup_full5254.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1592"C:\Program Files\Wondershare\Wondershare PDFelement\WSPrtSetup\WSPrtSetup.exe" /log "C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\log\InstallVirtualPrinter.log" /dvrname "Wondershare PDFelement" /prtname "Wondershare PDFelement" /monname "Wondershare PDFelement Monitor" /monport "Wondershare PDFelement Port" /monfile "PEPrinterMonitor.dll"C:\Program Files\Wondershare\Wondershare PDFelement\WSPrtSetup\WSPrtSetup.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare Software
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\wondershare\wondershare pdfelement\wsprtsetup\wsprtsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winspool.drv
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
44 750
Read events
44 293
Write events
436
Delete events
21

Modification events

(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WafCX
Operation:writeName:5254
Value:
sku-webr
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{0f583826-90cc-429d-9f6a-55f46d6d5d3aG}
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{0f583826-90cc-429d-9f6a-55f46d6d5d3aG}
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
324
Suspicious files
363
Text files
324
Unknown types
214

Dropped files

PID
Process
Filename
Type
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\jquery-2_1_4.min[1].jstext
MD5:5A78469E930137026167FC0FBA0FE3E6
SHA256:7BB14685F20EF4995672F51029F6BE814F866A035D7869F7DA6756A5FE8AC649
2036pdfelement-pro_setup_full5254.exeC:\Users\Public\Documents\Wondershare\WAE_DOWNTASK_5254.xmlxml
MD5:C15E9FD55D1ABC9C58726BCF1510494E
SHA256:4805296C89D1249BE3478986F2E8829545D373C97ADE9CA7C1BDCB48540DE140
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\javascript_call_native[1].jstext
MD5:B9DA127236EFDB755F568304B5EF3044
SHA256:01C839C0A9C47DC571175312EBC208EAE6FF28CED3A3EFA13C1EE81CD9764F71
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57binary
MD5:00A54E0038AD3EC151798E52F64B425C
SHA256:59C5993922F092F87CFCB21F57C1B8F42F643DDA7554294F0E420FADA5990295
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57binary
MD5:7E61D2597DCFF4DF10ABDE9D1BF86350
SHA256:A75A101324C414FF5E751014FD1048BD3056C62D9F89E698229346375B3564EC
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Temp\Wondershare\WAE\wsWAE.logtext
MD5:DFED171AF8BAA389C8A4829DA738C3EF
SHA256:F44BF7D5D152AFE7905238395AB95504E559067EC3DBEDC39736FF174F780818
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_8F986B155B6342EE1ACF678AFF6889B0binary
MD5:19B309CAA52739850DC035851F36238D
SHA256:E24397ECE1597FCE8FD29BD4A8125714B9880A085B04548582503F07AF71EF81
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAbinary
MD5:6DB44C2204411312A6F309ECC1B06435
SHA256:CA9EE6D77748C06F1627D2E10CF34A8EF36FB92462F3D440ECA422D9A4F6FF1D
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\14561BF7422BB6F70A9CB14F5AA8A7DA_6D5FC9FD3617659722A64D73A114DFF7binary
MD5:12EC5337F077341FF5FCB3C0B6B1CAE4
SHA256:4B4DCD86AE2E56C3B2C96FEC19CDAB5EEE1AE3A49287349F485ADAC3C1502F30
2036pdfelement-pro_setup_full5254.exeC:\Users\Public\Documents\Wondershare\pdfelement-pro_full5254.exe.~P2S —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
194
DNS requests
179
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
pdfelement-pro_setup_full5254.exe
GET
—
8.209.73.211:80
http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign={0f583826-90cc-429d-9f6a-55f46d6d5d3aG}&product_id=5254&wae=4.0.4&platform=win_x86
unknown
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
HEAD
200
163.181.56.209:80
http://download-pt.wondershare.com/cbs_down/pdfelement-pro_full5254.exe
unknown
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e5509cffa3aa06fd
unknown
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D
unknown
binary
471 b
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEA3EQd5SLWy5mr7JXcu5TKw%3D
unknown
binary
727 b
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAch2W18yjrFCctU7xjW0Yc%3D
unknown
binary
471 b
unknown
2036
pdfelement-pro_setup_full5254.exe
HEAD
200
163.181.56.210:80
http://download-pt.wondershare.com/cbs_down/pdfelement-pro_full5254.exe
unknown
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAKlf1nuem1AlkNvBwxf5A
unknown
binary
472 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
2036
pdfelement-pro_setup_full5254.exe
8.209.72.213:443
pc-api.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
8.209.73.211:80
platform.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
47.91.89.51:443
prod-web.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.215:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.216:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.209:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.210:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown

DNS requests

Domain
IP
Reputation
pc-api.wondershare.cc
  • 8.209.72.213
malicious
platform.wondershare.cc
  • 8.209.73.211
unknown
prod-web.wondershare.cc
  • 47.91.89.51
unknown
download-pt.wondershare.com
  • 163.181.56.215
  • 163.181.56.216
  • 163.181.56.209
  • 163.181.56.210
  • 163.181.56.211
  • 163.181.56.212
  • 163.181.56.213
  • 163.181.56.214
whitelisted
analytics.wondershare.cc
  • 47.91.90.244
unknown
wae.wondershare.cc
  • 163.181.92.234
  • 163.181.92.235
  • 163.181.92.236
  • 163.181.92.237
  • 163.181.92.238
  • 163.181.92.231
  • 163.181.92.232
  • 163.181.92.233
unknown
analytics.300624.com
  • 47.91.74.43
unknown
ctldl.windowsupdate.com
  • 2.19.126.137
  • 2.19.126.163
  • 23.48.23.61
  • 23.48.23.34
  • 23.48.23.50
  • 23.48.23.7
  • 23.48.23.60
  • 23.48.23.43
  • 23.48.23.20
  • 23.48.23.16
  • 23.48.23.51
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
fonts.googleapis.com
  • 216.58.212.170
whitelisted

Threats

PID
Process
Class
Message
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
2036
pdfelement-pro_setup_full5254.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
2036
pdfelement-pro_setup_full5254.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
1080
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
6 ETPRO signatures available at the full report
Process
Message
PEToolDeployment.exe
ProductVersion: 10.2.7.2639
PEToolDeployment.exe
PreviewVersion: 1.0.0.70
PEToolDeployment.exe
EnvironmentVersion: 4.0.30319.42000
PEToolDeployment.exe
EnvironmentBit: 32
PEToolDeployment.exe
InitLogTime: 2024-02-16 15:44:12:238
PEToolDeployment.exe
InitLogTimeSpan: 0.03125s
PEToolDeployment.exe
Args: "C:\Users\admin\AppData\Local\Temp\is-OF69C.tmp\PEToolDeployment.exe" /lastinstallversion /productanothername /loggernameend .Install
PEToolDeployment.exe
ProductName: PDFelement
PEToolDeployment.exe
ExitCode: 0
PEPreviewDeployment.exe
StartExeTime: 2024-02-16 15:44:12:769
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pdfelement-pro_setup_full5254.exe