File name:

pdfelement-pro_setup_full5254.exe

Full analysis: https://app.any.run/tasks/a5c01ee1-b118-45c9-9b0e-fbf5f71caf13
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: February 16, 2024, 15:42:16
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

B79061DE60AAEAC55A834351739FD3E7

SHA1:

3E28E5D7B260956325681A1BA30767E3CE0CD27A

SHA256:

0D13C2A94245B779B352695D94D8D263DA2682C75FAA13BAB5E6BC5E0E71FD73

SSDEEP:

98304:1SfFu4Cy9ZRo0k+ajyWaRduAC7KzhCBwbo/IAACaj/c:eG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEShellContextMenu4.exe (PID: 992)
      • PEAddInDeployment.exe (PID: 2620)
      • WSPrtSetup.exe (PID: 1592)

    • Creates a writable file in the system directory

      • pdfelement-pro_full5254.tmp (PID: 2744)
      • WSPrtSetup.exe (PID: 1592)

    • Registers / Runs the DLL via REGSVR32.EXE

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Create files in the Startup directory

      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeployment.exe (PID: 1192)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Reads the Internet Settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3768)
      • RegAsm.exe (PID: 3936)
      • PDFelement.exe (PID: 4040)

    • Reads Microsoft Outlook installation path

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Reads settings of System Certificates

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Checks Windows Trust Settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Reads Internet Explorer settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PDFelement.exe (PID: 4040)

    • Connects to unusual port

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Process requests binary or script from the Internet

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PDFelement.exe (PID: 4040)

    • Likely accesses (executes) a file from the Public directory

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Executable content was dropped or overwritten

      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEShellContextMenu4.exe (PID: 992)
      • PEAddInDeployment.exe (PID: 2620)
      • WSPrtSetup.exe (PID: 1592)

    • Reads the Windows owner or organization settings

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Process drops legitimate windows executable

      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEAddInDeployment.exe (PID: 2620)
      • WSPrtSetup.exe (PID: 1592)

    • The process drops C-runtime libraries

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Drops 7-zip archiver for unpacking

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Searches for installed software

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Starts itself from another location

      • PEShellContextMenu4.exe (PID: 992)

    • Creates/Modifies COM task schedule object

      • PEShellContextMenu4.exe (PID: 1936)
      • PEAddInDeployment.exe (PID: 2620)
      • regsvr32.exe (PID: 3256)
      • RegAsm.exe (PID: 3936)

    • Starts SC.EXE for service management

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Explorer used for Indirect Command Execution

      • explorer.exe (PID: 2192)
      • explorer.exe (PID: 2740)
      • explorer.exe (PID: 2152)

    • Reads the BIOS version

      • PDFelement.exe (PID: 4040)

  • INFO

    • Checks supported languages

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEToolDeployment.exe (PID: 2488)
      • zip.exe (PID: 1728)
      • zip.exe (PID: 1484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • PEShellContextMenu4.exe (PID: 1936)
      • FileAssociation.exe (PID: 2516)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PENotify.exe (PID: 3768)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3604)
      • PEPreviewDeployment.exe (PID: 3952)
      • PEPreviewDeployment.exe (PID: 2408)
      • RegAsm.exe (PID: 3936)
      • fontlistsave.exe (PID: 1972)
      • PDFelement.exe (PID: 4040)
      • zip.exe (PID: 1192)

    • Reads the computer name

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 1936)
      • PEShellContextMenu4.exe (PID: 992)
      • FileAssociation.exe (PID: 2516)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 1192)
      • PENotify.exe (PID: 3604)
      • PEPreviewDeployment.exe (PID: 3952)
      • RegAsm.exe (PID: 3936)
      • PEPreviewDeployment.exe (PID: 2408)
      • PDFelement.exe (PID: 4040)

    • Reads the machine GUID from the registry

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEToolDeployment.exe (PID: 2488)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • FileAssociation.exe (PID: 2516)
      • PEShellContextMenu4.exe (PID: 1936)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PEToolDeployment.exe (PID: 548)
      • PENotify.exe (PID: 3768)
      • PENotify.exe (PID: 3604)
      • PEToolDeployment.exe (PID: 1192)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEPreviewDeployment.exe (PID: 3952)
      • RegAsm.exe (PID: 3936)
      • PEPreviewDeployment.exe (PID: 2408)
      • PDFelement.exe (PID: 4040)

    • Checks proxy server information

      • pdfelement-pro_setup_full5254.exe (PID: 2036)

    • Create files in a temporary directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.exe (PID: 1900)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PDFelement.exe (PID: 4040)

    • Creates files in the program directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • zip.exe (PID: 1728)
      • zip.exe (PID: 1484)
      • PEAddInDeployment.exe (PID: 2620)
      • PEShellContextMenu4.exe (PID: 992)
      • PEToolDeployment.exe (PID: 2024)
      • PEToolDeployment.exe (PID: 268)
      • PDFelement.exe (PID: 4040)

    • Reads the software policy settings

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PENotify.exe (PID: 3768)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PDFelement.exe (PID: 4040)

    • Creates files or folders in the user directory

      • pdfelement-pro_setup_full5254.exe (PID: 2036)
      • PEPreviewDeployment.exe (PID: 2484)
      • PEToolDeployment.exe (PID: 2488)
      • pdfelement-pro_full5254.tmp (PID: 2744)
      • PEShellContextMenu4.exe (PID: 992)
      • regsvr32.exe (PID: 3256)
      • PEToolDeployment.exe (PID: 2024)
      • WSPrtSetup.exe (PID: 1592)
      • PEToolDeployment.exe (PID: 268)
      • PEToolDeployment.exe (PID: 548)
      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PEToolDeployment.exe (PID: 1192)
      • PEPreviewDeployment.exe (PID: 3952)
      • PEPreviewDeployment.exe (PID: 2408)
      • fontlistsave.exe (PID: 1972)
      • PDFelement.exe (PID: 4040)
      • zip.exe (PID: 1192)

    • Creates a software uninstall entry

      • pdfelement-pro_full5254.tmp (PID: 2744)

    • Reads Microsoft Office registry keys

      • PEAddInDeployment.exe (PID: 2620)

    • Reads the Internet Settings

      • explorer.exe (PID: 532)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 1376)

    • Reads security settings of Internet Explorer

      • explorer.exe (PID: 532)
      • explorer.exe (PID: 2824)
      • explorer.exe (PID: 1376)

    • Reads Environment values

      • PEToolDeploymentExtend.exe (PID: 3020)
      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Reads the time zone

      • PENotify.exe (PID: 3768)
      • PDFelement.exe (PID: 4040)

    • Application launched itself

      • chrome.exe (PID: 1548)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:02:01 09:19:03+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 12
CodeSize: 1278976
InitializedDataSize: 918016
UninitializedDataSize: -
EntryPoint: 0x106980
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 4.0.4.19
ProductVersionNumber: 4.0.4.19
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: wondershare-pdfelement_setup_full5254.exe
FileVersion: 4.0.4.19
LegalCopyright: Copyright©2023 Wondershare. All rights reserved.
ProductName: Wondershare PDFelement
ProductVersion: 10.0.3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
104
Monitored processes
47
Malicious processes
12
Suspicious processes
4

Behavior graph

Click at the process to see the details
start pdfelement-pro_setup_full5254.exe pdfelement-pro_full5254.exe pdfelement-pro_full5254.tmp petooldeployment.exe pepreviewdeployment.exe zip.exe no specs zip.exe no specs peaddindeployment.exe peshellcontextmenu4.exe peshellcontextmenu4.exe no specs fileassociation.exe no specs wsprtsetup.exe sc.exe no specs regsvr32.exe no specs petooldeployment.exe explorer.exe no specs petooldeployment.exe explorer.exe no specs petooldeployment.exe explorer.exe no specs petooldeploymentextend.exe penotify.exe explorer.exe no specs petooldeployment.exe penotify.exe pepreviewdeployment.exe regasm.exe pepreviewdeployment.exe fontlistsave.exe no specs explorer.exe no specs chrome.exe explorer.exe no specs chrome.exe no specs pdfelement.exe chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs zip.exe no specs chrome.exe no specs pdfelement-pro_setup_full5254.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
268"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" /install /path "C:\Program Files\Wondershare\Wondershare PDFelement\PECaptureTool.exe" /notifydeviceboot 1 /defaultnotifydeviceboot 1 /deviceboot "Wondershare PEScreenshot.lnk" /startup /explorerstartup proxy /entrance DeviceBoot /loggernameend .InstallC:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
532C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
548"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
explorer.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
992"C:\Program Files\Wondershare\Wondershare PDFelement\PEShellContextMenu4.exe"C:\Program Files\Wondershare\Wondershare PDFelement\PEShellContextMenu4.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare
Integrity Level:
HIGH
Description:
PEShellExtension
Exit code:
0
Version:
10.0.0.50
Modules
Images
c:\program files\wondershare\wondershare pdfelement\peshellcontextmenu4.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192"C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe" C:\Program Files\Wondershare\Wondershare PDFelement\PEToolDeployment.exe
explorer.exe
User:
admin
Company:
Wondershare
Integrity Level:
MEDIUM
Description:
Wondershare PDFelement
Exit code:
0
Version:
10.2.7.2639
Modules
Images
c:\program files\wondershare\wondershare pdfelement\petooldeployment.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
1192"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe" x -y -o"C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\Temp\WhatsNew\Pictures" "C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\Temp\WhatsNew\UpdateWindowsPicture.7z"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe—PDFelement.exe
User:
admin
Company:
Igor Pavlov
Integrity Level:
MEDIUM
Description:
7-Zip 独立命令行
Exit code:
0
Version:
9.20
Modules
Images
c:\program files\wondershare\wondershare pdfelement\zip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1376C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
1484"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe" x "C:\Program Files\Wondershare\Wondershare PDFelement\Languages\Uninstall.lng" -y -o"C:\Program Files\Wondershare\Wondershare PDFelement\Languages\Uninstall"C:\Program Files\Wondershare\Wondershare PDFelement\zip.exe—pdfelement-pro_full5254.tmp
User:
admin
Company:
Igor Pavlov
Integrity Level:
HIGH
Description:
7-Zip 独立命令行
Exit code:
0
Version:
9.20
Modules
Images
c:\program files\wondershare\wondershare pdfelement\zip.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
1548"C:\Program Files\Google\Chrome\Application\chrome.exe" http://cbs.wondershare.com/go.php?m=ic&back_url=https%3A%2F%2Fpdf.wondershare.com.br%2Fthankyou%2Finstall-pdfelement-pro-windows.html&client_sign={0f583826-90cc-429d-9f6a-55f46d6d5d3aG}&m_nProductID=5254&installtime=1708098340&product_version=10.2.7.2639C:\Program Files\Google\Chrome\Application\chrome.exe
pdfelement-pro_setup_full5254.exe
User:
admin
Company:
Google LLC
Integrity Level:
HIGH
Description:
Google Chrome
Exit code:
0
Version:
109.0.5414.120
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\109.0.5414.120\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
1592"C:\Program Files\Wondershare\Wondershare PDFelement\WSPrtSetup\WSPrtSetup.exe" /log "C:\Users\admin\AppData\Roaming\Wondershare\PDFelement10\log\InstallVirtualPrinter.log" /dvrname "Wondershare PDFelement" /prtname "Wondershare PDFelement" /monname "Wondershare PDFelement Monitor" /monport "Wondershare PDFelement Port" /monfile "PEPrinterMonitor.dll"C:\Program Files\Wondershare\Wondershare PDFelement\WSPrtSetup\WSPrtSetup.exe
pdfelement-pro_full5254.tmp
User:
admin
Company:
Wondershare Software
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.1
Modules
Images
c:\program files\wondershare\wondershare pdfelement\wsprtsetup\wsprtsetup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\winspool.drv
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
44 750
Read events
44 293
Write events
436
Delete events
21

Modification events

(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WafCX
Operation:writeName:5254
Value:
sku-webr
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{0f583826-90cc-429d-9f6a-55f46d6d5d3aG}
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{0f583826-90cc-429d-9f6a-55f46d6d5d3aG}
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2036) pdfelement-pro_setup_full5254.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
324
Suspicious files
363
Text files
324
Unknown types
214

Dropped files

PID
Process
Filename
Type
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\1[1].pngimage
MD5:3DE14E4A8349414ADEBBF2453281350E
SHA256:8F6F6CEB805CE1A0FA2ED9426F19644B351190F68589EF40CD2AE88F502EA779
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAbinary
MD5:4047BC019B30303CC6102DF9CC0D023D
SHA256:D877FE435C2F70E579F94D94AF9F1B440F3589E500650CF7D1226F91951071E6
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\index[1].htmhtml
MD5:51B4E5EB0EFAC01F3AC337775F41AE71
SHA256:8578BB0A4C0BC9E2F26ACE6D349C00E3B620773DD3CB1C4B74F7CA4FFA3489F5
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAder
MD5:C25AA3138ECCA892EECD927D96411497
SHA256:672DD4EDF8377379CD747002584490888F10C815717D1CF8ED7BF15365274A1D
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\javascript_call_native[1].jstext
MD5:B9DA127236EFDB755F568304B5EF3044
SHA256:01C839C0A9C47DC571175312EBC208EAE6FF28CED3A3EFA13C1EE81CD9764F71
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_8F986B155B6342EE1ACF678AFF6889B0der
MD5:285D048C71EA16E9E8C1CC3B3D82096E
SHA256:57B38A062B5438B3DF81BC15656434812A9B1CF070C6065FEB8FBF8F32BAAD27
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\css2[1].csstext
MD5:FDEDBC150E0C93F74206062BBD18BAFB
SHA256:9FA428251940904DCB7F598E3D2AB5129B82EEA4F4B402B8637B64014C841DEA
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBAder
MD5:AC89A852C2AAA3D389B2D2DD312AD367
SHA256:0B720E19270C672F9B6E0EC40B468AC49376807DE08A814573FE038779534F45
2036pdfelement-pro_setup_full5254.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_23FFFDCAABB8E63694AD1202ED02BF57binary
MD5:00A54E0038AD3EC151798E52F64B425C
SHA256:59C5993922F092F87CFCB21F57C1B8F42F643DDA7554294F0E420FADA5990295
2036pdfelement-pro_setup_full5254.exeC:\Users\Public\Documents\Wondershare\pdfelement-pro_full5254.exe.~P2S —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
43
TCP/UDP connections
194
DNS requests
179
Threats
21

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2036
pdfelement-pro_setup_full5254.exe
HEAD
200
163.181.56.209:80
http://download-pt.wondershare.com/cbs_down/pdfelement-pro_full5254.exe
unknown
—
—
—
2036
pdfelement-pro_setup_full5254.exe
GET
—
8.209.73.211:80
http://platform.wondershare.cc/rest/v2/downloader/runtime/?client_sign={0f583826-90cc-429d-9f6a-55f46d6d5d3aG}&product_id=5254&wae=4.0.4&platform=win_x86
unknown
—
—
—
2036
pdfelement-pro_setup_full5254.exe
GET
304
2.19.126.137:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e5509cffa3aa06fd
unknown
—
—
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gtsr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBQwkcLWD4LqGJ7bE7B1XZsEbmfwUAQU5K8rJnEaK0gnhS9SZizv8IkTcT4CDQIDvFNZazTHGPUBUGY%3D
unknown
binary
724 b
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAoFmyX1Sz2HlMxmMUd1OKM%3D
unknown
binary
471 b
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQlOydjtpho0%2Bholo77zGjGxETUEQQU8JyF%2FaKffY%2FJaLvV1IlNHb7TkP8CEA3EQd5SLWy5mr7JXcu5TKw%3D
unknown
binary
727 b
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEAch2W18yjrFCctU7xjW0Yc%3D
unknown
binary
471 b
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D
unknown
binary
1.41 Kb
—
2036
pdfelement-pro_setup_full5254.exe
HEAD
200
163.181.56.210:80
http://download-pt.wondershare.com/cbs_down/pdfelement-pro_full5254.exe
unknown
—
—
—
2036
pdfelement-pro_setup_full5254.exe
GET
200
172.217.16.131:80
http://ocsp.pki.goog/gts1c3/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBTHLnmK3f9hNLO67UdCuLvGwCQHYwQUinR%2Fr4XN7pXNPZzQ4kYU83E1HScCEQCAKlf1nuem1AlkNvBwxf5A
unknown
binary
472 b
—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
unknown
4
System
192.168.100.255:138
—
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
8.209.72.213:443
pc-api.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2036
pdfelement-pro_setup_full5254.exe
8.209.73.211:80
platform.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
47.91.89.51:443
prod-web.wondershare.cc
Alibaba US Technology Co., Ltd.
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.215:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.216:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.209:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown
2036
pdfelement-pro_setup_full5254.exe
163.181.56.210:80
download-pt.wondershare.com
Zhejiang Taobao Network Co.,Ltd
DE
unknown

DNS requests

Domain
IP
Reputation
pc-api.wondershare.cc
  • 8.209.72.213
unknown
platform.wondershare.cc
  • 8.209.73.211
unknown
prod-web.wondershare.cc
  • 47.91.89.51
unknown
download-pt.wondershare.com
  • 163.181.56.215
  • 163.181.56.216
  • 163.181.56.209
  • 163.181.56.210
  • 163.181.56.211
  • 163.181.56.212
  • 163.181.56.213
  • 163.181.56.214
unknown
analytics.wondershare.cc
  • 47.91.90.244
unknown
wae.wondershare.cc
  • 163.181.92.234
  • 163.181.92.235
  • 163.181.92.236
  • 163.181.92.237
  • 163.181.92.238
  • 163.181.92.231
  • 163.181.92.232
  • 163.181.92.233
unknown
analytics.300624.com
  • 47.91.74.43
unknown
ctldl.windowsupdate.com
  • 2.19.126.137
  • 2.19.126.163
  • 23.48.23.61
  • 23.48.23.34
  • 23.48.23.50
  • 23.48.23.7
  • 23.48.23.60
  • 23.48.23.43
  • 23.48.23.20
  • 23.48.23.16
  • 23.48.23.51
unknown
ocsp.digicert.com
  • 192.229.221.95
unknown
fonts.googleapis.com
  • 216.58.212.170
unknown

Threats

PID
Process
Class
Message
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
—
—
Potentially Bad Traffic
ET DNS Query for .cc TLD
6 ETPRO signatures available at the full report
Process
Message
PEToolDeployment.exe
ProductVersion: 10.2.7.2639
PEToolDeployment.exe
PreviewVersion: 1.0.0.70
PEToolDeployment.exe
EnvironmentVersion: 4.0.30319.42000
PEToolDeployment.exe
EnvironmentBit: 32
PEToolDeployment.exe
InitLogTime: 2024-02-16 15:44:12:238
PEToolDeployment.exe
InitLogTimeSpan: 0.03125s
PEToolDeployment.exe
Args: "C:\Users\admin\AppData\Local\Temp\is-OF69C.tmp\PEToolDeployment.exe" /lastinstallversion /productanothername /loggernameend .Install
PEToolDeployment.exe
ProductName: PDFelement
PEToolDeployment.exe
ExitCode: 0
PEPreviewDeployment.exe
StartExeTime: 2024-02-16 15:44:12:769
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
pdfelement-pro_setup_full5254.exe