URL:

http://wdl2.cache.wpscdn.cn/newupdate/2052/pertrial/9912/diffpatch/diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe

Full analysis: https://app.any.run/tasks/53c2ce4b-bc13-468e-b535-bc8c7a68496e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 06, 2020, 23:09:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

8EFBACCBE162C7052B7C190861EB8C6F

SHA1:

571B0E0AD35C0950266810D753140584693C147E

SHA256:

120B578E0744DE7DB4D8A649D0CC4C3B4529F18911171FEC8EE5E82F1A653AF2

SSDEEP:

3:N1KJBZLTIo+0jrNMVBccOK69LYe5X6Sh2goK6UUOhg6RzkAn:Ctm0v6AclYYi6SbTN

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 560)
      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 1428)
      • kvpins.exe (PID: 2252)
      • wps.exe (PID: 1524)
      • wps.exe (PID: 3088)
      • wpsupdate.exe (PID: 2716)
      • wpsupdate.exe (PID: 3988)

    • Downloads executable files from the Internet

      • iexplore.exe (PID: 2248)

    • Registers / Runs the DLL via REGSVR32.EXE

      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 560)

    • Loads the Task Scheduler COM API

      • wpsupdate.exe (PID: 2716)

    • Loads dropped or rewritten executable

      • kvpins.exe (PID: 2252)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 2248)
      • iexplore.exe (PID: 2628)
      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 1428)

    • Creates files in the user directory

      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 560)
      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 1428)
      • wpsupdate.exe (PID: 3988)

    • Application launched itself

      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 560)

    • Low-level read access rights to disk partition

      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 1428)

    • Creates a software uninstall entry

      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 560)

    • Modifies the open verb of a shell class

      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 560)

  • INFO

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 2628)
      • iexplore.exe (PID: 2248)
      • iexplore.exe (PID: 3548)
      • iexplore.exe (PID: 3900)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2628)

    • Reads settings of System Certificates

      • iexplore.exe (PID: 2628)

    • Changes internet zones settings

      • iexplore.exe (PID: 2628)
      • iexplore.exe (PID: 3900)

    • Application launched itself

      • iexplore.exe (PID: 2628)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2628)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2628)

    • Dropped object may contain Bitcoin addresses

      • diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe (PID: 1428)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3548)

    • Manual execution by user

      • iexplore.exe (PID: 3900)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
52
Monitored processes
13
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start iexplore.exe iexplore.exe diff_2052_11.1.0.9828_trial_to_11.1.0.9912_trial.exe diff_2052_11.1.0.9828_trial_to_11.1.0.9912_trial.exe regsvr32.exe no specs wpsupdate.exe wpsupdate.exe regsvr32.exe no specs wps.exe no specs kvpins.exe wps.exe no specs iexplore.exe iexplore.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
560"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
iexplore.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
安装程序
Exit code:
0
Version:
11,1,0,9912
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\6z2bcoul\diff_2052_11.1.0.9828_trial_to_11.1.0.9912_trial.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wkscli.dll
1000"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\kwpsshellext.dll"C:\Windows\system32\regsvr32.exe—diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1080"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\addons\kpdfcontextmenushellext\kpdfcontextmenushellext.dll"C:\Windows\system32\regsvr32.exe—diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
1428"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe" -needcommunicate -localapp="C:\Users\admin\AppData\Local" -appdata="C:\Users\admin\AppData\Roaming" -curuserpath="C:\Users\admin" -curuserdesktoppath="C:\Users\admin\Desktop" -curusertemppath="C:\Users\admin\AppData\Local\Temp" -msgwndname=wpssetup_message_E40ED -assobitmap=0 -assoexts= -upgradepowerC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
HIGH
Description:
安装程序
Exit code:
0
Version:
11,1,0,9912
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\6z2bcoul\diff_2052_11.1.0.9828_trial_to_11.1.0.9912_trial.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\netapi32.dll
c:\windows\system32\netutils.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\srvcli.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wkscli.dll
1524"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\wps.exe" Run /InstanceId=sslinker "C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\addons\ksslinker\ksslinker.dll"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\wps.exe—diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
HIGH
Description:
WPS Office
Exit code:
3221225781
Version:
11,1,0,9912
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.1.0.9912\office6\wps.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
2248"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2628 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2252"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\kvprinter\kvpins.exe" /i "C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\kvprinter\kvpins.inf" /sC:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\kvprinter\kvpins.exe
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
HIGH
Description:
kvpins
Exit code:
266
Version:
11,1,0,9912
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.1.0.9912\office6\kvprinter\kvpins.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\kingsoft\wps office\11.1.0.9912\office6\kvprinter\kvpvbsext.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2628"C:\Program Files\Internet Explorer\iexplore.exe" http://wdl2.cache.wpscdn.cn/newupdate/2052/pertrial/9912/diffpatch/diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
1
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2716"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\wtoolex\wpsupdate.exe" -createtaskC:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\wtoolex\wpsupdate.exe
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office Expansion tool
Exit code:
1
Version:
11,1,0,9912
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.1.0.9912\wtoolex\wpsupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\nsi.dll
3088"C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\wps.exe" C:\Users\admin\AppData\Local\Kingsoft\WPS Office\11.1.0.9912\office6\wps.exe—diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
User:
admin
Company:
Zhuhai Kingsoft Office Software Co.,Ltd
Integrity Level:
MEDIUM
Description:
WPS Office
Exit code:
3221225781
Version:
11,1,0,9912
Modules
Images
c:\users\admin\appdata\local\kingsoft\wps office\11.1.0.9912\office6\wps.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
Total events
1 426
Read events
1 168
Write events
247
Delete events
11

Modification events

(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
3445707402
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30829638
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A3000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2628) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
31
Suspicious files
356
Text files
165
Unknown types
5

Dropped files

PID
Process
Filename
Type
2248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe.rqalblq.partial —
MD5:—
SHA256:—
2628iexplore.exeC:\Users\admin\AppData\Local\Temp\~DF6E538FFCDF7165A0.TMP —
MD5:—
SHA256:—
2628iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe.rqalblq.partial:Zone.Identifier —
MD5:—
SHA256:—
2628iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Internet Explorer\Recovery\Active\{F9204FA5-D839-11EA-BD1A-12A9866C77DE}.datbinary
MD5:—
SHA256:—
560diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exeC:\Users\admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.logtext
MD5:—
SHA256:—
2628iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6Z2BCOUL\diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exeexecutable
MD5:—
SHA256:—
1428diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exeC:\Users\admin\AppData\Roaming\kingsoft\office6\log\setup\wpssetup.logtext
MD5:—
SHA256:—
2248iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial[1].exeexecutable
MD5:—
SHA256:—
1428diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exeC:\Users\admin\AppData\Local\Temp\wps\~e4523\CONTROL\default\background_oem.pngimage
MD5:481E9EC6D63B0D8979A5D5B4595134A5
SHA256:AF82FD27077BD7FF4892881A75E7A41780C7FDB9C274615C7AF96AC3A3CA38E1
1428diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exeC:\Users\admin\AppData\Local\Temp\wps\~e4523\CONTROL\default\background_choose_mode.pngimage
MD5:DFCD86EE5D01A98036E7FAB9634513B7
SHA256:4E595667FFBC31321ED210169F37374123291623ADD8575D6BDD78A4026DA9C2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
11
DNS requests
10
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2628
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
1428
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
POST
200
18.185.231.6:80
http://dw-online.ksosoft.com/api/dynamicParam/v1/app/55c7e27bb603a2fb
US
text
9.08 Kb
unknown
2248
iexplore.exe
GET
200
219.153.18.173:80
http://wdl2.cache.wpscdn.cn/newupdate/2052/pertrial/9912/diffpatch/diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
CN
executable
21.2 Mb
whitelisted
2628
iexplore.exe
GET
200
93.184.220.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTBL0V27RVZ7LBduom%2FnYB45SPUEwQU5Z1ZMIJHWMys%2BghUNoZ7OrUETfACEA8sEMlbBsCTf7jUSfg%2BhWk%3D
US
der
1.47 Kb
whitelisted
3900
iexplore.exe
GET
200
204.79.197.200:80
http://www.bing.com/favicon.ico
US
image
237 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2248
iexplore.exe
219.153.18.173:80
wdl2.cache.wpscdn.cn
Chongqing Telecom
CN
suspicious
1428
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
18.185.231.6:80
dw-online.ksosoft.com
—
US
unknown
1428
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
18.158.36.194:80
shuc-pc-hamlet.ksord.com
Massachusetts Institute of Technology
US
unknown
2628
iexplore.exe
152.199.19.161:443
r20swj13mr.microsoft.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
3900
iexplore.exe
204.79.197.200:80
www.bing.com
Microsoft Corporation
US
whitelisted
2628
iexplore.exe
93.184.220.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted

DNS requests

Domain
IP
Reputation
wdl2.cache.wpscdn.cn
  • 219.153.18.173
  • 59.80.51.14
  • 39.134.159.114
whitelisted
dw-online.ksosoft.com
  • 18.185.231.6
  • 3.124.110.130
  • 18.158.125.87
  • 18.158.125.168
  • 18.158.200.224
  • 18.185.46.28
  • 18.159.17.182
  • 18.158.120.224
unknown
shuc-pc-hamlet.ksord.com
  • 18.158.36.194
  • 18.194.27.45
unknown
r20swj13mr.microsoft.com
  • 152.199.19.161
whitelisted
iecvlist.microsoft.com
  • 152.199.19.161
whitelisted
ocsp.digicert.com
  • 93.184.220.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted

Threats

PID
Process
Class
Message
—
—
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
[kscreen] isElide:0 switchRec:0 switchRecElide:1
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
[kscreen] now screensaver is
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
unInstall qingshellex success!
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
unregister dll path:qingshellext.dll
diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe
unregister dll path:qingshellext.dll
wpsupdate.exe
2020/08/07 00:10:36 I wpsupdate 00000f94:00000e4c Update Exit.
wpsupdate.exe
2020/08/07 00:10:36 E wpsupdate 00000f94:00000e4c Failed RegCreateKeyExW: 0x80070002.
wpsupdate.exe
2020/08/07 00:10:36 I wpsupdate 00000f94:00000a70 [WorkerMain]Update work thread begin.
wpsupdate.exe
2020/08/07 00:10:37 I wpsupdate 00000a9c:00000f10 Update Exit.
wpsupdate.exe
2020/08/07 00:10:37 E wpsupdate 00000a9c:00000f10 Failed RegCreateKeyExW: 0x80070002.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://wdl2.cache.wpscdn.cn/newupdate/2052/pertrial/9912/diffpatch/diff_2052_11.1.0.9828_Trial_to_11.1.0.9912_Trial.exe