File name:

OfficeAssist.0195.80.1013.exe

Full analysis: https://app.any.run/tasks/b1e49a15-aea3-45a3-a905-916276ede695
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: May 28, 2019, 02:18:55
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
loader
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

81C7A19FF9623E1E8C7BFA1A117CFC10

SHA1:

1E8A361582CA815961E2D026C50DB8DA110C8CC5

SHA256:

2DEB899567FB6E855C70D676C6BF96F197E16AF70FC2DA4B06F1E517D7AE27A2

SSDEEP:

49152:GCUwmj5YHOmAriiydfxWgt5NrkIhIlOJzA9GmZa3BlPU875uWK8c2N6wWXWfO1e:GCULjiH6Lyd71k+IlwzAVaRJU875X6wv

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • OfficeAssist.0195.80.1013.exe (PID: 3008)

    • Application was dropped or rewritten from another process

      • OfficeAssist.0195.80.1013.exe (PID: 3008)
      • assistupdate.exe (PID: 1708)
      • notify.exe (PID: 3456)
      • updateself.exe (PID: 2136)
      • notify.exe (PID: 3848)

    • Loads the Task Scheduler DLL interface

      • notify.exe (PID: 3456)
      • assistupdate.exe (PID: 1708)
      • notify.exe (PID: 3848)

    • Loads dropped or rewritten executable

      • OfficeAssist.0195.80.1013.exe (PID: 1892)
      • OfficeAssist.0195.80.1013.exe (PID: 3008)
      • regsvr32.exe (PID: 2664)

    • Downloads executable files from the Internet

      • notify.exe (PID: 3456)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • OfficeAssist.0195.80.1013.exe (PID: 1892)
      • notify.exe (PID: 3456)
      • OfficeAssist.0195.80.1013.exe (PID: 3008)
      • updateself.exe (PID: 2136)

    • Creates files in the program directory

      • OfficeAssist.0195.80.1013.exe (PID: 1892)

    • Creates COM task schedule object

      • regsvr32.exe (PID: 2664)

    • Creates a software uninstall entry

      • OfficeAssist.0195.80.1013.exe (PID: 3008)

    • Creates files in the Windows directory

      • assistupdate.exe (PID: 1708)
      • notify.exe (PID: 3456)

    • Creates files in the user directory

      • notify.exe (PID: 3456)
      • OfficeAssist.0195.80.1013.exe (PID: 3008)

    • Reads internet explorer settings

      • notify.exe (PID: 3456)
      • notify.exe (PID: 3848)

  • INFO

    • Dropped object may contain Bitcoin addresses

      • OfficeAssist.0195.80.1013.exe (PID: 3008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (94.8)
.exe | Win32 Executable MS Visual C++ (generic) (3.4)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.5)
.exe | Generic Win/DOS Executable (0.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2009:12:05 23:50:52+01:00
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 164864
UninitializedDataSize: 1024
EntryPoint: 0x30fa
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.300
ProductVersionNumber: 1.0.0.300
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Chinese (Simplified)
CharacterSet: Windows, Latin1
Comments: Kingsoft Install Application
CompanyName: Kingsoft Corp. Ltd.
FileDescription: Kingsoft Install Application
FileVersion: 1.0.0.0300
LegalCopyright: Copyright(c)1988-2014 Kingsoft Corporation. All rights reserved.
ProductName: Kingsoft Office
ProductVersion: 1.0.0.0300

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Dec-2009 22:50:52
Detected languages:
  • Chinese - PRC
  • English - United States
Comments: Kingsoft Install Application
CompanyName: Kingsoft Corp. Ltd.
FileDescription: Kingsoft Install Application
FileVersion: 1.0.0.0300
LegalCopyright: Copyright(c)1988-2014 Kingsoft Corporation. All rights reserved.
ProductName: Kingsoft Office
ProductVersion: 1.0.0.0300

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000D8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-Dec-2009 22:50:52
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005C4C
0x00005E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.44011
.rdata
0x00007000
0x0000129C
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.04684
.data
0x00009000
0x00025C58
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
4.801
.ndata
0x0002F000
0x0000D000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0003C000
0x00003020
0x00003200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.13577

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.20956
716
UNKNOWN
English - United States
RT_MANIFEST
103
1.91924
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.66174
256
UNKNOWN
English - United States
RT_DIALOG
106
2.88094
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
39
Monitored processes
8
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
drop and start start drop and start drop and start drop and start officeassist.0195.80.1013.exe officeassist.0195.80.1013.exe regsvr32.exe no specs regsvr32.exe no specs assistupdate.exe no specs notify.exe updateself.exe notify.exe

Process information

PID
CMD
Path
Indicators
Parent process
1708"C:\Users\admin\AppData\Local\PPTAssist\assistupdate.exe" -createtaskC:\Users\admin\AppData\Local\PPTAssist\assistupdate.exe—OfficeAssist.0195.80.1013.exe
User:
admin
Company:
珠海金山办公软件有限公司
Integrity Level:
MEDIUM
Description:
PPT美化大师
Exit code:
1
Version:
1,0,0,0300
Modules
Images
c:\users\admin\appdata\local\pptassist\assistupdate.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1892"C:\Users\admin\AppData\Local\Temp\OfficeAssist.0195.80.1013.exe" C:\Users\admin\AppData\Local\Temp\OfficeAssist.0195.80.1013.exe
explorer.exe
User:
admin
Company:
Kingsoft Corp. Ltd.
Integrity Level:
MEDIUM
Description:
Kingsoft Install Application
Exit code:
0
Version:
1.0.0.0300
Modules
Images
c:\users\admin\appdata\local\temp\officeassist.0195.80.1013.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
2136"C:\Users\admin\AppData\Local\PPTAssist\updateself.exe" "C:\Users\admin\AppData\Roaming\pptassist\update\down\updateself.ini" C:\Users\admin\AppData\Local\PPTAssist\updateself.exe
notify.exe
User:
admin
Company:
珠海金山办公软件有限公司
Integrity Level:
MEDIUM
Description:
PPT美化大师
Exit code:
0
Version:
1,0,0,0300
Modules
Images
c:\users\admin\appdata\local\pptassist\updateself.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
2664"C:\Windows\System32\regsvr32.exe" /s "C:\Users\admin\AppData\Local\PPTAssist\pptassist.dll"C:\Windows\System32\regsvr32.exe—OfficeAssist.0195.80.1013.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3008"C:\ProgramData\kingsoft\20190528_31907\OfficeAssist.0195.80.1013.exe" C:\ProgramData\kingsoft\20190528_31907\OfficeAssist.0195.80.1013.exe
OfficeAssist.0195.80.1013.exe
User:
admin
Company:
珠海金山办公软件有限公司
Integrity Level:
MEDIUM
Description:
PPT美化大师安装程序
Exit code:
0
Version:
1,0,0,0300
Modules
Images
c:\programdata\kingsoft\20190528_31907\officeassist.0195.80.1013.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3456"C:\Users\admin\AppData\Local\PPTAssist\notify.exe" /from:ksostartC:\Users\admin\AppData\Local\PPTAssist\notify.exe
OfficeAssist.0195.80.1013.exe
User:
admin
Company:
珠海金山办公软件有限公司
Integrity Level:
MEDIUM
Description:
PPT Assist Expansion tool
Exit code:
0
Version:
1,0,0,0300
Modules
Images
c:\users\admin\appdata\local\pptassist\notify.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
3848"C:\Users\admin\AppData\Local\PPTAssist\notify.exe" C:\Users\admin\AppData\Local\PPTAssist\notify.exe
updateself.exe
User:
admin
Company:
珠海金山办公软件有限公司
Integrity Level:
MEDIUM
Description:
PPT Assist Expansion tool
Exit code:
0
Version:
2,0,0,0103
Modules
Images
c:\users\admin\appdata\local\pptassist\notify.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2\comctl32.dll
c:\windows\system32\gdi32.dll
3892"C:\Windows\System32\regsvr32.exe" /s "C:\Users\admin\AppData\Local\PPTAssist\pptassist64.dll"C:\Windows\System32\regsvr32.exe—OfficeAssist.0195.80.1013.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft(C) Register Server
Exit code:
3
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
1 682
Read events
1 512
Write events
157
Delete events
13

Modification events

(PID) Process:(3008) OfficeAssist.0195.80.1013.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted
Operation:writeName:C:\ProgramData\kingsoft\20190528_31907\OfficeAssist.0195.80.1013.exe
Value:
1
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Addins.1
Operation:writeName:
Value:
PPTAssist Class
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Addins.1\CLSID
Operation:writeName:
Value:
{034DF736-A378-4292-ACAE-A561088999F5}
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Addins
Operation:writeName:
Value:
PPTAssist Class
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Addins\CLSID
Operation:writeName:
Value:
{034DF736-A378-4292-ACAE-A561088999F5}
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Addins\CurVer
Operation:writeName:
Value:
PPTAssist.Addins.1
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Control.1
Operation:writeName:
Value:
PPTAssistControl Class
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Control.1\CLSID
Operation:writeName:
Value:
{1077138E-896C-445E-BD31-CFCFFA4636C4}
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Control
Operation:writeName:
Value:
PPTAssistControl Class
(PID) Process:(2664) regsvr32.exeKey:HKEY_CLASSES_ROOT\PPTAssist.Control\CLSID
Operation:writeName:
Value:
{1077138E-896C-445E-BD31-CFCFFA4636C4}
Executable files
20
Suspicious files
16
Text files
77
Unknown types
2

Dropped files

PID
Process
Filename
Type
1892OfficeAssist.0195.80.1013.exeC:\ProgramData\kingsoft\20190528_31907\oem.initext
MD5:—
SHA256:—
1892OfficeAssist.0195.80.1013.exeC:\Users\admin\AppData\Local\Temp\nsg2A9.tmp\v6svc.dllexecutable
MD5:—
SHA256:—
3008OfficeAssist.0195.80.1013.exeC:\Users\admin\AppData\Local\Temp\pptassist\~1203e0\install_res\101.pngimage
MD5:—
SHA256:—
3008OfficeAssist.0195.80.1013.exeC:\Users\admin\AppData\Local\Temp\pptassist\~1203e0\install_res\100.pngimage
MD5:F4F713DB58B4364A072B94A3B05AC5FA
SHA256:8488CCB8D08B19AF4BD04B73404D2085EDAECE9862DCC741D2EEDD4F454DDA93
1892OfficeAssist.0195.80.1013.exeC:\ProgramData\kingsoft\20190528_31907\OfficeAssist.0195.80.1013.exeexecutable
MD5:—
SHA256:—
3008OfficeAssist.0195.80.1013.exeC:\Users\admin\AppData\Local\Temp\pptassist\~1203e0\install_res\2.jpgimage
MD5:F179A0CA31A7FA7D1B62BF76B8DED22F
SHA256:77C059D87D8598FFA91558FE28459510D37CE801BBA3D93381E5F3AF6275FCD4
3008OfficeAssist.0195.80.1013.exeC:\Users\admin\AppData\Local\Temp\pptassist\~1203e0\install_res\1.pngimage
MD5:9179721463E747E379FE103222E124EC
SHA256:85F21DE1E3806D6A46DBB2259E52883CDAE40F3F977FDA0288DDB43E3CF42D62
3008OfficeAssist.0195.80.1013.exeC:\Users\admin\AppData\Local\Temp\pptassist\~1203e0\install_res\10.pngimage
MD5:FEAF35246015524B3B335462EA0E7C5B
SHA256:0C06BF07D4CFBB68C1901A4E3B9B5D649145396F07FE2433ED4F64CCFF5FB87A
3008OfficeAssist.0195.80.1013.exeC:\Users\admin\AppData\Local\Temp\pptassist\~1203e0\install_res\3.pngimage
MD5:4BD50D7E3DE354FA0D81DDACFBD84CFC
SHA256:F2E1EFDD762F897E19E4408C207D2BFF67CD354543607F69ADE025978FB59DBD
3008OfficeAssist.0195.80.1013.exeC:\Users\admin\AppData\Local\Temp\pptassist\~1203e0\install_res\102.pngimage
MD5:5192DC719389684E228C5ED6EAE9A3DA
SHA256:066733B6F7B054BECE74A4FE801732E991B830A0F70FD613444AADD96E8B24D7
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
5
DNS requests
7
Threats
1

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3008
OfficeAssist.0195.80.1013.exe
POST
200
120.92.88.213:80
http://spdyn.wps.cn/showpro/infos.ads?v=D1S1E1&d=ZG09L3dwcy9zaG93cHJvL2R5biZhY3Rpb249aW5zdGFsbCZwbnVtPTcmcDA9MERFNEU4QTY4RDlBNDZBREJEOTE2MjlEQjJDQjU5RkImcDE9ODAuMTAxMyZwMj0xLjAuMC4wMzAwJnAzPTAmcDQ9MyZwNT0wJnA2PTE=
CN
—
—
suspicious
3456
notify.exe
GET
—
150.138.180.206:80
http://wdl1.cache.wps.cn/pptassist/notify/mh/a/notify/updateself.ini
CN
—
—
malicious
3456
notify.exe
GET
200
150.138.180.206:80
http://wdl1.cache.wps.cn/pptassist/notify/mh/a/notify/utils.zip
CN
compressed
42.8 Kb
malicious
3848
notify.exe
POST
200
120.92.4.195:80
http://notify.meihua.docer.com/notifyserver/notify?v=D14kquAVOg3m7xr6kZvCf4xD%2B9VOT8RPBayqqH8pjjoEVRJLS2VhAukrMBP2bc9ObNjaDZpcjl1wviBMWPHuYA==
CN
binary
1.53 Kb
unknown
3456
notify.exe
POST
200
120.92.4.195:80
http://notify.meihua.docer.com/notifyserver/notify?v=OcZQ6m2wxvhM03Shr8GbXL11FNkR69mXXlQIOQCjUnpbIBm54scl5N6mfX0lxKV6bNjaDZpcjl1wviBMWPHuYA==
CN
binary
3.56 Kb
unknown
3456
notify.exe
GET
200
150.138.180.206:80
http://wdl1.cache.wps.cn/pptassist/notify/mh/a/minisite/1.0.6/notify.exe
CN
executable
464 Kb
malicious
3848
notify.exe
POST
200
120.92.4.195:80
http://notify.meihua.docer.com/notifyserver/notify?v=WTe5osFsH%2BYqDrs8%2BjDgCGlJo4dMycz%2FxWqe9%2B6U5c4M%2BF2unj9AToki8NuRqt3dbNjaDZpcjl1wviBMWPHuYA==
CN
binary
2.11 Kb
unknown
3456
notify.exe
GET
200
150.138.180.206:80
http://wdl1.cache.wps.cn/pptassist/notify/mh/a/notify/updateself.ini
CN
text
58 b
malicious
3456
notify.exe
GET
200
150.138.180.206:80
http://wdl1.cache.wps.cn/pptassist/notify/mh/a/notify/flowcontrol.zip
CN
compressed
3.49 Kb
malicious
3456
notify.exe
POST
200
120.92.4.195:80
http://notify.meihua.docer.com/notifyserver/notify?v=CBOOYSGFum%2FqskcNGjq8yjoxGtTS6B%2F43Vdl19ELkhtaqA4xO%2FoWKMBswKbvDffJbNjaDZpcjl1wviBMWPHuYA==
CN
binary
656 b
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3456
notify.exe
120.92.4.195:80
notify.meihua.docer.com
Beijing Kingsoft Cloud Internet Technology Co., Ltd
CN
unknown
3008
OfficeAssist.0195.80.1013.exe
120.92.88.213:80
spdyn.wps.cn
Beijing Kingsoft Cloud Internet Technology Co., Ltd
CN
unknown
3456
notify.exe
150.138.180.206:80
wdl1.cache.wps.cn
Xiangtan
CN
suspicious
3848
notify.exe
120.92.4.195:80
notify.meihua.docer.com
Beijing Kingsoft Cloud Internet Technology Co., Ltd
CN
unknown

DNS requests

Domain
IP
Reputation
spdyn.wps.cn
  • 120.92.88.213
suspicious
notify.meihua.docer.com
  • 120.92.4.195
unknown
wdl1.cache.wps.cn
  • 150.138.180.206
  • 150.138.211.215
  • 115.231.228.228
malicious

Threats

PID
Process
Class
Message
3456
notify.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
Process
Message
notify.exe
2019/05/28 03:19:09 I wpsnotify 00000d80:0000091c [WorkerMain]Notify work thread begin.
notify.exe
2019/05/28 03:19:10 I wpsnotify 00000d80:0000091c [ExecuteActions]actions count: 1.
notify.exe
2019/05/28 03:19:10 I wpsnotify 00000d80:0000091c [Getinfo]: 17.
notify.exe
2019/05/28 03:19:11 I wpsnotify 00000d80:0000091c [ExecuteActions]actions count: 12.
notify.exe
2019/05/28 03:19:11 I wpsnotify 00000d80:0000091c [Updatesetting]: 5.
notify.exe
2019/05/28 03:19:11 E wpsnotify 00000d80:0000091c CallProcedure Failed: 0x80004005.
notify.exe
2019/05/28 03:19:11 I wpsnotify 00000d80:0000091c [Updatesetting]: 1.
notify.exe
2019/05/28 03:19:11 I wpsnotify 00000d80:0000091c [Download]: 1.
notify.exe
2019/05/28 03:19:13 I wpsnotify 00000d80:0000091c [Updatesetting]: 1.
notify.exe
2019/05/28 03:19:13 I wpsnotify 00000d80:0000091c [Updatesetting]: 1.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
OfficeAssist.0195.80.1013.exe