download:

video-converter-ultimate-bing_setup_full975.exe

Full analysis: https://app.any.run/tasks/54da926a-c199-46c9-963c-fffd35dbd7ec
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: January 31, 2020, 00:27:20
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
trojan
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

9C856D016894D7B658976468B47C7001

SHA1:

9B7110C1CA6C794D6D35693569EA386D69D00660

SHA256:

D4FCB4A60DC223BF19BA93B16C4078D2555F6F27E26344F947E8E47FA59FF924

SSDEEP:

12288:Mw8Jiq97i32bkQoTHHYn5iwh6lchomWlWYwU0fClaLMjUtfvHB1+jG5Pv:Yw9QoTQiwh6lchom9Yw0WOUFvv+q53

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • video-converter-ultimate-bing_full975.exe (PID: 2864)
      • WSHelper.exe (PID: 3604)
      • CheckGraphicsType.exe (PID: 2640)
      • cmdCheckMFForVCE.exe (PID: 3992)
      • CheckNvidiaProfile.exe (PID: 2004)
      • URLReqService.exe (PID: 924)
      • WSHelper.exe (PID: 3136)
      • Wondershare Helper Compact.exe (PID: 3776)
      • VideoConverterUltimate.exe (PID: 3088)
      • sniffer.exe (PID: 2756)
      • TransferProcess.exe (PID: 2840)
      • WSVCUUpdateHelper.exe (PID: 3884)
      • Wondershare Helper Compact.exe (PID: 3916)
      • CheckNvidiaProfile.exe (PID: 2792)
      • CheckGraphicsType.exe (PID: 984)
      • cmdCheckMFForVCE.exe (PID: 1296)

    • Downloads executable files from the Internet

      • video-converter-ultimate-bing_setup_full975.exe (PID: 1888)
      • VideoConverterUltimate.exe (PID: 3088)

    • Changes the autorun value in the registry

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • Wondershare Helper Compact.tmp (PID: 2184)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Loads dropped or rewritten executable

      • WSHelper.exe (PID: 3604)
      • regsvr32.exe (PID: 3648)
      • RegAsm.exe (PID: 2076)
      • regsvr32.exe (PID: 3456)
      • regsvr32.exe (PID: 1500)
      • RegAsm.exe (PID: 2700)
      • CheckGraphicsType.exe (PID: 2640)
      • CheckNvidiaProfile.exe (PID: 2004)
      • cmdCheckMFForVCE.exe (PID: 3992)
      • VideoConverterUltimate.exe (PID: 3088)
      • URLReqService.exe (PID: 924)
      • sniffer.exe (PID: 2756)
      • WSVCUUpdateHelper.exe (PID: 3884)
      • regsvr32.exe (PID: 620)
      • RegAsm.exe (PID: 2192)
      • regsvr32.exe (PID: 376)
      • regsvr32.exe (PID: 4080)
      • RegAsm.exe (PID: 440)
      • TransferProcess.exe (PID: 2840)
      • WSHelper.exe (PID: 3136)
      • VideoConverterUltimate.exe (PID: 3796)
      • URLReqService.exe (PID: 1136)
      • CheckNvidiaProfile.exe (PID: 2792)
      • CheckGraphicsType.exe (PID: 984)
      • cmdCheckMFForVCE.exe (PID: 1296)
      • TransferProcess.exe (PID: 2412)

    • Registers / Runs the DLL via REGSVR32.EXE

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Changes settings of System certificates

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • VideoConverterUltimate.exe (PID: 3088)
      • RegAsm.exe (PID: 2076)

    • Changes internet zones settings

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • video-converter-ultimate_full975.tmp (PID: 2664)

  • SUSPICIOUS

    • Low-level read access rights to disk partition

      • video-converter-ultimate-bing_setup_full975.exe (PID: 1888)

    • Executable content was dropped or overwritten

      • video-converter-ultimate-bing_full975.exe (PID: 2864)
      • Wondershare Helper Compact.exe (PID: 3776)
      • Wondershare Helper Compact.tmp (PID: 2184)
      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • DVDTemplateInstall.tmp (PID: 832)
      • DVDTemplateInstall.exe (PID: 3296)
      • video-converter-ultimate_full975.exe (PID: 988)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Reads Windows owner or organization settings

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • DVDTemplateInstall.tmp (PID: 832)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Reads Internet Cache Settings

      • video-converter-ultimate-bing_setup_full975.exe (PID: 1888)
      • WSHelper.exe (PID: 3136)

    • Reads the Windows organization settings

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • DVDTemplateInstall.tmp (PID: 832)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Uses TASKKILL.EXE to kill process

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Reads internet explorer settings

      • video-converter-ultimate-bing_setup_full975.exe (PID: 1888)
      • VideoConverterUltimate.exe (PID: 3088)

    • Creates files in the Windows directory

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • InstallUtil.exe (PID: 3652)
      • CertUtil.exe (PID: 2132)
      • video-converter-ultimate_full975.tmp (PID: 2664)
      • CertUtil.exe (PID: 3508)

    • Creates files in the user directory

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Creates COM task schedule object

      • RegAsm.exe (PID: 2076)
      • RegAsm.exe (PID: 2352)
      • RegAsm.exe (PID: 2700)
      • RegAsm.exe (PID: 3728)
      • RegAsm.exe (PID: 2432)
      • RegAsm.exe (PID: 2192)
      • RegAsm.exe (PID: 2272)
      • RegAsm.exe (PID: 440)

    • Creates files in the program directory

      • RegAsm.exe (PID: 2076)
      • RegAsm.exe (PID: 3728)
      • RegAsm.exe (PID: 2700)
      • InstallUtil.exe (PID: 3652)
      • CheckNvidiaProfile.exe (PID: 2004)
      • CheckGraphicsType.exe (PID: 2640)
      • cmdCheckMFForVCE.exe (PID: 3992)
      • sniffer.exe (PID: 2756)
      • WSVCUUpdateHelper.exe (PID: 3884)
      • VideoConverterUltimate.exe (PID: 3088)
      • RegAsm.exe (PID: 2192)
      • RegAsm.exe (PID: 440)
      • RegAsm.exe (PID: 2432)
      • InstallUtil.exe (PID: 2836)
      • CheckNvidiaProfile.exe (PID: 2792)
      • CheckGraphicsType.exe (PID: 984)
      • cmdCheckMFForVCE.exe (PID: 1296)
      • VideoConverterUltimate.exe (PID: 3796)
      • WSHelper.exe (PID: 3136)

    • Removes files from Windows directory

      • CertUtil.exe (PID: 2132)
      • CertUtil.exe (PID: 3508)

    • Adds / modifies Windows certificates

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • VideoConverterUltimate.exe (PID: 3088)
      • RegAsm.exe (PID: 2076)

    • Starts Internet Explorer

      • video-converter-ultimate-bing_setup_full975.exe (PID: 1888)

    • Loads Python modules

      • VideoConverterUltimate.exe (PID: 3088)
      • sniffer.exe (PID: 2756)
      • VideoConverterUltimate.exe (PID: 3796)

    • Reads Environment values

      • VideoConverterUltimate.exe (PID: 3088)
      • TransferProcess.exe (PID: 2840)
      • WSVCUUpdateHelper.exe (PID: 3884)
      • VideoConverterUltimate.exe (PID: 3796)

    • Executed via COM

      • WSHelper.exe (PID: 3136)

    • Searches for installed software

      • WSVCUUpdateHelper.exe (PID: 3884)
      • video-converter-ultimate_full975.tmp (PID: 2664)

  • INFO

    • Application was dropped or rewritten from another process

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • DVDTemplateInstall.tmp (PID: 832)
      • Wondershare Helper Compact.tmp (PID: 2184)
      • video-converter-ultimate_full975.tmp (PID: 2664)
      • Wondershare Helper Compact.tmp (PID: 2464)

    • Loads dropped or rewritten executable

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • Wondershare Helper Compact.tmp (PID: 2184)
      • DVDTemplateInstall.tmp (PID: 832)
      • video-converter-ultimate_full975.tmp (PID: 2664)
      • Wondershare Helper Compact.tmp (PID: 2464)

    • Creates a software uninstall entry

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • Wondershare Helper Compact.tmp (PID: 2184)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Dropped object may contain TOR URL's

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • VideoConverterUltimate.exe (PID: 3088)

    • Dropped object may contain Bitcoin addresses

      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • sniffer.exe (PID: 2756)
      • video-converter-ultimate_full975.tmp (PID: 2664)
      • VideoConverterUltimate.exe (PID: 3088)

    • Creates files in the program directory

      • Wondershare Helper Compact.tmp (PID: 2184)
      • video-converter-ultimate-bing_full975.tmp (PID: 3308)
      • DVDTemplateInstall.tmp (PID: 832)
      • video-converter-ultimate_full975.tmp (PID: 2664)

    • Reads settings of System Certificates

      • RegAsm.exe (PID: 2076)
      • iexplore.exe (PID: 3132)
      • iexplore.exe (PID: 4092)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 4092)
      • iexplore.exe (PID: 3132)

    • Application launched itself

      • iexplore.exe (PID: 4092)

    • Changes internet zones settings

      • iexplore.exe (PID: 4092)

    • Creates files in the user directory

      • iexplore.exe (PID: 3132)
      • iexplore.exe (PID: 4092)

    • Changes settings of System certificates

      • iexplore.exe (PID: 3132)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 3132)

    • Reads internet explorer settings

      • iexplore.exe (PID: 3132)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (16.3)
.exe | Win64 Executable (generic) (14.5)
.dll | Win32 Dynamic Link Library (generic) (3.4)
.exe | Win32 Executable (generic) (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2018:06:01 05:42:12+02:00
PEType: PE32
LinkerVersion: 9
CodeSize: 451072
InitializedDataSize: 524800
UninitializedDataSize: -
EntryPoint: 0x51167
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 2.0.9.2
ProductVersionNumber: 2.0.9.2
FileFlagsMask: 0x0017
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileDescription: video-converter-ultimate(cpc)_setup_full975.exe
FileVersion: 2.0.9.2
LegalCopyright: Copyright©2017 Wondershare. All rights reserved.
ProductName: Video Converter Ultimate(CPC)
ProductVersion: 10.3.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
211
Monitored processes
103
Malicious processes
18
Suspicious processes
9

Behavior graph

Click at the process to see the details
download and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start drop and start video-converter-ultimate-bing_setup_full975.exe nfwchk.exe no specs video-converter-ultimate-bing_full975.exe video-converter-ultimate-bing_full975.tmp taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs wondershare helper compact.exe wondershare helper compact.tmp wshelper.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs installutil.exe no specs certutil.exe no specs urlreqservice.exe no specs checknvidiaprofile.exe no specs checkgraphicstype.exe no specs cmdcheckmfforvce.exe no specs videoconverterultimate.exe iexplore.exe iexplore.exe wshelper.exe transferprocess.exe sniffer.exe wsvcuupdatehelper.exe dvdtemplateinstall.exe dvdtemplateinstall.tmp video-converter-ultimate_full975.exe video-converter-ultimate_full975.tmp taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs taskkill.exe no specs wondershare helper compact.exe no specs wondershare helper compact.tmp no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regsvr32.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs regasm.exe no specs installutil.exe no specs certutil.exe no specs urlreqservice.exe no specs checknvidiaprofile.exe no specs checkgraphicstype.exe no specs cmdcheckmfforvce.exe no specs videoconverterultimate.exe transferprocess.exe video-converter-ultimate-bing_setup_full975.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
180"C:\Windows\system32\TASKKILL.exe" /F /IM ScreenCapture.exeC:\Windows\system32\TASKKILL.exe—video-converter-ultimate_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
376"C:\Windows\system32\TASKKILL.exe" /F /IM upl.exeC:\Windows\system32\TASKKILL.exe—video-converter-ultimate_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
376"C:\Windows\system32\regsvr32.exe" /s LAVSplitter.axC:\Windows\system32\regsvr32.exe—video-converter-ultimate_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\wbem\fastprox.dll
c:\windows\system32\rpcrtremote.dll
c:\windows\system32\cryptsp.dll
c:\windows\system32\wbemcomn.dll
c:\windows\system32\clbcatq.dll
c:\windows\system32\msctf.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\wkscli.dll
c:\windows\system32\netutils.dll
c:\windows\system32\wtsapi32.dll
404"C:\Windows\system32\TASKKILL.exe" /F /IM WSVCUUpdateHelper.exeC:\Windows\system32\TASKKILL.exe—video-converter-ultimate-bing_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
440"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "C:\Program Files\Wondershare\Video Converter Ultimate(CPC)\VideoToImages.exe" /codebase /tlbC:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe—video-converter-ultimate_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft .NET Assembly Registration Utility
Exit code:
0
Version:
2.0.50727.5420 (Win7SP1.050727-5400)
Modules
Images
c:\windows\microsoft.net\framework\v2.0.50727\regasm.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\apppatch\acgenral.dll
c:\windows\system32\sechost.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
540"C:\Windows\system32\TASKKILL.exe" /F /IM VideoConverterUltimate.exeC:\Windows\system32\TASKKILL.exe—video-converter-ultimate_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
620"C:\Windows\system32\regsvr32.exe" /s ac3filter.axC:\Windows\system32\regsvr32.exe—video-converter-ultimate_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft(C) Register Server
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\regsvr32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
628"C:\Windows\system32\TASKKILL.exe" /F /IM VideoToImages.exeC:\Windows\system32\TASKKILL.exe—video-converter-ultimate_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\windows\system32\rpcrt4.dll
c:\windows\system32\msctf.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\lpk.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\conhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
676"C:\Windows\system32\TASKKILL.exe" /F /IM TransferProcess.exeC:\Windows\system32\TASKKILL.exe—video-converter-ultimate-bing_full975.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Terminates Processes
Exit code:
128
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\taskkill.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\version.dll
c:\windows\system32\user32.dll
832"C:\Users\admin\AppData\Local\Temp\is-P48U5.tmp\DVDTemplateInstall.tmp" /SL5="$7013E,35805582,119296,C:\ProgramData\Wondershare\UniConverter\DVDTemplateInstall.exe" /SP- /VERYSILENT /norestart installpath "C:\ProgramData\Wondershare\UniConverter\MenuRes"C:\Users\admin\AppData\Local\Temp\is-P48U5.tmp\DVDTemplateInstall.tmp
DVDTemplateInstall.exe
User:
admin
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-p48u5.tmp\dvdtemplateinstall.tmp
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\ole32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
Total events
6 336
Read events
3 282
Write events
3 001
Delete events
53

Modification events

(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WafCX
Operation:writeName:
Value:
sku-ppc-bing
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WafCX
Operation:writeName:975
Value:
sku-ppc-bing
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\Wondershare Helper Compact
Operation:writeName:ClientSign
Value:
{C4BA3647-0000-0QM0-0001-5254004A04AF}
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Wondershare\WAF
Operation:writeName:ClientSign
Value:
{C4BA3647-0000-0QM0-0001-5254004A04AF}
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(1888) video-converter-ultimate-bing_setup_full975.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
Executable files
562
Suspicious files
49
Text files
2 117
Unknown types
1 030

Dropped files

PID
Process
Filename
Type
1888video-converter-ultimate-bing_setup_full975.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exe —
MD5:—
SHA256:—
1888video-converter-ultimate-bing_setup_full975.exeC:\Users\Public\Documents\Wondershare\NFWCHK.exe.config —
MD5:—
SHA256:—
1888video-converter-ultimate-bing_setup_full975.exeC:\Users\Public\Documents\Wondershare\video-converter-ultimate-bing_full975.exe.~P2S —
MD5:—
SHA256:—
1888video-converter-ultimate-bing_setup_full975.exeC:\Users\Public\Documents\Wondershare\video-converter-ultimate-bing_full975.exe —
MD5:—
SHA256:—
3308video-converter-ultimate-bing_full975.tmpC:\Program Files\Wondershare\Video Converter Ultimate(CPC)\is-3GH0T.tmp —
MD5:—
SHA256:—
3308video-converter-ultimate-bing_full975.tmpC:\Program Files\Wondershare\Video Converter Ultimate(CPC)\Skin\Uninstall\is-HFH4D.tmp —
MD5:—
SHA256:—
3308video-converter-ultimate-bing_full975.tmpC:\Program Files\Wondershare\Video Converter Ultimate(CPC)\Skin\Uninstall\is-JU5U5.tmp —
MD5:—
SHA256:—
3308video-converter-ultimate-bing_full975.tmpC:\Program Files\Wondershare\Video Converter Ultimate(CPC)\Skin\Uninstall\is-FPR85.tmp —
MD5:—
SHA256:—
1888video-converter-ultimate-bing_setup_full975.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\975-20190312144432[1].htmhtml
MD5:—
SHA256:—
3308video-converter-ultimate-bing_full975.tmpC:\Program Files\Wondershare\Video Converter Ultimate(CPC)\Skin\Uninstall\is-JHG8E.tmp —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
102
TCP/UDP connections
155
DNS requests
58
Threats
10

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1888
video-converter-ultimate-bing_setup_full975.exe
HEAD
200
95.100.39.19:80
http://download.wondershare.net/cbs_down/video-converter-ultimate-bing_full975.exe
DE
—
—
whitelisted
1888
video-converter-ultimate-bing_setup_full975.exe
GET
—
47.91.67.36:80
http://dlinst.wondershare.com/player/style/orbit-1.3.0.css
US
—
—
suspicious
1888
video-converter-ultimate-bing_setup_full975.exe
HEAD
200
72.247.185.51:80
http://download.wondershare.net/cbs_down/video-converter-ultimate-bing_full975.exe
NL
—
—
whitelisted
1888
video-converter-ultimate-bing_setup_full975.exe
GET
—
95.100.39.19:80
http://download.wondershare.net/cbs_down/video-converter-ultimate-bing_full975.exe
DE
—
—
whitelisted
1888
video-converter-ultimate-bing_setup_full975.exe
GET
—
72.247.185.51:80
http://download.wondershare.net/cbs_down/video-converter-ultimate-bing_full975.exe
NL
—
—
whitelisted
1888
video-converter-ultimate-bing_setup_full975.exe
GET
—
72.247.185.51:80
http://download.wondershare.net/cbs_down/video-converter-ultimate-bing_full975.exe
NL
—
—
whitelisted
1888
video-converter-ultimate-bing_setup_full975.exe
GET
200
47.91.67.36:80
http://platform.wondershare.com/rest/v2/downloader/runtime/?client_sign={C4BA3647-0000-0QM0-0001-5254004A04AF}&product_id=975
US
xml
1.64 Kb
suspicious
1888
video-converter-ultimate-bing_setup_full975.exe
GET
200
47.91.67.36:80
http://dlinst.wondershare.com/player/975-20190312144432.html
US
html
890 b
suspicious
1888
video-converter-ultimate-bing_setup_full975.exe
GET
200
47.91.67.36:80
http://dlinst.wondershare.com/player/975-20190312144432.html
US
html
890 b
suspicious
1888
video-converter-ultimate-bing_setup_full975.exe
GET
206
95.100.39.19:80
http://download.wondershare.net/cbs_down/video-converter-ultimate-bing_full975.exe
DE
binary
17.5 Mb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3132
iexplore.exe
172.217.22.40:443
www.googletagmanager.com
Google Inc.
US
whitelisted
3132
iexplore.exe
216.58.206.2:443
www.googleadservices.com
Google Inc.
US
whitelisted
3088
VideoConverterUltimate.exe
88.191.250.2:80
www.videolan.org
Free SAS
FR
malicious
3088
VideoConverterUltimate.exe
47.91.89.199:80
cbs.wondershare.com
Alibaba (China) Technology Co., Ltd.
US
malicious
3132
iexplore.exe
172.217.22.106:443
ajax.googleapis.com
Google Inc.
US
whitelisted
3088
VideoConverterUltimate.exe
185.113.25.56:443
www.toptenreviews.com
Future Publishing Ltd
GB
suspicious
1888
video-converter-ultimate-bing_setup_full975.exe
47.91.67.36:80
platform.wondershare.com
Alibaba (China) Technology Co., Ltd.
US
suspicious
1888
video-converter-ultimate-bing_setup_full975.exe
95.100.39.19:80
download.wondershare.net
Akamai International B.V.
DE
suspicious
1888
video-converter-ultimate-bing_setup_full975.exe
72.247.185.51:80
download.wondershare.net
Akamai International B.V.
NL
whitelisted
3308
video-converter-ultimate-bing_full975.tmp
104.108.55.202:443
videoconverter.wondershare.net
Akamai Technologies, Inc.
NL
unknown

DNS requests

Domain
IP
Reputation
platform.wondershare.com
  • 47.91.67.36
suspicious
download.wondershare.net
  • 95.100.39.19
  • 72.247.185.51
  • 2.17.123.210
  • 2.17.123.75
whitelisted
dlinst.wondershare.com
  • 47.91.67.36
suspicious
cbs.wondershare.com
  • 47.91.89.199
  • 47.91.76.37
  • 47.91.91.66
  • 47.91.89.20
whitelisted
videoconverter.wondershare.net
  • 104.108.55.202
suspicious
cbs.wondershare.net
  • 47.91.89.199
  • 47.91.76.37
  • 47.91.91.66
  • 47.91.89.20
malicious
ocsp.digicert.com
  • 72.21.91.29
whitelisted
images.wondershare.com
  • 172.227.177.13
whitelisted
code.jquery.com
  • 209.197.3.24
whitelisted
videoconverter.wondershare.com
  • 104.111.228.73
suspicious

Threats

PID
Process
Class
Message
1888
video-converter-ultimate-bing_setup_full975.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
1888
video-converter-ultimate-bing_setup_full975.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3308
video-converter-ultimate-bing_full975.tmp
A Network Trojan was detected
ET TROJAN Possible Win32/Get2 Downloader Activity
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
3088
VideoConverterUltimate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3088
VideoConverterUltimate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3088
VideoConverterUltimate.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
3088
VideoConverterUltimate.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
3088
VideoConverterUltimate.exe
Potentially Bad Traffic
ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download
1052
svchost.exe
Potentially Bad Traffic
ET DNS Query for .cc TLD
Process
Message
VideoConverterUltimate.exe
OS Version: Win7 OS32Bits
VideoConverterUltimate.exe
=======================================
VideoConverterUltimate.exe
DownloadHelper 1 OSUtils.OSVersion:Win7
VideoConverterUltimate.exe
Program.Start Product=UniConverter, Version=10.5.1.208
VideoConverterUltimate.exe
Program.InitLog...
VideoConverterUltimate.exe
ProductClient.Init, product lang: ENG id: 975
WSHelper.exe
HTTP/1.1 200 OK
WSHelper.exe
HTTP/1.1 200 OK
VideoConverterUltimate.exe
eMail =,regCode =
WSHelper.exe
HTTP/1.1 404 Not Found
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
video-converter-ultimate-bing_setup_full975.exe