File name:

PDFast-1.0.2.exe

Full analysis: https://app.any.run/tasks/ce49dfff-12f8-4833-aac9-9b04cad401cd
Verdict: Malicious activity
Analysis date: April 22, 2025, 15:19:40
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

F7A1A3EF01464771AC21D29976BE09F1

SHA1:

E936B694ED8C98CC9A0625A5E0166380E85D525E

SHA256:

103C8764F8AF476E8801C03A03969F388133B8586DE93B13FCBA52BF1772C8E5

SSDEEP:

98304:EL0druM/vIX0pafjCHE6B5fMxNRlOqAhcNAjcXILatBDuLtn3FGHw5ge0Ik44EZu:B7LXvIDb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Signed with known abused certificate

      • explorer.exe (PID: 856)

  • SUSPICIOUS

    • ADVANCEDINSTALLER mutex has been found

      • PDFast-1.0.2.exe (PID: 7188)

    • Reads security settings of Internet Explorer

      • PDFast-1.0.2.exe (PID: 7188)

    • Reads the Windows owner or organization settings

      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7288)

    • Executable content was dropped or overwritten

      • PDFast-1.0.2.exe (PID: 7188)
      • rundll32.exe (PID: 7664)
      • rundll32.exe (PID: 7888)
      • rundll32.exe (PID: 8000)
      • rundll32.exe (PID: 6972)
      • PDFast.exe (PID: 7540)

    • Process drops legitimate windows executable

      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7288)
      • PDFast.exe (PID: 7540)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7288)
      • PDFast-1.0.2.exe (PID: 7188)
      • PDFast.exe (PID: 7540)

  • INFO

    • The sample compiled with english language support

      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7288)
      • PDFast.exe (PID: 7540)

    • Checks supported languages

      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7288)
      • msiexec.exe (PID: 7608)
      • PDFast.exe (PID: 7540)
      • identity_helper.exe (PID: 7772)
      • PDFast.exe (PID: 5136)

    • Reads the software policy settings

      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7488)
      • msiexec.exe (PID: 7288)
      • rundll32.exe (PID: 7664)
      • rundll32.exe (PID: 6972)

    • Reads the computer name

      • msiexec.exe (PID: 7288)
      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7608)
      • PDFast.exe (PID: 7540)
      • PDFast.exe (PID: 5136)

    • Reads Environment values

      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7428)
      • msiexec.exe (PID: 7608)

    • Reads the machine GUID from the registry

      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7288)
      • PDFast.exe (PID: 7540)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7288)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7488)
      • rundll32.exe (PID: 8000)

    • Create files in a temporary directory

      • rundll32.exe (PID: 7664)
      • rundll32.exe (PID: 7888)
      • rundll32.exe (PID: 8000)
      • rundll32.exe (PID: 6972)

    • Creates files or folders in the user directory

      • PDFast-1.0.2.exe (PID: 7188)
      • msiexec.exe (PID: 7288)
      • PDFast.exe (PID: 7540)

    • Disables trace logs

      • rundll32.exe (PID: 7664)
      • rundll32.exe (PID: 6972)
      • PDFast.exe (PID: 7540)

    • Checks proxy server information

      • rundll32.exe (PID: 7664)
      • rundll32.exe (PID: 6972)
      • PDFast.exe (PID: 7540)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7288)

    • Manual execution by a user

      • PDFast.exe (PID: 7540)

    • Application launched itself

      • msedge.exe (PID: 8160)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:08 12:49:22+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 2534912
InitializedDataSize: 964608
UninitializedDataSize: -
EntryPoint: 0x1e0862
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.2.0
ProductVersionNumber: 1.0.2.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: PDFast
FileDescription: PDFast Installer
FileVersion: 1.0.2
InternalName: PDFast
LegalCopyright: Copyright (C) 2025 PDFast
OriginalFileName: PDFast.exe
ProductName: PDFast
ProductVersion: 1.0.2
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
181
Monitored processes
47
Malicious processes
4
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pdfast-1.0.2.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe msedge.exe rundll32.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs pdfast.exe identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs explorer.exe no specs explorer.exe no specs pdfast.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=4372 --field-trial-handle=2344,i,8212086792021904105,6171019231666848332,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856C:\WINDOWS\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -EmbeddingC:\Windows\explorer.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\shcore.dll
1196"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=1588 --field-trial-handle=2344,i,8212086792021904105,6171019231666848332,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1272"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6620 --field-trial-handle=2344,i,8212086792021904105,6171019231666848332,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1764"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x300,0x304,0x308,0x2f8,0x310,0x7ffc87785fd8,0x7ffc87785fe4,0x7ffc87785ff0C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
2240"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6704 --field-trial-handle=2344,i,8212086792021904105,6171019231666848332,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2552"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6804 --field-trial-handle=2344,i,8212086792021904105,6171019231666848332,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3020"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3296 --field-trial-handle=2344,i,8212086792021904105,6171019231666848332,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3268"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5408 --field-trial-handle=2344,i,8212086792021904105,6171019231666848332,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
24 532
Read events
24 344
Write events
176
Delete events
12

Modification events

(PID) Process:(7288) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
781C0000F49DB1FD99B3DB01
(PID) Process:(7288) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
E5D5ACDF2816D8397B1E421E7DCBDBDF82697F29CA43B69BD158D8BEC31CD566
(PID) Process:(7288) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7288) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\015A73038BCCE9A4D9CB5DB9BB9D3A25
Operation:writeName:42A06CB15348DC647A5B5B931CA0888F
Value:
C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe
(PID) Process:(7288) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\5FDD411600F442A4D8135D667D6E15BE
Operation:writeName:42A06CB15348DC647A5B5B931CA0888F
Value:
21:\Software\Microsoft\Windows\CurrentVersion\Uninstall\PDFast 1.0.2\DisplayName
(PID) Process:(7288) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\CB2CF82A73501EB48982555B20352FBE
Operation:writeName:42A06CB15348DC647A5B5B931CA0888F
Value:
C:\Users\admin\AppData\Roaming\PDFast\upd.exe
(PID) Process:(7288) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\1F71B56C260FA0044A47ADA58AA028D2
Operation:writeName:42A06CB15348DC647A5B5B931CA0888F
Value:
01:\Software\Microsoft\Windows\CurrentVersion\Uninstall\PDFast 1.0.2\NoModify
(PID) Process:(7288) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\FB5BAD0881B0D654BB0972B991982266
Operation:writeName:42A06CB15348DC647A5B5B931CA0888F
Value:
C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe.config
(PID) Process:(7288) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\88F1AE2693BC2454CA950689F5DB6F6E
Operation:writeName:42A06CB15348DC647A5B5B931CA0888F
Value:
C:\Users\admin\AppData\Roaming\PDFast\Core.dll
(PID) Process:(7288) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\67B966FC90AF5E348843A28F5C75FBB8
Operation:writeName:42A06CB15348DC647A5B5B931CA0888F
Value:
C:\Users\admin\AppData\Roaming\PDFast\msvcp140.dll
Executable files
223
Suspicious files
255
Text files
166
Unknown types
0

Dropped files

PID
Process
Filename
Type
7188PDFast-1.0.2.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:E1D2CC7A038F3BDBEE3D80DBDA7B93AA
SHA256:07FECED9715F0C2613D90E0824F2C1C9D8D62E906F207196C433BD10F791B33A
7188PDFast-1.0.2.exeC:\Users\admin\AppData\Local\Temp\shiC843.tmpexecutable
MD5:84A34BF3486F7B9B7035DB78D78BDD1E
SHA256:F85911C910B660E528D2CF291BAA40A92D09961996D6D84E7A53A7095C7CD96E
7288msiexec.exeC:\Windows\Installer\MSID1BA.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
7188PDFast-1.0.2.exeC:\Users\admin\AppData\Local\Temp\MSICD95.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
7664rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA9731AF93C64162D9BC0AD5F6822ED556\Microsoft.Win32.TaskScheduler.resources.dllexecutable
MD5:C9B4EAED07EF72E5ED0F9ECB3E9FFB66
SHA256:B2996E6B102FE829B5683936DD7197F26F375EA16499CC4E6AF88E78538B9FF1
7288msiexec.exeC:\Windows\Installer\10cff4.msiexecutable
MD5:2CC4D5B6E714091DDC71C301D12FB5BB
SHA256:9B84DAF91F2AAA896463801FB952F0887B6EEA7881BF4B0DD80EFA840EDCD40F
7664rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA9731AF93C64162D9BC0AD5F6822ED556\Microsoft.Win32.TaskScheduler.dllexecutable
MD5:0616EA42B68A8F5F2F01BCD985BDCBC7
SHA256:EA27C65491119EEE5C8E87CE3D470783580DB8FC5BD141C496768D7D0CCE779A
7664rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA9731AF93C64162D9BC0AD5F6822ED556\RequestSender.dllexecutable
MD5:2BECD9A34C47E04A7F4780ECAB9CC9E8
SHA256:69D1B22734FD95A761CA79AA8C1B9392CD8EE1331E23BC3E6F64A2243F2575C9
7288msiexec.exeC:\Windows\Installer\MSID1B9.tmpexecutable
MD5:FF28F8D0B16C52D475C6E06BD2FA24FA
SHA256:076ABA76E5FE015AFF3C42B3ADC0623B2DD1ABCB0E35B2F13CF2848F1A7A1CE8
7664rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA9731AF93C64162D9BC0AD5F6822ED556\CustomAction.configxml
MD5:EE9A8381338B060D86C58E2415F481F3
SHA256:7E1096D6F39EBE04D6E38BC714983AF05ED92CC2BB4D3365ED4C85E733CB145C
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
75
DNS requests
69
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7188
PDFast-1.0.2.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
536
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
536
SIHClient.exe
GET
200
2.16.253.202:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.120:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7188
PDFast-1.0.2.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDDbMOaoiAw9%2FpxWS%2BA%3D%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.120:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
7188
PDFast-1.0.2.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
whitelisted
—
—
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.14:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.184.206
whitelisted
crl.microsoft.com
  • 2.19.11.120
  • 2.19.11.105
whitelisted
www.microsoft.com
  • 95.101.149.131
  • 2.16.253.202
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 20.190.160.14
  • 20.190.160.131
  • 20.190.160.17
  • 20.190.160.66
  • 20.190.160.67
  • 20.190.160.5
  • 20.190.160.3
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
whitelisted
b.pdf-fast.com
  • 169.150.247.38
malicious
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PDFast-1.0.2.exe