File name:

22c59739ad3a91281718292510fe4bf29999b7fd2dfcc92a38a985d598e55e3a

Full analysis: https://app.any.run/tasks/5f29cfc7-16a9-4af7-a832-5254bf0b521b
Verdict: Malicious activity
Analysis date: December 02, 2023, 16:28:00
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/pdf
File info: PDF document, version 1.4
MD5:

C0FCAC5210D36192C579D70876B56AB6

SHA1:

4FAA3E1B12443D9FCD7A1C84B0CDE331D32ED7A7

SHA256:

22C59739AD3A91281718292510FE4BF29999B7FD2DFCC92A38A985D598E55E3A

SSDEEP:

768:zx1A09dKoT/v+/jB5/gPlUfDzq+P5UXAN+rxvoETbCtP9YGVeyvHAFbp:VtHx/KttgPOiWUXAAlgETq9Y/FFbp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    • Checks supported languages

      • wmpnscfg.exe (PID: 3508)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3508)

    • Application launched itself

      • msedge.exe (PID: 3420)
      • AcroRd32.exe (PID: 844)
      • RdrCEF.exe (PID: 1996)

    • Drops the executable file immediately after the start

      • RdrCEF.exe (PID: 1996)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3508)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.pdf | Adobe Portable Document Format (100)

EXIF

PDF

PDFVersion: 1.4
Linearized: No
Title: Rpg Simulator Hack Roblox
Creator: wkhtmltopdf 0.12.6
Producer: Qt 4.8.7
CreateDate: 2021:06:06 23:59:31+07:00
PageCount: 4
PageMode: UseOutlines
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
69
Monitored processes
33
Malicious processes
0
Suspicious processes
0

Behavior graph

Click at the process to see the details
start acrord32.exe acrord32.exe no specs rdrcef.exe rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs wmpnscfg.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
844"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\admin\AppData\Local\Temp\22c59739ad3a91281718292510fe4bf29999b7fd2dfcc92a38a985d598e55e3a.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
explorer.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
MEDIUM
Description:
Adobe Acrobat Reader DC
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1016"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3796 --field-trial-handle=1392,i,6679518541271027023,15819634345143980507,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1036"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3832 --field-trial-handle=1392,i,6679518541271027023,15819634345143980507,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1152"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --touch-events=enabled --field-trial-handle=1048,1698738451311662095,13785675145772616425,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-gpu-compositing --lang=en-US --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=18264182868450449798 --renderer-client-id=2 --mojo-platform-channel-handle=1168 --allow-no-sandbox-job /prefetch:1C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1236"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" --type=renderer "C:\Users\admin\AppData\Local\Temp\22c59739ad3a91281718292510fe4bf29999b7fd2dfcc92a38a985d598e55e3a.pdf"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe—AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe Acrobat Reader DC
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrord32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1900"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2384 --field-trial-handle=1392,i,6679518541271027023,15819634345143980507,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1996"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
AcroRd32.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2116"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3344 --field-trial-handle=1392,i,6679518541271027023,15819634345143980507,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2220"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --field-trial-handle=1048,1698738451311662095,13785675145772616425,131072 --disable-features=NetworkService,VizDisplayCompositor --disable-pack-loading --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/20.13.20064 Chrome/80.0.0.0" --lang=en-US --gpu-preferences=KAAAAAAAAADgACAgAQAAAAAAAAAAAGAAAAAAABAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --use-gl=swiftshader-webgl --log-file="C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --service-request-channel-token=16305022514082399739 --mojo-platform-channel-handle=1376 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
1
Version:
20.13.20064.405839
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
2220"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3760 --field-trial-handle=1392,i,6679518541271027023,15819634345143980507,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
Total events
15 836
Read events
15 793
Write events
42
Delete events
1

Modification events

(PID) Process:(1236) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\ExitSection
Operation:writeName:bLastExitNormal
Value:
1
(PID) Process:(1236) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral
Operation:writeName:uLastAppLaunchTimeStamp
Value:
738908672
(PID) Process:(1236) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\AVGeneral
Operation:writeName:iNumReaderLaunches
Value:
5
(PID) Process:(844) AcroRd32.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\17F\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1236) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\DC\SessionManagement
Operation:writeName:bNormalExit
Value:
1
(PID) Process:(844) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(844) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
460000005A010000090000000000000000000000000000000400000000000000C0E333BBEAB1D3010000000000000000000000000100000002000000C0A8016B000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(1236) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\DiskCabs
Operation:writeName:bForms_AdhocWorkflowBackup
Value:
0
(PID) Process:(1236) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\DiskCabs
Operation:writeName:bJSCache_GlobData
Value:
1
(PID) Process:(1236) AcroRd32.exeKey:HKEY_CURRENT_USER\Software\Adobe\Adobe Acrobat\DC\DiskCabs
Operation:writeName:bJSCache_GlobSettings
Value:
1
Executable files
1
Suspicious files
217
Text files
34
Unknown types
0

Dropped files

PID
Process
Filename
Type
1996RdrCEF.exe —
MD5:—
SHA256:—
1996RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\2a426f11fd8ebe18_0binary
MD5:02B7CE7759859C4F5ED8F0C250C100EE
SHA256:B853D51933FDF8D5127588B87ADEE93AB4ED2E20DE640A9185960E39002855B1
1996RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\0786087c3c360803_0binary
MD5:9995938FAA28BCD303A73E37CA10FD46
SHA256:399CC2CED705AE21C363BA28D92918FADBBF1D8B399B3F46006EB47E6BE3E20A
1996RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\4a0e94571d979b3c_0binary
MD5:780873415132BA12B2C78E6BD47C8784
SHA256:A957E2551FFD4AA0C297B709E9827276CA3ABC1D8DB3A8006602B4737B94A172
1996RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\aba6710fde0876af_0binary
MD5:0F10E0A923B14C677E90AF47B12E8DFB
SHA256:C018E68DB137E01BFDBE3067DFDE44D1CBBF670135540029B6C60BDB951E7B79
1996RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\bba29d2e6197e2f4_0binary
MD5:ED17BE07276DDE5A1AA1401BFF513812
SHA256:CD7C95E9A1449AF93F3578394516EC32C3BFF6FCD376C5927181F590B81C4F6F
1236AcroRd32.exeC:\Users\admin\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Reader\Files\TESTINGbinary
MD5:DC84B0D741E5BEAE8070013ADDCC8C28
SHA256:81FF65EFC4487853BDB4625559E69AB44F19E0F5EFBD6D5B2AF5E3AB267C8E06
1996RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Code Cache\js\todelete_72d9f526d2e2e7c8_0_1binary
MD5:BB1C0C2FF2555553FB7BC8488D4A8ECA
SHA256:FD537134808876994735BFDC1F994C293E8A910B72794541E83FEF36122FE079
1996RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old~RF20a22f.TMPtext
MD5:FF09ACD52BCF65FACA015BE3EC091DCA
SHA256:75176465D641ECB19503834BA4480B78CDE201E3A8256CC02219E5706FFD007A
1996RdrCEF.exeC:\Users\admin\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.oldtext
MD5:5705BEF2F423E8D5EF921B2CBEE16FB9
SHA256:154DF2B4012DEAA86794EF8A0C44FB435615A3143AA3336EA79D2A9544C14900
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
52
DNS requests
49
Threats
3

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
844
AcroRd32.exe
GET
200
184.24.77.184:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?7178f94da36a91d9
unknown
compressed
4.66 Kb
unknown
844
AcroRd32.exe
GET
200
184.24.77.184:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e2ca673e5584c85c
unknown
compressed
4.66 Kb
unknown
844
AcroRd32.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAbY2QTVWENG9oovp1QifsQ%3D
unknown
binary
471 b
unknown
3132
msedge.exe
GET
302
45.79.19.196:80
http://netcdn.tw/app/431946152/rpg-simulator-hack-roblox-game-hack?gp=1&js=1&uuid=1701534516.0017611322&other_args=eyJ1cmkiOiAiL2FwcC80MzE5NDYxNTIvcnBnLXNpbXVsYXRvci1oYWNrLXJvYmxveC1nYW1lLWhhY2siLCAiYXJncyI6ICIiLCAicmVmZXJlciI6ICIiLCAiYWNjZXB0IjogInRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LGltYWdlL3dlYnAsaW1hZ2UvYXBuZywqLyo7cT0wLjgsYXBwbGljYXRpb24vc2lnbmVkLWV4Y2hhbmdlO3Y9YjM7cT0wLjkifQ==
unknown
—
—
unknown
3132
msedge.exe
GET
302
15.197.204.56:80
http://www6.netcdn.tw/?template=ARROW_3&tdfs=0&s_token=1701534519.0379010000&uuid=1701534519.0379010000&term=Player%20Account%20Verification%20Software&term=Dedicated%20Server%20Hesse&term=Digital%20Products%20Online%20Store&term=Windows%20Unlock%20Game%20Dedicated%20Server&searchbox=0&showDomain=0&backfill=0
unknown
html
142 b
unknown
3132
msedge.exe
GET
200
45.79.19.196:80
http://netcdn.tw/app/431946152/rpg-simulator-hack-roblox-game-hack
unknown
compressed
650 b
unknown
1080
svchost.exe
GET
200
184.24.77.201:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?95a1910edfe5ddda
unknown
compressed
65.2 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
868
svchost.exe
23.35.228.137:80
—
AKAMAI-AS
DE
unknown
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
1996
RdrCEF.exe
23.35.236.137:443
geo2.adobe.com
AKAMAI-AS
DE
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1996
RdrCEF.exe
50.16.47.176:443
p13n.adobe.io
AMAZON-AES
US
unknown
868
svchost.exe
184.30.20.134:80
armmf.adobe.com
AKAMAI-AS
DE
unknown
1996
RdrCEF.exe
184.30.20.134:443
armmf.adobe.com
AKAMAI-AS
DE
unknown
844
AcroRd32.exe
2.19.198.75:443
acroipm2.adobe.com
Akamai International B.V.
DE
unknown
844
AcroRd32.exe
184.24.77.184:80
ctldl.windowsupdate.com
Akamai International B.V.
DE
unknown

DNS requests

Domain
IP
Reputation
geo2.adobe.com
  • 23.35.236.137
whitelisted
p13n.adobe.io
  • 50.16.47.176
  • 54.224.241.105
  • 18.213.11.84
  • 34.237.241.83
whitelisted
armmf.adobe.com
  • 184.30.20.134
whitelisted
acroipm2.adobe.com
  • 2.19.198.75
  • 23.32.238.90
  • 23.32.238.96
  • 23.32.238.128
  • 2.19.198.72
  • 23.32.238.89
  • 2.19.198.73
  • 23.32.238.105
  • 23.32.238.106
whitelisted
ctldl.windowsupdate.com
  • 184.24.77.184
  • 184.24.77.201
  • 184.24.77.203
  • 184.24.77.209
  • 184.24.77.194
  • 184.24.77.173
  • 184.24.77.186
  • 184.24.77.187
  • 184.24.77.193
  • 184.24.77.205
  • 184.24.77.206
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
netcdn.tw
  • 45.33.18.44
  • 173.255.194.134
  • 45.33.30.197
  • 96.126.123.244
  • 198.58.118.167
  • 45.33.20.235
  • 45.33.2.79
  • 45.33.23.183
  • 72.14.185.43
  • 45.56.79.23
  • 72.14.178.174
  • 45.79.19.196
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 20.103.180.120
whitelisted
edge.microsoft.com
  • 131.253.33.239
  • 13.107.22.239
whitelisted

Threats

PID
Process
Class
Message
3132
msedge.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
3132
msedge.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
3132
msedge.exe
Potentially Bad Traffic
ET INFO HTTP Request to a *.tw domain
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
22c59739ad3a91281718292510fe4bf29999b7fd2dfcc92a38a985d598e55e3a