File name:

PDFFlex-v4.102.1215.0.msi

Full analysis: https://app.any.run/tasks/ecbc1f8a-be9d-454d-8f2f-2b763232fa16
Verdict: Malicious activity
Analysis date: June 03, 2024, 03:27:21
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDFFlex, Author: PDFFlex.io, Keywords: Installer, MSI, Database, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o PDFFlex., Create Time/Date: Mon May 27 08:55:12 2024, Name of Creating Application: PDFFlex, Security: 0, Template: ;1033, Last Saved By: ;1046, Revision Number: {A101E974-EF6E-40A4-8532-07B644806946}4.102.1215.0;{A101E974-EF6E-40A4-8532-07B644806946}4.102.1215.0;{50C54027-847F-4B86-849A-9C02C888EE0B}, Number of Pages: 450, Number of Characters: 63
MD5:

F1C8A85FCE3AEC53C4B2BB45452D453A

SHA1:

9476A698165F4C3E89D370BD3135108D8D3DD476

SHA256:

2F9F2BB7999A0FA67A92203A5AE4E7DF47818835845BC170C50063CE333FE92B

SSDEEP:

98304:r9ISotSpkqN/2Wgx0xaAW9o+9DE+mzSE5lIP4GASazPtiG6CPUF0csMof+iZZjDJ:iNGPJx

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 928)
      • msiexec.exe (PID: 568)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2116)
      • powershell.exe (PID: 2080)
      • powershell.exe (PID: 2680)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 4068)
      • msiexec.exe (PID: 568)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 4068)

  • SUSPICIOUS

    • Reads the Internet Settings

      • msiexec.exe (PID: 3980)
      • powershell.exe (PID: 2080)
      • msiexec.exe (PID: 568)
      • powershell.exe (PID: 2680)
      • msiexec.exe (PID: 928)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 928)
      • msiexec.exe (PID: 568)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 928)
      • msiexec.exe (PID: 568)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 928)
      • msiexec.exe (PID: 568)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 928)
      • msiexec.exe (PID: 568)

    • Executes as Windows Service

      • VSSVC.exe (PID: 524)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 4068)
      • msiexec.exe (PID: 568)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 4068)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 4068)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 568)
      • msiexec.exe (PID: 928)

    • Node.exe was dropped

      • msiexec.exe (PID: 568)

  • INFO

    • An automatically generated document

      • msiexec.exe (PID: 3980)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3980)
      • powershell.exe (PID: 2116)
      • powershell.exe (PID: 2080)
      • powershell.exe (PID: 2680)

    • Reads the computer name

      • msiexec.exe (PID: 4068)
      • msiexec.exe (PID: 928)
      • wmpnscfg.exe (PID: 2312)
      • msiexec.exe (PID: 568)

    • Checks supported languages

      • msiexec.exe (PID: 4068)
      • msiexec.exe (PID: 928)
      • wmpnscfg.exe (PID: 2312)
      • msiexec.exe (PID: 568)
      • PDFFlex.exe (PID: 948)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 928)
      • powershell.exe (PID: 2116)
      • msiexec.exe (PID: 568)
      • powershell.exe (PID: 2080)
      • msiexec.exe (PID: 4068)
      • powershell.exe (PID: 2680)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 4068)
      • PDFFlex.exe (PID: 948)
      • msiexec.exe (PID: 568)

    • Reads the software policy settings

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 4068)
      • msiexec.exe (PID: 568)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 4068)
      • msiexec.exe (PID: 928)
      • msiexec.exe (PID: 568)

    • Application launched itself

      • msiexec.exe (PID: 4068)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3980)
      • msiexec.exe (PID: 4068)
      • msiexec.exe (PID: 568)

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3980)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 2116)
      • powershell.exe (PID: 2080)
      • powershell.exe (PID: 2680)

    • Reads Environment values

      • msiexec.exe (PID: 928)
      • msiexec.exe (PID: 568)

    • Manual execution by a user

      • wmpnscfg.exe (PID: 2312)

    • Disables trace logs

      • powershell.exe (PID: 2080)
      • powershell.exe (PID: 2680)

    • Checks proxy server information

      • msiexec.exe (PID: 568)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 4068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {7832C14D-212E-47F1-A394-F04540F58CE1}
Words: 10
Subject: PDFFlex
Author: PDFFlex.io
LastModifiedBy: -
Software: PDFFlex
Template: ;1033,1046,3082,1055
Comments: PDFFlex 4.102.1215.0
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:05:27 08:55:29
ModifyDate: 2024:05:27 08:55:29
LastPrinted: 2024:05:27 08:55:29
Pages: 450
Characters: 63
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
47
Monitored processes
10
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs powershell.exe no specs wmpnscfg.exe no specs vssvc.exe no specs msiexec.exe powershell.exe powershell.exe pdfflex.exe

Process information

PID
CMD
Path
Indicators
Parent process
524C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
568C:\Windows\system32\MsiExec.exe -Embedding A0439A76B624E9A6334D8CDC56271BD9C:\Windows\System32\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
928C:\Windows\system32\MsiExec.exe -Embedding E171F8D71829F3BAD40E8886B65CA45E CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
948"C:\Users\admin\AppData\Local\PDFFlex\PDFFlex.exe" /registerC:\Users\admin\AppData\Local\PDFFlex\PDFFlex.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Version:
4.102.1215.0
Modules
Images
c:\users\admin\appdata\local\pdfflex\pdfflex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\users\admin\appdata\local\pdfflex\webview2loader.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
2080 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss77D5.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msi77C2.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scr77C3.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scr77C4.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2116 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss3A6E.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msi3A5B.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scr3A5C.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scr3A5D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2312"C:\Program Files\Windows Media Player\wmpnscfg.exe"C:\Program Files\Windows Media Player\wmpnscfg.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Media Player Network Sharing Service Configuration Application
Exit code:
0
Version:
12.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\program files\windows media player\wmpnscfg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2680 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\PDFFlex\pssC56E.ps1" -propFile "C:\Users\admin\AppData\Local\PDFFlex\msiC55B.txt" -scriptFile "C:\Users\admin\AppData\Local\PDFFlex\scrC55C.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\PDFFlex\scrC55D.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
3980"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\Downloads\PDFFlex-v4.102.1215.0.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4068C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
32 278
Read events
31 926
Write events
331
Delete events
21

Modification events

(PID) Process:(3980) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(4068) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
40000000000000009C10C3FC65B5DA01E40F0000D8020000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4068) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
40000000000000009C10C3FC65B5DA01E40F0000D8020000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4068) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(4068) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000626A7FFD65B5DA01E40F0000D8020000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(4068) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000BCCC81FD65B5DA01E40F000034060000E8030000010000000000000000000000E19C917DA4ECDC4B93404D9EC7E874D00000000000000000
(PID) Process:(524) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000007EB88DFD65B5DA010C02000090050000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(524) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000007EB88DFD65B5DA010C02000024040000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(524) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000007EB88DFD65B5DA010C02000020040000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(524) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000007EB88DFD65B5DA010C02000010080000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
21
Suspicious files
49
Text files
19
Unknown types
0

Dropped files

PID
Process
Filename
Type
928msiexec.exeC:\Users\admin\AppData\Local\Temp\msi3A5B.txt —
MD5:—
SHA256:—
928msiexec.exeC:\Users\admin\AppData\Local\Temp\scr3A5C.ps1 —
MD5:—
SHA256:—
928msiexec.exeC:\Users\admin\AppData\Local\Temp\scr3A5D.txt —
MD5:—
SHA256:—
928msiexec.exeC:\Users\admin\AppData\Local\Temp\pss3A6E.ps1 —
MD5:—
SHA256:—
4068msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
4068msiexec.exeC:\Windows\Installer\107486.msi —
MD5:—
SHA256:—
568msiexec.exeC:\Users\admin\AppData\Local\Temp\msi77C2.txt —
MD5:—
SHA256:—
568msiexec.exeC:\Users\admin\AppData\Local\Temp\scr77C3.ps1 —
MD5:—
SHA256:—
568msiexec.exeC:\Users\admin\AppData\Local\Temp\scr77C4.txt —
MD5:—
SHA256:—
568msiexec.exeC:\Users\admin\AppData\Local\Temp\pss77D5.ps1 —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
14
DNS requests
7
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3980
msiexec.exe
GET
200
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?039ad9600c38d009
US
compressed
70.2 Kb
unknown
2080
powershell.exe
POST
200
18.66.107.68:80
http://d1jorhhovk7rc8.cloudfront.net/
US
binary
19 b
unknown
568
msiexec.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?1b4a1f070e4083d1
US
—
—
unknown
568
msiexec.exe
GET
200
108.138.2.195:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
US
binary
2.02 Kb
unknown
568
msiexec.exe
GET
200
18.245.39.64:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
US
binary
1.49 Kb
unknown
568
msiexec.exe
GET
200
18.245.39.64:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
US
binary
1.37 Kb
unknown
2680
powershell.exe
POST
200
18.66.107.68:80
http://d1jorhhovk7rc8.cloudfront.net/
US
binary
19 b
unknown
1088
svchost.exe
GET
304
199.232.214.172:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?9fb5557a30a98ae7
US
—
—
unknown
3980
msiexec.exe
GET
200
104.18.21.226:80
http://secure.globalsign.com/cacert/codesigningrootr45.crt
unknown
binary
1.37 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
224.0.0.252:5355
—
—
—
unknown
3980
msiexec.exe
104.18.21.226:80
secure.globalsign.com
CLOUDFLARENET
—
shared
3980
msiexec.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2080
powershell.exe
18.66.107.68:80
d1jorhhovk7rc8.cloudfront.net
AMAZON-02
US
unknown
568
msiexec.exe
18.66.92.89:443
dn0diw4x4ljz4.cloudfront.net
—
US
unknown
568
msiexec.exe
199.232.214.172:80
ctldl.windowsupdate.com
FASTLY
US
unknown
568
msiexec.exe
108.138.2.195:80
o.ss2.us
AMAZON-02
US
unknown

DNS requests

Domain
IP
Reputation
secure.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ctldl.windowsupdate.com
  • 199.232.214.172
  • 199.232.210.172
whitelisted
d1jorhhovk7rc8.cloudfront.net
  • 18.66.107.68
  • 18.66.107.107
  • 18.66.107.187
  • 18.66.107.193
unknown
dn0diw4x4ljz4.cloudfront.net
  • 18.66.92.89
  • 18.66.92.169
  • 18.66.92.74
  • 18.66.92.91
unknown
o.ss2.us
  • 108.138.2.195
  • 108.138.2.107
  • 108.138.2.10
  • 108.138.2.173
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.245.39.64
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.245.39.64
shared

Threats

No threats detected
Process
Message
PDFFlex.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PDFFlex-v4.102.1215.0.msi