URL:

https://ak.imgfarm.com/images/nocache/vicinio/installers/v2/226333724.LMDEDE.1/nsis/1141811-LMDEDE.1/200211210412066/msniPDFConverterHQ/PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe

Full analysis: https://app.any.run/tasks/14189935-a1d4-4752-9390-980e942d565e
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: March 23, 2020, 20:38:29
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
loader
Indicators:
MD5:

E76EEB60C6DD35CFAC517E270429A20F

SHA1:

E0A24724BD26D77AF149F857DE043EFBD656E8F3

SHA256:

2FF596D5CD2EDD1F23DAEB340DA230580A0081DE14E0F399F44824A8659E9B81

SSDEEP:

3:N8VEKCA0GEaAp3LWgOXBcXaWBgL2fZx2sbV2RRO5fN119nAB+0ufTAB+0znQhnhG:2eTLpigOXBmaWWL2fbbyO5/rnC+VTC+c

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Loads dropped or rewritten executable

      • PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe (PID: 1492)
      • Rundll32.exe (PID: 3012)

    • Application was dropped or rewritten from another process

      • PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe (PID: 1492)
      • SlimCleanerPlus.exe (PID: 1692)
      • SlimCleanerPlus.exe (PID: 3724)

    • Downloads executable files from the Internet

      • SlimCleanerPlus.exe (PID: 3724)

    • Changes settings of System certificates

      • SlimCleanerPlus.exe (PID: 3724)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • iexplore.exe (PID: 576)
      • iexplore.exe (PID: 2896)
      • PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe (PID: 1492)
      • SlimCleanerPlus.exe (PID: 3724)

    • Reads Internet Cache Settings

      • PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe (PID: 1492)

    • Uses RUNDLL32.EXE to load library

      • PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe (PID: 1492)

    • Changes the started page of IE

      • PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe (PID: 1492)

    • Creates files in the user directory

      • PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe (PID: 1492)

    • Creates a software uninstall entry

      • PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe (PID: 1492)

    • Adds / modifies Windows certificates

      • SlimCleanerPlus.exe (PID: 3724)

  • INFO

    • Reads settings of System Certificates

      • iexplore.exe (PID: 576)
      • SlimCleanerPlus.exe (PID: 3724)
      • iexplore.exe (PID: 2896)
      • iexplore.exe (PID: 2600)
      • iexplore.exe (PID: 2208)

    • Reads Internet Cache Settings

      • iexplore.exe (PID: 576)
      • iexplore.exe (PID: 2896)
      • iexplore.exe (PID: 2600)
      • iexplore.exe (PID: 2208)

    • Modifies the phishing filter of IE

      • iexplore.exe (PID: 2896)

    • Changes internet zones settings

      • iexplore.exe (PID: 2896)

    • Application launched itself

      • iexplore.exe (PID: 2896)

    • Reads internet explorer settings

      • iexplore.exe (PID: 576)
      • iexplore.exe (PID: 2600)
      • iexplore.exe (PID: 2208)

    • Creates files in the user directory

      • iexplore.exe (PID: 576)
      • iexplore.exe (PID: 2600)
      • iexplore.exe (PID: 2208)

    • Changes settings of System certificates

      • iexplore.exe (PID: 2896)

    • Adds / modifies Windows certificates

      • iexplore.exe (PID: 2896)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
44
Monitored processes
8
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details

Process information

PID
CMD
Path
Indicators
Parent process
576"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2896 CREDAT:267521 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
1492"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe" C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
iexplore.exe
User:
admin
Company:
Ask Applications, Inc.
Integrity Level:
MEDIUM
Description:
PDFConverterHQ Setup
Exit code:
0
Version:
2.7.1.3000
Modules
Images
c:\users\admin\appdata\local\microsoft\windows\temporary internet files\content.ie5\b6qgx7lp\pdfconverterhq.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1692SI_MODE=toaster SI_DELAY=60 SI_LAUNCH=onreboot @P2_ORIGIN=^CAM^xdm235^LMDEDE^de @P2=^SW2^xdm110 @UL_STUBID=b86d2e9570b54cfcb6d09bcfe136b7adC:\Users\admin\AppData\Local\Temp\nsbFDB2.tmp\SlimCleanerPlus.exe—PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
User:
admin
Company:
SlimWare Utilities Holdings, Inc.
Integrity Level:
MEDIUM
Description:
DriverUpdate SlimWare Downloader
Exit code:
3221226540
Version:
2.4.2
Modules
Images
c:\users\admin\appdata\local\temp\nsbfdb2.tmp\slimcleanerplus.exe
c:\systemroot\system32\ntdll.dll
2208"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2896 CREDAT:2692359 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2600"C:\Program Files\Internet Explorer\iexplore.exe" SCODEF:2896 CREDAT:3085578 /prefetch:2C:\Program Files\Internet Explorer\iexplore.exe
iexplore.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\iertutil.dll
2896"C:\Program Files\Internet Explorer\iexplore.exe" https://ak.imgfarm.com/images/nocache/vicinio/installers/v2/226333724.LMDEDE.1/nsis/1141811-LMDEDE.1/200211210412066/msniPDFConverterHQ/PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exeC:\Program Files\Internet Explorer\iexplore.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Internet Explorer
Exit code:
0
Version:
11.00.9600.16428 (winblue_gdr.131013-1700)
Modules
Images
c:\program files\internet explorer\iexplore.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\api-ms-win-downlevel-advapi32-l1-1-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\api-ms-win-downlevel-version-l1-1-0.dll
3012"Rundll32.exe" "C:\Users\admin\AppData\Local\PDFConverterHQTooltab\TooltabExtension.dll",A -hp=https://hp.myway.com/pdfconverterhq/lmdedeie/index.html -ua="(Windows NT 6.1; Win32; MSIE 11.0; Build 7601; SP 1)" -ul=https://anx.mindspark.com/anx.gif?anxa=%251&anxe=%252&anxt=ED9A59DC-DD73-4B1C-A63F-5D1659B7FD9B&anxtv=2.7.1.3000&anxp=^CAM^xdm235^LMDEDE^de&anxsi=28768054924&anxv=%253&anxd=2020-03-23&anxr=%254 -hu=SHOWC:\Windows\system32\Rundll32.exe—PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
3724"C:\Users\admin\AppData\Local\Temp\nsbFDB2.tmp\SlimCleanerPlus.exe" SI_MODE=toaster SI_DELAY=60 SI_LAUNCH=onreboot @P2_ORIGIN=^CAM^xdm235^LMDEDE^de @P2=^SW2^xdm110 @UL_STUBID=b86d2e9570b54cfcb6d09bcfe136b7adC:\Users\admin\AppData\Local\Temp\nsbFDB2.tmp\SlimCleanerPlus.exe
PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
User:
admin
Company:
SlimWare Utilities Holdings, Inc.
Integrity Level:
HIGH
Description:
DriverUpdate SlimWare Downloader
Exit code:
0
Version:
2.4.2
Modules
Images
c:\users\admin\appdata\local\temp\nsbfdb2.tmp\slimcleanerplus.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\psapi.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
Total events
6 320
Read events
1 520
Write events
3 481
Delete events
1 319

Modification events

(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateLowDateTime
Value:
552913336
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager
Operation:writeName:NextCheckForUpdateHighDateTime
Value:
30802259
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:CompatibilityFlags
Value:
0
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
Operation:writeName:ProxyEnable
Value:
0
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
Operation:writeName:SavedLegacySettings
Value:
46000000A1000000010000000000000000000000000000000000000000000000C0E333BBEAB1D301000000000000000000000000020000001700000000000000FE800000000000007D6CB050D9C573F70B000000000000006D00330032005C004D00530049004D004700330032002E0064006C000100000004AA400014AA4000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000C0A8016400000000000000000000000000000000000000000800000000000000805D3F00983740000008000002000000000000600000002060040000B8A94000020000008802000060040000B8A9400004000000F8010000B284000088B64000B84B400043003A000000000000000000000000000000000000000000
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
0
(PID) Process:(2896) iexplore.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
1
Executable files
9
Suspicious files
52
Text files
52
Unknown types
21

Dropped files

PID
Process
Filename
Type
576iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Cab8A56.tmp —
MD5:—
SHA256:—
576iexplore.exeC:\Users\admin\AppData\Local\Temp\Low\Tar8A57.tmp —
MD5:—
SHA256:—
2896iexplore.exeC:\Users\admin\AppData\Local\Temp\~DFAAC1ABE371DBC988.TMP —
MD5:—
SHA256:—
2896iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe.qcw5v5x.partial:Zone.Identifier —
MD5:—
SHA256:—
1492PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exeC:\Users\admin\AppData\Local\Temp\Cab276.tmp —
MD5:—
SHA256:—
1492PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exeC:\Users\admin\AppData\Local\Temp\Tar277.tmp —
MD5:—
SHA256:—
576iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cder
MD5:119E24F6DA202BA33B87CE805BFD8CC5
SHA256:A36B75593C30B2FEEAB0814DE6C1416C15D225F07C4688C3E337B38D8C9409CC
576iexplore.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_9487BC0D4381A7CDEB9A8CC43F66D27Cbinary
MD5:8B649A91EB20E892666EB5E9CE85A026
SHA256:42E7D506FF45248C258E9AB95EB7EA33A9C827BF5D8BA4ADE73DC56B4B33249C
576iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad[1].exeexecutable
MD5:1534B1A36A5029E0612F4ECFBB1E653A
SHA256:87BD2CC63FC389667E4F3146A501E9C0A7B05FA2256684F00CA20D6D4938035B
576iexplore.exeC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\B6QGX7LP\PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe.qcw5v5x.partialexecutable
MD5:1534B1A36A5029E0612F4ECFBB1E653A
SHA256:87BD2CC63FC389667E4F3146A501E9C0A7B05FA2256684F00CA20D6D4938035B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
27
TCP/UDP connections
73
DNS requests
37
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
576
iexplore.exe
GET
200
72.21.91.29:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAVG%2Fhgj9%2BGUHaOfzhTEYXM%3D
US
der
471 b
whitelisted
1492
PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
GET
200
2.16.186.35:80
http://isrg.trustid.ocsp.identrust.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRv9GhNQxLSSGKBnMArPUcsHYovpgQUxKexpHsscfrb4UuQdf%2FEFWCFiRACEAoBQUIAAAFThXNqC4Xspwg%3D
unknown
der
1.37 Kb
whitelisted
1492
PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
GET
200
2.16.186.11:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMX%2Fe0p2X%2FGrZv50DSIlQkDlA%3D%3D
unknown
der
527 b
whitelisted
576
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
1492
PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
GET
200
2.16.186.11:80
http://ocsp.int-x3.letsencrypt.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBR%2B5mrncpqz%2FPiiIGRsFqEtYHEIXQQUqEpqYwR93brm0Tm3pkVl7%2FOo7KECEgMTpiZKu5ZPjufHzmOwcG0K9w%3D%3D
unknown
der
527 b
whitelisted
576
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFeh1L3VO0beCAAAAAAyCgc%3D
US
der
471 b
whitelisted
576
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
576
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
576
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D
US
der
468 b
whitelisted
576
iexplore.exe
GET
200
172.217.21.195:80
http://ocsp.pki.goog/gts1o1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEFeh1L3VO0beCAAAAAAyCgc%3D
US
der
471 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
576
iexplore.exe
35.244.218.203:443
dp.tb.ask.com
—
US
whitelisted
2600
iexplore.exe
35.244.218.203:443
dp.tb.ask.com
—
US
whitelisted
576
iexplore.exe
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
576
iexplore.exe
172.227.91.152:443
ak.imgfarm.com
Akamai Technologies, Inc.
US
whitelisted
576
iexplore.exe
72.21.91.29:80
ocsp.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
576
iexplore.exe
93.184.220.29:80
crl3.digicert.com
MCI Communications Services, Inc. d/b/a Verizon Business
US
whitelisted
1492
PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
35.244.218.203:443
dp.tb.ask.com
—
US
whitelisted
1492
PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
2.16.186.35:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
1492
PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
2.16.186.11:80
isrg.trustid.ocsp.identrust.com
Akamai International B.V.
—
whitelisted
1492
PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe
34.102.222.207:443
anx.mindspark.com
—
US
malicious

DNS requests

Domain
IP
Reputation
ak.imgfarm.com
  • 172.227.91.152
whitelisted
ocsp.digicert.com
  • 72.21.91.29
whitelisted
api.bing.com
  • 13.107.5.80
whitelisted
www.bing.com
  • 204.79.197.200
  • 13.107.21.200
whitelisted
crl3.digicert.com
  • 93.184.220.29
whitelisted
dp.tb.ask.com
  • 35.244.218.203
whitelisted
isrg.trustid.ocsp.identrust.com
  • 2.16.186.35
  • 2.16.186.11
whitelisted
ocsp.int-x3.letsencrypt.org
  • 2.16.186.11
  • 2.16.186.17
whitelisted
anx.mindspark.com
  • 34.102.222.207
whitelisted
ak.ssl.imgfarm.com
  • 104.96.145.33
whitelisted

Threats

PID
Process
Class
Message
3724
SlimCleanerPlus.exe
Generic Protocol Command Decode
SURICATA HTTP Request abnormal Content-Encoding header
3724
SlimCleanerPlus.exe
Potentially Bad Traffic
ET POLICY Executable served from Amazon S3
3724
SlimCleanerPlus.exe
Potential Corporate Privacy Violation
ET POLICY PE EXE or DLL Windows file download HTTP
4 ETPRO signatures available at the full report
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://ak.imgfarm.com/images/nocache/vicinio/installers/v2/226333724.LMDEDE.1/nsis/1141811-LMDEDE.1/200211210412066/msniPDFConverterHQ/PDFConverterHQ.b86d2e9570b54cfcb6d09bcfe136b7ad.exe