File name:

pdftools.exe

Full analysis: https://app.any.run/tasks/d2ab0530-111b-413a-83c5-dc2dfa011de2
Verdict: Malicious activity
Analysis date: June 23, 2024, 17:25:40
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Code page: 1252, Title: Installation Database, Subject: PDFTool, Author: PDFTool, Keywords: Installer, MSI, Database, Comments: A base dados do instalador contm a lgica e os dados necessrios para instalar o PDFTool., Create Time/Date: Wed Jun 5 01:47:22 2024, Name of Creating Application: PDFTool, Security: 0, Template: ;1033, Last Saved By: ;1046, Revision Number: {C4DC16C3-086F-42C0-8A97-FB551E944BA2}3.1.1226.0;{C4DC16C3-086F-42C0-8A97-FB551E944BA2}3.1.1226.0;{759E1C35-24B9-49EA-8CEB-CD132296703E}, Number of Pages: 450, Number of Characters: 63
MD5:

1CF39F857CF330724A561EE034719CEB

SHA1:

70F80CE7B1C8C7B5018616B94EE39622C09A4431

SHA256:

3309757BE3807094DF770EAE6E6CF207A4C109208BE993A4F47EC971E68086EB

SSDEEP:

98304:T9ISoHSpk1N/2W4x0xaAW9BvOqPgBGs8fc+3JrOrSLDun89jdbAiLzXOpkAnvMzM:/

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • msiexec.exe (PID: 3368)
      • msiexec.exe (PID: 3308)
      • msiexec.exe (PID: 2652)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 2652)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 2496)
      • powershell.exe (PID: 4020)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 3308)

  • SUSPICIOUS

    • Reads the Internet Settings

      • msiexec.exe (PID: 3368)
      • powershell.exe (PID: 2496)
      • msiexec.exe (PID: 3204)
      • powershell.exe (PID: 4020)
      • msiexec.exe (PID: 2652)

    • Executes as Windows Service

      • VSSVC.exe (PID: 2348)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 3308)
      • msiexec.exe (PID: 2652)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 3308)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 2652)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 2652)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 2652)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 2652)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 2652)
      • msiexec.exe (PID: 3204)

    • Node.exe was dropped

      • msiexec.exe (PID: 2652)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 3308)

  • INFO

    • Reads the software policy settings

      • msiexec.exe (PID: 3368)
      • msiexec.exe (PID: 3308)
      • msiexec.exe (PID: 2652)

    • Create files in a temporary directory

      • msiexec.exe (PID: 3368)
      • msiexec.exe (PID: 2652)
      • powershell.exe (PID: 2496)
      • msiexec.exe (PID: 3308)
      • powershell.exe (PID: 4020)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 3308)
      • msiexec.exe (PID: 3204)
      • msiexec.exe (PID: 2652)
      • PDFTool.exe (PID: 1168)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 3368)
      • msiexec.exe (PID: 3308)
      • msiexec.exe (PID: 2652)

    • Checks supported languages

      • msiexec.exe (PID: 3308)
      • msiexec.exe (PID: 3204)
      • msiexec.exe (PID: 2652)
      • PDFTool.exe (PID: 1168)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3368)
      • powershell.exe (PID: 2496)
      • powershell.exe (PID: 4020)

    • Application launched itself

      • msiexec.exe (PID: 3308)

    • Reads the computer name

      • msiexec.exe (PID: 3308)
      • msiexec.exe (PID: 3204)
      • msiexec.exe (PID: 2652)
      • PDFTool.exe (PID: 1168)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 3368)
      • msiexec.exe (PID: 3308)
      • msiexec.exe (PID: 2652)

    • Reads Environment values

      • msiexec.exe (PID: 2652)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 2496)
      • powershell.exe (PID: 4020)

    • Disables trace logs

      • powershell.exe (PID: 2496)
      • powershell.exe (PID: 4020)

    • Checks proxy server information

      • msiexec.exe (PID: 2652)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 3308)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (81.9)
.mst | Windows SDK Setup Transform Script (9.2)
.msp | Windows Installer Patch (7.6)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {64F635BD-5FE0-42C3-B402-98D246F01E01}
Words: 10
Subject: PDFTool
Author: PDFTool
LastModifiedBy: -
Software: PDFTool
Template: ;1033,1046,3082,1055
Comments: PDFTool 3.1.1226.0
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2024:06:05 01:47:43
ModifyDate: 2024:06:05 01:47:43
LastPrinted: 2024:06:05 01:47:43
Pages: 450
Characters: 63
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
51
Monitored processes
8
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs msiexec.exe powershell.exe powershell.exe pdftool.exe

Process information

PID
CMD
Path
Indicators
Parent process
1168"C:\Users\admin\AppData\Local\PDFTool\PDFTool.exe" /registerC:\Users\admin\AppData\Local\PDFTool\PDFTool.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WebView2App
Version:
3.1.1226.0
Modules
Images
c:\users\admin\appdata\local\pdftool\pdftool.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2348C:\Windows\system32\vssvc.exeC:\Windows\System32\VSSVC.exe—services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Microsoft® Volume Shadow Copy Service
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\vssvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
2496 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pss3F07.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msi3EC6.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scr3EC7.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scr3EC8.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
2652C:\Windows\system32\MsiExec.exe -Embedding 8152374E91C7C16E3C630746817DDC8EC:\Windows\System32\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3204C:\Windows\system32\MsiExec.exe -Embedding 52A3E9A8F1DB32FCD02015DCB2D088D9 CC:\Windows\System32\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3308C:\Windows\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
3368"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\pdftools.exe.msiC:\Windows\System32\msiexec.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
4020 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\PDFTool\pss8F11.ps1" -propFile "C:\Users\admin\AppData\Local\PDFTool\msi8EFF.txt" -scriptFile "C:\Users\admin\AppData\Local\PDFTool\scr8F00.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\PDFTool\scr8F01.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.14409.1005 (rs1_srvoob.161208-1155)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
Total events
30 683
Read events
30 330
Write events
335
Delete events
18

Modification events

(PID) Process:(3368) msiexec.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3308) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SystemRestore
Operation:writeName:SrCreateRp (Enter)
Value:
4000000000000000B629876992C5DA01EC0C0000480C0000D5070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3308) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppCreate (Enter)
Value:
4000000000000000108C896992C5DA01EC0C0000480C0000D0070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3308) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SPP
Operation:writeName:LastIndex
Value:
75
(PID) Process:(3308) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\SPP
Operation:writeName:SppGatherWriterMetadata (Enter)
Value:
4000000000000000E40C4D6A92C5DA01EC0C0000480C0000D3070000000000000000000000000000000000000000000000000000000000000000000000000000
(PID) Process:(3308) msiexec.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\VssapiPublisher
Operation:writeName:IDENTIFY (Enter)
Value:
40000000000000003E6F4F6A92C5DA01EC0C0000140A0000E8030000010000000000000000000000BCCC41A81ABF6E4680DA545A479518550000000000000000
(PID) Process:(2348) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Shadow Copy Optimization Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000B41F606A92C5DA012C0900007C090000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2348) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\ASR Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000B41F606A92C5DA012C0900007C0B0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2348) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\Registry Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000B41F606A92C5DA012C090000E0050000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
(PID) Process:(2348) VSSVC.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\VSS\Diag\COM+ REGDB Writer
Operation:writeName:IDENTIFY (Enter)
Value:
4000000000000000B41F606A92C5DA012C090000700E0000E8030000010000000100000000000000000000000000000000000000000000000000000000000000
Executable files
26
Suspicious files
40
Text files
21
Unknown types
1

Dropped files

PID
Process
Filename
Type
3308msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
3308msiexec.exeC:\Windows\Installer\53b3b.msi —
MD5:—
SHA256:—
2652msiexec.exeC:\Users\admin\AppData\Local\Temp\msi3EC6.txt —
MD5:—
SHA256:—
2652msiexec.exeC:\Users\admin\AppData\Local\Temp\scr3EC7.ps1 —
MD5:—
SHA256:—
2652msiexec.exeC:\Users\admin\AppData\Local\Temp\scr3EC8.txt —
MD5:—
SHA256:—
2652msiexec.exeC:\Users\admin\AppData\Local\Temp\pss3F07.ps1 —
MD5:—
SHA256:—
3368msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C5C8CC0A7FE31816B4641D0465402560der
MD5:E94FB54871208C00DF70F708AC47085B
SHA256:7B9D553E1C92CB6E8803E137F4F287D4363757F5D44B37D52F9FCA22FB97DF86
3368msiexec.exeC:\Users\admin\AppData\Local\Temp\CabEA6C.tmpcompressed
MD5:49AEBF8CBD62D92AC215B2923FB1B9F5
SHA256:B33EFCB95235B98B48508E019AFA4B7655E80CF071DEFABD8B2123FC8B29307F
3368msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C5C8CC0A7FE31816B4641D0465402560binary
MD5:9599C84EBA998EC0BD8821A1E6026E4A
SHA256:74C1CC9770B3A0BA1282E623FBB30874C753B2A9CE86E3323F64589E45972A8F
3368msiexec.exeC:\Users\admin\AppData\Local\Temp\MSIEEA6.tmpexecutable
MD5:D0C9613582605F3793FDAD7279DE428B
SHA256:8BD84F1156EBDFA44AFAAC8A4579BA56A8C7513E3D51E00822167EA144923726
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
18
DNS requests
11
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3368
msiexec.exe
GET
200
104.18.20.226:80
http://secure.globalsign.com/cacert/codesigningrootr45.crt
unknown
—
—
unknown
3368
msiexec.exe
GET
200
95.101.63.90:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?1dde39db66ab0126
unknown
—
—
unknown
1372
svchost.exe
GET
304
95.101.63.90:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?33775f6043c93e33
unknown
—
—
unknown
1372
svchost.exe
GET
200
2.18.173.151:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
unknown
1372
svchost.exe
GET
200
72.247.176.73:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
unknown
2496
powershell.exe
POST
200
18.173.206.117:80
http://d25xn4y1w1xf3s.cloudfront.net/
unknown
—
—
unknown
2652
msiexec.exe
GET
200
108.138.2.195:80
http://o.ss2.us//MEowSDBGMEQwQjAJBgUrDgMCGgUABBSLwZ6EW5gdYc9UaSEaaLjjETNtkAQUv1%2B30c7dH4b0W1Ws3NcQwg6piOcCCQCnDkpMNIK3fw%3D%3D
unknown
—
—
unknown
2652
msiexec.exe
GET
200
18.66.142.79:80
http://ocsp.rootg2.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D
unknown
—
—
unknown
2652
msiexec.exe
GET
200
18.66.142.79:80
http://ocsp.rootca1.amazontrust.com/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEjgLnWaIozse2b%2BczaaODg8%3D
unknown
—
—
unknown
1060
svchost.exe
GET
304
95.101.63.90:80
http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?e1c7fb6f69bbdcfa
unknown
—
—
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1372
svchost.exe
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1060
svchost.exe
224.0.0.252:5355
—
—
—
unknown
3368
msiexec.exe
104.18.20.226:80
secure.globalsign.com
CLOUDFLARENET
—
shared
3368
msiexec.exe
95.101.63.90:80
ctldl.windowsupdate.com
Akamai International B.V.
GB
unknown
1372
svchost.exe
95.101.63.90:80
ctldl.windowsupdate.com
Akamai International B.V.
GB
unknown
1372
svchost.exe
72.247.176.73:80
crl.microsoft.com
Akamai International B.V.
GB
unknown
1372
svchost.exe
2.18.173.151:80
www.microsoft.com
AKAMAI-AS
NO
unknown
2496
powershell.exe
18.173.206.117:80
d25xn4y1w1xf3s.cloudfront.net
—
US
unknown

DNS requests

Domain
IP
Reputation
secure.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
ctldl.windowsupdate.com
  • 95.101.63.90
  • 95.101.63.96
whitelisted
settings-win.data.microsoft.com
  • 51.104.136.2
whitelisted
crl.microsoft.com
  • 72.247.176.73
  • 95.101.63.66
whitelisted
www.microsoft.com
  • 2.18.173.151
whitelisted
d25xn4y1w1xf3s.cloudfront.net
  • 18.173.206.117
  • 18.173.206.200
  • 18.173.206.161
  • 18.173.206.212
unknown
dn0diw4x4ljz4.cloudfront.net
  • 18.66.92.91
  • 18.66.92.74
  • 18.66.92.89
  • 18.66.92.169
unknown
o.ss2.us
  • 108.138.2.195
  • 108.138.2.173
  • 108.138.2.10
  • 108.138.2.107
whitelisted
ocsp.rootg2.amazontrust.com
  • 18.66.142.79
whitelisted
ocsp.rootca1.amazontrust.com
  • 18.66.142.79
shared

Threats

No threats detected
Process
Message
PDFTool.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
PDFTool.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pdftools.exe