File name:

PDFast.exe

Full analysis: https://app.any.run/tasks/ca781e98-0e07-43ff-8886-9cb15e83f090
Verdict: Malicious activity
Analysis date: April 29, 2025, 13:54:19
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

4B37AF94182C7FB0F196D2A01BC96CBA

SHA1:

667B91D2CCEB9D2D96F40B2A6D66AD0A8D4AA2B7

SHA256:

88F472E68FC40D523B498BA14997FB9006569DF5E843F00CDF1DE2AC5966A010

SSDEEP:

98304:XL0druM/vIX0pafjCHE6B5fMxNRlOqAhcNAjcXILaNyKuvRofk1y2seY6mG+Eb2u:U7LBG/LvtU8E

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • PDFast.exe (PID: 2140)

    • ADVANCEDINSTALLER mutex has been found

      • PDFast.exe (PID: 2140)

    • Reads the Windows owner or organization settings

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 5680)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 7308)
      • PDFast.exe (PID: 2140)
      • rundll32.exe (PID: 7536)
      • rundll32.exe (PID: 7632)
      • rundll32.exe (PID: 7736)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 5680)
      • PDFast.exe (PID: 2140)

    • Process drops legitimate windows executable

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 5680)

    • There is functionality for taking screenshot (YARA)

      • PDFast.exe (PID: 2140)

    • Detects AdvancedInstaller (YARA)

      • PDFast.exe (PID: 2140)

  • INFO

    • Reads the computer name

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 5680)
      • msiexec.exe (PID: 5116)
      • msiexec.exe (PID: 7224)
      • identity_helper.exe (PID: 7600)

    • The sample compiled with english language support

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 5680)

    • Checks supported languages

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 5680)
      • msiexec.exe (PID: 5116)
      • msiexec.exe (PID: 7224)

    • Creates files or folders in the user directory

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 5680)

    • Reads the machine GUID from the registry

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 5680)

    • Reads Environment values

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 5116)
      • msiexec.exe (PID: 7224)
      • identity_helper.exe (PID: 7600)

    • Reads the software policy settings

      • PDFast.exe (PID: 2140)
      • msiexec.exe (PID: 1660)
      • msiexec.exe (PID: 5680)
      • rundll32.exe (PID: 7308)
      • rundll32.exe (PID: 7736)

    • Create files in a temporary directory

      • PDFast.exe (PID: 2140)
      • rundll32.exe (PID: 7308)
      • rundll32.exe (PID: 7536)
      • rundll32.exe (PID: 7736)
      • rundll32.exe (PID: 7632)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1660)
      • rundll32.exe (PID: 7632)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5680)

    • Disables trace logs

      • rundll32.exe (PID: 7308)

    • Checks proxy server information

      • rundll32.exe (PID: 7308)

    • Application launched itself

      • msedge.exe (PID: 7700)
      • msedge.exe (PID: 7936)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:08 12:49:22+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 2534912
InitializedDataSize: 964608
UninitializedDataSize: -
EntryPoint: 0x1e0862
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: PDFast
FileDescription: PDFast Installer
FileVersion: 1.0.0
InternalName: PDFast
LegalCopyright: Copyright (C) 2025 PDFast
OriginalFileName: PDFast.exe
ProductName: PDFast
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
189
Monitored processes
59
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pdfast.exe msiexec.exe sppextcomobj.exe no specs slui.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe msedge.exe rundll32.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
736"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5244 --field-trial-handle=2436,i,17417117668770533658,5774381870973472329,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
856"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5704 --field-trial-handle=2436,i,17417117668770533658,5774381870973472329,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1228"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5076 --field-trial-handle=2344,i,4234693529906483568,9743062257223942516,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1324"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3532 --field-trial-handle=2436,i,17417117668770533658,5774381870973472329,262144 --variations-seed-version /prefetch:1C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1328"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2336 --field-trial-handle=2344,i,4234693529906483568,9743062257223942516,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1568"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5452 --field-trial-handle=2436,i,17417117668770533658,5774381870973472329,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1660"C:\WINDOWS\system32\msiexec.exe" /i "C:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.0\install\CA604DA\PDFast.msi" AI_SETUPEXEPATH=C:\Users\admin\AppData\Local\Temp\PDFast.exe SETUPEXEDIR=C:\Users\admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1745933773 " AI_EUIMSI=""C:\Windows\SysWOW64\msiexec.exe—PDFast.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2040"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --no-appcompat-clear --mojo-platform-channel-handle=5544 --field-trial-handle=2436,i,17417117668770533658,5774381870973472329,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2140"C:\Users\admin\AppData\Local\Temp\PDFast.exe" C:\Users\admin\AppData\Local\Temp\PDFast.exe
explorer.exe
User:
admin
Company:
PDFast
Integrity Level:
MEDIUM
Description:
PDFast Installer
Exit code:
0
Version:
1.0.0
Modules
Images
c:\users\admin\appdata\local\temp\pdfast.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2196C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s DnscacheC:\Windows\System32\svchost.exe
services.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\kernel.appcore.dll
Total events
25 581
Read events
25 398
Write events
171
Delete events
12

Modification events

(PID) Process:(5680) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
301600001AA27D3B0EB9DB01
(PID) Process:(5680) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
30AAF36816A5095098E97F5BF66ADED4A441531F402D8751BA312EBC676ACC9F
(PID) Process:(5680) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5680) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\C838C4529A8903C499B4533DE8B85105
Operation:writeName:2869F0CE147ABAD43AAB440DC66A40AD
Value:
C:\Users\admin\AppData\Roaming\PDFast\
(PID) Process:(5680) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\015A73038BCCE9A4D9CB5DB9BB9D3A25
Operation:writeName:2869F0CE147ABAD43AAB440DC66A40AD
Value:
C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe
(PID) Process:(5680) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\6F7C244855AA08A448CDAA0F9BE83E00
Operation:writeName:2869F0CE147ABAD43AAB440DC66A40AD
Value:
21:\Software\Microsoft\Windows\CurrentVersion\Uninstall\PDFast 1.0.0\DisplayName
(PID) Process:(5680) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\CB2CF82A73501EB48982555B20352FBE
Operation:writeName:2869F0CE147ABAD43AAB440DC66A40AD
Value:
C:\Users\admin\AppData\Roaming\PDFast\upd.exe
(PID) Process:(5680) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\1F71B56C260FA0044A47ADA58AA028D2
Operation:writeName:2869F0CE147ABAD43AAB440DC66A40AD
Value:
01:\Software\Microsoft\Windows\CurrentVersion\Uninstall\PDFast 1.0.0\NoModify
(PID) Process:(5680) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\FB5BAD0881B0D654BB0972B991982266
Operation:writeName:2869F0CE147ABAD43AAB440DC66A40AD
Value:
C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe.config
(PID) Process:(5680) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\88F1AE2693BC2454CA950689F5DB6F6E
Operation:writeName:2869F0CE147ABAD43AAB440DC66A40AD
Value:
C:\Users\admin\AppData\Roaming\PDFast\Core.dll
Executable files
71
Suspicious files
283
Text files
73
Unknown types
1

Dropped files

PID
Process
Filename
Type
2140PDFast.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:427895E4B73153279339C87278F94A62
SHA256:59D31E591623B4B5F4BB6D2B4DC2FC8BFD300D193796A99696998C97D5300595
2140PDFast.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_4A9E0CB487DCAD37DE0BF8934D0E9988binary
MD5:980EB63A76A22FEB63F375F1E717BFB4
SHA256:3444F1EFAFE84F005A127CCE1E6797DFCCD63604A136428099B8609056552E1A
2140PDFast.exeC:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.0\install\CA604DA\PDFast.msiexecutable
MD5:B2B9E8F52F0D74109FFB3443B633DBF2
SHA256:053B80BD6A6B47FD74AF194B731A2F8D30284981AB5A8E25A3CA839AB2804AFD
7308rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA4CDC977CFE44BCFA8CAD14283FA1280A\RequestSender.dllexecutable
MD5:2BECD9A34C47E04A7F4780ECAB9CC9E8
SHA256:69D1B22734FD95A761CA79AA8C1B9392CD8EE1331E23BC3E6F64A2243F2575C9
2140PDFast.exeC:\Users\admin\AppData\Local\Temp\MSID016.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
2140PDFast.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:83542442EA4E868BD27AC5A62C337F0E
SHA256:2956E193BFE4E4903EAE9F65FBC8FD7F1E3B39EDBFB77D7F48E62F5803F2A4D4
5680msiexec.exeC:\Windows\Installer\10d236.msiexecutable
MD5:B2B9E8F52F0D74109FFB3443B633DBF2
SHA256:053B80BD6A6B47FD74AF194B731A2F8D30284981AB5A8E25A3CA839AB2804AFD
2140PDFast.exeC:\Users\admin\AppData\Local\Temp\MSID006.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
2140PDFast.exeC:\Users\admin\AppData\Local\Temp\shiCF0A.tmpexecutable
MD5:84A34BF3486F7B9B7035DB78D78BDD1E
SHA256:F85911C910B660E528D2CF291BAA40A92D09961996D6D84E7A53A7095C7CD96E
2140PDFast.exeC:\Users\admin\AppData\Local\Temp\MSICF49.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
63
DNS requests
65
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.19.11.105:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
2140
PDFast.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDDbMOaoiAw9%2FpxWS%2BA%3D%3D
unknown
—
—
whitelisted
2140
PDFast.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
856
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
856
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.19.11.105:80
crl.microsoft.com
Elisa Oyj
NL
whitelisted
5496
MoUsoCoreWorker.exe
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
2140
PDFast.exe
104.18.20.226:80
ocsp.globalsign.com
CLOUDFLARENET
—
whitelisted
3216
svchost.exe
172.211.123.248:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.31.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
7308
rundll32.exe
169.150.247.37:443
b.pdf-fast.com
—
GB
malicious

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.174
whitelisted
settings-win.data.microsoft.com
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 2.19.11.105
  • 2.19.11.120
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 95.101.149.131
whitelisted
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
client.wns.windows.com
  • 172.211.123.248
whitelisted
login.live.com
  • 40.126.31.130
  • 20.190.159.2
  • 20.190.159.73
  • 40.126.31.131
  • 40.126.31.67
  • 20.190.159.4
  • 20.190.159.128
  • 40.126.31.3
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
b.pdf-fast.com
  • 169.150.247.37
malicious
config.edge.skype.com
  • 13.107.43.16
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
PDFast.exe