File name:

pdf_fastt.exe

Full analysis: https://app.any.run/tasks/2cffad47-863a-443f-a4c0-7002bbc9d8e3
Verdict: Malicious activity
Analysis date: March 24, 2025, 10:15:37
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

D07C0D93E1877BFD22277F8DC5F52243

SHA1:

8A2FBA3E22DF81A024422F9461A156861922BE34

SHA256:

90D6AAE544561330DE2DD96213F1DDB616DD4BF3FEC1B644B59B9FDD3F4C8B48

SSDEEP:

98304:yL0druM/vIX0pafjCHE6B5fMxNRlOqAhcNAjcXILa9m2TTxw+0hoeiVBu//Za4K1:n7YRfkoxONeIK

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • pdf_fastt.exe (PID: 300)
      • rundll32.exe (PID: 7452)
      • rundll32.exe (PID: 7208)
      • rundll32.exe (PID: 7540)
      • rundll32.exe (PID: 7700)

    • Reads security settings of Internet Explorer

      • pdf_fastt.exe (PID: 300)

    • ADVANCEDINSTALLER mutex has been found

      • pdf_fastt.exe (PID: 300)

    • Reads the Windows owner or organization settings

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)

    • Drops 7-zip archiver for unpacking

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)

    • Process drops legitimate windows executable

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)

    • The process drops C-runtime libraries

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)

    • Detects AdvancedInstaller (YARA)

      • pdf_fastt.exe (PID: 300)

    • There is functionality for taking screenshot (YARA)

      • pdf_fastt.exe (PID: 300)

  • INFO

    • Checks supported languages

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)
      • msiexec.exe (PID: 6156)
      • msiexec.exe (PID: 5548)
      • identity_helper.exe (PID: 7716)

    • The sample compiled with english language support

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)
      • msedge.exe (PID: 7232)

    • Creates files or folders in the user directory

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)

    • Reads Environment values

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 6156)
      • msiexec.exe (PID: 5548)
      • identity_helper.exe (PID: 7716)

    • Reads the computer name

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)
      • msiexec.exe (PID: 6156)
      • identity_helper.exe (PID: 7716)
      • msiexec.exe (PID: 5548)

    • Reads the machine GUID from the registry

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 5408)

    • Reads the software policy settings

      • pdf_fastt.exe (PID: 300)
      • msiexec.exe (PID: 1180)
      • msiexec.exe (PID: 5408)
      • rundll32.exe (PID: 7208)
      • rundll32.exe (PID: 7700)
      • slui.exe (PID: 4608)

    • Checks proxy server information

      • pdf_fastt.exe (PID: 300)
      • rundll32.exe (PID: 7208)
      • rundll32.exe (PID: 7700)
      • slui.exe (PID: 4608)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 1180)
      • rundll32.exe (PID: 7540)

    • Create files in a temporary directory

      • pdf_fastt.exe (PID: 300)
      • rundll32.exe (PID: 7452)
      • rundll32.exe (PID: 7208)
      • rundll32.exe (PID: 7700)
      • rundll32.exe (PID: 7540)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5408)
      • msedge.exe (PID: 7232)

    • Disables trace logs

      • rundll32.exe (PID: 7208)
      • rundll32.exe (PID: 7700)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5408)

    • Application launched itself

      • msedge.exe (PID: 7676)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (64.6)
.dll | Win32 Dynamic Link Library (generic) (15.4)
.exe | Win32 Executable (generic) (10.5)
.exe | Generic Win/DOS Executable (4.6)
.exe | DOS Executable Generic (4.6)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:08 12:49:22+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 2534912
InitializedDataSize: 964608
UninitializedDataSize: -
EntryPoint: 0x1e0862
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.1.0
ProductVersionNumber: 1.0.1.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: PDFast
FileDescription: PDFast Installer
FileVersion: 1.0.1
InternalName: PDFast
LegalCopyright: Copyright (C) 2025 PDFast
OriginalFileName: PDFast.exe
ProductName: PDFast
ProductVersion: 1.0.1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
214
Monitored processes
70
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pdf_fastt.exe msiexec.exe sppextcomobj.exe no specs slui.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe msedge.exe rundll32.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs ucpdmgr.exe no specs conhost.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4220 --field-trial-handle=2396,i,9255281652968339364,6175480107251033208,262144 --variations-seed-version /prefetch:2C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
208\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
300"C:\Users\admin\AppData\Local\Temp\pdf_fastt.exe" C:\Users\admin\AppData\Local\Temp\pdf_fastt.exe
explorer.exe
User:
admin
Company:
PDFast
Integrity Level:
MEDIUM
Description:
PDFast Installer
Exit code:
0
Version:
1.0.1
Modules
Images
c:\users\admin\appdata\local\temp\pdf_fastt.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
496"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4360 --field-trial-handle=2396,i,9255281652968339364,6175480107251033208,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
616"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7440 --field-trial-handle=2396,i,9255281652968339364,6175480107251033208,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
672"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6524 --field-trial-handle=2396,i,9255281652968339364,6175480107251033208,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
720"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6072 --field-trial-handle=2396,i,9255281652968339364,6175480107251033208,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
920"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=6556 --field-trial-handle=2396,i,9255281652968339364,6175480107251033208,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
1180"C:\WINDOWS\system32\msiexec.exe" /i "C:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.1\install\7F1CFC9\PDFast.msi" AI_SETUPEXEPATH=C:\Users\admin\AppData\Local\Temp\pdf_fastt.exe SETUPEXEDIR=C:\Users\admin\AppData\Local\Temp\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1742810248 " AI_EUIMSI=""C:\Windows\SysWOW64\msiexec.exe—pdf_fastt.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
24 413
Read events
24 237
Write events
164
Delete events
12

Modification events

(PID) Process:(5408) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
20150000D3885AB5A59CDB01
(PID) Process:(5408) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
D36C6B51E308D51C6FD3B2D521B88542B208B8F17F1287C5FFCE7C1E46D57B89
(PID) Process:(5408) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5408) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(5408) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10d390.rbs
Value:
31169701
(PID) Process:(5408) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10d390.rbsLow
Value:
(PID) Process:(5408) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\
Value:
(PID) Process:(5408) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\C838C4529A8903C499B4533DE8B85105
Operation:writeName:1F2A784A2D2F9E946A3AB293701FFC9C
Value:
C:\Users\admin\AppData\Roaming\PDFast\
(PID) Process:(5408) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\015A73038BCCE9A4D9CB5DB9BB9D3A25
Operation:writeName:1F2A784A2D2F9E946A3AB293701FFC9C
Value:
C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe
(PID) Process:(5408) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\ACF51106BDB59F8438FDCF0F07F3C94A
Operation:writeName:1F2A784A2D2F9E946A3AB293701FFC9C
Value:
21:\Software\Microsoft\Windows\CurrentVersion\Uninstall\PDFast 1.0.1\DisplayName
Executable files
70
Suspicious files
421
Text files
93
Unknown types
6

Dropped files

PID
Process
Filename
Type
300pdf_fastt.exeC:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.1\install\holder0.aiph —
MD5:—
SHA256:—
300pdf_fastt.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:9C87873F82F5338F9BF45E0D51C120CF
SHA256:71C5B103AAD40A384CE08915EC16407341956CF4F6D735FA884A8A4FBB4B19DE
300pdf_fastt.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_4A9E0CB487DCAD37DE0BF8934D0E9988binary
MD5:DCB33EB85CD01F813F2AF5363EDB231C
SHA256:C4EC435B6F07C56F76E546DE19D82CB7B799C0FEC1BA3B673A2682C6CD9B5598
300pdf_fastt.exeC:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.1\install\7F1CFC9\PDFast.msiexecutable
MD5:599A43B025F7B2361552B93CFD0CA50B
SHA256:D2AB2386C36B1931A26C9DD925DCD10499807FDEEEF2BCA69DC63F0D6419E257
300pdf_fastt.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:A01AA2A1DC785CB688108D57D64CD1A1
SHA256:1A0A99320828B04BFE18113174DC5EF4DF1BD213E38D1451EED9E51F1E235384
300pdf_fastt.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_4A9E0CB487DCAD37DE0BF8934D0E9988binary
MD5:A519D899CE1A382903E9E58B5F13AC09
SHA256:76E77D3423619396A16944F28977E71D82E2D00CD326EE551F977F302E66F4A6
300pdf_fastt.exeC:\Users\admin\AppData\Local\Temp\shiCDB2.tmpexecutable
MD5:84A34BF3486F7B9B7035DB78D78BDD1E
SHA256:F85911C910B660E528D2CF291BAA40A92D09961996D6D84E7A53A7095C7CD96E
5408msiexec.exeC:\Windows\Installer\10d38e.msiexecutable
MD5:599A43B025F7B2361552B93CFD0CA50B
SHA256:D2AB2386C36B1931A26C9DD925DCD10499807FDEEEF2BCA69DC63F0D6419E257
300pdf_fastt.exeC:\Users\admin\AppData\Local\Temp\MSICE4F.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
5408msiexec.exeC:\Windows\Installer\MSID5B1.tmpexecutable
MD5:FF28F8D0B16C52D475C6E06BD2FA24FA
SHA256:076ABA76E5FE015AFF3C42B3ADC0623B2DD1ABCB0E35B2F13CF2848F1A7A1CE8
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
54
TCP/UDP connections
106
DNS requests
97
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
300
pdf_fastt.exe
GET
200
151.101.194.133:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1628
backgroundTaskHost.exe
GET
200
184.30.131.245:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
300
pdf_fastt.exe
GET
200
151.101.194.133:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDDbMOaoiAw9%2FpxWS%2BA%3D%3D
unknown
—
—
whitelisted
5392
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1742982545&P2=404&P3=2&P4=SLVLXCw896Xk8M8z4oaFYfYJn6Qfm24PW9lPO0s%2bHOgf6xK3j38fN8%2bVGf2qKKLaS%2fKGnHx%2fc5RwTBQUnpX0aw%3d%3d
unknown
—
—
whitelisted
7328
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5392
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1742982545&P2=404&P3=2&P4=SLVLXCw896Xk8M8z4oaFYfYJn6Qfm24PW9lPO0s%2bHOgf6xK3j38fN8%2bVGf2qKKLaS%2fKGnHx%2fc5RwTBQUnpX0aw%3d%3d
unknown
—
—
whitelisted
7328
SIHClient.exe
GET
200
2.19.217.218:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5392
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/68591036-2289-4858-9f7f-9149e89c8a08?P1=1742982545&P2=404&P3=2&P4=SLVLXCw896Xk8M8z4oaFYfYJn6Qfm24PW9lPO0s%2bHOgf6xK3j38fN8%2bVGf2qKKLaS%2fKGnHx%2fc5RwTBQUnpX0aw%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
300
pdf_fastt.exe
151.101.194.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
3216
svchost.exe
40.113.110.67:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
20.190.159.130:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
184.30.131.245:80
ocsp.digicert.com
AKAMAI-AS
US
whitelisted
7208
rundll32.exe
169.150.247.37:443
b.pdf-fast.com
—
GB
unknown
7700
rundll32.exe
169.150.247.37:443
b.pdf-fast.com
—
GB
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
ocsp.globalsign.com
  • 151.101.194.133
  • 151.101.2.133
  • 151.101.130.133
  • 151.101.66.133
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.130
  • 40.126.31.71
  • 40.126.31.129
  • 40.126.31.67
  • 20.190.159.64
  • 40.126.31.128
  • 20.190.159.2
  • 40.126.31.1
whitelisted
ocsp.digicert.com
  • 184.30.131.245
whitelisted
b.pdf-fast.com
  • 169.150.247.37
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
  • 150.171.28.11
  • 150.171.27.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pdf_fastt.exe