File name:

MDE_File_Sample_70f80ce7b1c8c7b5018616b94ee39622c09a4431.zip

Full analysis: https://app.any.run/tasks/949c243d-15e1-434e-98ca-188bf36480f2
Verdict: Malicious activity
Analysis date: December 10, 2024, 16:36:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-exec
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=deflate
MD5:

6E5612E3717F6AA12E3609535E4B0239

SHA1:

47CCB0B5BF3585F12F3449A8708483D1C05EF491

SHA256:

A5A9F1974B8BAD0BE058DCCD73D03CBC813E144BAE0A24D87DAD73769EB40A16

SSDEEP:

98304:NtMJ19gbpADVNA+jnf40eSDx//2zXLIGS9yQcibs0uAEFNfisKu6oY9hRq6nJw00:N1QFctn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 6812)

    • Bypass execution policy to execute commands

      • powershell.exe (PID: 3928)
      • powershell.exe (PID: 6344)

    • Changes the autorun value in the registry

      • msiexec.exe (PID: 5920)

    • Changes powershell execution policy (Bypass)

      • msiexec.exe (PID: 6168)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 6812)
      • msiexec.exe (PID: 6168)
      • msiexec.exe (PID: 6484)

    • Executes as Windows Service

      • VSSVC.exe (PID: 6800)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5920)

    • The process bypasses the loading of PowerShell profile settings

      • msiexec.exe (PID: 6168)

    • The process executes Powershell scripts

      • msiexec.exe (PID: 6168)

    • The process hide an interactive prompt from the user

      • msiexec.exe (PID: 6168)

    • Starts POWERSHELL.EXE for commands execution

      • msiexec.exe (PID: 6168)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 5920)

    • Checks Windows Trust Settings

      • msiexec.exe (PID: 6168)

    • Node.exe was dropped

      • msiexec.exe (PID: 6168)

    • Executes application which crashes

      • PDFTool.exe (PID: 4504)
      • PDFTool.exe (PID: 6088)
      • PDFTool.exe (PID: 1296)

  • INFO

    • The process uses the downloaded file

      • WinRAR.exe (PID: 6812)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 6284)
      • powershell.exe (PID: 3928)
      • powershell.exe (PID: 6344)

    • Reads Microsoft Office registry keys

      • WinRAR.exe (PID: 6812)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 6284)

    • Reads the computer name

      • msiexec.exe (PID: 5920)
      • msiexec.exe (PID: 6484)
      • PDFTool.exe (PID: 1296)
      • PDFTool.exe (PID: 6088)

    • Checks supported languages

      • msiexec.exe (PID: 5920)
      • msiexec.exe (PID: 6484)
      • msiexec.exe (PID: 6168)
      • PDFTool.exe (PID: 4504)
      • PDFTool.exe (PID: 1296)
      • PDFTool.exe (PID: 6088)

    • Checks proxy server information

      • msiexec.exe (PID: 6284)
      • msiexec.exe (PID: 6168)
      • WerFault.exe (PID: 4320)
      • WerFault.exe (PID: 2928)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 6284)
      • msiexec.exe (PID: 5920)
      • msiexec.exe (PID: 6168)
      • msiexec.exe (PID: 5256)

    • Reads the software policy settings

      • msiexec.exe (PID: 6284)
      • powershell.exe (PID: 3928)
      • msiexec.exe (PID: 6168)
      • powershell.exe (PID: 6344)
      • WerFault.exe (PID: 6352)

    • Reads Environment values

      • msiexec.exe (PID: 6484)
      • msiexec.exe (PID: 6168)
      • msiexec.exe (PID: 4952)

    • The sample compiled with english language support

      • msiexec.exe (PID: 6284)
      • msiexec.exe (PID: 5920)
      • msiexec.exe (PID: 6168)
      • msiexec.exe (PID: 5256)

    • Manages system restore points

      • SrTasks.exe (PID: 6012)

    • Disables trace logs

      • powershell.exe (PID: 3928)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 6168)
      • PDFTool.exe (PID: 4504)
      • PDFTool.exe (PID: 6088)

    • Uses string replace method (POWERSHELL)

      • powershell.exe (PID: 3928)
      • powershell.exe (PID: 6344)

    • Process checks computer location settings

      • msiexec.exe (PID: 6484)

    • Sends debugging messages

      • PDFTool.exe (PID: 4504)
      • PDFTool.exe (PID: 1296)
      • PDFTool.exe (PID: 6088)

    • Manual execution by a user

      • PDFTool.exe (PID: 1296)
      • PDFTool.exe (PID: 6088)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0001
ZipCompression: Deflated
ZipModifyDate: 2024:12:10 16:35:38
ZipCRC: 0x4d2d32a0
ZipCompressedSize: 2897244
ZipUncompressedSize: 5265920
ZipFileName: PDFTool-v3.1.1226.0.msi
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
150
Monitored processes
21
Malicious processes
2
Suspicious processes
0

Behavior graph

Click at the process to see the details
start winrar.exe no specs msiexec.exe msiexec.exe msiexec.exe no specs vssvc.exe no specs srtasks.exe no specs conhost.exe no specs msiexec.exe powershell.exe conhost.exe no specs powershell.exe conhost.exe no specs pdftool.exe werfault.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs pdftool.exe werfault.exe pdftool.exe werfault.exe

Process information

PID
CMD
Path
Indicators
Parent process
1296"C:\Users\admin\AppData\Local\PDFTool\PDFTool.exe" C:\Users\admin\AppData\Local\PDFTool\PDFTool.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WebView2App
Version:
3.1.1226.0
Modules
Images
c:\users\admin\appdata\local\pdftool\pdftool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
1740\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1864C:\Windows\syswow64\MsiExec.exe -Embedding BE4FC888F7FE178E30ED8A1505025E1F CC:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
2928C:\WINDOWS\SysWOW64\WerFault.exe -u -p 1296 -s 1732C:\Windows\SysWOW64\WerFault.exe
PDFTool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3928 -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\admin\AppData\Local\Temp\pssD930.ps1" -propFile "C:\Users\admin\AppData\Local\Temp\msiD257.txt" -scriptFile "C:\Users\admin\AppData\Local\Temp\scrD258.ps1" -scriptArgsFile "C:\Users\admin\AppData\Local\Temp\scrD259.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\oleaut32.dll
4320C:\WINDOWS\SysWOW64\WerFault.exe -u -p 4504 -s 1768C:\Windows\SysWOW64\WerFault.exe
PDFTool.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Problem Reporting
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\werfault.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
4504"C:\Users\admin\AppData\Local\PDFTool\PDFTool.exe" /registerC:\Users\admin\AppData\Local\PDFTool\PDFTool.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WebView2App
Exit code:
3762504530
Version:
3.1.1226.0
Modules
Images
c:\users\admin\appdata\local\pdftool\pdftool.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4952C:\Windows\syswow64\MsiExec.exe -Embedding BC05E77ADDA2021E23EE6ADC2101BAB8C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
5256"C:\WINDOWS\System32\msiexec.exe" /i "C:\Users\admin\AppData\Local\Temp\Rar$EXb6812.46176\PDFTool-v3.1.1226.0.msi" C:\Windows\System32\msiexec.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
5488\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—SrTasks.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
42 497
Read events
42 143
Write events
325
Delete events
29

Modification events

(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\MDE_File_Sample_70f80ce7b1c8c7b5018616b94ee39622c09a4431.zip
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(6812) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.msi\OpenWithProgids
Operation:writeName:Msi.Package
Value:
Executable files
45
Suspicious files
61
Text files
24
Unknown types
7

Dropped files

PID
Process
Filename
Type
6812WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXb6812.40174\PDFTool-v3.1.1226.0.msi —
MD5:—
SHA256:—
5920msiexec.exeC:\System Volume Information\SPP\metadata-2 —
MD5:—
SHA256:—
5920msiexec.exeC:\Windows\Installer\13cf0b.msi —
MD5:—
SHA256:—
6168msiexec.exeC:\Users\admin\AppData\Local\Temp\msiD257.txt —
MD5:—
SHA256:—
6168msiexec.exeC:\Users\admin\AppData\Local\Temp\scrD258.ps1 —
MD5:—
SHA256:—
6168msiexec.exeC:\Users\admin\AppData\Local\Temp\scrD259.txt —
MD5:—
SHA256:—
6168msiexec.exeC:\Users\admin\AppData\Local\Temp\pssD930.ps1 —
MD5:—
SHA256:—
6284msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:0A97DAD2E7D0ECF2B8D2FF5536E2439A
SHA256:F3BE5EED8151EA7518F05EE1838E8D4C16BDDD2A1240E1A35B70848AA1D89D5D
6284msiexec.exeC:\Users\admin\AppData\Local\Temp\MSI88DB.tmpexecutable
MD5:D0C9613582605F3793FDAD7279DE428B
SHA256:8BD84F1156EBDFA44AFAAC8A4579BA56A8C7513E3D51E00822167EA144923726
6284msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_4B24743B8F91CE797D24B8FCFCA3C262binary
MD5:F9CFF2109743B8FD1A75FE344813781C
SHA256:E2C48C3BAC82C56FE7BDEED9D7709A25C0109E4854F11DD71024BF027422A2A2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
18
TCP/UDP connections
55
DNS requests
32
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6072
svchost.exe
GET
200
23.216.77.28:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6072
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6284
msiexec.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
6284
msiexec.exe
GET
200
151.101.130.133:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDEXkmCboMU2WPdtTtg%3D%3D
unknown
—
—
whitelisted
6580
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
3988
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4712
MoUsoCoreWorker.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
6072
svchost.exe
23.216.77.28:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6072
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
92.123.104.65:443
www.bing.com
Akamai International B.V.
DE
whitelisted
1176
svchost.exe
20.190.159.75:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
whitelisted
crl.microsoft.com
  • 23.216.77.28
  • 23.216.77.19
  • 184.24.77.35
  • 184.24.77.37
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
google.com
  • 172.217.16.142
whitelisted
www.bing.com
  • 92.123.104.65
  • 92.123.104.64
  • 92.123.104.67
  • 92.123.104.59
  • 92.123.104.5
  • 92.123.104.63
  • 92.123.104.66
  • 92.123.104.56
  • 92.123.104.62
  • 92.123.104.29
  • 92.123.104.31
  • 92.123.104.18
  • 92.123.104.19
  • 92.123.104.23
  • 92.123.104.17
  • 92.123.104.21
  • 92.123.104.20
  • 92.123.104.27
whitelisted
login.live.com
  • 20.190.159.75
  • 20.190.159.23
  • 20.190.159.64
  • 20.190.159.2
  • 40.126.31.73
  • 20.190.159.73
  • 20.190.159.4
  • 20.190.159.71
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.213.166.81
whitelisted
ocsp.globalsign.com
  • 151.101.130.133
  • 151.101.2.133
  • 151.101.66.133
  • 151.101.194.133
whitelisted
arc.msn.com
  • 20.223.35.26
whitelisted

Threats

No threats detected
Process
Message
PDFTool.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
PDFTool.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
PDFTool.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
PDFTool.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
PDFTool.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
PDFTool.exe
WebView2: Failed to find an installed WebView2 runtime or non-stable Microsoft Edge installation.
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MDE_File_Sample_70f80ce7b1c8c7b5018616b94ee39622c09a4431.zip