File name:

PDFast.exe

Full analysis: https://app.any.run/tasks/8ff0293f-e098-44fc-92cc-d206edc13464
Verdict: Malicious activity
Analysis date: April 08, 2025, 20:57:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

1E995EEF7DEBA589543F502C4B14DA47

SHA1:

8950965F40F30EB40D11DE71754A4FE93B098F3D

SHA256:

A7F0794872BC5D0FEDCF6161C7002E0D9FC7E23CD8D390E0327DB7C010DD7A1A

SSDEEP:

98304:pL0druM/vIX0pafjCHE6B5fMxNRlOqAhcNAjcXILaN2nVmqZLDvHUVGT4aSx2J5l:G7a88G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • ADVANCEDINSTALLER mutex has been found

      • PDFast.exe (PID: 5972)

    • Reads security settings of Internet Explorer

      • PDFast.exe (PID: 5972)

    • Reads the Windows owner or organization settings

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)

    • Executable content was dropped or overwritten

      • PDFast.exe (PID: 5972)
      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 1240)
      • rundll32.exe (PID: 5668)
      • PDFast.exe (PID: 5588)
      • rundll32.exe (PID: 2096)

    • Process drops legitimate windows executable

      • PDFast.exe (PID: 5972)
      • PDFast.exe (PID: 5588)

    • The process drops C-runtime libraries

      • PDFast.exe (PID: 5588)

  • INFO

    • The sample compiled with english language support

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • PDFast.exe (PID: 5588)

    • Reads the computer name

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 1164)
      • PDFast.exe (PID: 684)
      • identity_helper.exe (PID: 1240)
      • PDFast.exe (PID: 5588)

    • Checks supported languages

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 5864)
      • msiexec.exe (PID: 1164)
      • PDFast.exe (PID: 5588)
      • PDFast.exe (PID: 684)
      • identity_helper.exe (PID: 1240)

    • Checks proxy server information

      • PDFast.exe (PID: 5972)
      • rundll32.exe (PID: 1388)
      • PDFast.exe (PID: 5588)
      • rundll32.exe (PID: 2096)

    • Reads Environment values

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 1164)
      • identity_helper.exe (PID: 1240)

    • Reads the machine GUID from the registry

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • PDFast.exe (PID: 684)
      • PDFast.exe (PID: 5588)

    • Reads the software policy settings

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 3100)
      • msiexec.exe (PID: 5864)
      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 2096)
      • PDFast.exe (PID: 5588)

    • Creates files or folders in the user directory

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • PDFast.exe (PID: 5588)

    • Create files in a temporary directory

      • PDFast.exe (PID: 5972)
      • rundll32.exe (PID: 1240)
      • rundll32.exe (PID: 5668)
      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 2096)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3100)
      • rundll32.exe (PID: 5668)
      • explorer.exe (PID: 6244)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5864)

    • Disables trace logs

      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 2096)
      • PDFast.exe (PID: 5588)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5864)

    • Application launched itself

      • msedge.exe (PID: 7020)

    • Manual execution by a user

      • PDFast.exe (PID: 5588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (49.3)
.exe | Win64 Executable (generic) (32.7)
.dll | Win32 Dynamic Link Library (generic) (7.8)
.exe | Win32 Executable (generic) (5.3)
.exe | Generic Win/DOS Executable (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:08 12:49:22+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 2534912
InitializedDataSize: 964608
UninitializedDataSize: -
EntryPoint: 0x1e0862
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: PDFast
FileDescription: PDFast Installer
FileVersion: 1.0.0
InternalName: PDFast
LegalCopyright: Copyright (C) 2025 PDFast
OriginalFileName: PDFast.exe
ProductName: PDFast
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
189
Monitored processes
51
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pdfast.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe msedge.exe rundll32.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs pdfast.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs explorer.exe no specs explorer.exe no specs pdfast.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"explorer.exe" "C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe"C:\Windows\SysWOW64\explorer.exe—PDFast.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
684"C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe" C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PDFast
Version:
1.0.1.1
Modules
Images
c:\users\admin\appdata\roaming\pdfast\pdfast.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
744"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=6032 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5620 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6052 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164C:\Windows\syswow64\MsiExec.exe -Embedding 996B3A52AFF9F93D9685DBD96028F9F0C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1168"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5156 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4916 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240rundll32.exe "C:\WINDOWS\Installer\MSIEF5C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1109937 59 RequestSender!RequestSender.CustomActions.CreateScheduledTaskC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1240"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7020 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
24 686
Read events
24 504
Write events
170
Delete events
12

Modification events

(PID) Process:(5864) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
E81600004C4B1AECC8A8DB01
(PID) Process:(5864) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
A7161B42BEA44483F0497B1915A687BAE4B7B3B1FD22D4769F7D385E5A4C90A9
(PID) Process:(5864) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5864) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\{EC0F9682-A741-4DAB-A3BA-44D06CA604DA}\
Value:
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
217
Suspicious files
284
Text files
166
Unknown types
0

Dropped files

PID
Process
Filename
Type
5972PDFast.exeC:\Users\admin\AppData\Local\Temp\shiD1AA.tmpexecutable
MD5:84A34BF3486F7B9B7035DB78D78BDD1E
SHA256:F85911C910B660E528D2CF291BAA40A92D09961996D6D84E7A53A7095C7CD96E
5972PDFast.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:CC87414D35EB1924047E3FBB49CA346C
SHA256:BE590CDD73ADA87F63DDFD90CCA75FC86F49227F0B59AC4F71F4996E0C780B80
5972PDFast.exeC:\Users\admin\AppData\Local\Temp\MSID247.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
5972PDFast.exeC:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.0\install\holder0.aiphbinary
MD5:9D14DB0A481FC2E4FDE4706B5E475410
SHA256:2F35C842455706BCA40332DC7D5F7FE6BB58A00041CFB861164A2DD1695221C6
5972PDFast.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\357F04AD41BCF5FE18FCB69F60C6680F_17C8AB9779FC5F78079CADEDFCBF773Bbinary
MD5:4079451031FE6508070084A12CCE46A1
SHA256:84EA743D2C4B76F1BB4D16C566E9CEA2D9DE28ADD6C2B25F24B086AE1C877604
5972PDFast.exeC:\Users\admin\AppData\Local\Temp\MSID3FE.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
5864msiexec.exeC:\Windows\Installer\MSIE67D.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
5972PDFast.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:35BDB6C83E15875E5FFB8BFE1D534A26
SHA256:01B7F7AEA033DE77678522CF3462CC3E10744C1DE657E2E4916D84030CC3A91A
1388rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA10E67185934BAFEB37C0A65F7C59AB4E\CustomAction.configxml
MD5:EE9A8381338B060D86C58E2415F481F3
SHA256:7E1096D6F39EBE04D6E38BC714983AF05ED92CC2BB4D3365ED4C85E733CB145C
5864msiexec.exeC:\Windows\Installer\MSIDEE8.tmpexecutable
MD5:71DE8487243FBCDAE48E9657A87319E3
SHA256:599411239695F85B4BDD07377A99291BE02EC8B47752E239FEDB29802897C1B6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
73
DNS requests
72
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
8024
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5972
PDFast.exe
GET
200
151.101.194.133:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDH02JuY%2BNRarIhFtHg%3D%3D
unknown
—
—
whitelisted
5036
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744556657&P2=404&P3=2&P4=HizsFQTvg9hVUt7wxxIWABgDAjUX5e4bahbG5xIQ695shpvR%2fbmfscKZK%2fEyHsBiQFWBfQvCcEUu6SX6SYri5A%3d%3d
unknown
—
—
whitelisted
8024
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5036
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744556657&P2=404&P3=2&P4=HizsFQTvg9hVUt7wxxIWABgDAjUX5e4bahbG5xIQ695shpvR%2fbmfscKZK%2fEyHsBiQFWBfQvCcEUu6SX6SYri5A%3d%3d
unknown
—
—
whitelisted
5036
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744556657&P2=404&P3=2&P4=HizsFQTvg9hVUt7wxxIWABgDAjUX5e4bahbG5xIQ695shpvR%2fbmfscKZK%2fEyHsBiQFWBfQvCcEUu6SX6SYri5A%3d%3d
unknown
—
—
whitelisted
5036
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744556657&P2=404&P3=2&P4=HizsFQTvg9hVUt7wxxIWABgDAjUX5e4bahbG5xIQ695shpvR%2fbmfscKZK%2fEyHsBiQFWBfQvCcEUu6SX6SYri5A%3d%3d
unknown
—
—
whitelisted
5036
svchost.exe
GET
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/cd4e6fbf-c0e9-4dc2-9e3d-7f538bc7435a?P1=1744560257&P2=404&P3=2&P4=iV03%2bpZ6MyC3G%2fyzCIMtgZqmVaBhyw5txc5lBCDUJwUYYJJbTE1zpigwkLcLVgvuYBw40ZOcTh0IongjH62p3g%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.168:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5972
PDFast.exe
151.101.194.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1388
rundll32.exe
169.150.247.38:443
b.pdf-fast.com
—
GB
unknown
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.168
  • 23.48.23.173
  • 23.48.23.174
  • 23.48.23.163
  • 23.48.23.159
  • 23.48.23.164
  • 23.48.23.169
  • 23.48.23.166
  • 23.48.23.170
whitelisted
ocsp.globalsign.com
  • 151.101.194.133
  • 151.101.2.133
  • 151.101.130.133
  • 151.101.66.133
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.128
  • 40.126.31.1
  • 20.190.159.71
  • 20.190.159.0
  • 40.126.31.129
  • 40.126.31.2
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
b.pdf-fast.com
  • 169.150.247.38
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PDFast.exe