File name:

PDFast.exe

Full analysis: https://app.any.run/tasks/8ff0293f-e098-44fc-92cc-d206edc13464
Verdict: Malicious activity
Analysis date: April 08, 2025, 20:57:54
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
advancedinstaller
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

1E995EEF7DEBA589543F502C4B14DA47

SHA1:

8950965F40F30EB40D11DE71754A4FE93B098F3D

SHA256:

A7F0794872BC5D0FEDCF6161C7002E0D9FC7E23CD8D390E0327DB7C010DD7A1A

SSDEEP:

98304:pL0druM/vIX0pafjCHE6B5fMxNRlOqAhcNAjcXILaN2nVmqZLDvHUVGT4aSx2J5l:G7a88G

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • ADVANCEDINSTALLER mutex has been found

      • PDFast.exe (PID: 5972)

    • Reads security settings of Internet Explorer

      • PDFast.exe (PID: 5972)

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 5864)
      • PDFast.exe (PID: 5972)

    • Executable content was dropped or overwritten

      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 1240)
      • rundll32.exe (PID: 5668)
      • rundll32.exe (PID: 2096)
      • PDFast.exe (PID: 5588)
      • PDFast.exe (PID: 5972)

    • Process drops legitimate windows executable

      • PDFast.exe (PID: 5588)
      • PDFast.exe (PID: 5972)

    • The process drops C-runtime libraries

      • PDFast.exe (PID: 5588)

  • INFO

    • The sample compiled with english language support

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • PDFast.exe (PID: 5588)

    • Checks supported languages

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 1280)
      • msiexec.exe (PID: 5864)
      • msiexec.exe (PID: 1164)
      • PDFast.exe (PID: 5588)
      • identity_helper.exe (PID: 1240)
      • PDFast.exe (PID: 684)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 3100)
      • rundll32.exe (PID: 5668)
      • explorer.exe (PID: 6244)

    • Reads the software policy settings

      • msiexec.exe (PID: 3100)
      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 2096)
      • PDFast.exe (PID: 5588)

    • Reads the machine GUID from the registry

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • PDFast.exe (PID: 5588)
      • PDFast.exe (PID: 684)

    • Reads Environment values

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 1164)
      • identity_helper.exe (PID: 1240)
      • msiexec.exe (PID: 1280)

    • Reads the computer name

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • msiexec.exe (PID: 1164)
      • PDFast.exe (PID: 5588)
      • PDFast.exe (PID: 684)
      • identity_helper.exe (PID: 1240)
      • msiexec.exe (PID: 1280)

    • Checks proxy server information

      • PDFast.exe (PID: 5972)
      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 2096)
      • PDFast.exe (PID: 5588)

    • Creates files or folders in the user directory

      • PDFast.exe (PID: 5972)
      • msiexec.exe (PID: 5864)
      • PDFast.exe (PID: 5588)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 5864)

    • Create files in a temporary directory

      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 1240)
      • rundll32.exe (PID: 5668)
      • rundll32.exe (PID: 2096)
      • PDFast.exe (PID: 5972)

    • Disables trace logs

      • rundll32.exe (PID: 1388)
      • rundll32.exe (PID: 2096)
      • PDFast.exe (PID: 5588)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 5864)

    • Application launched itself

      • msedge.exe (PID: 7020)

    • Manual execution by a user

      • PDFast.exe (PID: 5588)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 EXE PECompact compressed (generic) (49.3)
.exe | Win64 Executable (generic) (32.7)
.dll | Win32 Dynamic Link Library (generic) (7.8)
.exe | Win32 Executable (generic) (5.3)
.exe | Generic Win/DOS Executable (2.3)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2023:08:08 12:49:22+00:00
ImageFileCharacteristics: Executable, Large address aware, 32-bit
PEType: PE32
LinkerVersion: 14.36
CodeSize: 2534912
InitializedDataSize: 964608
UninitializedDataSize: -
EntryPoint: 0x1e0862
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x003f
FileFlags: Debug
FileOS: Win32
ObjectFileType: Dynamic link library
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: PDFast
FileDescription: PDFast Installer
FileVersion: 1.0.0
InternalName: PDFast
LegalCopyright: Copyright (C) 2025 PDFast
OriginalFileName: PDFast.exe
ProductName: PDFast
ProductVersion: 1.0.0
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
189
Monitored processes
51
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pdfast.exe msiexec.exe msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe rundll32.exe msedge.exe rundll32.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs pdfast.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe no specs explorer.exe no specs explorer.exe no specs pdfast.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
644"explorer.exe" "C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe"C:\Windows\SysWOW64\explorer.exe—PDFast.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
1
Version:
10.0.19041.3758 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcp_win.dll
684"C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe" C:\Users\admin\AppData\Roaming\PDFast\PDFast.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
PDFast
Version:
1.0.1.1
Modules
Images
c:\users\admin\appdata\roaming\pdfast\pdfast.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
744"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=6032 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
780"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5620 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1116"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6052 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1164C:\Windows\syswow64\MsiExec.exe -Embedding 996B3A52AFF9F93D9685DBD96028F9F0C:\Windows\SysWOW64\msiexec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1168"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5156 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1196"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4916 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1240rundll32.exe "C:\WINDOWS\Installer\MSIEF5C.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_1109937 59 RequestSender!RequestSender.CustomActions.CreateScheduledTaskC:\Windows\SysWOW64\rundll32.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
1240"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7020 --field-trial-handle=2436,i,1899484496230708715,9930900864477338319,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
Total events
24 686
Read events
24 504
Write events
170
Delete events
12

Modification events

(PID) Process:(5864) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
E81600004C4B1AECC8A8DB01
(PID) Process:(5864) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
A7161B42BEA44483F0497B1915A687BAE4B7B3B1FD22D4769F7D385E5A4C90A9
(PID) Process:(5864) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(5864) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Users\admin\AppData\Roaming\Microsoft\Installer\{EC0F9682-A741-4DAB-A3BA-44D06CA604DA}\
Value:
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableFileTracing
Value:
0
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableAutoFileTracing
Value:
0
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:EnableConsoleTracing
Value:
0
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:FileTracingMask
Value:
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:ConsoleTracingMask
Value:
(PID) Process:(1388) rundll32.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Tracing\rundll32_RASMANCS
Operation:writeName:MaxFileSize
Value:
1048576
Executable files
217
Suspicious files
284
Text files
166
Unknown types
0

Dropped files

PID
Process
Filename
Type
5972PDFast.exeC:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.0\install\CA604DA\PDFast.msiexecutable
MD5:9193849BA75ECA3516FDA249D9149700
SHA256:D625019951CFD3FEEABE95307FC5C1D7E89D0749A5D8BE5FF62701A44206BAF4
5972PDFast.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_1AB74AA2E3A56E1B8AD8D3FEC287554Ebinary
MD5:CC87414D35EB1924047E3FBB49CA346C
SHA256:BE590CDD73ADA87F63DDFD90CCA75FC86F49227F0B59AC4F71F4996E0C780B80
5972PDFast.exeC:\Users\admin\AppData\Local\Temp\MSID3DE.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
5972PDFast.exeC:\Users\admin\AppData\Local\Temp\MSID247.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
5972PDFast.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\357F04AD41BCF5FE18FCB69F60C6680F_17C8AB9779FC5F78079CADEDFCBF773Bbinary
MD5:416FD214510D060FEB1CA51BC63E8983
SHA256:3B1DA5B38546A416C0727AD52E2D1D2C2461D1A5B3214B87B5E2AB674C672FC1
5864msiexec.exeC:\Windows\Installer\MSIDEE8.tmpexecutable
MD5:71DE8487243FBCDAE48E9657A87319E3
SHA256:599411239695F85B4BDD07377A99291BE02EC8B47752E239FEDB29802897C1B6
5972PDFast.exeC:\Users\admin\AppData\Roaming\PDFast\PDFast 1.0.0\install\holder0.aiphbinary
MD5:9D14DB0A481FC2E4FDE4706B5E475410
SHA256:2F35C842455706BCA40332DC7D5F7FE6BB58A00041CFB861164A2DD1695221C6
5972PDFast.exeC:\Users\admin\AppData\Local\Temp\MSID3FE.tmpexecutable
MD5:B7A6A99CBE6E762C0A61A8621AD41706
SHA256:39FD8D36F8E5D915AD571EA429DB3C3DE6E9C160DBEA7C3E137C9BA4B7FD301D
5864msiexec.exeC:\Windows\Installer\10d7c4.msiexecutable
MD5:9193849BA75ECA3516FDA249D9149700
SHA256:D625019951CFD3FEEABE95307FC5C1D7E89D0749A5D8BE5FF62701A44206BAF4
1388rundll32.exeC:\Users\admin\AppData\Local\Temp\SFXCA10E67185934BAFEB37C0A65F7C59AB4E\RequestSender.dllexecutable
MD5:19F78AA7A17C75B9D9CB9B3F83A01C31
SHA256:7E0626A5C55B3603E73E3D021481A50C9C507F0B9B117951641EC1D87A545788
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
17
TCP/UDP connections
73
DNS requests
72
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.48.23.168:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5972
PDFast.exe
GET
200
151.101.194.133:80
http://ocsp.globalsign.com/codesigningrootr45/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQVFZP5vqhCrtRN5SWf40Rn6NM1IAQUHwC%2FRoAK%2FHg5t6W0Q9lWULvOljsCEHe9DgW3WQu2HUdhUx4%2Fde0%3D
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5972
PDFast.exe
GET
200
151.101.194.133:80
http://ocsp.globalsign.com/gsgccr45evcodesignca2020/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBQaCbVYh07WONuW4e63Ydlu4AlbDAQUJZ3Q%2FFkJhmPF7POxEztXHAOSNhECDH02JuY%2BNRarIhFtHg%3D%3D
unknown
—
—
whitelisted
8024
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
8024
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5036
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744556657&P2=404&P3=2&P4=HizsFQTvg9hVUt7wxxIWABgDAjUX5e4bahbG5xIQ695shpvR%2fbmfscKZK%2fEyHsBiQFWBfQvCcEUu6SX6SYri5A%3d%3d
unknown
—
—
whitelisted
5036
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744556657&P2=404&P3=2&P4=HizsFQTvg9hVUt7wxxIWABgDAjUX5e4bahbG5xIQ695shpvR%2fbmfscKZK%2fEyHsBiQFWBfQvCcEUu6SX6SYri5A%3d%3d
unknown
—
—
whitelisted
5036
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744556657&P2=404&P3=2&P4=HizsFQTvg9hVUt7wxxIWABgDAjUX5e4bahbG5xIQ695shpvR%2fbmfscKZK%2fEyHsBiQFWBfQvCcEUu6SX6SYri5A%3d%3d
unknown
—
—
whitelisted
5036
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/a575cead-e662-4f4d-b0c3-81f1438d0388?P1=1744556657&P2=404&P3=2&P4=HizsFQTvg9hVUt7wxxIWABgDAjUX5e4bahbG5xIQ695shpvR%2fbmfscKZK%2fEyHsBiQFWBfQvCcEUu6SX6SYri5A%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.168:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5972
PDFast.exe
151.101.194.133:80
ocsp.globalsign.com
FASTLY
US
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.159.73:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
1388
rundll32.exe
169.150.247.38:443
b.pdf-fast.com
—
GB
unknown
2104
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.186.142
whitelisted
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.48.23.168
  • 23.48.23.173
  • 23.48.23.174
  • 23.48.23.163
  • 23.48.23.159
  • 23.48.23.164
  • 23.48.23.169
  • 23.48.23.166
  • 23.48.23.170
whitelisted
ocsp.globalsign.com
  • 151.101.194.133
  • 151.101.2.133
  • 151.101.130.133
  • 151.101.66.133
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.159.73
  • 40.126.31.128
  • 40.126.31.1
  • 20.190.159.71
  • 20.190.159.0
  • 40.126.31.129
  • 40.126.31.2
  • 20.190.159.64
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
b.pdf-fast.com
  • 169.150.247.38
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
edge.microsoft.com
  • 150.171.28.11
  • 150.171.27.11
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
PDFast.exe