URL:

https://www.pdfforge.org/pdfcreator/download

Full analysis: https://app.any.run/tasks/7c4da78e-020f-4a3d-abbe-f314b91b22cf
Verdict: Malicious activity
Analysis date: March 26, 2020, 16:43:18
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MD5:

5A3FD0149276A2A45424EC348C79C39C

SHA1:

EBBFE4C22A3FA84922168BF3BBA19460155052DD

SHA256:

D11FD0427142E8613A2D353E68983C694323E766CF756996EC6A711E29D220BF

SSDEEP:

3:N8DSLTKSFScaFJp:2OLTKSFuFz

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • PDFCreator-4_0_3-Setup.exe (PID: 1460)
      • PDFCreator-4_0_3-Setup.exe (PID: 3244)
      • 7z.exe (PID: 2704)
      • PrinterHelper.exe (PID: 3812)
      • PDFCreatorSetup.exe (PID: 1604)
      • setuphelper.exe (PID: 440)
      • setuphelper.exe (PID: 3708)
      • architect-setup.exe (PID: 1296)
      • PDF_Architect_7_Installer.exe (PID: 3064)
      • PDFCreator.exe (PID: 3576)
      • PDFCreator.exe (PID: 3444)
      • gswin32c.exe (PID: 2524)
      • updater-ws.exe (PID: 3440)
      • ws.exe (PID: 2080)
      • stats-com.exe (PID: 3476)

    • Loads dropped or rewritten executable

      • rundll32.exe (PID: 3640)
      • rundll32.exe (PID: 3788)
      • rundll32.exe (PID: 3112)
      • PDFCreatorSetup.exe (PID: 1604)
      • rundll32.exe (PID: 748)
      • rundll32.exe (PID: 3388)
      • rundll32.exe (PID: 1676)
      • setuphelper.exe (PID: 3708)
      • setuphelper.exe (PID: 440)
      • rundll32.exe (PID: 2692)
      • RegAsm.exe (PID: 3060)
      • RegAsm.exe (PID: 2436)
      • PrinterHelper.exe (PID: 3812)
      • spoolsv.exe (PID: 1188)
      • regsvr32.exe (PID: 2412)
      • PDFCreator.exe (PID: 3576)
      • architect-setup.exe (PID: 1296)
      • DllHost.exe (PID: 1712)
      • PDFCreator.exe (PID: 3444)
      • WINWORD.EXE (PID: 2588)
      • MsiExec.exe (PID: 952)
      • MsiExec.exe (PID: 2060)
      • updater-ws.exe (PID: 3440)
      • stats-com.exe (PID: 3476)
      • ws.exe (PID: 2080)
      • DllHost.exe (PID: 4056)
      • svchost.exe (PID: 860)
      • explorer.exe (PID: 372)
      • gswin32c.exe (PID: 2524)

    • Changes settings of System certificates

      • PDFCreatorSetup.exe (PID: 1604)
      • architect-setup.exe (PID: 1296)
      • PDFCreator-4_0_3-Setup.exe (PID: 1460)

    • Registers / Runs the DLL via REGSVR32.EXE

      • architect-setup.exe (PID: 1296)

  • SUSPICIOUS

    • Reads Environment values

      • PDFCreatorSetup.exe (PID: 1604)
      • PDFCreator.exe (PID: 3576)

    • Modifies files in Chrome extension folder

      • chrome.exe (PID: 3144)

    • Executable content was dropped or overwritten

      • chrome.exe (PID: 3144)
      • chrome.exe (PID: 3792)
      • PDFCreator-4_0_3-Setup.exe (PID: 1460)
      • 7z.exe (PID: 2704)
      • rundll32.exe (PID: 3640)
      • rundll32.exe (PID: 748)
      • rundll32.exe (PID: 1676)
      • rundll32.exe (PID: 3388)
      • msiexec.exe (PID: 2108)
      • PDFCreatorSetup.exe (PID: 1604)
      • spoolsv.exe (PID: 1188)
      • PrinterHelper.exe (PID: 3812)
      • architect-setup.exe (PID: 1296)

    • Adds / modifies Windows certificates

      • PDFCreatorSetup.exe (PID: 1604)
      • architect-setup.exe (PID: 1296)
      • PDFCreator-4_0_3-Setup.exe (PID: 1460)

    • Uses RUNDLL32.EXE to load library

      • MsiExec.exe (PID: 1156)
      • MsiExec.exe (PID: 4064)

    • Creates COM task schedule object

      • RegAsm.exe (PID: 2436)
      • RegAsm.exe (PID: 3060)
      • regsvr32.exe (PID: 2412)
      • MsiExec.exe (PID: 952)
      • MsiExec.exe (PID: 2060)
      • MsiExec.exe (PID: 3476)

    • Creates files in the program directory

      • RegAsm.exe (PID: 3060)
      • PDFCreatorSetup.exe (PID: 1604)
      • architect-setup.exe (PID: 1296)

    • Creates files in the Windows directory

      • PrinterHelper.exe (PID: 3812)
      • spoolsv.exe (PID: 1188)

    • Removes files from Windows directory

      • spoolsv.exe (PID: 1188)
      • PrinterHelper.exe (PID: 3812)

    • Searches for installed software

      • PDFCreatorSetup.exe (PID: 1604)
      • PDFCreator.exe (PID: 3576)

    • Starts itself from another location

      • architect-setup.exe (PID: 1296)

    • Reads Internet Cache Settings

      • architect-setup.exe (PID: 1296)

    • Executed via COM

      • DllHost.exe (PID: 1712)

    • Creates files in the user directory

      • explorer.exe (PID: 372)

    • Starts Microsoft Office Application

      • PDFCreator.exe (PID: 3576)

    • Executed as Windows Service

      • vssvc.exe (PID: 4072)

    • Modifies the open verb of a shell class

      • msiexec.exe (PID: 2108)

    • Creates a software uninstall entry

      • architect-setup.exe (PID: 1296)

    • Changes IE settings (feature browser emulation)

      • AcroRd32.exe (PID: 1388)

  • INFO

    • Reads the hosts file

      • chrome.exe (PID: 3144)
      • chrome.exe (PID: 3792)
      • RdrCEF.exe (PID: 3552)

    • Application launched itself

      • chrome.exe (PID: 3144)
      • msiexec.exe (PID: 2108)
      • RdrCEF.exe (PID: 3552)

    • Reads Internet Cache Settings

      • chrome.exe (PID: 3144)

    • Reads settings of System Certificates

      • PDFCreator-4_0_3-Setup.exe (PID: 1460)
      • PDFCreatorSetup.exe (PID: 1604)
      • chrome.exe (PID: 3792)
      • PrinterHelper.exe (PID: 3812)
      • PDFCreator.exe (PID: 3576)
      • architect-setup.exe (PID: 1296)

    • Loads dropped or rewritten executable

      • MsiExec.exe (PID: 1156)
      • MsiExec.exe (PID: 4064)

    • Dropped object may contain Bitcoin addresses

      • 7z.exe (PID: 2704)
      • msiexec.exe (PID: 2108)
      • architect-setup.exe (PID: 1296)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 2108)

    • Creates files in the program directory

      • msiexec.exe (PID: 2108)

    • Manual execution by user

      • PDFCreator.exe (PID: 3576)

    • Reads Microsoft Office registry keys

      • WINWORD.EXE (PID: 2588)

    • Creates files in the user directory

      • WINWORD.EXE (PID: 2588)

    • Low-level read access rights to disk partition

      • vssvc.exe (PID: 4072)

    • Searches for installed software

      • msiexec.exe (PID: 2108)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
122
Monitored processes
76
Malicious processes
25
Suspicious processes
5

Behavior graph

Click at the process to see the details
drop and start drop and start start drop and start drop and start drop and start drop and start drop and start drop and start drop and start chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs pdfcreator-4_0_3-setup.exe no specs pdfcreator-4_0_3-setup.exe 7z.exe pdfcreatorsetup.exe msiexec.exe msiexec.exe no specs rundll32.exe no specs rundll32.exe rundll32.exe no specs msiexec.exe no specs rundll32.exe rundll32.exe setuphelper.exe no specs regasm.exe no specs rundll32.exe setuphelper.exe no specs regasm.exe no specs rundll32.exe no specs printerhelper.exe architect-setup.exe spoolsv.exe regsvr32.exe no specs pdf_architect_7_installer.exe no specs pdfcreator.exe server no specs winword.exe no specs pdfcreator.exe no specs vssvc.exe no specs msiexec.exe no specs msiexec.exe no specs msiexec.exe no specs ws.exe no specs msiexec.exe no specs updater-ws.exe no specs stats-com.exe no specs gswin32c.exe acrord32.exe no specs acrord32.exe no specs rdrcef.exe no specs rdrcef.exe no specs rdrcef.exe no specs explorer.exe no specs Thumbnail Cache Out of Proc Server no specs svchost.exe

Process information

PID
CMD
Path
Indicators
Parent process
304"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,17520006566804599063,14212101678021356474,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=1480792801777221921 --mojo-platform-channel-handle=3468 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
372C:\Windows\Explorer.EXEC:\Windows\explorer.exe——
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Explorer
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\winanr.dll
c:\windows\system32\wshtcpip.dll
c:\windows\explorer.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
440"C:\Program Files\PDFCreator\setuphelper.exe" /ComInterface=RegisterC:\Program Files\PDFCreator\setuphelper.exe—rundll32.exe
User:
SYSTEM
Company:
pdfforge
Integrity Level:
SYSTEM
Description:
SetupHelper
Exit code:
0
Version:
1.2.0.0
Modules
Images
c:\program files\pdfcreator\setuphelper.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
748rundll32.exe "C:\Windows\Installer\MSI17D1.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_11016421 13 PDFCreator_setup!pdfforge.PDFCreator.Setup.Builder.Features.FreewareExclusiveFeaturesBuilder.CheckInstallC:\Windows\system32\rundll32.exe
MsiExec.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\rundll32.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\imagehlp.dll
860C:\Windows\system32\svchost.exe -k netsvcsC:\Windows\System32\svchost.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Host Process for Windows Services
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windanr.exe
c:\windows\system32\svchost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
952"C:\Windows\system32\MsiExec.exe" /Y "C:\Program Files\PDF Architect 7\preview-handler.dll"C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
956"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1000,17520006566804599063,14212101678021356474,131072 --enable-features=PasswordImport --disable-gpu-compositing --lang=en-US --enable-offline-auto-reload --enable-offline-auto-reload-visible-only --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --service-request-channel-token=3168560508315394261 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1028"C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-3d-apis --disable-databases --disable-direct-npapi-requests --disable-file-system --disable-notifications --disable-shared-workers --disable-direct-write --lang=en-US --lang=en-US --log-severity=disable --product-version="ReaderServices/15.23.20053 Chrome/45.0.2454.85" --device-scale-factor=1 --enable-delegated-renderer --num-raster-threads=2 --gpu-rasterization-msaa-sample-count=8 --content-image-texture-target=3553 --video-image-texture-target=3553 --disable-accelerated-video-decode --disable-webrtc-hw-encoding --disable-gpu-compositing --channel="3552.1.187177326\1564431828" --allow-no-sandbox-job /prefetch:673131151C:\Program Files\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe—RdrCEF.exe
User:
admin
Company:
Adobe Systems Incorporated
Integrity Level:
LOW
Description:
Adobe RdrCEF
Exit code:
0
Version:
15.23.20053.211670
Modules
Images
c:\program files\adobe\acrobat reader dc\reader\acrocef\rdrcef.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1064"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --field-trial-handle=1000,17520006566804599063,14212101678021356474,131072 --enable-features=PasswordImport --lang=en-US --service-sandbox-type=utility --service-request-channel-token=10761118126215875916 --mojo-platform-channel-handle=3612 --ignored=" --type=renderer " /prefetch:8C:\Program Files\Google\Chrome\Application\chrome.exe—chrome.exe
User:
admin
Company:
Google LLC
Integrity Level:
LOW
Description:
Google Chrome
Exit code:
0
Version:
75.0.3770.100
Modules
Images
c:\program files\google\chrome\application\chrome.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\google\chrome\application\75.0.3770.100\chrome_elf.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
1156C:\Windows\system32\MsiExec.exe -Embedding 863CDC24A074810342479620AA56E199C:\Windows\system32\MsiExec.exe—msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows® installer
Exit code:
0
Version:
5.0.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\msiexec.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
Total events
19 510
Read events
11 528
Write events
7 538
Delete events
444

Modification events

(PID) Process:(3144) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3144) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3144) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3144) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3144) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(1920) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:writeName:3144-13229714613725625
Value:
259
(PID) Process:(3144) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Update\ClientState\{8A69D345-D564-463c-AFF1-A69D9E530F96}
Operation:writeName:dr
Value:
1
(PID) Process:(3144) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome
Operation:writeName:UsageStatsInSample
Value:
0
(PID) Process:(3144) chrome.exeKey:HKEY_CURRENT_USER\Software\Google\Chrome\BrowserExitCodes
Operation:delete valueName:3120-13213713943555664
Value:
0
(PID) Process:(3144) chrome.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Google\Update\ClientStateMedium\{8A69D345-D564-463C-AFF1-A69D9E530F96}
Operation:writeName:usagestats
Value:
0
Executable files
255
Suspicious files
222
Text files
695
Unknown types
82

Dropped files

PID
Process
Filename
Type
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\BrowserMetrics\BrowserMetrics-5E7CDBB6-C48.pma —
MD5:—
SHA256:—
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\77d387d3-a9ef-417c-b3e8-5d05579a8eb3.tmp —
MD5:—
SHA256:—
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\000028.dbtmp —
MD5:—
SHA256:—
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.oldtext
MD5:—
SHA256:—
860svchost.exeC:\Windows\appcompat\programs\RecentFileCache.bcftxt
MD5:—
SHA256:—
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\data_reduction_proxy_leveldb\LOG.old~RFa66cdb.TMPtext
MD5:—
SHA256:—
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB\LOG.oldtext
MD5:—
SHA256:—
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Last Tabsbinary
MD5:—
SHA256:—
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB\LOG.oldtext
MD5:—
SHA256:—
3144chrome.exeC:\Users\admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
36
TCP/UDP connections
146
DNS requests
71
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3792
chrome.exe
GET
200
216.239.36.21:80
http://download.pdfforge.org/download/pdfcreator/PDFCreator-stable
US
html
18.3 Kb
malicious
3792
chrome.exe
GET
200
216.239.36.21:80
http://download.pdfforge.org/scripts/vendor/adsense_cse.js
US
text
1.01 Kb
malicious
3792
chrome.exe
GET
200
216.239.36.21:80
http://download.pdfforge.org/images/base/en_logo.png
US
image
11.3 Kb
malicious
3792
chrome.exe
GET
200
216.239.36.21:80
http://download.pdfforge.org/scripts/vendor/modernizr.js
US
html
4.95 Kb
malicious
3792
chrome.exe
GET
200
216.239.36.21:80
http://download.pdfforge.org/styles/overwrite.css
US
text
1.53 Kb
malicious
3792
chrome.exe
GET
200
216.239.36.21:80
http://download.pdfforge.org/styles/screen.css
US
text
42.4 Kb
malicious
3792
chrome.exe
GET
200
216.58.210.2:80
http://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js
US
text
38.1 Kb
whitelisted
3792
chrome.exe
GET
200
216.239.36.21:80
http://download.pdfforge.org/scripts/main.min.js?v=2
US
text
4.53 Kb
malicious
3792
chrome.exe
GET
200
209.197.3.15:80
http://netdna.bootstrapcdn.com/font-awesome/4.4.0/css/font-awesome.min.css
US
text
5.94 Kb
whitelisted
3792
chrome.exe
GET
200
209.197.3.15:80
http://netdna.bootstrapcdn.com/font-awesome/4.4.0/fonts/fontawesome-webfont.woff2?v=4.4.0
US
woff2
62.9 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3792
chrome.exe
172.217.18.106:443
fonts.googleapis.com
Google Inc.
US
whitelisted
3792
chrome.exe
172.217.21.234:443
maps.googleapis.com
Google Inc.
US
whitelisted
3792
chrome.exe
172.217.18.10:443
ajax.googleapis.com
Google Inc.
US
whitelisted
3792
chrome.exe
216.58.210.2:443
pagead2.googlesyndication.com
Google Inc.
US
whitelisted
3792
chrome.exe
46.105.202.131:443
cdn.pdfforge.org
OVH SAS
FR
suspicious
3792
chrome.exe
172.217.22.77:443
accounts.google.com
Google Inc.
US
whitelisted
3792
chrome.exe
178.33.77.135:443
www.pdfforge.org
OVH SAS
FR
suspicious
3792
chrome.exe
172.217.23.163:443
fonts.gstatic.com
Google Inc.
US
whitelisted
3792
chrome.exe
99.86.7.87:443
clientcdn.pushengage.com
AT&T Services, Inc.
US
suspicious
3792
chrome.exe
216.58.206.14:443
www.google-analytics.com
Google Inc.
US
whitelisted

DNS requests

Domain
IP
Reputation
www.pdfforge.org
  • 178.33.77.135
unknown
clientservices.googleapis.com
  • 216.58.207.67
whitelisted
accounts.google.com
  • 172.217.22.77
shared
fonts.googleapis.com
  • 172.217.18.106
whitelisted
maps.googleapis.com
  • 172.217.21.234
whitelisted
ajax.googleapis.com
  • 172.217.18.10
whitelisted
pagead2.googlesyndication.com
  • 216.58.210.2
whitelisted
fonts.gstatic.com
  • 172.217.23.163
whitelisted
cdn.pdfforge.org
  • 46.105.202.131
suspicious
static.pdfforge.org
  • 46.105.202.131
suspicious

Threats

No threats detected
Process
Message
gswin32c.exe
RRANTY: see the file PUBLIC for details.
gswin32c.exe
GPL Ghostscript 9.25 (2018-09-13) Copyright (C) 2018 Artifex Software, Inc. All rights reserved. This software comes with NO WA
gswin32c.exe
Loading NimbusMonoPS-Regular font from %rom%Resource/Font/NimbusMonoPS-Regular...
gswin32c.exe
4508436 3088464 1801504 501472 1 done.
gswin32c.exe
%%[ ProductName: GPL Ghostscript ]%%
gswin32c.exe
Loading NimbusRoman-Regular font from %rom%Resource/Font/NimbusRoman-Regular...
gswin32c.exe
4614532 3294236 2337576 1001352 2 done.
gswin32c.exe
%%[Page: 1]%% %%[LastPage]%%
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.pdfforge.org/pdfcreator/download