URL:

https://www.pdfagile.com/

Full analysis: https://app.any.run/tasks/d72f3c25-8cdd-4610-861e-7d27f1ead5a4
Verdict: Malicious activity
Analysis date: June 13, 2025, 19:29:12
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MD5:

78C049D2BD629C65B02179531E1457B6

SHA1:

11B9D4CE918CDD335355D9CB35C13CBB77854011

SHA256:

F233F9C964941C044287C1BA8CA0DD9FB76B3375E18ABDE6CCF17452698DB52B

SSDEEP:

3:N8DSLUGLGK3:2OL1R

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Registers / Runs the DLL via REGSVR32.EXE

      • pdfagile.exe (PID: 7448)

  • SUSPICIOUS

    • There is functionality for taking screenshot (YARA)

      • PDFAgile.en.100.1.1.1.exe (PID: 8096)
      • pdfagile.exe (PID: 7860)

    • Process drops legitimate windows executable

      • PDFAgile.en.100.1.1.1.exe (PID: 8096)

    • Executes as Windows Service

      • fpprotect.exe (PID: 8084)

    • Creates a software uninstall entry

      • PDFAgile.en.100.1.1.1.exe (PID: 8096)

    • Executable content was dropped or overwritten

      • PDFAgile.en.100.1.1.1.exe (PID: 8096)

    • The process drops C-runtime libraries

      • PDFAgile.en.100.1.1.1.exe (PID: 8096)

    • Searches for installed software

      • fpprotect.exe (PID: 8084)
      • pdf_ext_process.exe (PID: 7092)
      • pdf_ext_process.exe (PID: 3964)
      • pdfagile.exe (PID: 7860)
      • pdf_ext_process.exe (PID: 6152)
      • pdfagile.exe (PID: 7192)

    • Reads the date of Windows installation

      • pdf_ext_process64.exe (PID: 1332)
      • pdf_ext_process64.exe (PID: 7228)

    • Reads security settings of Internet Explorer

      • pdf_ext_process64.exe (PID: 1332)
      • pdf_ext_process64.exe (PID: 7228)
      • PDFAgile.en.100.1.1.1.exe (PID: 8096)

    • Application launched itself

      • pdfagile.exe (PID: 7860)
      • pdfagile.exe (PID: 7192)

  • INFO

    • Checks supported languages

      • identity_helper.exe (PID: 7932)
      • PDFAgile.en.100.1.1.1.exe (PID: 8096)
      • fpprotect.exe (PID: 8084)
      • pdf_ext_process.exe (PID: 7092)
      • pdf_ext_process64.exe (PID: 1332)
      • pdf_ext_process.exe (PID: 3964)
      • pdfagile.exe (PID: 2620)
      • pdfagile.exe (PID: 7192)
      • pdfagile.exe (PID: 7448)
      • pdfagile.exe (PID: 7860)
      • pdf_ext_process64.exe (PID: 7228)
      • pdf_ext_process.exe (PID: 6152)

    • Application launched itself

      • msedge.exe (PID: 3888)

    • Reads Environment values

      • identity_helper.exe (PID: 7932)

    • Reads the computer name

      • identity_helper.exe (PID: 7932)
      • PDFAgile.en.100.1.1.1.exe (PID: 8096)
      • fpprotect.exe (PID: 8084)
      • pdfagile.exe (PID: 7448)
      • pdfagile.exe (PID: 2620)
      • pdfagile.exe (PID: 7192)
      • pdf_ext_process64.exe (PID: 1332)
      • pdfagile.exe (PID: 7860)
      • pdf_ext_process64.exe (PID: 7228)

    • Creates files in the program directory

      • PDFAgile.en.100.1.1.1.exe (PID: 8096)
      • fpprotect.exe (PID: 8084)
      • pdfagile.exe (PID: 2620)

    • Executable content was dropped or overwritten

      • msedge.exe (PID: 3888)

    • Create files in a temporary directory

      • PDFAgile.en.100.1.1.1.exe (PID: 8096)
      • pdfagile.exe (PID: 7860)

    • The sample compiled with english language support

      • PDFAgile.en.100.1.1.1.exe (PID: 8096)

    • Process checks computer location settings

      • pdf_ext_process64.exe (PID: 1332)
      • pdf_ext_process64.exe (PID: 7228)

    • Creates files or folders in the user directory

      • pdfagile.exe (PID: 2620)
      • pdfagile.exe (PID: 7448)

    • Reads the machine GUID from the registry

      • pdfagile.exe (PID: 7448)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
205
Monitored processes
58
Malicious processes
2
Suspicious processes
2

Behavior graph

Click at the process to see the details
start msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs pdfagile.en.100.1.1.1.exe no specs pdfagile.en.100.1.1.1.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs slui.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs fpprotect.exe no specs pdf_ext_process.exe no specs pdf_ext_process64.exe no specs pdf_ext_process.exe no specs pdfagile.exe pdfagile.exe pdfagile.exe pdf_ext_process64.exe no specs pdfagile.exe pdf_ext_process.exe no specs msedge.exe no specs pdfagile.exe vipgui.exe no specs fphelper.exe no specs fastcl-probe.exe no specs conhost.exe no specs pdfagile.exe regsvr32.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs pdfagile.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
188"C:\Program Files (x86)\pdfagile\vipgui.exe" --pid=501 --open_web=main --vipfrom=0 --preload_by_pid=7860C:\Program Files (x86)\pdfagile\vipgui.exe—pdfagile.exe
User:
admin
Company:
Copyright (C) DocuAgile Pte. Ltd.
Integrity Level:
MEDIUM
Description:
PDF Agile
Exit code:
0
Version:
2025,04,18,371
Modules
Images
c:\program files (x86)\pdfagile\vipgui.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
304"C:\Program Files (x86)\pdfagile\pdfagile.exe" -worker=1C:\Program Files (x86)\pdfagile\pdfagile.exe
pdfagile.exe
User:
admin
Company:
Copyright (C) DocuAgile Pte. Ltd.
Integrity Level:
MEDIUM
Description:
PDFAgile
Exit code:
0
Version:
2025,04,18,2317
Modules
Images
c:\program files (x86)\pdfagile\pdfagile.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
984"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6716,i,3807853873324013547,8587281287356337445,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
984"C:\Program Files (x86)\pdfagile\fphelper.exe" -admin -path:"C:\Program Files (x86)\pdfagile\pdfagile.exe" -param:"-checkSsd" -pid:8 -withOutUacC:\Program Files (x86)\pdfagile\fphelper.exe—pdfagile.exe
User:
admin
Company:
Copyright (C) DocuAgile Pte. Ltd.
Integrity Level:
MEDIUM
Description:
PDF Agile
Exit code:
0
Version:
2025,05,15,373
Modules
Images
c:\program files (x86)\pdfagile\fphelper.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
984"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=6360,i,3807853873324013547,8587281287356337445,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1096"C:\Program Files (x86)\pdfagile\fastcl-probe.exe"C:\Program Files (x86)\pdfagile\fastcl-probe.exe—pdfagile.exe
User:
admin
Company:
Copyright (C) DocuAgile Pte. Ltd.
Integrity Level:
MEDIUM
Description:
PDFAgile
Exit code:
152
Version:
2022,06,14,2262
Modules
Images
c:\program files (x86)\pdfagile\fastcl-probe.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
1096"C:\Program Files (x86)\pdfagile\pdfagile.exe" -sactive=1C:\Program Files (x86)\pdfagile\pdfagile.exe
fpprotect.exe
User:
admin
Company:
Copyright (C) DocuAgile Pte. Ltd.
Integrity Level:
HIGH
Description:
PDFAgile
Exit code:
0
Version:
2025,04,18,2317
Modules
Images
c:\program files (x86)\pdfagile\pdfagile.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
1332"C:\Program Files (x86)\pdfagile\pdf_ext_process64.exe" /ext:1C:\Program Files (x86)\pdfagile\pdf_ext_process64.exe—PDFAgile.en.100.1.1.1.exe
User:
admin
Company:
Copyright (C) DocuAgile Pte. Ltd.
Integrity Level:
HIGH
Description:
PDF Agile
Exit code:
4294967295
Version:
2025,03,24,348
Modules
Images
c:\program files (x86)\pdfagile\pdf_ext_process64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1356"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=5968,i,3807853873324013547,8587281287356337445,262144 --variations-seed-version --mojo-platform-channel-handle=7652 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2128"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --string-annotations --always-read-main-dll --field-trial-handle=7688,i,3807853873324013547,8587281287356337445,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
15 123
Read events
14 950
Write events
156
Delete events
17

Modification events

(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\ThirdParty
Operation:writeName:StatusCodes
Value:
01000000
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\525154
Operation:writeName:WindowTabManagerFileMappingId
Value:
{4AB15BF3-D260-4100-92C0-C36051145CF1}
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(3888) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
23187F580F962F00
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\525154
Operation:writeName:WindowTabManagerFileMappingId
Value:
{F0673EA4-D8EE-4EEF-BEA8-E7548F1A22AC}
(PID) Process:(3888) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\525154
Operation:writeName:WindowTabManagerFileMappingId
Value:
{58CCFFEF-129A-46AB-B430-4FBA22679FDA}
Executable files
162
Suspicious files
620
Text files
719
Unknown types
0

Dropped files

PID
Process
Filename
Type
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old~RF1762ff.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\ClientCertificates\LOG.old —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF17630f.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF17630f.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF17631f.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF17633e.TMP —
MD5:—
SHA256:—
3888msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
192
DNS requests
184
Threats
17

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4216
msedge.exe
GET
200
150.171.27.11:80
http://edge.microsoft.com/browsernetworktime/time/1/current?cup2key=2:Vuce-MCgt82004SDFGpfEYhPq7ycZctUrGdn0Q9JBqo&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
unknown
—
—
whitelisted
3676
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
2.16.168.124:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1268
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8096
PDFAgile.en.100.1.1.1.exe
POST
200
170.106.156.244:80
http://pdfagilesu.pdfagile.com/uv?t=1749842983
unknown
—
—
unknown
7904
svchost.exe
HEAD
200
208.89.74.17:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1750170509&P2=404&P3=2&P4=PK4I4bbffgc5OCfP%2bOJPdD2HTKK9NTPX9%2fnXLOs8bjD%2f8h3FQELtG7S5xK5VwaNMRnRWdj7MadOnozM101jD4Q%3d%3d
unknown
—
—
whitelisted
8096
PDFAgile.en.100.1.1.1.exe
POST
200
198.11.183.41:80
http://global-receiver-ta.thinkingdata.cn/sync_data
unknown
—
—
unknown
1332
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1332
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7904
svchost.exe
GET
206
208.89.74.17:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1750170509&P2=404&P3=2&P4=PK4I4bbffgc5OCfP%2bOJPdD2HTKK9NTPX9%2fnXLOs8bjD%2f8h3FQELtG7S5xK5VwaNMRnRWdj7MadOnozM101jD4Q%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
1268
svchost.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
4984
RUXIMICS.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
5944
MoUsoCoreWorker.exe
20.73.194.208:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4216
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4216
msedge.exe
150.171.27.11:80
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4216
msedge.exe
150.171.27.11:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
4216
msedge.exe
2.16.241.224:443
copilot.microsoft.com
Akamai International B.V.
DE
whitelisted
4216
msedge.exe
148.153.240.74:443
www.pdfagile.com
CDSC-AS1
US
unknown

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.206
whitelisted
edge.microsoft.com
  • 150.171.27.11
  • 150.171.28.11
  • 151.101.128.176
  • 151.101.192.176
  • 151.101.0.176
  • 151.101.64.176
whitelisted
config.edge.skype.com
  • 13.107.42.16
whitelisted
www.pdfagile.com
  • 148.153.240.74
  • 148.153.240.75
  • 148.153.240.76
  • 148.153.240.77
  • 148.153.240.78
  • 90.84.161.28
  • 148.153.240.72
  • 148.153.240.73
  • 148.153.240.70
  • 90.84.161.17
unknown
copilot.microsoft.com
  • 2.16.241.224
  • 2.16.241.220
whitelisted
www.bing.com
  • 2.16.241.205
  • 2.16.241.201
  • 2.16.241.218
  • 2.23.227.215
  • 2.23.227.208
whitelisted
cms-cdn.pdfagile.com
  • 90.84.161.17
  • 148.153.240.70
unknown
fonts.gstatic.com
  • 216.58.206.67
  • 142.250.185.67
whitelisted
fonts.googleapis.com
  • 142.250.186.42
  • 142.250.186.74
whitelisted
js.stripe.com
  • 151.101.128.176
  • 151.101.192.176
  • 151.101.0.176
  • 151.101.64.176
whitelisted

Threats

PID
Process
Class
Message
4216
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
4216
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
4216
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
4216
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
8096
PDFAgile.en.100.1.1.1.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
8096
PDFAgile.en.100.1.1.1.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
8096
PDFAgile.en.100.1.1.1.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
8096
PDFAgile.en.100.1.1.1.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
8096
PDFAgile.en.100.1.1.1.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
7860
pdfagile.exe
Potentially Bad Traffic
ET HUNTING Suspicious Mozilla User-Agent - Likely Fake (Mozilla/4.0)
Process
Message
pdfagile.exe
default file : ""
pdfagile.exe
before file : "-setdefault=1"
pdfagile.exe
default file : ""
pdfagile.exe
after : "-associateebook=1"
pdfagile.exe
after : "-associateeofd=1"
pdfagile.exe
before file : "-associateebook=1"
pdfagile.exe
after : "-setdefault=1"
pdfagile.exe
CmdLineProcessor "-setdefault=1 -associateebook=1 -associateeofd=1 -apply_preview_panel=1 -from_usr_set=2"
pdfagile.exe
default file : ""
pdfagile.exe
before file : "-associateeofd=1"
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://www.pdfagile.com/