| URL: | https://tools.pdf24.org/en/creator |
| Full analysis: | https://app.any.run/tasks/2a0c8fa7-3f37-47dc-a789-26bd556ea0bf |
| Verdict: | Malicious activity |
| Analysis date: | March 04, 2024, 16:44:30 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 2E48B438068096016E56E9CB6312A080 |
| SHA1: | 75C94F348639F9723C84384BA8466C3C953792C6 |
| SHA256: | F272825ADB68B7A67E34AA1415AC4E14BC36611DA33B297102DC14AA3669AC4B |
| SSDEEP: | 3:N8CKXSbO3n:2CKXSC3 |
MALICIOUS
Drops the executable file immediately after the start
- pdf24-creator-9.6.0-x86.exe (PID: 748)
- pdf24-creator-9.6.0-x86.exe (PID: 1340)
- pdf24-PrinterInstall.exe (PID: 3760)
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
Changes the autorun value in the registry
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
Registers / Runs the DLL via REGSVR32.EXE
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
Creates a writable file in the system directory
- pdf24-PrinterInstall.exe (PID: 3760)
- expand.exe (PID: 4092)
- expand.exe (PID: 3456)
- expand.exe (PID: 3808)
- expand.exe (PID: 752)
Actions looks like stealing of personal data
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
SUSPICIOUS
Executable content was dropped or overwritten
- pdf24-creator-9.6.0-x86.exe (PID: 748)
- pdf24-creator-9.6.0-x86.exe (PID: 1340)
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
- expand.exe (PID: 4092)
- expand.exe (PID: 3456)
- pdf24-PrinterInstall.exe (PID: 3760)
Reads security settings of Internet Explorer
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
- pdf24-Launcher.exe (PID: 1540)
Starts SC.EXE for service management
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
Uses WMIC.EXE to obtain data on processes
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
Reads the Windows owner or organization settings
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
Reads the Internet Settings
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
- WMIC.exe (PID: 2576)
- WMIC.exe (PID: 2248)
- WMIC.exe (PID: 2096)
- pdf24-Launcher.exe (PID: 1540)
Creates/Modifies COM task schedule object
- regsvr32.exe (PID: 3292)
- regsvr32.exe (PID: 3780)
Starts CMD.EXE for commands execution
- pdf24-PrinterInstall.exe (PID: 3760)
Process drops legitimate windows executable
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
- expand.exe (PID: 4092)
- expand.exe (PID: 3456)
- pdf24-PrinterInstall.exe (PID: 3760)
The process drops C-runtime libraries
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
Executes as Windows Service
- pdf24.exe (PID: 3524)
Reads Microsoft Outlook installation path
- pdf24-Launcher.exe (PID: 1540)
Checks Windows Trust Settings
- pdf24-Launcher.exe (PID: 1540)
Reads settings of System Certificates
- pdf24-Launcher.exe (PID: 1540)
INFO
Modifies the phishing filter of IE
- iexplore.exe (PID: 4052)
Application launched itself
- iexplore.exe (PID: 4052)
- msedge.exe (PID: 3548)
- msedge.exe (PID: 1168)
Checks supported languages
- pdf24-creator-9.6.0-x86.exe (PID: 748)
- pdf24-creator-9.6.0-x86.tmp (PID: 3776)
- pdf24-creator-9.6.0-x86.exe (PID: 1340)
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
- pdf24-PrinterInstall.exe (PID: 3760)
- pdf24-PrinterInstall.exe (PID: 2740)
- pdf24-Launcher.exe (PID: 1540)
- pdf24-PrinterInstall.exe (PID: 324)
- pdf24.exe (PID: 3440)
- pdf24.exe (PID: 3524)
- pdf24.exe (PID: 1932)
The process uses the downloaded file
- iexplore.exe (PID: 4052)
Drops the executable file immediately after the start
- iexplore.exe (PID: 3664)
- expand.exe (PID: 4092)
- expand.exe (PID: 3456)
Executable content was dropped or overwritten
- iexplore.exe (PID: 3664)
Create files in a temporary directory
- pdf24-creator-9.6.0-x86.exe (PID: 748)
- pdf24-creator-9.6.0-x86.exe (PID: 1340)
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
- pdf24-PrinterInstall.exe (PID: 3760)
- pdf24-PrinterInstall.exe (PID: 2740)
- pdf24.exe (PID: 1932)
- pdf24-PrinterInstall.exe (PID: 324)
Reads the computer name
- pdf24-creator-9.6.0-x86.tmp (PID: 3776)
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
- pdf24-PrinterInstall.exe (PID: 3760)
- pdf24-PrinterInstall.exe (PID: 2740)
- pdf24-PrinterInstall.exe (PID: 324)
- pdf24.exe (PID: 3524)
- pdf24.exe (PID: 1932)
- pdf24-Launcher.exe (PID: 1540)
- pdf24.exe (PID: 3440)
Creates a software uninstall entry
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
Creates files in the program directory
- pdf24-PrinterInstall.exe (PID: 3760)
- pdf24-creator-9.6.0-x86.tmp (PID: 2260)
- pdf24-PrinterInstall.exe (PID: 2740)
- pdf24.exe (PID: 3440)
- pdf24-PrinterInstall.exe (PID: 324)
Manual execution by a user
- msedge.exe (PID: 1168)
- pdf24-Launcher.exe (PID: 1540)
Reads the machine GUID from the registry
- pdf24-Launcher.exe (PID: 1540)
Reads the software policy settings
- pdf24-Launcher.exe (PID: 1540)
Creates files or folders in the user directory
- pdf24-Launcher.exe (PID: 1540)
Checks proxy server information
- pdf24-Launcher.exe (PID: 1540)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
100
Monitored processes
48
Malicious processes
7
Suspicious processes
2
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 324 | "C:\Program Files\PDF24\pdf24-PrinterInstall.exe" -printerName "PDF24 Fax" -portName "\\.\pipe\FaxPrint" -log "C:\Program Files\PDF24\faxPrnInst.log" -config fax installPrinter installCompatiblePrinter | C:\Program Files\PDF24\pdf24-PrinterInstall.exe | — | pdf24-creator-9.6.0-x86.tmp | |||||||||||
User: admin Company: geek software GmbH Integrity Level: HIGH Description: PDF24 PrinterInstall Exit code: 0 Version: 9.6.0 Modules
| |||||||||||||||
| 680 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3584 --field-trial-handle=1204,i,4318366816371229202,10475039304707094862,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 748 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\pdf24-creator-9.6.0-x86.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\pdf24-creator-9.6.0-x86.exe | iexplore.exe | ||||||||||||
User: admin Company: geek software GmbH Integrity Level: MEDIUM Description: PDF24 Creator Exit code: 0 Version: 9.6.0 Modules
| |||||||||||||||
| 752 | expand "c:\windows\system32\spool\drivers\w32x86\pcc\ntprint.inf_x86_neutral_88459cb66b0e2d44.cab" -F:PSCRIPT.NTF "C:\Windows\system32\spool\DRIVERS\W32X86" | C:\Windows\System32\expand.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: LZ Expansion Utility Exit code: 0 Version: 6.1.7601.24535 (win7sp1_ldr_escrow.191105-1059) Modules
| |||||||||||||||
| 1040 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1268 --field-trial-handle=1332,i,404089362182654112,17271954826871872121,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1168 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --flag-switches-begin --flag-switches-end --do-not-de-elevate https://www.pdf24.org/products/pdf-creator/afterInstall.php?version=9.6.0&iid=C81EE893-9B70-45CE-A451-6E3B7225849C&language=en | C:\Program Files\Microsoft\Edge\Application\msedge.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1220 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2156 --field-trial-handle=1204,i,4318366816371229202,10475039304707094862,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1264 | C:\Windows\system32\cmd.exe /c expand "c:\windows\system32\spool\drivers\w32x86\pcc\ntprint.inf_x86_neutral_88459cb66b0e2d44.cab" -F:PSCRIPT.NTF "C:\Windows\system32\spool\DRIVERS\W32X86" | C:\Windows\System32\cmd.exe | — | pdf24-PrinterInstall.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1316 | C:\Windows\system32\cmd.exe /c expand "c:\windows\system32\spool\drivers\w32x86\pcc\ntprint.inf_x86_neutral_88459cb66b0e2d44.cab" -F:PSCRIPT.HLP "C:\Windows\system32\spool\DRIVERS\W32X86" | C:\Windows\System32\cmd.exe | — | pdf24-PrinterInstall.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1340 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\pdf24-creator-9.6.0-x86.exe" /SPAWNWND=$80210 /NOTIFYWND=$80212 | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\PO2HN1X2\pdf24-creator-9.6.0-x86.exe | pdf24-creator-9.6.0-x86.tmp | ||||||||||||
User: admin Company: geek software GmbH Integrity Level: HIGH Description: PDF24 Creator Exit code: 0 Version: 9.6.0 Modules
| |||||||||||||||
Total events
40 100
Read events
39 723
Write events
290
Delete events
87
Modification events
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPDaysSinceLastAutoMigration |
Value: 1 | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchLowDateTime |
Value: | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TabbedBrowsing |
| Operation: | write | Name: | NTPLastLaunchHighDateTime |
Value: 31092307 | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateLowDateTime |
Value: | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\UrlBlockManager |
| Operation: | write | Name: | NextCheckForUpdateHighDateTime |
Value: 31092307 | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main |
| Operation: | write | Name: | CompatibilityFlags |
Value: 0 | |||
| (PID) Process: | (4052) iexplore.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
396
Suspicious files
563
Text files
1 385
Unknown types
415
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3664 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:753DF6889FD7410A2E9FE333DA83A429 | SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78 | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabFA0F.tmp | compressed | |
MD5:753DF6889FD7410A2E9FE333DA83A429 | SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78 | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\DY534W2X\A.font,,_fontello-c650def2,,_css,,_icon-font.css,,qv==659fcfea+js,,_dropzone,,_dropzone.css,,qv==651fad9b+js,,_utilz,,_utilz.css,,qv==63f78248+css,,_style[1].css | text | |
MD5:385150F2B189805D4BADAD30475D237C | SHA256:F53ABBA84DA6982AFAE40F6ABEA770908F1191B36C7DAA5AA1CE57C360BD5D96 | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BF5AF5FA52E2CF752DAA16705FD254CA | binary | |
MD5:E49C77E21E246817E780ECEF3230677C | SHA256:097897DDE3BED51663982E1844C2F4168516C27277FED68A3AE7CB5FA43D058E | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MFAQUS6V\creator[1].htm | html | |
MD5:F192D7840BB0744276CD5954DCFA1F04 | SHA256:2A1E87B4A6150B63242A683C5F2C837B6B2B2B0F8C6FFC638C72FFCBC2136D28 | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarFA10.tmp | cat | |
MD5:DD73CEAD4B93366CF3465C8CD32E2796 | SHA256:A6752B7851B591550E4625B832A393AABCC428DE18D83E8593CD540F7D7CAE22 | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157 | binary | |
MD5:5B1B76ED62257CFD7DC934269715AB48 | SHA256:4119036EEB015BF9F08DEED356D028C794FE02C04D69A5D0B524CA9FD9C261D5 | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 | binary | |
MD5:0EB238C38150DE6C93B2D237DBC08116 | SHA256:DB3BC148B78E70440A8DDBD59DE070B5B7EF31410DB746ECC9FAA4ED04A7BD46 | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\CabFA21.tmp | compressed | |
MD5:753DF6889FD7410A2E9FE333DA83A429 | SHA256:B42DC237E44CBC9A43400E7D3F9CBD406DBDEFD62BFE87328F8663897D69DF78 | |||
| 3664 | iexplore.exe | C:\Users\admin\AppData\Local\Temp\Low\TarFA22.tmp | cat | |
MD5:DD73CEAD4B93366CF3465C8CD32E2796 | SHA256:A6752B7851B591550E4625B832A393AABCC428DE18D83E8593CD540F7D7CAE22 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
16
TCP/UDP connections
83
DNS requests
59
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3664 | iexplore.exe | GET | 304 | 2.22.242.112:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?d362edf7b65e9a48 | unknown | — | — | unknown |
3664 | iexplore.exe | GET | 304 | 2.22.242.121:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?927e0d673a39dd41 | unknown | — | — | unknown |
3664 | iexplore.exe | GET | 200 | 2.19.245.44:80 | http://x1.c.lencr.org/ | unknown | binary | 717 b | unknown |
3664 | iexplore.exe | GET | 200 | 2.22.242.121:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0302b3af7cdfdbed | unknown | compressed | 67.5 Kb | unknown |
3664 | iexplore.exe | GET | 200 | 2.22.242.112:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?5b0325f31ae0f9b6 | unknown | compressed | 67.5 Kb | unknown |
3664 | iexplore.exe | GET | 200 | 2.16.241.8:80 | http://r3.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBRI2smg%2ByvTLU%2Fw3mjS9We3NfmzxAQUFC6zF7dYVsuuUAlA5h%2BvnYsUwsYCEgR14AuRYMCOPQbh%2BiCurBtjRw%3D%3D | unknown | binary | 503 b | unknown |
4052 | iexplore.exe | GET | 304 | 2.22.242.112:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?4dd617501e33218a | unknown | — | — | unknown |
4052 | iexplore.exe | GET | 304 | 2.22.242.112:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/disallowedcertstl.cab?bdc5ae628aaf0bd4 | unknown | — | — | unknown |
4052 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAzlnDD9eoNTLi0BRrMy%2BWU%3D | unknown | binary | 312 b | unknown |
4052 | iexplore.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | binary | 471 b | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
3664 | iexplore.exe | 88.99.34.112:443 | tools.pdf24.org | Hetzner Online GmbH | DE | unknown |
3664 | iexplore.exe | 2.22.242.112:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
3664 | iexplore.exe | 2.22.242.121:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
3664 | iexplore.exe | 2.19.245.44:80 | x1.c.lencr.org | AKAMAI-AS | DE | unknown |
3664 | iexplore.exe | 2.16.241.8:80 | r3.o.lencr.org | Akamai International B.V. | DE | unknown |
4052 | iexplore.exe | 88.99.34.112:443 | tools.pdf24.org | Hetzner Online GmbH | DE | unknown |
4052 | iexplore.exe | 2.22.242.112:80 | ctldl.windowsupdate.com | Akamai International B.V. | DE | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
tools.pdf24.org |
| shared |
ctldl.windowsupdate.com |
| whitelisted |
x1.c.lencr.org |
| whitelisted |
r3.o.lencr.org |
| shared |
consent.pdf24.org |
| unknown |
api.bing.com |
| whitelisted |
www.bing.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
download.pdf24.org |
| unknown |
r20swj13mr.microsoft.com |
| whitelisted |