File name:

pdf24-creator-installer.exe

Full analysis: https://app.any.run/tasks/1abd9ef1-0688-4ae5-b600-573443b34421
Verdict: Malicious activity
Analysis date: February 21, 2025, 12:46:29
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
arch-doc
delphi
inno
installer
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

9AC8560D27B0FFC0DAF6F54974B059D1

SHA1:

A6805E50710D54E952532BF43E0A50AE55A049C6

SHA256:

F62FBA626DADF2B4DF26E92A8E1D358F680BF13B567112A7066F68D91D07D4EC

SSDEEP:

12288:B0mnEV/OX5bWqVVX7pV7JYpopr+wCarSMadLVAy3Cy8RuH6DLcywRBflHuN5DU:B0mnEVsbrchwady8UM9uN5DU

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • pdf24-creator-installer.exe (PID: 3840)
      • pdf24-creator.exe (PID: 2928)
      • pdf24-creator.exe (PID: 1400)

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • pdf24-creator-installer.exe (PID: 3840)
      • pdf24-creator.tmp (PID: 4804)
      • pdf24-creator.tmp (PID: 1916)

    • There is functionality for taking screenshot (YARA)

      • pdf24-creator-installer.exe (PID: 3840)

    • Checks Windows Trust Settings

      • pdf24-creator-installer.exe (PID: 3840)

    • Executable content was dropped or overwritten

      • pdf24-creator.exe (PID: 2928)
      • pdf24-creator.exe (PID: 1400)
      • pdf24-creator.tmp (PID: 1916)

    • Reads the Windows owner or organization settings

      • pdf24-creator.tmp (PID: 1916)

    • Stops a currently running service

      • sc.exe (PID: 6056)

    • The process drops C-runtime libraries

      • pdf24-creator.tmp (PID: 1916)

    • Process drops legitimate windows executable

      • pdf24-creator.tmp (PID: 1916)

    • Uses WMIC.EXE to obtain data on processes

      • pdf24-creator.tmp (PID: 1916)

  • INFO

    • The sample compiled with english language support

      • pdf24-creator-installer.exe (PID: 3840)
      • pdf24-creator.tmp (PID: 1916)

    • Reads the computer name

      • pdf24-creator-installer.exe (PID: 3840)
      • pdf24-creator.tmp (PID: 4804)
      • pdf24-creator.exe (PID: 1400)
      • pdf24-creator.tmp (PID: 1916)

    • Reads the machine GUID from the registry

      • pdf24-creator-installer.exe (PID: 3840)

    • Checks supported languages

      • pdf24-creator-installer.exe (PID: 3840)
      • pdf24-creator.exe (PID: 2928)
      • pdf24-creator.tmp (PID: 4804)
      • pdf24-creator.exe (PID: 1400)
      • pdf24-creator.tmp (PID: 1916)

    • Reads the software policy settings

      • pdf24-creator-installer.exe (PID: 3840)

    • Create files in a temporary directory

      • pdf24-creator-installer.exe (PID: 3840)
      • pdf24-creator.exe (PID: 2928)
      • pdf24-creator.exe (PID: 1400)
      • pdf24-creator.tmp (PID: 1916)

    • Checks proxy server information

      • pdf24-creator-installer.exe (PID: 3840)

    • Creates files or folders in the user directory

      • pdf24-creator-installer.exe (PID: 3840)

    • Process checks computer location settings

      • pdf24-creator-installer.exe (PID: 3840)
      • pdf24-creator.tmp (PID: 4804)
      • pdf24-creator.tmp (PID: 1916)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 2084)
      • WMIC.exe (PID: 1292)
      • WMIC.exe (PID: 2624)

    • Detects InnoSetup installer (YARA)

      • pdf24-creator.exe (PID: 2928)
      • pdf24-creator.exe (PID: 1400)
      • pdf24-creator.tmp (PID: 1916)
      • pdf24-creator.tmp (PID: 4804)

    • Creates files in the program directory

      • pdf24-creator.tmp (PID: 1916)

    • Compiled with Borland Delphi (YARA)

      • pdf24-creator.exe (PID: 2928)
      • pdf24-creator.tmp (PID: 4804)
      • pdf24-creator.exe (PID: 1400)
      • pdf24-creator.tmp (PID: 1916)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win64 Executable (generic) (76.4)
.exe | Win32 Executable (generic) (12.4)
.exe | Generic Win/DOS Executable (5.5)
.exe | DOS Executable Generic (5.5)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2025:01:15 11:46:15+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 14.42
CodeSize: 348160
InitializedDataSize: 306688
UninitializedDataSize: -
EntryPoint: 0x2e1c4
OSVersion: 6
ImageVersion: -
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 1.0.0.0
ProductVersionNumber: 1.0.0.0
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
FileVersion: 1.0.0
ProductVersion: 1.0.0
CompanyName: geek software GmbH
ProductName: PDF24 Creator Installer
LegalCopyright: geek software GmbH
InternalName: PDF24 Creator Installer
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
141
Monitored processes
13
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start pdf24-creator-installer.exe pdf24-creator.exe pdf24-creator.tmp no specs pdf24-creator.exe pdf24-creator.tmp sc.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs wmic.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1292"C:\Windows\System32\wbem\WMIC.exe" PROCESS WHERE "Name='pdf24.exe'" CALL TERMINATEC:\Windows\SysWOW64\wbem\WMIC.exe—pdf24-creator.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
1400"C:\Users\admin\AppData\Local\Temp\pdf24-creator.exe" /SPAWNWND=$5035A /NOTIFYWND=$6034E /FromSmallInstaller /SkipLicensePage /SILENTC:\Users\admin\AppData\Local\Temp\pdf24-creator.exe
pdf24-creator.tmp
User:
admin
Company:
geek software GmbH
Integrity Level:
HIGH
Description:
PDF24 Creator
Version:
11.23.0
Modules
Images
c:\users\admin\appdata\local\temp\pdf24-creator.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
1760\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—sc.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1916"C:\Users\admin\AppData\Local\Temp\is-UUDQ0.tmp\pdf24-creator.tmp" /SL5="$702D6,365614836,835072,C:\Users\admin\AppData\Local\Temp\pdf24-creator.exe" /SPAWNWND=$5035A /NOTIFYWND=$6034E /FromSmallInstaller /SkipLicensePage /SILENTC:\Users\admin\AppData\Local\Temp\is-UUDQ0.tmp\pdf24-creator.tmp
pdf24-creator.exe
User:
admin
Company:
geek software GmbH
Integrity Level:
HIGH
Description:
Setup/Uninstall
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-uudq0.tmp\pdf24-creator.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
2084"C:\Windows\System32\wbem\WMIC.exe" PROCESS WHERE "Name='pdf24-Reader.exe' AND CommandLine LIKE '%/shellPreview%'" CALL TERMINATEC:\Windows\SysWOW64\wbem\WMIC.exe—pdf24-creator.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2624"C:\Windows\System32\wbem\WMIC.exe" PROCESS WHERE "Name='prevhost.exe' AND CommandLine LIKE '%{09E6D117-5330-4A29-8C20-0C3AF9F90A1C}%'" CALL TERMINATEC:\Windows\SysWOW64\wbem\WMIC.exe—pdf24-creator.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
WMI Commandline Utility
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\wbem\wmic.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2792\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2904\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WMIC.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2928"C:\Users\admin\AppData\Local\Temp\pdf24-creator.exe" /FromSmallInstaller /SkipLicensePage /SILENTC:\Users\admin\AppData\Local\Temp\pdf24-creator.exe
pdf24-creator-installer.exe
User:
admin
Company:
geek software GmbH
Integrity Level:
MEDIUM
Description:
PDF24 Creator
Version:
11.23.0
Modules
Images
c:\users\admin\appdata\local\temp\pdf24-creator.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
3840"C:\Users\admin\AppData\Local\Temp\pdf24-creator-installer.exe" C:\Users\admin\AppData\Local\Temp\pdf24-creator-installer.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\pdf24-creator-installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
1 980
Read events
1 977
Write events
3
Delete events
0

Modification events

(PID) Process:(3840) pdf24-creator-installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(3840) pdf24-creator-installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(3840) pdf24-creator-installer.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
Executable files
202
Suspicious files
1 287
Text files
1 393
Unknown types
1

Dropped files

PID
Process
Filename
Type
3840pdf24-creator-installer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\KCV3KQBA\pdf24-creator-11.23.0-x64[1].exe —
MD5:—
SHA256:—
3840pdf24-creator-installer.exeC:\Users\admin\AppData\Local\Temp\pdf24-creator.exe —
MD5:—
SHA256:—
3840pdf24-creator-installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751binary
MD5:47CF61EC70A340F5AE77928C64135FC9
SHA256:376322D49028C51667D2DCB0B2CCA2F3546EA020DCB0066BC06FD80856BFC478
3840pdf24-creator-installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
3840pdf24-creator-installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70183DE3F77B9C824C4AB403E252A996binary
MD5:3CB41ED32F201FB2AE7C16CD9C248910
SHA256:BCD568D09CF6AB058D75A5D3122BEAC863D55A2E26C71CCB22B75AE29390A1FC
1916pdf24-creator.tmpC:\Program Files\PDF24\is-OCOEI.tmpexecutable
MD5:7E224C05C0CDC41F8EC184ADD6D9DD64
SHA256:434342629B982A9B467914ED26826B31E723E1F33F5B0C62434A0B3EBCFDB949
3840pdf24-creator-installer.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\pdf24-creator-latest-x64[1].htmhtml
MD5:FC2A1A5880025C2D294C3D7030F59B05
SHA256:4796011BF77495529013046ED013469B54177800FB37082A164AF1A7E970BC59
1400pdf24-creator.exeC:\Users\admin\AppData\Local\Temp\is-UUDQ0.tmp\pdf24-creator.tmpexecutable
MD5:429ED1D6CE36D693E97CF64E40735EC7
SHA256:5E0B351CED501E497B8F0C10250A66DBEDFE9252BD61B24BE912DF6870D8AFC2
3840pdf24-creator-installer.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\70183DE3F77B9C824C4AB403E252A996binary
MD5:642D79C531F32BFDED61D32C1768AC2D
SHA256:A62B2C7BD83A3227412C73216E3BDF50B35F97B8526D205C434382BC00F24415
1916pdf24-creator.tmpC:\Program Files\PDF24\concrt140.dllexecutable
MD5:8FC1C2F2EBB7E46DF30ECD772622B0BC
SHA256:E2E4609C569C69F7B1686F6D0E81CE62187AC5DF05E0247954500053B3C3DE3F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
36
DNS requests
23
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4712
MoUsoCoreWorker.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4712
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
3840
pdf24-creator-installer.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
3840
pdf24-creator-installer.exe
GET
200
184.24.77.52:80
http://e6.o.lencr.org/MFMwUTBPME0wSzAJBgUrDgMCGgUABBTUejiAQejpjQc4fOz2ttjyD6VkMQQUDcXM%2FZvuFAWhTDCCpT5eisNYCdICEgPBARXEJ%2BQ9ut0iVd81jHBWpg%3D%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
5880
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
5880
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4444
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
92.123.104.30:443
—
Akamai International B.V.
DE
unknown
—
—
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4712
MoUsoCoreWorker.exe
23.48.23.143:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4712
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
5064
SearchApp.exe
92.123.104.30:443
—
Akamai International B.V.
DE
unknown
3840
pdf24-creator-installer.exe
88.198.205.206:443
download.pdf24.org
Hetzner Online GmbH
DE
unknown
3840
pdf24-creator-installer.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted
3840
pdf24-creator-installer.exe
184.24.77.52:80
e6.o.lencr.org
Akamai International B.V.
DE
whitelisted
1076
svchost.exe
23.35.238.131:443
go.microsoft.com
AKAMAI-AS
DE
whitelisted
1176
svchost.exe
40.126.31.2:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 23.48.23.143
  • 23.48.23.162
  • 23.48.23.190
  • 23.48.23.161
  • 23.48.23.183
  • 23.48.23.194
  • 23.48.23.180
  • 23.48.23.158
  • 23.48.23.156
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.219.150.101
whitelisted
google.com
  • 142.250.186.174
whitelisted
download.pdf24.org
  • 88.198.205.206
  • 128.140.92.59
  • 91.107.177.140
  • 195.201.227.97
  • 128.140.108.66
  • 5.75.227.95
  • 157.90.231.214
  • 157.90.115.179
  • 116.203.147.5
unknown
x1.c.lencr.org
  • 69.192.161.44
whitelisted
e6.o.lencr.org
  • 184.24.77.52
  • 184.24.77.67
  • 184.24.77.54
  • 184.24.77.80
  • 184.24.77.46
  • 184.24.77.48
  • 184.24.77.53
  • 184.24.77.83
  • 184.24.77.45
whitelisted
go.microsoft.com
  • 23.35.238.131
whitelisted
login.live.com
  • 40.126.31.2
  • 20.190.159.75
  • 20.190.159.73
  • 40.126.31.128
  • 40.126.31.131
  • 20.190.159.0
  • 20.190.159.68
  • 20.190.159.4
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
pdf24-creator-installer.exe