File scan report

Verdict Safe

Analyzed Oct 27, 20264 hours ago

Is PIM.dll safe? Yes, no threats found.

A validly Adobe-signed component DLL, first seen on Jun 28, 2021 and shared by thousands of sources, that none of the 70 antivirus engines that checked it flagged.

Read the whole reasonShow less

Strong evidence · A verified publisher signature, and no engine flags it.

Use it as usual if it came from the official source

No action is required; this signed Adobe component can be kept. As always, install Adobe software only from Adobe's official channels.

Good practice2 tips

We found nothing harmful in this file.

Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Antivirus results

0 of 70 flagged

Flagged 0
No detection 70
No result 5

FilePIM.dll2.2 MBSHA-256 7917708a9f34…b03b51

Code signing Adobe Inc.
Test run Completed
First seen 5y ago

It has a long history: seen by 3,709 sources over more than six months.

Chapter 02

Why we think so

0 points against it and 5 in its favour, checked against the scan evidence.

Analyst conclusion

This DLL carries a valid Adobe Inc. signature and none of the 70 antivirus engines that checked it flagged it. It has been submitted by over 3,700 sources since Jun 28, 2021. In the sandbox runs it only wrote to Adobe's own setup folder, and the combined sandbox verdict was clean.

Where this verdict could be wrong1 caveat

Our publisher history for this signer is small, with only four earlier samples on record, but none of them was malicious.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 4 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete

4isolated sandbox runs
29sandbox rule tags
2spawned processes
8network contacts
40filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was detonated in 4 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEANclean

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1010
T1012
T1018
T1027· Obfuscated code
T1027.005· Obfuscated code
T1033· Reads user info
T1036
T1047
T1053.005· Scheduled task
T1055· Process injection
T1056· Keylogging
T1057· Lists programs
T1059· Runs commands
T1071· Application protocol
T1082· System recon
T1083· Scans your files
T1087
T1095· Custom network
T1112
T1129· Loads modules
T1134
T1213
T1218.011
T1222
T1497· Sandbox evasion
T1518· Checks your AV
T1518.001· Checks your AV
T1547.001· Auto-start
T1614.001

Observed activity

Processes started

Programs the file ran, with their command lines.

rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\readme.dll",#1
wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding

Network contacts

8 hosts, listed as 3 domains, 5 addresses. Links show the host and path only.

Domainimg-prod-cms-rt-microsoft-com.akamaized.net
Domainlogin.live.com
Domainprda.aadg.msidentity.com
IP address20.42.65.92
IP address13.89.179.12
IP address20.42.73.29

Show all 8 entries

IP address52.168.117.173
IP address104.208.16.94

Files

Files the file created, changed or deleted.

WrittenC:\temp\{AA29A12E-AED7-4D58-AE3C-399347A03EF2}\OOBE
WrittenC:\Program Files (x86)
WrittenC:\Program Files (x86)\Common Files
WrittenC:\Program Files (x86)\Common Files\Adobe
WrittenC:\Program Files (x86)\Common Files\Adobe\OOBE
WrittenC:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp

Show all 30 entries

WrittenC:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db
WrittenC:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db-journal
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_ae7bc89b6bac970c0e8bce4599c172ae7b5db_82810a17_19df08bc
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_ae7bc89b6bac970c0e8bce4599c172ae7b5db_82810a17_19df08bc\Report.wer
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_de9d4e3632a6bc0f94a12a26aebac9570a0dedf_82810a17_16cf27ec
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_de9d4e3632a6bc0f94a12a26aebac9570a0dedf_82810a17_16cf27ec\Report.wer
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_de9d4e3632a6bc0f94a12a26aebac9570a0dedf_82810a17_19831406
WrittenC:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_rundll32.exe_de9d4e3632a6bc0f94a12a26aebac9570a0dedf_82810a17_19831406\Report.wer
WrittenC:\ProgramData\Microsoft\Windows\WER\Temp\WER16E6.tmp
DeletedC:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db-journal
DeletedC:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\pim.db
DeletedC:\Program Files (x86)\Common Files\Adobe\OOBE
DeletedC:\temp\{AA29A12E-AED7-4D58-AE3C-399347A03EF2}\OOBE\PDApp
DeletedC:\temp\{AA29A12E-AED7-4D58-AE3C-399347A03EF2}\OOBE
DeletedC:\temp\{AA29A12E-AED7-4D58-AE3C-399347A03EF2}
DeletedC:\temp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER16E6.tmp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER16E6.tmp.WERInternalMetadata.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER19D5.tmp
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER19D5.tmp.xml
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER19E6.tmp.csv
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER1B8.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER1DCF.tmp.txt
DeletedC:\ProgramData\Microsoft\Windows\WER\Temp\WER2E1.tmp

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

SetHKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Debug\StoreLocation
SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0174E68C97DDF1E0EEEA415EA336A163D2B61AFD\Blob
SetHKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Windows\Windows Error Reporting\Debug\StoreLocation
Set\REGISTRY\A\{be2bdf7c-0f03-e055-fcfb-54679c97c4c3}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Set\REGISTRY\A\{be2bdf7c-0f03-e055-fcfb-54679c97c4c3}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788
SetHKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\Windows\Windows Error Reporting\Debug

Show all 15 entries

SetHKEY_LOCAL_MACHINE\Software\WOW6432Node\Microsoft\IdentityCRL\ClockData
SetHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\AmiHivePermissionsCorrect
SetHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\AmiHiveOwnerCorrect
Set\REGISTRY\A\{be2bdf7c-0f03-e055-fcfb-54679c97c4c3}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\ProgramId
Set\REGISTRY\A\{be2bdf7c-0f03-e055-fcfb-54679c97c4c3}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\FileId
Set\REGISTRY\A\{be2bdf7c-0f03-e055-fcfb-54679c97c4c3}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\LowerCaseLongPath
Set\REGISTRY\A\{be2bdf7c-0f03-e055-fcfb-54679c97c4c3}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\LongPathHash
Set\REGISTRY\A\{be2bdf7c-0f03-e055-fcfb-54679c97c4c3}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\Name
Set\REGISTRY\A\{be2bdf7c-0f03-e055-fcfb-54679c97c4c3}\Root\InventoryApplicationFile\rundll32.exe|ccf370e740f0e788\Publisher

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

ACC.log
Global\359dca4322b8b4a0f7f92bf448150fb
Global\{3EBE6875-9C4E-4782-8A43-275AFFFCA6FB}
Global\SyncRootManager
\Sessions\1\BaseNamedObjects\ACC.log
\Sessions\1\BaseNamedObjects\Global\359dca4322b8b4a0f7f92bf448150fb

Show all 10 entries

\Sessions\1\BaseNamedObjects\Global\{3EBE6875-9C4E-4782-8A43-275AFFFCA6FB}
\Sessions\1\BaseNamedObjects\Global\SyncRootManager
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6856
\Sessions\1\BaseNamedObjects\Global\AmiProviderMutex_InventoryApplicationFile

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processExplorer.EXEC:\Windows\Explorer.EXE
VM processservices.exeC:\Windows\system32\services.exe
VM processsvchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p
VM processsvchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
VM host92.65.42.20.in-addr.arpa
VM hostfp2E7A.wpc.2BE4.phicdn.net

Show all 10 entries

VM host173.117.168.52.in-addr.arpa
VM host33.28.101.95.in-addr.arpa
VM hostfp2e7a.wpc.phicdn.net
VM host18.115.17.2.in-addr.arpa

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

d59ef1b3df42961327a2…0a86d5Not checked
no saved verdict
11fcd5165f8c809570f4…77f419Not checked
no saved verdict
719c494230422240eda3…2b4a2eNot checked
no saved verdict
08a4504245ed77cf2722…c8c58aNot checked
no saved verdict
1be2f2e118ad37bc257d…eb0b30Not checked
no saved verdict
c0b194919f9cc9dbd05e…3499eaNot checked
no saved verdict
ab161569ffa4a5abd096…bc14a8Not checked
no saved verdict
ce68d716fcaf0f846c17…e7de1aNot checked
no saved verdict
6581739eedeab1f93bbf…bcca97Not checked
no saved verdict
7e9e19f8f358f65d294e…dcfbb8Not checked
no saved verdict

Chapter 04

Technical details

None of the 70 antivirus engines that checked it flag it; signed by Adobe Inc..

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 70 engines flagged it · 5 gave no result DetailsOct 22, 2026

Sandbox runVirusTotal sandboxes · C2AE, CAPA, CAPE SandboxComplete4 runs: 1 clean, 3 without a verdict DetailsOct 27, 2026

Contacted hostsMalwareTips URL scannerComplete14 contacted hosts checked DetailsOct 27, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 community YARA rule (generic only) · 1 MalwareTips behaviour rule DetailsOct 27, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 27, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 27, 2026

File fingerprint

Last analyzed: Oct 27, 2026, 6:51 PM UTC

SHA-256: 7917708a9f343067e01242423eaa73ae981e20ce07ace6274fdcc71ee2b03b51
SHA-1: 23c4a09cd6a63850c94109b7b8cbbc197f38931d
MD5: 7efc2b6852333d9ebac124d4844ba2af

About this file

PIM.dll says it is PIM DLL, 2.2 MB.

Claims to be: PIM DLLFrom the file's own version information, written by whoever built it.
Original name: PIM.dllMatches the shared file name.
Type and size: Win32 DLL · 2.2 MB
Signer: Adobe Inc.Valid code signature.
First seen: Jun 28, 2021On VirusTotal.
Submitted by: 3,709 distinct sources
Packer: None detected
Entropy: 6.40 of 8

First scanned Oct 27, 2026

Antivirus consensus

0 of 70 engines flagged this file

0 malicious0 suspicious70 not flagged5 no result

5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-235 engines
0flagged
Low-trust17 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetClean
DeepInstinctClean
DrWebClean
ElasticClean
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleNo result
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisClean
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.

1 YARA1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Community YARA rules

Researcher-authored signatures reported by YARAify

pdb_YARAifygeneric

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.

ent 6.40Unpacked

Section entropy5 sections

.text

6.68

.rdata

5.18

.data

4.79

.rsrc

3.67

.reloc

6.72

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.

Common & old

Unique uploaders

3,709

Hundreds of people have uploaded this — common.

Total submissions

23,357

Includes repeat uploads by the same source.

First seen

5y ago

Jun 28, 2021

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

here

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is PIM.dll safe?

We found nothing harmful in PIM.dll. None of the 70 antivirus engines that checked it flag it. It has a valid digital signature from Adobe Inc.. Use it only as part of a program you got from the developer's own website.

What is PIM.dll?

PIM.dll is a Windows library (DLL), about 2.2 MB. Its version information says it is “PIM DLL”. The digital signature from Adobe Inc. checks out. VirusTotal first saw it on Jun 28, 2021.

How many antivirus engines detected PIM.dll?

None of the 70 antivirus engines that checked it flag PIM.dll. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

Is PIM.dll digitally signed?

Yes. PIM.dll has a valid digital signature from Adobe Inc., which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of PIM.dll?

The SHA-256 fingerprint of PIM.dll is 7917708a9f343067e01242423eaa73ae981e20ce07ace6274fdcc71ee2b03b51, and its MD5 is 7efc2b6852333d9ebac124d4844ba2af. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to use PIM.dll?

We found nothing harmful in PIM.dll, and its digital signature checks out. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of PIM.dll?

This report reflects the scan on Oct 27, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is PIM.dll safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

0 of 70 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is PIM.dll safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Related file reports