File name:

CPS-Digital setup 1.0.0.12.exe

Full analysis: https://app.any.run/tasks/ead695da-7ce6-47b6-a516-67766fb47652
Verdict: Malicious activity
Analysis date: May 13, 2025, 08:40:05
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
inno
installer
delphi
winring0x64-sys
vuln-driver
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 11 sections
MD5:

BF07EB36FC88F6718239F496182BB573

SHA1:

7D588E0DBA7448EB331459770B5310CA233EFD1D

SHA256:

039FADB22CD33BE780EE3F98A13E2AF952628FA5244BB1917631FC2D14D3B281

SSDEEP:

98304:Urq3BdwQCeC/CxdGf272JyJ7Yd8lkyQxqg85LpeGIrtB1ES1gWdJ3pCbD4jYV9j+:8l4CbL

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Vulnerable driver has been detected

      • OpenHardwareMonitorServer.exe (PID: 7984)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • CPS-Digital setup 1.0.0.12.exe (PID: 7216)
      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)
      • OpenHardwareMonitorServer.exe (PID: 7984)

    • Reads the Windows owner or organization settings

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Reads security settings of Internet Explorer

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)
      • DeviceDriver.exe (PID: 7940)

    • Uses TASKKILL.EXE to kill process

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Process drops legitimate windows executable

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • The process drops C-runtime libraries

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Drops a system driver (possible attempt to evade defenses)

      • OpenHardwareMonitorServer.exe (PID: 7984)

  • INFO

    • Reads the computer name

      • CPS-Digital setup 1.0.0.12.exe (PID: 7216)
      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)
      • DeviceDriver.exe (PID: 7940)
      • OpenHardwareMonitorServer.exe (PID: 7984)

    • Create files in a temporary directory

      • CPS-Digital setup 1.0.0.12.exe (PID: 7216)
      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Checks supported languages

      • CPS-Digital setup 1.0.0.12.exe (PID: 7216)
      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)
      • OpenHardwareMonitorServer.exe (PID: 7984)
      • DeviceDriver.exe (PID: 7940)
      • DeviceDriver.exe (PID: 1348)

    • Process checks computer location settings

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Creates files in the program directory

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)
      • OpenHardwareMonitorServer.exe (PID: 7984)

    • The sample compiled with english language support

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Creates a software uninstall entry

      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Detects InnoSetup installer (YARA)

      • CPS-Digital setup 1.0.0.12.exe (PID: 7216)
      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Compiled with Borland Delphi (YARA)

      • CPS-Digital setup 1.0.0.12.exe (PID: 7216)
      • CPS-Digital setup 1.0.0.12.tmp (PID: 7240)

    • Reads the machine GUID from the registry

      • DeviceDriver.exe (PID: 7940)

    • Checks proxy server information

      • DeviceDriver.exe (PID: 7940)

    • The sample compiled with japanese language support

      • OpenHardwareMonitorServer.exe (PID: 7984)

    • Creates files or folders in the user directory

      • DeviceDriver.exe (PID: 7940)

    • Reads the software policy settings

      • DeviceDriver.exe (PID: 7940)
      • slui.exe (PID: 7292)

    • Manual execution by a user

      • DeviceDriver.exe (PID: 3096)
      • DeviceDriver.exe (PID: 7148)
      • DeviceDriver.exe (PID: 7924)
      • DeviceDriver.exe (PID: 7428)
      • DeviceDriver.exe (PID: 1348)
      • DeviceDriver.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (67.7)
.exe | Win32 EXE PECompact compressed (generic) (25.6)
.exe | Win32 Executable (generic) (2.7)
.exe | Win16/32 Executable Delphi generic (1.2)
.exe | Generic Win/DOS Executable (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2024:07:12 07:26:53+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 2.25
CodeSize: 685056
InitializedDataSize: 156160
UninitializedDataSize: -
EntryPoint: 0xa83bc
OSVersion: 6.1
ImageVersion: -
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName:
FileDescription: CPS-Digital Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: CPS-Digital
ProductVersion: 1.0.0.12
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
17
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start cps-digital setup 1.0.0.12.exe cps-digital setup 1.0.0.12.tmp sppextcomobj.exe no specs slui.exe taskkill.exe no specs conhost.exe no specs devicedriver.exe THREAT openhardwaremonitorserver.exe devicedriver.exe no specs devicedriver.exe devicedriver.exe no specs slui.exe no specs devicedriver.exe devicedriver.exe no specs devicedriver.exe openhardwaremonitorserver.exe no specs cps-digital setup 1.0.0.12.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1348"C:\Program Files\CPS-Digital\DeviceDriver.exe" C:\Program Files\CPS-Digital\DeviceDriver.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\cps-digital\devicedriver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\setupapi.dll
c:\windows\syswow64\msvcrt.dll
2420"C:\Program Files\CPS-Digital\DeviceDriver.exe" C:\Program Files\CPS-Digital\DeviceDriver.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\program files\cps-digital\devicedriver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
3096"C:\Program Files\CPS-Digital\DeviceDriver.exe" C:\Program Files\CPS-Digital\DeviceDriver.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\program files\cps-digital\devicedriver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
4880"C:\Users\admin\Desktop\CPS-Digital setup 1.0.0.12.exe" C:\Users\admin\Desktop\CPS-Digital setup 1.0.0.12.exe—explorer.exe
User:
admin
Company:
Integrity Level:
MEDIUM
Description:
CPS-Digital Setup
Exit code:
3221226540
Version:
Modules
Images
c:\users\admin\desktop\cps-digital setup 1.0.0.12.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
7148"C:\Program Files\CPS-Digital\DeviceDriver.exe" C:\Program Files\CPS-Digital\DeviceDriver.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\program files\cps-digital\devicedriver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\setupapi.dll
7216"C:\Users\admin\Desktop\CPS-Digital setup 1.0.0.12.exe" C:\Users\admin\Desktop\CPS-Digital setup 1.0.0.12.exe
explorer.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
CPS-Digital Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\desktop\cps-digital setup 1.0.0.12.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comctl32.dll
7240"C:\Users\admin\AppData\Local\Temp\is-DOG06.tmp\CPS-Digital setup 1.0.0.12.tmp" /SL5="$8028C,3585567,842240,C:\Users\admin\Desktop\CPS-Digital setup 1.0.0.12.exe" C:\Users\admin\AppData\Local\Temp\is-DOG06.tmp\CPS-Digital setup 1.0.0.12.tmp
CPS-Digital setup 1.0.0.12.exe
User:
admin
Company:
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-dog06.tmp\cps-digital setup 1.0.0.12.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
7260C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
7292"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7336"C:\Program Files\CPS-Digital\\HardwareMonitor\OpenHardwareMonitorServer.exe"C:\Program Files\CPS-Digital\HardwareMonitor\OpenHardwareMonitorServer.exe—DeviceDriver.exe
User:
admin
Integrity Level:
HIGH
Description:
OpenHardwareMonitorServer
Version:
1.0.0.0
Modules
Images
c:\program files\cps-digital\hardwaremonitor\openhardwaremonitorserver.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\advapi32.dll
Total events
2 619
Read events
2 586
Write events
33
Delete events
0

Modification events

(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.myp\OpenWithProgids
Operation:writeName:CPS-DigitalFile.myp
Value:
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\DeviceDriver.exe\SupportedTypes
Operation:writeName:.myp
Value:
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_CURRENT_USER\SOFTWARE\CPS-Digital
Operation:writeName:LCID
Value:
1033
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DFDE92CF-050B-4D44-8580-9C665C255D31}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.3.3
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DFDE92CF-050B-4D44-8580-9C665C255D31}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\CPS-Digital
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DFDE92CF-050B-4D44-8580-9C665C255D31}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\CPS-Digital\
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DFDE92CF-050B-4D44-8580-9C665C255D31}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DFDE92CF-050B-4D44-8580-9C665C255D31}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DFDE92CF-050B-4D44-8580-9C665C255D31}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(7240) CPS-Digital setup 1.0.0.12.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DFDE92CF-050B-4D44-8580-9C665C255D31}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
Executable files
29
Suspicious files
11
Text files
32
Unknown types
0

Dropped files

PID
Process
Filename
Type
7240CPS-Digital setup 1.0.0.12.tmpC:\Users\admin\AppData\Local\Temp\is-F4S3P.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
7240CPS-Digital setup 1.0.0.12.tmpC:\Program Files\CPS-Digital\is-1AS9G.tmpexecutable
MD5:A47528D67392E9D5C2E18A626BF8F0BF
SHA256:501CA13A515200E0F340F59FEB12638E7883C9AC78F9A0AA14C1E2E7560AE431
7240CPS-Digital setup 1.0.0.12.tmpC:\Program Files\CPS-Digital\unins000.exeexecutable
MD5:28F65C9D36FF71735BF12177D6F129CF
SHA256:8E3FB8F745C0A9355D7C7ED23832796B24C45880F1A8C79E5097A4ED3DB79E4C
7240CPS-Digital setup 1.0.0.12.tmpC:\Program Files\CPS-Digital\DeviceDriver.exeexecutable
MD5:A47528D67392E9D5C2E18A626BF8F0BF
SHA256:501CA13A515200E0F340F59FEB12638E7883C9AC78F9A0AA14C1E2E7560AE431
7240CPS-Digital setup 1.0.0.12.tmpC:\Program Files\CPS-Digital\is-0BKUF.tmpexecutable
MD5:C092885EA11BD80D35CB55C7D488F1E2
SHA256:885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
7240CPS-Digital setup 1.0.0.12.tmpC:\Program Files\CPS-Digital\is-83LOD.tmpexecutable
MD5:A47528D67392E9D5C2E18A626BF8F0BF
SHA256:501CA13A515200E0F340F59FEB12638E7883C9AC78F9A0AA14C1E2E7560AE431
7240CPS-Digital setup 1.0.0.12.tmpC:\Program Files\CPS-Digital\is-FDFT1.tmpexecutable
MD5:31CE620CB32AC950D31E019E67EFC638
SHA256:1E0F8F7F13502F5CEE17232E9BEBCA7B44DD6EC29F1842BB61033044C65B2BBF
7216CPS-Digital setup 1.0.0.12.exeC:\Users\admin\AppData\Local\Temp\is-DOG06.tmp\CPS-Digital setup 1.0.0.12.tmpexecutable
MD5:2A48B00D247C2E4CAF3E250A0AEA5318
SHA256:A1E2DBAA8FB2DE1F489E5F48712039E4DA95D909EF5F6FC5C3D81038F22E686F
7240CPS-Digital setup 1.0.0.12.tmpC:\Program Files\CPS-Digital\is-LUGMC.tmpexecutable
MD5:28F65C9D36FF71735BF12177D6F129CF
SHA256:8E3FB8F745C0A9355D7C7ED23832796B24C45880F1A8C79E5097A4ED3DB79E4C
7240CPS-Digital setup 1.0.0.12.tmpC:\Program Files\CPS-Digital\msvcp140.dllexecutable
MD5:C092885EA11BD80D35CB55C7D488F1E2
SHA256:885A0A146A83B0D5A19B88C4EB6372B648CFAED817BD31D8CD3FB91313DEA13D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
10
TCP/UDP connections
28
DNS requests
22
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.19:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7940
DeviceDriver.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/rootr1/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCDQHuXxad%2F5c1K2Rl1mo%3D
unknown
—
—
whitelisted
7940
DeviceDriver.exe
GET
200
104.18.21.226:80
http://ocsp2.globalsign.com/rootr3/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBT1nGh%2FJBjWKnkPdZIzB1bqhelHBwQUj%2FBLf6guRSSuTVD6Y5qL3uLdG7wCDQHuXyId%2FGI71DM6hVc%3D
unknown
—
—
whitelisted
7940
DeviceDriver.exe
GET
200
104.18.21.226:80
http://ocsp.globalsign.com/gsrsaovsslca2018/ME0wSzBJMEcwRTAJBgUrDgMCGgUABBRrcGT%2BanRD3C1tW3nsrKeuXC7DPwQU%2BO9%2F8s14Z6jeb48kjYjxhwMCs%2BsCDFFE8lCd0P0bqZaxeQ%3D%3D
unknown
—
—
whitelisted
2616
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2616
SIHClient.exe
GET
200
23.219.150.101:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.19:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5496
MoUsoCoreWorker.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
40.126.32.74:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2112
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.124.78.146
whitelisted
crl.microsoft.com
  • 23.216.77.19
  • 23.216.77.37
  • 23.216.77.21
  • 23.216.77.5
  • 23.216.77.17
  • 23.216.77.18
  • 23.216.77.6
  • 23.216.77.38
  • 23.216.77.22
whitelisted
google.com
  • 142.250.185.174
whitelisted
www.microsoft.com
  • 23.35.229.160
  • 23.219.150.101
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 40.126.32.74
  • 20.190.160.66
  • 20.190.160.67
  • 40.126.32.134
  • 20.190.160.65
  • 40.126.32.72
  • 20.190.160.20
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
upgrade-1318931438.cos.ap-beijing.myqcloud.com
  • 82.156.94.45
  • 82.156.94.47
  • 82.156.94.48
  • 82.156.94.13
  • 82.156.94.17
whitelisted
ocsp.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted
ocsp2.globalsign.com
  • 104.18.21.226
  • 104.18.20.226
whitelisted

Threats

PID
Process
Class
Message
2196
svchost.exe
Misc activity
ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com)
7940
DeviceDriver.exe
Misc activity
ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)
2196
svchost.exe
Misc activity
ET INFO Tencent Cloud Storage Domain in DNS Lookup (myqcloud .com)
7924
DeviceDriver.exe
Misc activity
ET INFO Observed Tencent Cloud Storage Domain (myqcloud .com in TLS SNI)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
CPS-Digital setup 1.0.0.12.exe