File name:

Cts_Driver_Installer.exe

Full analysis: https://app.any.run/tasks/adfa1298-eea7-4a52-98e7-10feb4e0e006
Verdict: Malicious activity
Analysis date: May 29, 2025, 07:16:21
OS: Windows 10 Professional (build: 19044, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections
MD5:

C7199BA47CC3AF0150699CF9A83BCA97

SHA1:

7560EF190DB119B201E3FC1E9DDF27E0BBC23DD6

SHA256:

50CD8AB997570214DBF33533F76D7984E0CB75FC58C80374E58D0B59631B68B9

SSDEEP:

12288:qZy3Yrn3aVVVVVVVVVVFmY6pIhVVPLMCH0oxJ9VHlEDCGUXo2DbKNov28/GT0rQm:uZ9YLX0fMOmGT0rQ7Zi98KKG

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Executing a file with an untrusted certificate

      • DPInst_64.exe (PID: 812)
      • DPInst_64.exe (PID: 6740)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • Cts_Driver_Installer.exe (PID: 6404)
      • DPInst_64.exe (PID: 812)
      • drvinst.exe (PID: 5968)
      • Cts_Driver_Installer.exe (PID: 3100)

    • Process drops legitimate windows executable

      • Cts_Driver_Installer.exe (PID: 6404)
      • Cts_Driver_Installer.exe (PID: 3100)

    • Drops a system driver (possible attempt to evade defenses)

      • Cts_Driver_Installer.exe (PID: 6404)
      • DPInst_64.exe (PID: 812)
      • drvinst.exe (PID: 5968)
      • Cts_Driver_Installer.exe (PID: 3100)

    • Starts a Microsoft application from unusual location

      • DPInst_64.exe (PID: 812)
      • DPInst_64.exe (PID: 6740)

    • Creates files in the driver directory

      • drvinst.exe (PID: 5968)

  • INFO

    • Checks supported languages

      • Cts_Driver_Installer.exe (PID: 6404)
      • DPInst_64.exe (PID: 812)
      • drvinst.exe (PID: 5968)

    • The sample compiled with Italian language support

      • Cts_Driver_Installer.exe (PID: 6404)

    • The sample compiled with arabic language support

      • Cts_Driver_Installer.exe (PID: 6404)
      • Cts_Driver_Installer.exe (PID: 3100)

    • The sample compiled with english language support

      • Cts_Driver_Installer.exe (PID: 6404)
      • DPInst_64.exe (PID: 812)
      • drvinst.exe (PID: 5968)
      • Cts_Driver_Installer.exe (PID: 3100)

    • Reads the computer name

      • DPInst_64.exe (PID: 812)
      • drvinst.exe (PID: 5968)

    • Create files in a temporary directory

      • DPInst_64.exe (PID: 812)

    • Reads the machine GUID from the registry

      • drvinst.exe (PID: 5968)

    • Manual execution by a user

      • powershell.exe (PID: 536)
      • Cts_Driver_Installer.exe (PID: 3100)
      • msedge.exe (PID: 4688)

    • Reads the software policy settings

      • slui.exe (PID: 4272)
      • drvinst.exe (PID: 5968)

    • Checks current location (POWERSHELL)

      • powershell.exe (PID: 536)

    • Script raised an exception (POWERSHELL)

      • powershell.exe (PID: 536)

    • Application launched itself

      • msedge.exe (PID: 4688)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (35.8)
.exe | Win64 Executable (generic) (31.7)
.scr | Windows screen saver (15)
.dll | Win32 Dynamic Link Library (generic) (7.5)
.exe | Win32 Executable (generic) (5.1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2013:04:17 13:22:19+00:00
ImageFileCharacteristics: Executable, 32-bit
PEType: PE32
LinkerVersion: 9
CodeSize: 49664
InitializedDataSize: 2117632
UninitializedDataSize: -
EntryPoint: 0x2c77
OSVersion: 5
ImageVersion: -
SubsystemVersion: 5
Subsystem: Windows GUI
FileVersionNumber: 1.0.6.0
ProductVersionNumber: 1.0.0.1
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Italian
CharacterSet: Unicode
CompanyName: CTS Electronis SpA
FileDescription: Cts_Driver_installer - give /u for uninstall /s for silent
FileVersion: 1, 0, 6, 0
InternalName: Cts_Driver_installer
LegalCopyright: Copyright © 2009
OriginalFileName: Cts_Driver_installer.exe
ProductName: CTS Electronis Cts_Driver_installer
ProductVersion: 1, 0, 0, 1
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
197
Monitored processes
58
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start cts_driver_installer.exe dpinst_64.exe drvinst.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs slui.exe powershell.exe conhost.exe no specs cts_driver_installer.exe dpinst_64.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs identity_helper.exe no specs identity_helper.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs cts_driver_installer.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
236"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=3668 --field-trial-handle=2360,i,1739544388776502969,7094128658894502091,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
496"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=5752 --field-trial-handle=2360,i,1739544388776502969,7094128658894502091,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
536"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows PowerShell
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
680"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=6676 --field-trial-handle=2360,i,1739544388776502969,7094128658894502091,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.59\identity_helper.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
PWA Identity Proxy Host
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\identity_helper.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
812"C:\Users\admin\Desktop\DPInst_64.exe" /q /sw /se /sa C:\Users\admin\Desktop\DPInst_64.exe
Cts_Driver_Installer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Driver Package Installer
Exit code:
256
Version:
2.1
Modules
Images
c:\users\admin\desktop\dpinst_64.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
968"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=7204 --field-trial-handle=2360,i,1739544388776502969,7094128658894502091,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1532"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=4024 --field-trial-handle=2360,i,1739544388776502969,7094128658894502091,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1672"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --disable-quic --no-appcompat-clear --mojo-platform-channel-handle=8044 --field-trial-handle=2360,i,1739544388776502969,7094128658894502091,262144 --variations-seed-version /prefetch:8C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
122.0.2365.59
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\122.0.2365.59\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
2320C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
3100"C:\Users\admin\Desktop\New folder\Cts_Driver_Installer.exe" C:\Users\admin\Desktop\New folder\Cts_Driver_Installer.exe
explorer.exe
User:
admin
Company:
CTS Electronis SpA
Integrity Level:
HIGH
Description:
Cts_Driver_installer - give /u for uninstall /s for silent
Exit code:
1
Version:
1, 0, 6, 0
Modules
Images
c:\users\admin\desktop\new folder\cts_driver_installer.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\acgenral.dll
Total events
15 541
Read events
15 493
Write events
48
Delete events
0

Modification events

(PID) Process:(812) DPInst_64.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\Setup\SetupapiLogStatus
Operation:writeName:setupapi.dev.log
Value:
4096
(PID) Process:(4688) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:failed_count
Value:
0
(PID) Process:(4688) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
2
(PID) Process:(4688) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon
Operation:writeName:state
Value:
1
(PID) Process:(4688) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics
Operation:writeName:user_experience_metrics.stability.exited_cleanly
Value:
0
(PID) Process:(4688) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
DC397F63D7942F00
(PID) Process:(4688) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\132018
Operation:writeName:WindowTabManagerFileMappingId
Value:
{1A17A913-3C93-46BD-BCA9-9C1B61F3E834}
(PID) Process:(4688) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\132018
Operation:writeName:WindowTabManagerFileMappingId
Value:
{79B7DDC9-CEBE-4233-898A-9095D4AB569D}
(PID) Process:(4688) msedge.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault
Operation:writeName:S-1-5-21-1693682860-607145093-2874071422-1001
Value:
EB148B63D7942F00
(PID) Process:(4688) msedge.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowProperties\132018
Operation:writeName:WindowTabManagerFileMappingId
Value:
{69BE5D7C-9EAD-4314-9951-1D4E485931F7}
Executable files
54
Suspicious files
748
Text files
105
Unknown types
0

Dropped files

PID
Process
Filename
Type
6404Cts_Driver_Installer.exeC:\Users\admin\Desktop\CtsScannerUd_64.infbinary
MD5:C86214D4D060077A19D037B49799411A
SHA256:5ED9E4081C9832DD01896D6E613CC4C0A2E3ABC945DC56BCC9B67AA478F5BC26
6404Cts_Driver_Installer.exeC:\Users\admin\Desktop\CtsScannerUd_64.catbinary
MD5:E57C4991E976EA149E4B9962A12E4721
SHA256:96259E5423BE3004764206B9ACF92D06FBE77DB1956D9E0CB8DEFDC58DA026DF
812DPInst_64.exeC:\Users\admin\AppData\Local\Temp\{ad72dbd9-6d2f-f743-b55d-8022e7eff74b}\ctsscannerud_64.infbinary
MD5:C86214D4D060077A19D037B49799411A
SHA256:5ED9E4081C9832DD01896D6E613CC4C0A2E3ABC945DC56BCC9B67AA478F5BC26
5968drvinst.exeC:\Windows\System32\DriverStore\Temp\{f89a923b-25c0-ca42-a74c-28bd8ffe21c4}\CtsScannerUd_64.catbinary
MD5:E57C4991E976EA149E4B9962A12E4721
SHA256:96259E5423BE3004764206B9ACF92D06FBE77DB1956D9E0CB8DEFDC58DA026DF
6404Cts_Driver_Installer.exeC:\Users\admin\Desktop\CtsScannerUd_64.sysexecutable
MD5:508F1B94383E60362C9829E9C6B61702
SHA256:B020AEE40DB12D1C77CA0CC863937ADB88802898CA37ECC45F0B63107ADD800F
6404Cts_Driver_Installer.exeC:\Users\admin\Desktop\DPInst_64.exeexecutable
MD5:BE3C79033FA8302002D9D3A6752F2263
SHA256:181BF85D3B5900FF8ABED34BC415AFC37FC322D9D7702E14D144F96A908F5CAB
812DPInst_64.exeC:\Users\admin\AppData\Local\Temp\{ad72dbd9-6d2f-f743-b55d-8022e7eff74b}\SETC810.tmpbinary
MD5:E57C4991E976EA149E4B9962A12E4721
SHA256:96259E5423BE3004764206B9ACF92D06FBE77DB1956D9E0CB8DEFDC58DA026DF
812DPInst_64.exeC:\Users\admin\AppData\Local\Temp\{ad72dbd9-6d2f-f743-b55d-8022e7eff74b}\CtsScannerUd_64.catbinary
MD5:E57C4991E976EA149E4B9962A12E4721
SHA256:96259E5423BE3004764206B9ACF92D06FBE77DB1956D9E0CB8DEFDC58DA026DF
812DPInst_64.exeC:\Users\admin\AppData\Local\Temp\{ad72dbd9-6d2f-f743-b55d-8022e7eff74b}\SETC860.tmpexecutable
MD5:508F1B94383E60362C9829E9C6B61702
SHA256:B020AEE40DB12D1C77CA0CC863937ADB88802898CA37ECC45F0B63107ADD800F
812DPInst_64.exeC:\Users\admin\AppData\Local\Temp\{ad72dbd9-6d2f-f743-b55d-8022e7eff74b}\SETC820.tmpbinary
MD5:C86214D4D060077A19D037B49799411A
SHA256:5ED9E4081C9832DD01896D6E613CC4C0A2E3ABC945DC56BCC9B67AA478F5BC26
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
30
TCP/UDP connections
143
DNS requests
145
Threats
4

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
2.16.168.114:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
7368
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
2.23.181.156:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
7368
SIHClient.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
2924
SearchApp.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
6340
svchost.exe
HEAD
200
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1748969549&P2=404&P3=2&P4=ZeU1cAEj3U3PJIDyF29V8CJ4nu3l2tAIvlpRyKcvncPcvccJ98hkckYmjNzIJoRjcjB1d9PGV%2b%2bVc8YHBbTlJA%3d%3d
unknown
—
—
whitelisted
6340
svchost.exe
GET
206
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1748969549&P2=404&P3=2&P4=ZeU1cAEj3U3PJIDyF29V8CJ4nu3l2tAIvlpRyKcvncPcvccJ98hkckYmjNzIJoRjcjB1d9PGV%2b%2bVc8YHBbTlJA%3d%3d
unknown
—
—
whitelisted
6340
svchost.exe
GET
206
208.89.74.21:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/bf8090eb-6e5c-4c51-9250-5bf9b46cf160?P1=1748969549&P2=404&P3=2&P4=ZeU1cAEj3U3PJIDyF29V8CJ4nu3l2tAIvlpRyKcvncPcvccJ98hkckYmjNzIJoRjcjB1d9PGV%2b%2bVc8YHBbTlJA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
6544
svchost.exe
40.126.31.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
4
System
192.168.100.255:138
—
—
—
whitelisted
7272
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
2.16.168.114:80
crl.microsoft.com
Akamai International B.V.
RU
whitelisted
5496
MoUsoCoreWorker.exe
2.23.181.156:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
3216
svchost.exe
172.211.123.249:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
FR
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
6544
svchost.exe
20.190.159.128:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 142.250.185.238
whitelisted
crl.microsoft.com
  • 2.16.168.114
  • 2.16.168.124
whitelisted
www.microsoft.com
  • 2.23.181.156
  • 95.101.149.131
whitelisted
nexusrules.officeapps.live.com
  • 52.111.236.23
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.245.163.56
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.95.31.18
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
  • 51.124.78.146
  • 20.73.194.208
whitelisted
www.bing.com
  • 2.16.204.151
  • 2.16.204.134
  • 2.16.204.160
  • 2.16.204.153
  • 2.16.204.136
  • 2.16.204.146
  • 2.16.204.137
  • 2.16.204.143
  • 2.16.204.148
  • 2.19.96.97
  • 2.19.96.81
  • 2.19.96.107
  • 2.19.96.123
  • 2.19.96.74
  • 2.19.96.104
  • 2.19.96.106
  • 2.19.96.66
  • 2.19.96.112
  • 2.19.96.130
  • 2.19.96.19
  • 2.19.96.91
  • 2.19.96.120
  • 2.19.96.67
  • 2.16.241.218
  • 2.16.241.205
  • 2.16.241.201
  • 2.16.241.222
whitelisted
login.live.com
  • 40.126.32.138
  • 40.126.32.134
  • 20.190.160.131
  • 20.190.160.67
  • 40.126.32.133
  • 20.190.160.66
  • 20.190.160.65
  • 20.190.160.17
  • 40.126.31.131
  • 40.126.31.69
  • 40.126.31.1
  • 40.126.31.3
  • 40.126.31.130
  • 20.190.159.2
  • 20.190.159.128
  • 20.190.159.0
whitelisted

Threats

PID
Process
Class
Message
7388
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7388
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7388
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
7388
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] Google Tag Manager analytics (googletagmanager .com)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Cts_Driver_Installer.exe