File name:

STARTECH_CSDS_R3.01_Setup_240216.exe

Full analysis: https://app.any.run/tasks/0ad68dba-47b8-4b61-ba94-6373e1c75682
Verdict: Malicious activity
Analysis date: November 28, 2024, 14:59:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

2CCEB57E71764ECED55A3187DF7EE73B

SHA1:

A6B5664BB0033165F2BF95241635CC7E56728E34

SHA256:

90DAB8CAF106C1D946B1A1112ABB8D67AD4B0B51473E8A85AAEC366BF78CEDF5

SSDEEP:

98304:z+cD4dng3JGw9RFIqPbmrH+BV1ZQGIfkTCeXEUe4BtPfWhvdUyKLCyB1EgmDBq3I:MMT5mQur

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 3820)

    • Executable content was dropped or overwritten

      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6096)
      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6360)
      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)
      • vsbsetup.exe (PID: 7028)
      • drvinst.exe (PID: 7092)
      • drvinst.exe (PID: 7156)

    • Reads the Windows owner or organization settings

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Drops a system driver (possible attempt to evade defenses)

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)
      • drvinst.exe (PID: 7092)
      • vsbsetup.exe (PID: 7028)
      • drvinst.exe (PID: 7156)

    • Starts CMD.EXE for commands execution

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Executing commands from a ".bat" file

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 6948)

    • Executes as Windows Service

      • sec_service.exe (PID: 6444)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 780)

  • INFO

    • Create files in a temporary directory

      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6096)
      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6360)

    • Checks supported languages

      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6096)
      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6360)
      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 3820)
      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Reads the computer name

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 3820)
      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Process checks computer location settings

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 3820)

    • Manual execution by a user

      • CSDS.exe (PID: 5672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 37376
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: StarTech.com
FileDescription: StarTech.com Device Server Manager Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: StarTech.com Device Server Manager
ProductVersion: 3.01
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
267
Monitored processes
19
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start startech_csds_r3.01_setup_240216.exe startech_csds_r3.01_setup_240216.tmp no specs startech_csds_r3.01_setup_240216.exe startech_csds_r3.01_setup_240216.tmp sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vspdxp_install.exe no specs vsbsetup.exe drvinst.exe drvinst.exe drvinst.exe no specs sec_service.exe no specs sec_service.exe no specs sec_service.exe netsh.exe no specs plugscheduler.exe no specs csds.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
780"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2324netsh advfirewall firewall add rule name="STARTECHSDS" dir=in action=allow program="C:\Program Files\STARTECH\StarTech.com Device Server Manager"\sec_service.exe enable=yesC:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2800"C:\Program Files\STARTECH\StarTech.com Device Server Manager"\sec_service.exe INSTALL C:\Program Files\STARTECH\StarTech.com Device Server Manager\sec_service.exe—cmd.exe
User:
admin
Company:
Electronic Team
Integrity Level:
HIGH
Description:
Electronic Team Serial to Ethernet Connector Service
Exit code:
4294967295
Version:
9.0.1253
Modules
Images
c:\program files\startech\startech.com device server manager\sec_service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3820"C:\Users\admin\AppData\Local\Temp\is-CR5D4.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmp" /SL5="$702AA,3114502,780288,C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe" C:\Users\admin\AppData\Local\Temp\is-CR5D4.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmp—STARTECH_CSDS_R3.01_Setup_240216.exe
User:
admin
Company:
StarTech.com
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-cr5d4.tmp\startech_csds_r3.01_setup_240216.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
5672"C:\Program Files\STARTECH\StarTech.com Device Server Manager\CSDS.exe" C:\Program Files\STARTECH\StarTech.com Device Server Manager\CSDS.exe—explorer.exe
User:
admin
Company:
Centos Inc.
Integrity Level:
MEDIUM
Description:
StarTech.com Device Server Manager
Version:
1.0.0.0
Modules
Images
c:\program files\startech\startech.com device server manager\csds.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6096"C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe" C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe
explorer.exe
User:
admin
Company:
StarTech.com
Integrity Level:
MEDIUM
Description:
StarTech.com Device Server Manager Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\startech_csds_r3.01_setup_240216.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6340DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\WINDOWS\INF\oem6.inf" "oem6.inf:6d06cfc4838aed2e:VSBus_Device:10.6.914.0:vsbc9," "44fb335b7" "0000000000000210"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6360"C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe" /SPAWNWND=$40208 /NOTIFYWND=$702AA C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe
STARTECH_CSDS_R3.01_Setup_240216.tmp
User:
admin
Company:
StarTech.com
Integrity Level:
HIGH
Description:
StarTech.com Device Server Manager Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\startech_csds_r3.01_setup_240216.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6384"C:\Users\admin\AppData\Local\Temp\is-DQ9PJ.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmp" /SL5="$70298,3114502,780288,C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe" /SPAWNWND=$40208 /NOTIFYWND=$702AA C:\Users\admin\AppData\Local\Temp\is-DQ9PJ.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmp
STARTECH_CSDS_R3.01_Setup_240216.exe
User:
admin
Company:
StarTech.com
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-dq9pj.tmp\startech_csds_r3.01_setup_240216.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
6404"C:\Program Files\STARTECH\StarTech.com Device Server Manager"\sec_service.exe ENABLE C:\Program Files\STARTECH\StarTech.com Device Server Manager\sec_service.exe—cmd.exe
User:
admin
Company:
Electronic Team
Integrity Level:
HIGH
Description:
Electronic Team Serial to Ethernet Connector Service
Exit code:
4294967295
Version:
9.0.1253
Modules
Images
c:\program files\startech\startech.com device server manager\sec_service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
16 094
Read events
16 030
Write events
50
Delete events
14

Modification events

(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.1
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\STARTECH\StarTech.com Device Server Manager
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\STARTECH\StarTech.com Device Server Manager\
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Language
Value:
english
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:DisplayName
Value:
StarTech.com Device Server Manager version 3.01
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\STARTECH\StarTech.com Device Server Manager\CSDS.exe
Executable files
70
Suspicious files
92
Text files
9
Unknown types
11

Dropped files

PID
Process
Filename
Type
6360STARTECH_CSDS_R3.01_Setup_240216.exeC:\Users\admin\AppData\Local\Temp\is-DQ9PJ.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmpexecutable
MD5:8F9AEFD4CE989C97690F81289178CCCF
SHA256:04E4A2FF097E8AFE26265DE4EA765EF7E9AF4BD0342785A1D2CA0F09BFE55477
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\is-OMD90.tmpbinary
MD5:D7888F89D3513499FB6BFDCF78F44CBA
SHA256:CD8C47D914159B866E5ED3FD4647D825A9E8BE6136A2F65719C0D3AB463886B2
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\is-IIQ97.tmpexecutable
MD5:7B93999BB2C8922D65BB4EEBC08BFB6B
SHA256:F267F24E957C83447BC32931DA05CA44260C7403AB02A0A0773683A4B8708F2B
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\evsbc9.sysexecutable
MD5:8C8B3CF9D6900E213DFD39FDD6BA7D2B
SHA256:345EB8E4DB28E2F57C4F1586580A8281B512618BB1F9AC884ED822819211CC2B
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\evsbc9.infbinary
MD5:316034BFB57712DDA4E453CD47595CAE
SHA256:E741B5975F2BFA627B7CBA007B45132129C818CE3AC8D65C8EEE591161A18CA6
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\is-M7VQ0.tmpexecutable
MD5:8C8B3CF9D6900E213DFD39FDD6BA7D2B
SHA256:345EB8E4DB28E2F57C4F1586580A8281B512618BB1F9AC884ED822819211CC2B
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\is-BHAQK.tmpbinary
MD5:4752D71828209DC1265C855BF01F09E1
SHA256:8F21CAF4EAEB108C889FD45D2B369DA2985EFF4998D10E9C1F4817326D605E92
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\evserial9.catbinary
MD5:4752D71828209DC1265C855BF01F09E1
SHA256:8F21CAF4EAEB108C889FD45D2B369DA2985EFF4998D10E9C1F4817326D605E92
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\is-9G73F.tmpexecutable
MD5:74B33283648C1088B8466DE7B70298E8
SHA256:75AC14E03E32C82051A4E19EB429F39AB26AE88616B961B98D95604622FD258C
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\evserial9.sysexecutable
MD5:7B93999BB2C8922D65BB4EEBC08BFB6B
SHA256:F267F24E957C83447BC32931DA05CA44260C7403AB02A0A0773683A4B8708F2B
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
57
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
4804
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
4804
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
640
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.131:443
www.bing.com
Akamai International B.V.
GB
whitelisted
1176
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.52.120.96
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 2.23.209.131
  • 2.23.209.160
  • 2.23.209.144
  • 2.23.209.149
  • 2.23.209.150
  • 2.23.209.135
  • 2.23.209.158
  • 2.23.209.133
  • 2.23.209.141
  • 2.23.209.143
  • 2.23.209.137
  • 2.23.209.156
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
activate.electronic.us
  • 188.40.191.126
unknown
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
STARTECH_CSDS_R3.01_Setup_240216.exe