File name:

STARTECH_CSDS_R3.01_Setup_240216.exe

Full analysis: https://app.any.run/tasks/0ad68dba-47b8-4b61-ba94-6373e1c75682
Verdict: Malicious activity
Analysis date: November 28, 2024, 14:59:20
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 10 sections
MD5:

2CCEB57E71764ECED55A3187DF7EE73B

SHA1:

A6B5664BB0033165F2BF95241635CC7E56728E34

SHA256:

90DAB8CAF106C1D946B1A1112ABB8D67AD4B0B51473E8A85AAEC366BF78CEDF5

SSDEEP:

98304:z+cD4dng3JGw9RFIqPbmrH+BV1ZQGIfkTCeXEUe4BtPfWhvdUyKLCyB1EgmDBq3I:MMT5mQur

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 3820)

    • Executable content was dropped or overwritten

      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6096)
      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6360)
      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)
      • vsbsetup.exe (PID: 7028)
      • drvinst.exe (PID: 7092)
      • drvinst.exe (PID: 7156)

    • Reads the Windows owner or organization settings

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Executing commands from a ".bat" file

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Drops a system driver (possible attempt to evade defenses)

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)
      • drvinst.exe (PID: 7092)
      • vsbsetup.exe (PID: 7028)
      • drvinst.exe (PID: 7156)

    • Starts CMD.EXE for commands execution

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Executes as Windows Service

      • sec_service.exe (PID: 6444)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 780)

    • Uses NETSH.EXE to add a firewall rule or allowed programs

      • cmd.exe (PID: 6948)

  • INFO

    • Checks supported languages

      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6096)
      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 3820)
      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)
      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6360)

    • Create files in a temporary directory

      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6096)
      • STARTECH_CSDS_R3.01_Setup_240216.exe (PID: 6360)

    • Reads the computer name

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 3820)
      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 6384)

    • Process checks computer location settings

      • STARTECH_CSDS_R3.01_Setup_240216.tmp (PID: 3820)

    • Manual execution by a user

      • CSDS.exe (PID: 5672)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (65.1)
.exe | Win32 EXE PECompact compressed (generic) (24.6)
.dll | Win32 Dynamic Link Library (generic) (3.9)
.exe | Win32 Executable (generic) (2.6)
.exe | Win16/32 Executable Delphi generic (1.2)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 37376
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6.1
ImageVersion: 6
SubsystemVersion: 6.1
Subsystem: Windows GUI
FileVersionNumber: 0.0.0.0
ProductVersionNumber: 0.0.0.0
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: StarTech.com
FileDescription: StarTech.com Device Server Manager Setup
FileVersion:
LegalCopyright:
OriginalFileName:
ProductName: StarTech.com Device Server Manager
ProductVersion: 3.01
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
267
Monitored processes
19
Malicious processes
3
Suspicious processes
2

Behavior graph

Click at the process to see the details
start startech_csds_r3.01_setup_240216.exe startech_csds_r3.01_setup_240216.tmp no specs startech_csds_r3.01_setup_240216.exe startech_csds_r3.01_setup_240216.tmp sc.exe no specs conhost.exe no specs cmd.exe no specs conhost.exe no specs vspdxp_install.exe no specs vsbsetup.exe drvinst.exe drvinst.exe drvinst.exe no specs sec_service.exe no specs sec_service.exe no specs sec_service.exe netsh.exe no specs plugscheduler.exe no specs csds.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
780"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
2324netsh advfirewall firewall add rule name="STARTECHSDS" dir=in action=allow program="C:\Program Files\STARTECH\StarTech.com Device Server Manager"\sec_service.exe enable=yesC:\Windows\SysWOW64\netsh.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Network Command Shell
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\netsh.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
2800"C:\Program Files\STARTECH\StarTech.com Device Server Manager"\sec_service.exe INSTALL C:\Program Files\STARTECH\StarTech.com Device Server Manager\sec_service.exe—cmd.exe
User:
admin
Company:
Electronic Team
Integrity Level:
HIGH
Description:
Electronic Team Serial to Ethernet Connector Service
Exit code:
4294967295
Version:
9.0.1253
Modules
Images
c:\program files\startech\startech.com device server manager\sec_service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3820"C:\Users\admin\AppData\Local\Temp\is-CR5D4.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmp" /SL5="$702AA,3114502,780288,C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe" C:\Users\admin\AppData\Local\Temp\is-CR5D4.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmp—STARTECH_CSDS_R3.01_Setup_240216.exe
User:
admin
Company:
StarTech.com
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-cr5d4.tmp\startech_csds_r3.01_setup_240216.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
5672"C:\Program Files\STARTECH\StarTech.com Device Server Manager\CSDS.exe" C:\Program Files\STARTECH\StarTech.com Device Server Manager\CSDS.exe—explorer.exe
User:
admin
Company:
Centos Inc.
Integrity Level:
MEDIUM
Description:
StarTech.com Device Server Manager
Version:
1.0.0.0
Modules
Images
c:\program files\startech\startech.com device server manager\csds.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6096"C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe" C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe
explorer.exe
User:
admin
Company:
StarTech.com
Integrity Level:
MEDIUM
Description:
StarTech.com Device Server Manager Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\startech_csds_r3.01_setup_240216.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6340DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\WINDOWS\INF\oem6.inf" "oem6.inf:6d06cfc4838aed2e:VSBus_Device:10.6.914.0:vsbc9," "44fb335b7" "0000000000000210"C:\Windows\System32\drvinst.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
6360"C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe" /SPAWNWND=$40208 /NOTIFYWND=$702AA C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe
STARTECH_CSDS_R3.01_Setup_240216.tmp
User:
admin
Company:
StarTech.com
Integrity Level:
HIGH
Description:
StarTech.com Device Server Manager Setup
Exit code:
0
Version:
Modules
Images
c:\users\admin\downloads\startech_csds_r3.01_setup_240216.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6384"C:\Users\admin\AppData\Local\Temp\is-DQ9PJ.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmp" /SL5="$70298,3114502,780288,C:\Users\admin\Downloads\STARTECH_CSDS_R3.01_Setup_240216.exe" /SPAWNWND=$40208 /NOTIFYWND=$702AA C:\Users\admin\AppData\Local\Temp\is-DQ9PJ.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmp
STARTECH_CSDS_R3.01_Setup_240216.exe
User:
admin
Company:
StarTech.com
Integrity Level:
HIGH
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-dq9pj.tmp\startech_csds_r3.01_setup_240216.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
6404"C:\Program Files\STARTECH\StarTech.com Device Server Manager"\sec_service.exe ENABLE C:\Program Files\STARTECH\StarTech.com Device Server Manager\sec_service.exe—cmd.exe
User:
admin
Company:
Electronic Team
Integrity Level:
HIGH
Description:
Electronic Team Serial to Ethernet Connector Service
Exit code:
4294967295
Version:
9.0.1253
Modules
Images
c:\program files\startech\startech.com device server manager\sec_service.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
Total events
16 094
Read events
16 030
Write events
50
Delete events
14

Modification events

(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.1
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\STARTECH\StarTech.com Device Server Manager
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\STARTECH\StarTech.com Device Server Manager\
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
(Default)
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Selected Tasks
Value:
desktopicon
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Deselected Tasks
Value:
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:Inno Setup: Language
Value:
english
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:DisplayName
Value:
StarTech.com Device Server Manager version 3.01
(PID) Process:(6384) STARTECH_CSDS_R3.01_Setup_240216.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{CA6852D7-AD1C-4838-8287-0C40C41C12F7}_is1
Operation:writeName:DisplayIcon
Value:
C:\Program Files\STARTECH\StarTech.com Device Server Manager\CSDS.exe
Executable files
70
Suspicious files
92
Text files
9
Unknown types
11

Dropped files

PID
Process
Filename
Type
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\CSDS.exeexecutable
MD5:14CB0908E2A9791A5E26E83348305E57
SHA256:7A79B109E8E9AC60AF3241CC5C50A0E5F3A7A35F858A4168718DA536014D0076
6360STARTECH_CSDS_R3.01_Setup_240216.exeC:\Users\admin\AppData\Local\Temp\is-DQ9PJ.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmpexecutable
MD5:8F9AEFD4CE989C97690F81289178CCCF
SHA256:04E4A2FF097E8AFE26265DE4EA765EF7E9AF4BD0342785A1D2CA0F09BFE55477
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Users\admin\AppData\Local\Temp\is-K2KRR.tmp\_isetup\_setup64.tmpexecutable
MD5:E4211D6D009757C078A9FAC7FF4F03D4
SHA256:388A796580234EFC95F3B1C70AD4CB44BFDDC7BA0F9203BF4902B9929B136F95
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\evsbc9.infbinary
MD5:316034BFB57712DDA4E453CD47595CAE
SHA256:E741B5975F2BFA627B7CBA007B45132129C818CE3AC8D65C8EEE591161A18CA6
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\evsbc9.sysexecutable
MD5:8C8B3CF9D6900E213DFD39FDD6BA7D2B
SHA256:345EB8E4DB28E2F57C4F1586580A8281B512618BB1F9AC884ED822819211CC2B
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\is-M7VQ0.tmpexecutable
MD5:8C8B3CF9D6900E213DFD39FDD6BA7D2B
SHA256:345EB8E4DB28E2F57C4F1586580A8281B512618BB1F9AC884ED822819211CC2B
6096STARTECH_CSDS_R3.01_Setup_240216.exeC:\Users\admin\AppData\Local\Temp\is-CR5D4.tmp\STARTECH_CSDS_R3.01_Setup_240216.tmpexecutable
MD5:8F9AEFD4CE989C97690F81289178CCCF
SHA256:04E4A2FF097E8AFE26265DE4EA765EF7E9AF4BD0342785A1D2CA0F09BFE55477
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\is-PH4B5.tmpexecutable
MD5:14CB0908E2A9791A5E26E83348305E57
SHA256:7A79B109E8E9AC60AF3241CC5C50A0E5F3A7A35F858A4168718DA536014D0076
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\unins000.exeexecutable
MD5:BA81803E3327CE8C9F79D894160113DE
SHA256:FFEF380CD2301D9AFE8030AA3833E2D2268AA468FC1D0C2BE2FC1F5F939BD8AB
6384STARTECH_CSDS_R3.01_Setup_240216.tmpC:\Program Files\STARTECH\StarTech.com Device Server Manager\NT5\evserial9.infbinary
MD5:D7888F89D3513499FB6BFDCF78F44CBA
SHA256:CD8C47D914159B866E5ED3FD4647D825A9E8BE6136A2F65719C0D3AB463886B2
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
8
TCP/UDP connections
57
DNS requests
27
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
1.01 Kb
whitelisted
—
—
GET
200
2.16.164.9:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
1.01 Kb
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
—
—
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
DE
binary
973 b
whitelisted
5064
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
US
binary
314 b
whitelisted
1176
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
US
binary
471 b
whitelisted
4804
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
418 b
whitelisted
4804
SIHClient.exe
GET
200
23.52.120.96:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
408 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
640
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
2.16.164.9:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
88.221.169.152:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
5064
SearchApp.exe
2.23.209.131:443
www.bing.com
Akamai International B.V.
GB
whitelisted
1176
svchost.exe
40.126.32.133:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
5064
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
whitelisted
crl.microsoft.com
  • 2.16.164.9
  • 2.16.164.49
whitelisted
www.microsoft.com
  • 88.221.169.152
  • 23.52.120.96
whitelisted
google.com
  • 172.217.18.14
whitelisted
www.bing.com
  • 2.23.209.131
  • 2.23.209.160
  • 2.23.209.144
  • 2.23.209.149
  • 2.23.209.150
  • 2.23.209.135
  • 2.23.209.158
  • 2.23.209.133
  • 2.23.209.141
  • 2.23.209.143
  • 2.23.209.137
  • 2.23.209.156
whitelisted
login.live.com
  • 40.126.32.133
  • 40.126.32.72
  • 40.126.32.74
  • 40.126.32.76
  • 40.126.32.134
  • 40.126.32.140
  • 20.190.160.14
  • 40.126.32.136
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
go.microsoft.com
  • 23.32.186.57
whitelisted
activate.electronic.us
  • 188.40.191.126
unknown
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
STARTECH_CSDS_R3.01_Setup_240216.exe