File name:

dxdiag.exe

Full analysis: https://app.any.run/tasks/76300be3-b0fe-4131-956c-d2ff7739eb7a
Verdict: Malicious activity
Analysis date: January 17, 2025, 06:43:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

A89C2FBE79D28488F189F2720D493E28

SHA1:

8762B0F85CE78B2087E9AFB623503A082055FB0A

SHA256:

C0FDE8F32045CFA2CCB9CDAED79297EC6FD0E09ADEA83304153667997EB12A93

SSDEEP:

1536:LWcynywOjPTv4mRZq0+NV7DkMJBBxHjdIjJqHNIFJXetVfG1HX:LunFBBxHjdIK4gtVfG1HX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for self-deleting

      • dxdiag.exe (PID: 5740)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • dxdiag.exe (PID: 5740)
      • dxdiag.exe (PID: 7104)

    • Process drops legitimate windows executable

      • dxdiag.exe (PID: 5740)

    • Executable content was dropped or overwritten

      • dxdiag.exe (PID: 5740)

    • Executes as Windows Service

      • mcbuilder.exe (PID: 3736)

    • Sets range of bytes to zero

      • fsutil.exe (PID: 5240)

    • Reads security settings of Internet Explorer

      • dxdiag.exe (PID: 5740)

    • Connects to unusual port

      • mcbuilder.exe (PID: 3736)

    • Starts CMD.EXE for commands execution

      • dxdiag.exe (PID: 5740)

    • Hides command output

      • cmd.exe (PID: 2928)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2928)

  • INFO

    • Checks supported languages

      • dxdiag.exe (PID: 7104)
      • dxdiag.exe (PID: 5740)
      • mcbuilder.exe (PID: 3736)

    • Reads the computer name

      • dxdiag.exe (PID: 7104)
      • dxdiag.exe (PID: 5740)
      • mcbuilder.exe (PID: 3736)

    • The process uses the downloaded file

      • dllhost.exe (PID: 2736)
      • dxdiag.exe (PID: 5740)

    • Reads the machine GUID from the registry

      • dxdiag.exe (PID: 7104)
      • dxdiag.exe (PID: 5740)
      • mcbuilder.exe (PID: 3736)

    • Create files in a temporary directory

      • dxdiag.exe (PID: 5740)

    • Creates files in the program directory

      • dxdiag.exe (PID: 5740)

    • Process checks computer location settings

      • dxdiag.exe (PID: 5740)

    • The sample compiled with english language support

      • dxdiag.exe (PID: 5740)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 2736)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:02:13 06:50:48+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 20992
InitializedDataSize: 34816
UninitializedDataSize: -
EntryPoint: 0x432f
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.1.2600.2180
ProductVersionNumber: 5.1.2600.2180
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Magnifier
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: MAGNIFIER
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: MAGNIFY.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.2180
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
11
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dxdiag.exe no specs CMSTPLUA no specs Color Management no specs dxdiag.exe mcbuilder.exe cmd.exe no specs conhost.exe no specs ping.exe no specs fsutil.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2736C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
2928"C:\WINDOWS\system32\cmd.exe" /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "C:\Users\admin\Desktop\dxdiag.exe" & del "C:\Users\admin\Desktop\dxdiag.exe" > NUL & exitC:\Windows\SysWOW64\cmd.exe—dxdiag.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3552ping -n 2 127.0.0.1 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
3736C:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\mcbuilder.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\mcbuilder.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Resource cache builder tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\programdata\microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\mcbuilder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
3988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5240fsutil file setzerodata offset=0 length=524288 "C:\Users\admin\Desktop\dxdiag.exe" C:\Windows\SysWOW64\fsutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
fsutil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\fsutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
5740"C:\Users\admin\Desktop\dxdiag.exe" C:\Users\admin\Desktop\dxdiag.exe
dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Magnifier
Exit code:
0
Version:
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Modules
Images
c:\users\admin\desktop\dxdiag.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
6136"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6412C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
6768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 209
Read events
1 207
Write events
1
Delete events
1

Modification events

(PID) Process:(6412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration
Operation:writeName:DisplayCalibrator
Value:
C:\Users\admin\Desktop\dxdiag.exe
(PID) Process:(6412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration
Operation:delete valueName:DisplayCalibrator
Value:
C:\Users\admin\Desktop\dxdiag.exe
Executable files
22
Suspicious files
1
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\devobjv.dll —
MD5:—
SHA256:—
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\uexfatr.dll —
MD5:—
SHA256:—
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\mcbuilder.exeexecutable
MD5:A89C2FBE79D28488F189F2720D493E28
SHA256:C0FDE8F32045CFA2CCB9CDAED79297EC6FD0E09ADEA83304153667997EB12A93
5740dxdiag.exeC:\Users\admin\AppData\Local\Temp\tmp4D44.tmpexecutable
MD5:A89C2FBE79D28488F189F2720D493E28
SHA256:C0FDE8F32045CFA2CCB9CDAED79297EC6FD0E09ADEA83304153667997EB12A93
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\d3dxofx.dllexecutable
MD5:7D87620E1D43D2479716B8FFCF2A846D
SHA256:ED4B421A10D24DC03B0372D11924B415ED0CDC8896490826344879D58DC0D11B
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\NdfEventViews.xmltext
MD5:86166DAA04A6C154826508304CC6D4AC
SHA256:886FD04B819586A8D78DC97DF3061DED9A7065E65D030BB02893ED658E29CA0A
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\eapprovpn.dllexecutable
MD5:4990DB7B1196F0FF5EF3A1FFF407653E
SHA256:23B1447478FD6F62AC3918E1F93303AE956B6CEE28402586F01CEB2AA39AE0A1
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\gamemoden.dllexecutable
MD5:7D143079F601D7BA0E7FDBCC1F4B4A80
SHA256:39369CFB966D02CA2DF0050AB765F051A0547E8A443203B26F7BAA3EA6AEC113
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\RCX4D64.tmpexecutable
MD5:F3D3B9A02EFAFF2B5DD8E83B8C6C90B7
SHA256:1CA1236D5388938C745D4609C040F041C2010FED111162A1278F21F882C1F500
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\wsmanconfig_scheman.xmltext
MD5:930423065AB3F5DB52D5726C7FC66385
SHA256:176FE54ED73D56B0A03F33B6C5997E5701F46BBB0309A46477E9DD256BE50A09
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
50
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
880
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6272
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
2.21.65.132:443
www.bing.com
Akamai International B.V.
NL
whitelisted
880
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
880
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.21.65.132
  • 2.21.65.154
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.68
  • 20.190.160.22
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.133
  • 20.190.160.14
  • 40.126.32.140
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dxdiag.exe