File name:

dxdiag.exe

Full analysis: https://app.any.run/tasks/76300be3-b0fe-4131-956c-d2ff7739eb7a
Verdict: Malicious activity
Analysis date: January 17, 2025, 06:43:26
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/vnd.microsoft.portable-executable
File info: PE32 executable (GUI) Intel 80386, for MS Windows, 4 sections
MD5:

A89C2FBE79D28488F189F2720D493E28

SHA1:

8762B0F85CE78B2087E9AFB623503A082055FB0A

SHA256:

C0FDE8F32045CFA2CCB9CDAED79297EC6FD0E09ADEA83304153667997EB12A93

SSDEEP:

1536:LWcynywOjPTv4mRZq0+NV7DkMJBBxHjdIjJqHNIFJXetVfG1HX:LunFBBxHjdIK4gtVfG1HX

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Starts CMD.EXE for self-deleting

      • dxdiag.exe (PID: 5740)

  • SUSPICIOUS

    • Starts a Microsoft application from unusual location

      • dxdiag.exe (PID: 5740)
      • dxdiag.exe (PID: 7104)

    • Process drops legitimate windows executable

      • dxdiag.exe (PID: 5740)

    • Executable content was dropped or overwritten

      • dxdiag.exe (PID: 5740)

    • Executes as Windows Service

      • mcbuilder.exe (PID: 3736)

    • Starts CMD.EXE for commands execution

      • dxdiag.exe (PID: 5740)

    • Reads security settings of Internet Explorer

      • dxdiag.exe (PID: 5740)

    • Hides command output

      • cmd.exe (PID: 2928)

    • Runs PING.EXE to delay simulation

      • cmd.exe (PID: 2928)

    • Sets range of bytes to zero

      • fsutil.exe (PID: 5240)

    • Connects to unusual port

      • mcbuilder.exe (PID: 3736)

  • INFO

    • Checks supported languages

      • dxdiag.exe (PID: 7104)
      • dxdiag.exe (PID: 5740)
      • mcbuilder.exe (PID: 3736)

    • The process uses the downloaded file

      • dllhost.exe (PID: 2736)
      • dxdiag.exe (PID: 5740)

    • Reads security settings of Internet Explorer

      • dllhost.exe (PID: 2736)

    • Reads the machine GUID from the registry

      • dxdiag.exe (PID: 7104)
      • dxdiag.exe (PID: 5740)
      • mcbuilder.exe (PID: 3736)

    • Reads the computer name

      • dxdiag.exe (PID: 7104)
      • dxdiag.exe (PID: 5740)
      • mcbuilder.exe (PID: 3736)

    • Create files in a temporary directory

      • dxdiag.exe (PID: 5740)

    • Creates files in the program directory

      • dxdiag.exe (PID: 5740)

    • Process checks computer location settings

      • dxdiag.exe (PID: 5740)

    • The sample compiled with english language support

      • dxdiag.exe (PID: 5740)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Win32 Executable MS Visual C++ (generic) (42.2)
.exe | Win64 Executable (generic) (37.3)
.dll | Win32 Dynamic Link Library (generic) (8.8)
.exe | Win32 Executable (generic) (6)
.exe | Generic Win/DOS Executable (2.7)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2021:02:13 06:50:48+00:00
ImageFileCharacteristics: No relocs, Executable, 32-bit
PEType: PE32
LinkerVersion: 10
CodeSize: 20992
InitializedDataSize: 34816
UninitializedDataSize: -
EntryPoint: 0x432f
OSVersion: 5.1
ImageVersion: -
SubsystemVersion: 5.1
Subsystem: Windows GUI
FileVersionNumber: 5.1.2600.2180
ProductVersionNumber: 5.1.2600.2180
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Windows NT 32-bit
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: English (U.S.)
CharacterSet: Unicode
CompanyName: Microsoft Corporation
FileDescription: Microsoft Magnifier
FileVersion: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
InternalName: MAGNIFIER
LegalCopyright: © Microsoft Corporation. All rights reserved.
OriginalFileName: MAGNIFY.EXE
ProductName: Microsoft® Windows® Operating System
ProductVersion: 5.1.2600.2180
No data.
screenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
128
Monitored processes
11
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start dxdiag.exe no specs CMSTPLUA no specs Color Management no specs dxdiag.exe mcbuilder.exe cmd.exe no specs conhost.exe no specs ping.exe no specs fsutil.exe no specs ucpdmgr.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2736C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{D2E7041B-2927-42FB-8E9F-7CE93B6DC937}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
2928"C:\WINDOWS\system32\cmd.exe" /d /c ping -n 2 127.0.0.1 > NUL & fsutil file setzerodata offset=0 length=524288 "C:\Users\admin\Desktop\dxdiag.exe" & del "C:\Users\admin\Desktop\dxdiag.exe" > NUL & exitC:\Windows\SysWOW64\cmd.exe—dxdiag.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\combase.dll
3552ping -n 2 127.0.0.1 C:\Windows\SysWOW64\PING.EXE—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
TCP/IP Ping Command
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\ping.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\ws2_32.dll
3736C:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\mcbuilder.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\mcbuilder.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Resource cache builder tool
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\programdata\microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\mcbuilder.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\ws2_32.dll
3988\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5240fsutil file setzerodata offset=0 length=524288 "C:\Users\admin\Desktop\dxdiag.exe" C:\Windows\SysWOW64\fsutil.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
fsutil.exe
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\fsutil.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\msvcrt.dll
c:\windows\syswow64\advapi32.dll
5740"C:\Users\admin\Desktop\dxdiag.exe" C:\Users\admin\Desktop\dxdiag.exe
dllhost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Microsoft Magnifier
Exit code:
0
Version:
5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Modules
Images
c:\users\admin\desktop\dxdiag.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ws2_32.dll
c:\windows\syswow64\rpcrt4.dll
6136"C:\WINDOWS\system32\UCPDMgr.exe"C:\Windows\System32\UCPDMgr.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
User Choice Protection Manager
Exit code:
0
Version:
1.0.0.414301
Modules
Images
c:\windows\system32\ucpdmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
6412C:\WINDOWS\SysWOW64\DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}C:\Windows\SysWOW64\dllhost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
COM Surrogate
Exit code:
0
Version:
10.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\dllhost.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\ucrtbase.dll
c:\windows\syswow64\combase.dll
6768\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—UCPDMgr.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
1 209
Read events
1 207
Write events
1
Delete events
1

Modification events

(PID) Process:(6412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration
Operation:writeName:DisplayCalibrator
Value:
C:\Users\admin\Desktop\dxdiag.exe
(PID) Process:(6412) dllhost.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\ICM\Calibration
Operation:delete valueName:DisplayCalibrator
Value:
C:\Users\admin\Desktop\dxdiag.exe
Executable files
22
Suspicious files
1
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\devobjv.dll —
MD5:—
SHA256:—
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\uexfatr.dll —
MD5:—
SHA256:—
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\NdfEventViewl.xmltext
MD5:86166DAA04A6C154826508304CC6D4AC
SHA256:886FD04B819586A8D78DC97DF3061DED9A7065E65D030BB02893ED658E29CA0A
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\mcbuilder.exeexecutable
MD5:A89C2FBE79D28488F189F2720D493E28
SHA256:C0FDE8F32045CFA2CCB9CDAED79297EC6FD0E09ADEA83304153667997EB12A93
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\RCX4D64.tmpexecutable
MD5:F3D3B9A02EFAFF2B5DD8E83B8C6C90B7
SHA256:1CA1236D5388938C745D4609C040F041C2010FED111162A1278F21F882C1F500
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\d3dxofx.dllexecutable
MD5:7D87620E1D43D2479716B8FFCF2A846D
SHA256:ED4B421A10D24DC03B0372D11924B415ED0CDC8896490826344879D58DC0D11B
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\RCX4D84.tmpexecutable
MD5:40971532E89ABBA85B99757FDD4615B0
SHA256:C03B03C09AF02815492EF1B8A329A31C84D766398068046A0CBE36803C85A8DB
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\eapprovpn.dllexecutable
MD5:4990DB7B1196F0FF5EF3A1FFF407653E
SHA256:23B1447478FD6F62AC3918E1F93303AE956B6CEE28402586F01CEB2AA39AE0A1
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\timedatee.cplexecutable
MD5:E3F08CD99E30F98E4D4EBE873C47B0CF
SHA256:CB28A2B47563EAD49B74BDB50B4A97A6D4BF793703FE36BF774E0A54D724A2B6
5740dxdiag.exeC:\ProgramData\Microsoft\v2.0_2.0.0.0__6cf057e92141bcbb\AppxProvisioningb.xmlxml
MD5:3D7FF4B04224F03AF5B3894878B1D33B
SHA256:8D1659B73479A51F5AA891390EB809156AFC52567C309E2462957E1D69B775A3
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
50
DNS requests
21
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
880
svchost.exe
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
880
svchost.exe
GET
200
2.16.164.49:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
1176
svchost.exe
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
—
—
GET
200
95.101.149.131:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
—
—
GET
200
2.23.77.188:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
6272
backgroundTaskHost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
192.168.100.255:137
—
—
—
whitelisted
5064
SearchApp.exe
2.21.65.132:443
www.bing.com
Akamai International B.V.
NL
whitelisted
880
svchost.exe
2.16.164.49:80
crl.microsoft.com
Akamai International B.V.
NL
whitelisted
880
svchost.exe
95.101.149.131:80
www.microsoft.com
Akamai International B.V.
NL
whitelisted
—
—
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
1176
svchost.exe
40.126.32.134:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1176
svchost.exe
2.23.77.188:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
—
—
184.28.89.167:443
go.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
www.bing.com
  • 2.21.65.132
  • 2.21.65.154
whitelisted
google.com
  • 142.250.185.206
whitelisted
crl.microsoft.com
  • 2.16.164.49
  • 2.16.164.72
whitelisted
www.microsoft.com
  • 95.101.149.131
whitelisted
ocsp.digicert.com
  • 2.23.77.188
  • 2.17.190.73
whitelisted
login.live.com
  • 40.126.32.134
  • 40.126.32.68
  • 20.190.160.22
  • 40.126.32.74
  • 40.126.32.138
  • 40.126.32.133
  • 20.190.160.14
  • 40.126.32.140
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
settings-win.data.microsoft.com
  • 20.73.194.208
  • 51.104.136.2
whitelisted
arc.msn.com
  • 20.223.36.55
whitelisted
fd.api.iris.microsoft.com
  • 20.199.58.43
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
dxdiag.exe