File name:

MSUSBDisplay_Windows_V2.0.2.5.exe

Full analysis: https://app.any.run/tasks/30e43365-c525-4ff8-bed1-310764598628
Verdict: Malicious activity
Analysis date: October 14, 2024, 12:20:56
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows
MD5:

D432735B6B14EC441F5BA5667FAE4974

SHA1:

E3D4BEC3C871E789CD1CB8072726D13751C0B6EF

SHA256:

E5CE0909FEFE01A76ECA39D01D4CD8C93832E4DBE5F965F1FB2C4144D3093476

SSDEEP:

98304:d+cD4dnQXjkBLUS9flxpNg9g2/mtIaYYqYxcO00zBD7IukeHzuyVYw40YSvk8cCE:GpbCZ1

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads security settings of Internet Explorer

      • MSUSBDisplay_Windows_V2.0.2.5.tmp (PID: 3828)

    • Executable content was dropped or overwritten

      • MSUSBDisplay_Windows_V2.0.2.5.exe (PID: 2620)
      • MSUSBDisplay_Windows_V2.0.2.5.exe (PID: 4432)
      • MSUSBDisplay_Windows_V2.0.2.5.tmp (PID: 5068)
      • devcon.exe (PID: 7104)
      • devcon.exe (PID: 7140)
      • drvinst.exe (PID: 1204)
      • drvinst.exe (PID: 1184)
      • devcon.exe (PID: 6180)
      • drvinst.exe (PID: 6692)
      • drvinst.exe (PID: 3852)
      • drvinst.exe (PID: 6960)
      • devcon.exe (PID: 6168)
      • drvinst.exe (PID: 5512)
      • drvinst.exe (PID: 6664)
      • devcon.exe (PID: 1204)
      • drvinst.exe (PID: 6988)
      • drvinst.exe (PID: 5756)

    • The process drops C-runtime libraries

      • MSUSBDisplay_Windows_V2.0.2.5.tmp (PID: 5068)

    • Drops a system driver (possible attempt to evade defenses)

      • MSUSBDisplay_Windows_V2.0.2.5.tmp (PID: 5068)
      • devcon.exe (PID: 7104)
      • drvinst.exe (PID: 1204)
      • devcon.exe (PID: 7140)
      • drvinst.exe (PID: 1184)
      • drvinst.exe (PID: 3852)

    • Process drops legitimate windows executable

      • MSUSBDisplay_Windows_V2.0.2.5.tmp (PID: 5068)

    • Executes as Windows Service

      • WUDFHost.exe (PID: 4292)
      • WUDFHost.exe (PID: 7152)
      • WUDFHost.exe (PID: 6708)
      • WUDFHost.exe (PID: 6276)
      • WUDFHost.exe (PID: 1452)
      • WUDFHost.exe (PID: 6548)
      • WUDFHost.exe (PID: 1884)
      • WUDFHost.exe (PID: 6952)
      • WUDFHost.exe (PID: 3916)

  • INFO

    • Checks supported languages

      • MSUSBDisplay_Windows_V2.0.2.5.tmp (PID: 3828)
      • MSUSBDisplay_Windows_V2.0.2.5.exe (PID: 2620)

    • Create files in a temporary directory

      • MSUSBDisplay_Windows_V2.0.2.5.exe (PID: 2620)

    • Reads the computer name

      • MSUSBDisplay_Windows_V2.0.2.5.tmp (PID: 3828)

    • Process checks computer location settings

      • MSUSBDisplay_Windows_V2.0.2.5.tmp (PID: 3828)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | Inno Setup installer (53.5)
.exe | InstallShield setup (21)
.exe | Win32 EXE PECompact compressed (generic) (20.2)
.exe | Win32 Executable (generic) (2.1)
.exe | Win16/32 Executable Delphi generic (1)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2022:04:14 16:10:23+00:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, Bytes reversed lo, 32-bit, Bytes reversed hi
PEType: PE32
LinkerVersion: 2.25
CodeSize: 741888
InitializedDataSize: 126464
UninitializedDataSize: -
EntryPoint: 0xb5eec
OSVersion: 6
ImageVersion: 6
SubsystemVersion: 6
Subsystem: Windows GUI
FileVersionNumber: 2.0.2.5
ProductVersionNumber: 2.0.2.5
FileFlagsMask: 0x003f
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Neutral
CharacterSet: Unicode
Comments: This installation was built with Inno Setup.
CompanyName: MS
FileDescription: MS USB Display Setup
FileVersion: 2.0.2.5
LegalCopyright: Copyright © MS 2022
OriginalFileName:
ProductName: MS USB Display
ProductVersion: 2.0.2.5
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
171
Monitored processes
39
Malicious processes
2
Suspicious processes
1

Behavior graph

Click at the process to see the details
start msusbdisplay_windows_v2.0.2.5.exe msusbdisplay_windows_v2.0.2.5.tmp no specs msusbdisplay_windows_v2.0.2.5.exe msusbdisplay_windows_v2.0.2.5.tmp devcon.exe no specs conhost.exe no specs devcon.exe conhost.exe no specs drvinst.exe devcon.exe conhost.exe no specs drvinst.exe drvinst.exe devcon.exe conhost.exe no specs drvinst.exe drvinst.exe wudfhost.exe no specs devcon.exe conhost.exe no specs drvinst.exe drvinst.exe wudfhost.exe no specs wudfhost.exe no specs devcon.exe conhost.exe no specs drvinst.exe drvinst.exe wudfhost.exe no specs wudfhost.exe no specs wudfhost.exe no specs devcon.exe no specs conhost.exe no specs wudfhost.exe no specs wudfhost.exe no specs wudfhost.exe no specs winusbdisplay.exe no specs devcon.exe no specs conhost.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1184DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{457451c7-ec7c-e945-9716-1529c0cb7715}\indirectdisplaybus.inf" "9" "45a813563" "00000000000001FC" "WinSta0\Default" "0000000000000200" "208" "c:\program files\ms usb display\idd\indirectdisplaybus"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1204DrvInst.exe "4" "0" "C:\Users\admin\AppData\Local\Temp\{503dd973-84d1-b24d-9db6-1d6630f360ca}\MSUSBDisplay.inf" "9" "410771dbb" "00000000000001C8" "WinSta0\Default" "00000000000001CC" "208" "C:\Program Files\MS USB Display\lib_usb"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
1204"C:\Program Files\MS USB Display\tool\x64\devcon.exe" update "C:\Program Files\MS USB Display\idd\indirectdisplaydriver2\indirectdisplaydriver2.inf" MS\IddBus2C:\Program Files\MS USB Display\tool\x64\devcon.exe
MSUSBDisplay_Windows_V2.0.2.5.tmp
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Setup API
Exit code:
0
Version:
10.0.10586.0 (th2_release.151029-1700)
Modules
Images
c:\program files\ms usb display\tool\x64\devcon.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
1452"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-257a7d93-4f47-4c63-b0b6-dc8ae65acba7 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8e5dbcf9-b89d-4ca7-b65e-3d330ccc899d -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e00a49fc-7196-454b-a542-4d0323dc3c50 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4681375d-e3c9-4eb7-bf23-a94a38402fc7 -LifetimeId:9d267969-045c-4b90-a1a7-fe4ade824e2f -DeviceGroupId:IddSampleDriverGroup1 -HostArg:0C:\Windows\System32\WUDFHost.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Driver Foundation - User-mode Driver Framework Host Process
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wudfhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\wudfplatform.dll
1568\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—devcon.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
1884"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-35a711b2-1942-44ed-b3a4-d21b7dc0d01b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-44ae46fb-b8ea-4af7-a7aa-000c6b56b2e7 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a22cd862-108e-46d8-82b7-37ad03086eb6 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7b873574-9712-48f4-b0d7-00b6490b328f -LifetimeId:3e0fedc8-1d19-48b4-b462-c52947a0932c -DeviceGroupId:IddSampleDriverGroup -HostArg:0C:\Windows\System32\WUDFHost.exe—services.exe
User:
LOCAL SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Driver Foundation - User-mode Driver Framework Host Process
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\wudfhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\sechost.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\devobj.dll
2236"C:\Program Files\MS USB Display\WinUsbDisplay.exe" firstinstallC:\Program Files\MS USB Display\WinUsbDisplay.exe—MSUSBDisplay_Windows_V2.0.2.5.tmp
User:
admin
Company:
MS
Integrity Level:
HIGH
Description:
Windows USB Display
Exit code:
1073807364
Version:
2.0.2.5
Modules
Images
c:\program files\ms usb display\winusbdisplay.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
2620"C:\Users\admin\AppData\Local\Temp\MSUSBDisplay_Windows_V2.0.2.5.exe" C:\Users\admin\AppData\Local\Temp\MSUSBDisplay_Windows_V2.0.2.5.exe
explorer.exe
User:
admin
Company:
MS
Integrity Level:
MEDIUM
Description:
MS USB Display Setup
Exit code:
0
Version:
2.0.2.5
Modules
Images
c:\users\admin\appdata\local\temp\msusbdisplay_windows_v2.0.2.5.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
3828"C:\Users\admin\AppData\Local\Temp\is-O8R0I.tmp\MSUSBDisplay_Windows_V2.0.2.5.tmp" /SL5="$60260,2391492,869376,C:\Users\admin\AppData\Local\Temp\MSUSBDisplay_Windows_V2.0.2.5.exe" C:\Users\admin\AppData\Local\Temp\is-O8R0I.tmp\MSUSBDisplay_Windows_V2.0.2.5.tmp—MSUSBDisplay_Windows_V2.0.2.5.exe
User:
admin
Company:
MS
Integrity Level:
MEDIUM
Description:
Setup/Uninstall
Exit code:
0
Version:
51.1052.0.0
Modules
Images
c:\users\admin\appdata\local\temp\is-o8r0i.tmp\msusbdisplay_windows_v2.0.2.5.tmp
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\comdlg32.dll
3852DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\WINDOWS\INF\oem6.inf" "oem6.inf:c14ce884432a57a1:IndirectDisplayBus_Device:11.48.12.282:root\indirectdisplaybus," "45a813563" "00000000000001FC"C:\Windows\System32\drvinst.exe
svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Driver Installation Module
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\drvinst.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\cfgmgr32.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\ntmarta.dll
c:\windows\system32\devrtl.dll
c:\windows\system32\drvstore.dll
Total events
29 566
Read events
29 418
Write events
122
Delete events
26

Modification events

(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Operation:writeName:Windows Usb Display
Value:
C:\Program Files\MS USB Display\WinUsbDisplay.exe
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_CURRENT_USER\SOFTWARE\WinUsbDisplay\Server
Operation:writeName:LogLevel
Value:
1
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1
Operation:writeName:Inno Setup: Setup Version
Value:
6.2.1
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1
Operation:writeName:Inno Setup: App Path
Value:
C:\Program Files\MS USB Display
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1
Operation:writeName:InstallLocation
Value:
C:\Program Files\MS USB Display\
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1
Operation:writeName:Inno Setup: Icon Group
Value:
MS USB Display
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1
Operation:writeName:Inno Setup: User
Value:
admin
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1
Operation:writeName:Inno Setup: Language
Value:
default
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1
Operation:writeName:DisplayName
Value:
Uninstall MS USB Display
(PID) Process:(5068) MSUSBDisplay_Windows_V2.0.2.5.tmpKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{509DC88F-BC75-4AED-B511-9892EAD1AE48}}_is1
Operation:writeName:UninstallString
Value:
"C:\Program Files\MS USB Display\unins000.exe"
Executable files
94
Suspicious files
51
Text files
8
Unknown types
22

Dropped files

PID
Process
Filename
Type
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\unins000.exeexecutable
MD5:03CA1B364078DCED779B3AF7B67B7ACA
SHA256:42055E50BD82868991E5226E47B2BCBC4734C5B5C2690057C55A5EF4B649AF95
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\is-G9HS6.tmpexecutable
MD5:03CA1B364078DCED779B3AF7B67B7ACA
SHA256:42055E50BD82868991E5226E47B2BCBC4734C5B5C2690057C55A5EF4B649AF95
4432MSUSBDisplay_Windows_V2.0.2.5.exeC:\Users\admin\AppData\Local\Temp\is-T98M4.tmp\MSUSBDisplay_Windows_V2.0.2.5.tmpexecutable
MD5:68B9C3FFFA755FA1D7B1C3EBF47901F0
SHA256:1CB08670DC780EB2ED9F2AC061A81B6C98546320B115453596B14671B9E88D0A
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\is-UHLMJ.tmpexecutable
MD5:034CCADC1C073E4216E9466B720F9849
SHA256:86E39B5995AF0E042FCDAA85FE2AEFD7C9DDC7AD65E6327BD5E7058BC3AB615F
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\is-PG7HE.tmptext
MD5:059591600C07B8F4DBE64E09A78BC2FD
SHA256:6BC69BB11D17ACC4245701BD021B0541689EEB1DBA7DD4224BD8962623A26CD0
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\is-VHIK6.tmpexecutable
MD5:2FF69D9815B4A8CD3EAE3E41AA99D6E9
SHA256:B839104AC92AEFBAF16086A47030A1757AA561F2DCA5AD3785B00A46C764772C
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\WinUsbDisplay.exeexecutable
MD5:2FF69D9815B4A8CD3EAE3E41AA99D6E9
SHA256:B839104AC92AEFBAF16086A47030A1757AA561F2DCA5AD3785B00A46C764772C
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\is-4JAV9.tmpexecutable
MD5:76D1CB612FA0CB1B94BCD51A9D0E9EE8
SHA256:B884AE358DF9914F2A1BB44D77CE6B6DF98E6E00AD12B274F28A62801264FD98
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\libusb0.dllexecutable
MD5:4E31FCD3246112F7137838A2668F1871
SHA256:168604FE69A8E06EFC14934099817D416E291C39D3D45A5ACB711038A7059186
5068MSUSBDisplay_Windows_V2.0.2.5.tmpC:\Program Files\MS USB Display\libyuv.dllexecutable
MD5:76D1CB612FA0CB1B94BCD51A9D0E9EE8
SHA256:B884AE358DF9914F2A1BB44D77CE6B6DF98E6E00AD12B274F28A62801264FD98
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
58
DNS requests
17
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
200
23.32.238.107:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6548
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6548
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
4360
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
—
—
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
4004
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1428
backgroundTaskHost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
6908
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
—
—
23.32.238.107:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
6944
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4020
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
4360
SearchApp.exe
104.126.37.161:443
www.bing.com
Akamai International B.V.
DE
whitelisted
4360
SearchApp.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.32.238.107
  • 23.32.238.112
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
google.com
  • 142.250.185.142
whitelisted
www.bing.com
  • 104.126.37.161
  • 104.126.37.152
  • 104.126.37.144
  • 104.126.37.160
  • 104.126.37.145
  • 104.126.37.162
  • 104.126.37.146
  • 104.126.37.155
  • 104.126.37.153
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
login.live.com
  • 20.190.159.0
  • 40.126.31.73
  • 20.190.159.64
  • 20.190.159.23
  • 20.190.159.75
  • 20.190.159.2
  • 20.190.159.68
  • 20.190.159.73
whitelisted
th.bing.com
  • 104.126.37.155
  • 104.126.37.153
  • 104.126.37.161
  • 104.126.37.152
  • 104.126.37.144
  • 104.126.37.160
  • 104.126.37.145
  • 104.126.37.162
  • 104.126.37.146
whitelisted
go.microsoft.com
  • 23.218.210.69
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
MSUSBDisplay_Windows_V2.0.2.5.exe