Port 9001 used by Microsoft-HTTPAPI/2.0

The port 9001 seems to be used by Microsoft-HTTPAPI/2.0. I get this from the browser doing a

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Thu, 09 Apr 2020 08:10:11 GMT
Connection: close
Content-Length: 315

Using netstat -aonb | grep 9001:

 TCP 0.0.0.0:9001 0.0.0.0:0 LISTENING 4 TCP [::]:9001 [::]:0 LISTENING 4 TCP [::1]:9001 [::1]:50916 TIME_WAIT 0 TCP [::1]:9001 [::1]:50957 TIME_WAIT 0

So PID 4 is ntoskrnl.exe.

I checked that Internet Information Service is off

How could I investigate further ? Thank you for your help

1 Answer

After Daniel B comment I did the following:

$ netsh http show servicestate
Snapshot of HTTP service state (Server Session View):
-----------------------------------------------------
Server session ID: FF00000520000001 Version: 2.0 State: Active Properties: Max bandwidth: 4294967295 Timeouts: Entity body timeout (secs): 120 Drain entity body timeout (secs): 120 Request queue timeout (secs): 120 Idle connection timeout (secs): 120 Header wait timeout (secs): 120 Minimum send rate (bytes/sec): 150 URL groups: URL group ID: FE00000540000001 State: Active Request queue name: Request queue is unnamed. Properties: Max bandwidth: inherited Max connections: inherited Timeouts: Timeout values inherited Number of registered URLs: 1 Registered URLs:
Request queues: Request queue name: Request queue is unnamed. Version: 2.0 State: Active Request queue 503 verbosity level: Basic Max requests: 1000 Number of active processes attached: 1 Process IDs: 5592 

And now I get the culprit Process IDs: 5592, IGGC/Service stands for
Intel Graphic Command Center