Operated by Microsoft Corporation, US.
00:15:5D is the default dynamic MAC pool for Microsoft Hyper-V virtual machines, registered to Microsoft Corporation at One Microsoft Way, Redmond. The pool is structured: the first three octets are Microsoft's OUI, the next two octets are derived from the last two octets of the Hyper-V host's IP address, and the final octet is randomized across 0x00–0xFF — giving a default of 256 dynamic MACs per host, adjustable through the MinimumMacAddress and MaximumMacAddress settings. Because the middle octets come from the host IP rather than anything globally coordinated, duplicate-MAC collisions can occur across separate Hyper-V hosts that share IP-octet patterns; during triage, a VMSMP event ID 28 on a host is the signature of such a collision. This entry is specifically the Hyper-V virtualization range — Microsoft itself is a large hardware vendor that ships Surface, Xbox, and other devices on roughly a hundred other MAC prefixes (e.g. 70:F8:AE), so 00:15:5D should be read as "Hyper-V guest" rather than "a Microsoft physical device." Like all virtualization OUIs it identifies the hypervisor platform, not the guest operating system or workload, and it appears in sandbox-evasion blocklists used by malware to detect virtual environments.