| File name: | 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe |
| Full analysis: | https://app.any.run/tasks/7d7cbbd6-59b5-44a8-8665-85bca5b1eadf |
| Verdict: | Malicious activity |
| Threats: | Medusa is a ransomware malware family targeting businesses and institutions. Medusa encrypts crucial data, rendering it inaccessible, and attempts to pressure users to pay to regain control of their information. The group behind this malicious software hosts a TOR website where it shares the list of the organizations whose infrastructure has been compromised. This malware utilizes various tactics, including exploiting vulnerabilities and employs a unique file extension (".MEDUSA") to mark encrypted files. |
| Analysis date: | April 29, 2025, 18:27:31 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (console) Intel 80386, for MS Windows, 5 sections |
| MD5: | 983A20479A281A182D33B75C0945E447 |
| SHA1: | 0D16A8891CA0662CF43F4A87CF2769BBDC39B279 |
| SHA256: | 0065B818525D8A364F5D9E4B801E3408DAD6576CE6D8CA5C01B19C3857A08D64 |
| SSDEEP: | 12288:YC//8v+VvS7o0NMG7IrkuXlLg9gOWE6nCfotSoM3xgYK4HRfVZmH5:jcv+VvS7o0NMG7IrnOWEoCfotMgkV |
MALICIOUS
Starts NET.EXE for service management
- net.exe (PID: 8048)
- net.exe (PID: 7788)
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
- net.exe (PID: 7876)
- net.exe (PID: 7696)
- net.exe (PID: 7608)
- net.exe (PID: 7532)
- net.exe (PID: 7964)
- net.exe (PID: 8136)
- net.exe (PID: 7368)
- net.exe (PID: 7544)
- net.exe (PID: 7260)
- net.exe (PID: 7680)
- net.exe (PID: 7816)
- net.exe (PID: 7316)
- net.exe (PID: 7748)
- net.exe (PID: 7956)
- net.exe (PID: 8068)
- net.exe (PID: 8148)
- net.exe (PID: 7268)
- net.exe (PID: 3300)
- net.exe (PID: 1280)
- net.exe (PID: 5428)
- net.exe (PID: 3888)
- net.exe (PID: 6876)
- net.exe (PID: 2244)
- net.exe (PID: 7692)
- net.exe (PID: 6564)
- net.exe (PID: 7204)
- net.exe (PID: 7564)
- net.exe (PID: 5400)
- net.exe (PID: 7820)
- net.exe (PID: 7916)
- net.exe (PID: 8032)
- net.exe (PID: 7428)
- net.exe (PID: 5228)
- net.exe (PID: 3140)
- net.exe (PID: 7972)
- net.exe (PID: 7864)
- net.exe (PID: 4784)
- net.exe (PID: 7348)
- net.exe (PID: 6620)
- net.exe (PID: 8000)
- net.exe (PID: 5892)
- net.exe (PID: 2040)
- net.exe (PID: 5384)
- net.exe (PID: 736)
- net.exe (PID: 4428)
- net.exe (PID: 7344)
- net.exe (PID: 5640)
- net.exe (PID: 7892)
- net.exe (PID: 8012)
- net.exe (PID: 6372)
- net.exe (PID: 632)
- net.exe (PID: 5984)
- net.exe (PID: 2152)
- net.exe (PID: 7588)
- net.exe (PID: 3956)
- net.exe (PID: 2340)
- net.exe (PID: 4068)
- net.exe (PID: 7856)
- net.exe (PID: 4692)
- net.exe (PID: 6752)
- net.exe (PID: 6436)
- net.exe (PID: 7684)
- net.exe (PID: 8324)
- net.exe (PID: 6872)
- net.exe (PID: 8624)
- net.exe (PID: 8904)
- net.exe (PID: 8732)
- net.exe (PID: 8228)
- net.exe (PID: 8428)
- net.exe (PID: 8828)
- net.exe (PID: 9036)
- net.exe (PID: 9144)
- net.exe (PID: 8692)
- net.exe (PID: 8444)
- net.exe (PID: 6184)
- net.exe (PID: 8744)
- net.exe (PID: 8260)
- net.exe (PID: 8596)
- net.exe (PID: 8928)
- net.exe (PID: 9064)
- net.exe (PID: 4208)
- net.exe (PID: 9160)
- net.exe (PID: 8404)
- net.exe (PID: 8288)
- net.exe (PID: 8864)
- net.exe (PID: 8820)
- net.exe (PID: 4812)
- net.exe (PID: 8556)
- net.exe (PID: 9104)
- net.exe (PID: 8252)
- net.exe (PID: 8976)
- net.exe (PID: 8240)
- net.exe (PID: 8200)
- net.exe (PID: 8852)
- net.exe (PID: 8896)
- net.exe (PID: 8988)
- net.exe (PID: 8220)
- net.exe (PID: 8816)
- net.exe (PID: 8616)
- net.exe (PID: 9052)
- net.exe (PID: 8356)
- net.exe (PID: 744)
- net.exe (PID: 9168)
- net.exe (PID: 6816)
- net.exe (PID: 8280)
- net.exe (PID: 9132)
- net.exe (PID: 8420)
- net.exe (PID: 8388)
- net.exe (PID: 8968)
- net.exe (PID: 8932)
- net.exe (PID: 8264)
- net.exe (PID: 8680)
- net.exe (PID: 8956)
- net.exe (PID: 8276)
- net.exe (PID: 9152)
- net.exe (PID: 8348)
- net.exe (PID: 8244)
- net.exe (PID: 3268)
- net.exe (PID: 4724)
- net.exe (PID: 1600)
- net.exe (PID: 8784)
- net.exe (PID: 8752)
- net.exe (PID: 8536)
- net.exe (PID: 8216)
- net.exe (PID: 6192)
- net.exe (PID: 5592)
- net.exe (PID: 9120)
- net.exe (PID: 8764)
- net.exe (PID: 960)
- net.exe (PID: 9232)
- net.exe (PID: 9320)
- net.exe (PID: 9492)
- net.exe (PID: 9408)
- net.exe (PID: 9584)
- net.exe (PID: 9664)
- net.exe (PID: 5304)
- net.exe (PID: 8960)
- net.exe (PID: 5988)
- net.exe (PID: 8840)
XORed URL has been found (YARA)
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
Antivirus name has been found in the command line (generic signature)
- taskkill.exe (PID: 10124)
Uses TASKKILL.EXE to kill antiviruses
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
MEDUSA note has been found
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
MEDUSA has been detected
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
SUSPICIOUS
Uses TASKKILL.EXE to kill process
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
Uses TASKKILL.EXE to kill Browsers
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
Uses TASKKILL.EXE to kill Office Apps
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
Write to the desktop.ini file (may be used to cloak folders)
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
INFO
Checks supported languages
- 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe (PID: 7432)
Manual execution by a user
- WINWORD.EXE (PID: 7456)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
xor-url
(PID) Process(7432) 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe
Decrypted-URLs (7)http://5ar4vuckm3k7osdlzskqkaqmqr4jjpmdikuotmlpkrbsxx7ard3xetyd.onion/960358a497fe6f10ac8009dcee87c67d
http://s7lmmhlt3iwnwirxvgjidl6omcblvw2rg75txjfduy73kx5brlmiulad.onion/
http://uyku4o2yg34ekvjtszg6gu7cvjzm6hyszhtu7c55iyuzhpr4k5knewyd.onion/960358a497fe6f10ac8009dcee87c67d
http://xfv4jzckytb4g3ckwemcny3ihv4i5p4lqzdpi624cxisu35my5fwi5qd.onion/
https://t.me/+lyskiDn9KiYxZjlh
https://utox.org/uTox_win64.exe)
https://www.torproject.org/download/):
TRiD
| .exe | | | Win64 Executable (generic) (64.6) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (15.4) |
| .exe | | | Win32 Executable (generic) (10.5) |
| .exe | | | Generic Win/DOS Executable (4.6) |
| .exe | | | DOS Executable Generic (4.6) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2025:01:28 21:45:46+00:00 |
| ImageFileCharacteristics: | Executable, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 14.27 |
| CodeSize: | 488960 |
| InitializedDataSize: | 192512 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x37bfa |
| OSVersion: | 6 |
| ImageVersion: | - |
| SubsystemVersion: | 6 |
| Subsystem: | Windows command line |
Total processes
648
Monitored processes
517
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 208 | C:\WINDOWS\system32\net1 stop "ReportServer$SYSTEM_BGC" /y | C:\Windows\SysWOW64\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 632 | net stop "PDVFSService" /y | C:\Windows\SysWOW64\net.exe | — | 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 644 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 728 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 736 | net stop "MSSQLSERVER" /y | C:\Windows\SysWOW64\net.exe | — | 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 744 | net stop "wbengine" /y | C:\Windows\SysWOW64\net.exe | — | 0065b818525d8a364f5d9e4b801e3408dad6576ce6d8ca5c01b19c3857a08d64.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 864 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 864 | C:\WINDOWS\system32\net1 stop "sacsvr" /y | C:\Windows\SysWOW64\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 896 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 904 | C:\WINDOWS\system32\net1 stop "TrueKey" /y | C:\Windows\SysWOW64\net1.exe | — | net.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Net Command Exit code: 2 Version: 10.0.19041.3636 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
15 732
Read events
15 459
Write events
249
Delete events
24
Modification events
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling |
| Operation: | write | Name: | 0 |
Value: 017012000000001000B24E9A3E02000000000000000600000000000000 | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | vn' |
Value: 766E2700201D000001000000000000007A814E6834B9DB0100000000 | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common |
| Operation: | write | Name: | SessionId |
Value: 58FB9E6C6E4F1049B27D02326E9A834C | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200 |
| Operation: | delete value | Name: | 0 |
Value: ซ鴐㝅娴Ꝇ꿹�䙔�닜樁င$驄摽鶲
ީ湕湫睯쥮Ȇ∢්ł¢ᣂ숁씀褎예됏죃캲ǭ砃㐶ᇅᆘዒ看椀渀眀漀爀搀⸀攀砀攀씀‖ៅ肀줄࠘㈲㈱䐭捥 | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\GracefulExit\WINWORD\2200 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\WINWORD\7456 |
| Operation: | write | Name: | 0 |
Value: 0B0E1057EA446B78DC2E439F6FF0314CA0A953230046D6B2F7C1C6A6EEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C50E8908C91003783634C511A03AD2120B770069006E0077006F00720064002E00650078006500C51620C517808004C91808323231322D44656300 | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Word\Resiliency\StartupItems |
| Operation: | write | Name: | ;p' |
Value: 3B702700201D0000040000000000000049AD936834B9DB018C00000001000000840000003E0043003A005C00550073006500720073005C00610064006D0069006E005C0041007000700044006100740061005C0052006F0061006D0069006E0067005C004D006900630072006F0073006F00660074005C00540065006D0070006C0061007400650073005C004E006F0072006D0061006C002E0064006F0074006D00000000000000 | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0 |
| Operation: | write | Name: | FilePath |
Value: officeclient.microsoft.com\EE485E18-A791-4745-962F-FC8740BC6237 | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0 |
| Operation: | write | Name: | StartDate |
Value: 30A0A66834B9DB01 | |||
| (PID) Process: | (7456) WINWORD.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\Internet\WebServiceCache\AllUsers\officeclient.microsoft.com\config16--lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3\0 |
| Operation: | write | Name: | EndDate |
Value: 30601093FDB9DB01 | |||
Executable files
1
Suspicious files
42
Text files
5
Unknown types
1
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\EE485E18-A791-4745-962F-FC8740BC6237 | xml | |
MD5:33D0C54FE3CFC8EE8463B9F95FDC9AA3 | SHA256:E1B860B85D3586A79C6124E8561ADEEF1E5A70811FF1807C133A466D09D0EED6 | |||
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 | binary | |
MD5:FB60FF789C58BC6CDCCF1F388665810F | SHA256:D0D379988D4ED6E4ACBE57E83246B62FE36DACBF96793173F626B7E31FDFB8E4 | |||
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_6372E0472AFF76BB926C97818BC773B9 | binary | |
MD5:693EC291E29A37E97B36CF7E8F9C3741 | SHA256:C7E0A73D570E65983DA2B1037DF08BAFCF5102B52EE6FE258FB4EBC9994CF437 | |||
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bin | text | |
MD5:CC90D669144261B198DEAD45AA266572 | SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899 | |||
| 7456 | WINWORD.EXE | C:\Users\admin\Desktop\~$lowensure.rtf | binary | |
MD5:68F7950EF1C4C79FBC83561DAD1484AC | SHA256:37CECB831EEF1146036D9373628B272250062C0E18D9B6248FD8DED761966619 | |||
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bin | text | |
MD5:51EBB121052E767F99257AD2EA915C24 | SHA256:DFC186B3787DA20A0F1BD5A38384A5502FDF215151A6D013191F5FE81E6EBDFB | |||
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\Features\6FeatureCache.txt | binary | |
MD5:EF1FA8818BBB17FAEC3C7350D622F2D9 | SHA256:12379444D12FCDEC499D96DD46FFBB3B05EACDD868C461037BC38E753F9BF334 | |||
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres | binary | |
MD5:83AF0E36708B3BA4E6C6D4E98BD1FC21 | SHA256:76745B98BBEFB67529A5C45AB5FCB3461BBD54DE64462E12C936B9708E652AD3 | |||
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\Local\Temp\Diagnostics\WINWORD\App1745951267831616100_6B44EA57-DC78-432E-9F6F-F0314CA0A953.log | — | |
MD5:— | SHA256:— | |||
| 7456 | WINWORD.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Templates\~$Normal.dotm | binary | |
MD5:CD3B96F9B32CDFF7159ACDF7FFF6A90E | SHA256:08D8A5256A9C17253C758BAC86BB9CEACF003241A30B9DB725B7744F85839F96 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
7
TCP/UDP connections
29
DNS requests
20
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | GET | 200 | 23.216.77.12:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
7456 | WINWORD.EXE | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEA77flR%2B3w%2FxBpruV2lte6A%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
7456 | WINWORD.EXE | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEApDqVCbATUviZV57HIIulA%3D | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.54.109.203:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
10232 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
10232 | SIHClient.exe | GET | 200 | 23.219.150.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 23.216.77.12:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | — | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
3216 | svchost.exe | 172.211.123.248:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
— | — | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 23.54.109.203:80 | — | AKAMAI-AS | DE | whitelisted |
— | — | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
7456 | WINWORD.EXE | 52.109.32.97:443 | officeclient.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | GB | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
settings-win.data.microsoft.com |
| whitelisted |
officeclient.microsoft.com |
| whitelisted |
ecs.office.com |
| whitelisted |
roaming.officeapps.live.com |
| whitelisted |