| Category | Started On | Completed On | Duration | Cuckoo Version |
|---|---|---|---|---|
| FILE | 2022-02-18 14:52:41.803827 | 2022-02-18 14:53:08.927498 | 27 seconds | 2.0-dev |
| Machine | Label | Manager | Started On | Shutdown On |
|---|---|---|---|---|
| win7cuckoo | win7 Clone 1 | VirtualBox | 2022-02-18 14:52:42 | 2022-02-18 14:53:08 |
File Details
| File name | 40bffba8deebcfa89ff78591d1697290a8f8145d.bin | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| File size | 27016 bytes | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| File type | PE32 executable (DLL) (GUI) Intel 80386, for MS Windows | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| CRC32 | 1D3D3684 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| MD5 | 6f6a6e38715c9b3838f95e03fa0567f3 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA1 | 40bffba8deebcfa89ff78591d1697290a8f8145d | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA256 | b1eab91db2cb293c153d0cb5ebf1ac3a9d50ac75d050403e8b9e1ec68881bd5f | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| SHA512 | b1ecc5e8aff711a0ec8aa9d8415e1b26b06bc8e5607f26baba34506c30849b091e2fb3ea7051471000640c869aa9024e09749cbeac5595c16a4806d15f3221c2 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Ssdeep | None | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| PEiD | None matched | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Yara |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| VirusTotal |
Permalink VirusTotal Scan Date: 2022-01-27 07:15:53 Detection Rate: 0/63 (Expand)
|
MetaFlows Scores
Metaflows Analysis Results (Signatures=50, Anomalies=0, PEiD=0, Yara=0, VT[1645213994]=0): Snort Events=0, AV Events=0
Total Score=50
Total Score=50
Signatures
nolookup_communication details
Communicates with host for which no DNS query was performed
Screenshots
Static Analysis
Version Infos
| LegalCopyright: | Copyright \xa9 1995-2006 Microsoft Corporation. |
| InternalName: | ppcrlconfig600 |
| FileVersion: | 16.000.28985.00 |
| CompanyName: | Microsoft Corporation |
| LegalTrademarks: | Microsoft\xae is a registered trademark of Microsoft Corporation. |
| ProductName: | Microsoft\xae Windows Live ID |
| ProductVersion: | 16.000.28985.00 |
| FileDescription: | Passport CRL configuration |
| OriginalFilename: | ppcrlconfig600.dll |
| Translation: | 0x0409 0x04b0 |
Sections
| Name | Virtual Address | Virtual Size | Size of Raw Data | Entropy |
|---|---|---|---|---|
| .rdata | 0x00001000 | 0x00000070 | 0x00000200 | 0.991548493219 |
| .rsrc | 0x00002000 | 0x00004308 | 0x00004400 | 5.71972703582 |
Resources
| Name | Offset | Size | Language | Sub-language | File type |
|---|---|---|---|---|---|
| RT_VERSION | 0x000020a0 | 0x0000041c | LANG_ENGLISH | SUBLANG_ENGLISH_US | data |
| None | 0x000024c0 | 0x00003e48 | LANG_ENGLISH | SUBLANG_ENGLISH_US | XML document text |
Strings
!This program cannot be run in DOS mode.
.rdata
@.rsrc
.rdata
.rdata$zzzdbg
.rsrc$01
.rsrc$02
<?xml version="1.0" encoding="us-ascii"?><Signature xmlns="http://www.w3.org/2000/09/xmldsig#"><cfg:Configuration version="1.1" xmlns:cfg="http://schemas.microsoft.com/Passport/PPCRL"><!--
When a certificate is rev'd, a line like the following should be
added to the cfg:Settings section:
<cfg:Certificate expired="true">SLCA_BACKUP.CER</cfg:Certificate>
--><cfg:Settings><cfg:DeviceDNSSuffix>.devicedns.live.com</cfg:DeviceDNSSuffix><cfg:DeviceDNSSuffixOld></cfg:DeviceDNSSuffixOld><cfg:EIDEnumBCSP>Microsoft Base Smart Card Crypto Provider</cfg:EIDEnumBCSP><cfg:EIDEnumRootCAThumbprint>0tOOumDKocEgVaLhyDsVrUUBEMI=</cfg:EIDEnumRootCAThumbprint><cfg:UpdateNeededInterval>604800</cfg:UpdateNeededInterval><cfg:ResolveTimeout>0</cfg:ResolveTimeout><cfg:ConnectTimeout>10000</cfg:ConnectTimeout><cfg:SendTimeout>30000</cfg:SendTimeout><cfg:ReceiveTimeout>30000</cfg:ReceiveTimeout><cfg:MinMinutesBetweenMetaConfigCheck>20160</cfg:MinMinutesBetweenMetaConfigCheck><!--[SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine")]--><cfg:AndroidSsoCerts>sX6CAbEo4edMwCNRCrfqA6wn3eUNMtgQ6hV3dY8cwJg=,g2b69yfcSDF6LzoMN/oSfz81YZTPuy9LYo7H5qGnXA8=,uSUTbz6nwKGVFpChqzE5ENqB9AmUqFNC7GIoiPEocFE=,oHlCFSeKVn6IevbN4BWl6IQU72QPfas4VaPneWWL53g=,fVOTUco5wnynBkCeWptrBi25v43D2MqmE3Bnrn9otec=,KEg2GpweMt8dPi7Wp7nmelJc+KE7Fk+ABslHlXj3Rt4=,7r0PFuYpr4uDgb/t/dZJYF/pD3Y/XLe6Rz657vlNmvE=,Mb5ACW+THNfxHV4mLSssQ3xEOF+07LwQE9ladDWBb5w=,6EPuPaEZXWr7icqjznQnsI/AH9h4ok+lbpYsNccdXnA=,rQZmwqojBROk1Pc/okKkWGzY7WcmodDdVCUHcv2blgU=</cfg:AndroidSsoCerts><cfg:ConfigServerSslURI>https://go.microsoft.com/fwlink/?LinkId=690512</cfg:ConfigServerSslURI><cfg:ConfigServerCdnURI>http://go.microsoft.com/fwlink/?LinkId=253579</cfg:ConfigServerCdnURI><cfg:ConfigServerURI>http://clientconfig.passport.net/ppcrlconfig.srf</cfg:ConfigServerURI><cfg:TopNonFedDomains>@hotmail.,@msn.,@live.,@yahoo.,@gmail.,@windowslive.,@sympatico.,@aol.,@163.,@freemail.,@gmx.,@comcast.,@web.,@libero.,@wanadoo.,@sbcglobal.,@example.,@tiscali.,@126.,@mail.,@q.,@xiaoi.,@hanmail.,@walla.,@free.,@ppauthz.com,@compaq.,@hotmail.co.,@messengeruser.,@passport.,@webtv.</cfg:TopNonFedDomains><cfg:DIDCOMMetaData><cfg:DIDWithAuth>1</cfg:DIDWithAuth><cfg:AssocPDIDToLDID>1</cfg:AssocPDIDToLDID><cfg:Protocol><cfg:CLSID>{1C109E4C-2F30-4EA3-A57A-A290877A2303}</cfg:CLSID><cfg:DATA><![CDATA[<Input version="1" match="20"><Excluded><Controller>Win32_USBControllerDevice</Controller><Controller>Win32_1394ControllerDevice</Controller><Controller>Win32_PCMCIAControllerDevice</Controller><Controller>Win32_ConnectionShare</Controller></Excluded><Class name="Win32_PhysicalMedia" pos="1" hash="32" match="10"><Data>SerialNumber</Data></Class><Class name="Win32_NetworkAdapter" pos="2" hash="32" match="10"><Data>MACAddress</Data></Class><Class name="Win32_BIOS" pos="3" hash="32" match="10"><Data>Manufacturer</Data><Data>SerialNumber</Data></Class></Input>]]></cfg:DATA><cfg:PREFIX>01</cfg:PREFIX></cfg:Protocol><cfg:Protocol><cfg:CLSID>{B9F1D9B8-1DA6-4F17-962F-69EC82EA2704}</cfg:CLSID><cfg:PREFIX>03</cfg:PREFIX><cfg:LOGICAL>1</cfg:LOGICAL><cfg:SYSTEM>1</cfg:SYSTEM></cfg:Protocol><cfg:Protocol><cfg:CLSID>{B9F1D9B8-1DA6-4F17-962F-69EC82EA2704}</cfg:CLSID><cfg:PREFIX>02</cfg:PREFIX><cfg:LOGICAL>1</cfg:LOGICAL></cfg:Protocol><cfg:CONSENTVERSION>1</cfg:CONSENTVERSION></cfg:DIDCOMMetaData><cfg:Certificate>MIIDGzCCAtugAwIBAgIJAL6pALeLZHDvMAkGByqGSM44BAMwIzEhMB8GA1UEAxMYVG9rZW4gU2lnbmluZyBQdWJsaWMgS2V5MB4XDTE2MDUwOTIwNDA1NVoXDTIxMDUwODIwNDA1NVowIzEhMB8GA1UEAxMYVG9rZW4gU2lnbmluZyBQdWJsaWMgS2V5MIIBtzCCASwGByqGSM44BAEwggEfAoGBAKmnM6FKnJ1osHWBHd8jHFFMDNwygIcof9EfHW6xJbU2uIzVV5WRu251RbRbmOqozesK44vkeBx9Ntl7PSu0W5RJFCEw9o4RLG0J40MWDNDQ+7iqvIsM6lsgZrDjNoWJ2t/Yrnnp0r3F9YNtj7J4vgLCYNOlkr2kcfGiji+SXotXAhUAqGI2zlbARtjz+simu2PihUPkV1MCgYEAnrIIXPvjKvWiXd3uve7eDS8qRHW7yoAseVLgeEIbS4VSj/9iQqunx1weQGlds75CLZgpcrY4Z5wbkxSjnK1EV30qce4+VzgXYGLZIAvl78wbAMFrG0josXccAbmqVM4LX2Z5yu1TEpPZLvgiaV4gJk4jsYhInqPm3Bw2qQ+gZokDgYQAAoGAFozcPQdM9MmszvEWMXuFrfEA8kVMnKIyA60paSi7CIecSAlsRLyw3D9J9pRW6HHdRZgOrKvnNcY63gKB56SKyj6r3nGqtkwEpu9yw1K+k2aSyJcKPHYVNw1Um5McKJgQJ49ShJFPaWXfDZPOCpgMpdzibnWjMcTak5rz4FHSUtOjgZgwgZUwHQYDVR0OBBYEFKNT6lUDzQppxFhwtv/jkSCRx596MFMGA1UdIwRMMEqAFKNT6lUDzQppxFhwtv/jkSCRx596oSekJTAjMSEwHwYDVQQDExhUb2tlbiBTaWduaW5nIFB1YmxpYyBLZXmCCQC+qQC3i2Rw7zASBgNVHRMBAf8ECDAGAQH/AgEAMAsGA1UdDwQEAwIBxjAJBgcqhkjOOAQDAy8AMCwCFGjnp838qB/wTUdvoRt4G3aW0fv0AhRe8cZDdOveTDCbWane65nlVv0Udw==</cfg:Certificate><cfg:Certificate>MIIDHDCCAtugAwIBAgIJAPVhDwwaTUJrMAkGByqGSM44BAMwIzEhMB8GA1UEAxMYVG9rZW4gU2lnbmluZyBQdWJsaWMgS2V5MB4XDTIxMDMxODE4NDIzN1oXDTQxMDMxMzE4NDIzN1owIzEhMB8GA1UEAxMYVG9rZW4gU2lnbmluZyBQdWJsaWMgS2V5MIIBtzCCASsGByqGSM44BAEwggEeAoGBANwZEes+CsJ6G4/Pe5XmGS9e5qki7KPMh9+IU5JE+z0H0Q4v51cKYCcm0OHtStB4oTF3RqTcYT6wYp/k6CcrGUVKo60tWY3C+ohOABpfoAnstLX/bZmWYQ87KzkRpB21WGCAJsoNQ5V0oQbwnEeeWO5sfZ6T3lfP7YgyeY4NatWhAhUAhFP2mQrVRzurTrsPRs5S1aNUWWUCgYBw3lXgm9xw1G9BSs8mP9sv8IefC87tBupniaUY/lz+AlN0qs6tXPHSesobCFxLDNT0Vhw4fSTJBPlq99tvV6ipEQkBtR3ColMVMq0G7ECW8ojnPWUcwdYUCyky7kyV7EuwnUYoAN4nZWBhN9BOj/nO0Ds5HInryR0RnTEvT0uojwOBhQACgYEA2SDhhPBDnKxvmH9RHvTUW0pvaTyAbFXxQ1WP+rcN608akqKmyMiskxCUySoBGAEbE/szcBqTu4VpvskyOBHY6Li6ewYP5cpVe7mARh27+cuGOzz3JZAVwi79D6u9/6OxnLyfbdRpYFq0qlmtUSbqtp895cs0cLn8TIppt+h6iDKjgZgwgZUwHQYDVR0OBBYEFNggH9qn8tEAK/Xtp75ejkmJcgjwMFMGA1UdIwRMMEqAFNggH9qn8tEAK/Xtp75ejkmJcgjwoSekJTAjMSEwHwYDVQQDExhUb2tlbiBTaWduaW5nIFB1YmxpYyBLZXmCCQD1YQ8MGk1CazASBgNVHRMBAf8ECDAGAQH/AgEAMAsGA1UdDwQEAwIBxjAJBgcqhkjOOAQDAzAAMC0CFHDGG3jer0Hzy/Qr08Dx/XpQGPG/AhUAg5mwhsY1EvBXNSor8eaySNirEH0=</cfg:Certificate><cfg:AddressResolutionTTL>900</cfg:AddressResolutionTTL><cfg:UseServiceMonitor>1</cfg:UseServiceMonitor><cfg:ClientTimeOutForRpcCallsNoNetwork>5</cfg:ClientTimeOutForRpcCallsNoNetwork><cfg:ClientTimeoutForRpcCallsWithNetwork>60</cfg:ClientTimeoutForRpcCallsWithNetwork><cfg:MonitorTimeOutForRpcCalls>2</cfg:MonitorTimeOutForRpcCalls><cfg:MonitorGracePeriodForServiceStop>3</cfg:MonitorGracePeriodForServiceStop><cfg:MaxHandleCount>10000</cfg:MaxHandleCount><cfg:MaxWorkingSet>157286400</cfg:MaxWorkingSet><cfg:CallIsPastDueAt>180</cfg:CallIsPastDueAt><cfg:MaxActiveCallsPastDue>3</cfg:MaxActiveCallsPastDue><cfg:MaxTotalPastDue>100</cfg:MaxTotalPastDue><cfg:LivesspMaxTokenSize>60000</cfg:LivesspMaxTokenSize><cfg:SQMSessionMemory>65536</cfg:SQMSessionMemory><cfg:SQMUploadLink>http://sqm.microsoft.com/sqm/WindowsLive/sqmserver.dll</cfg:SQMUploadLink><cfg:SQMAppId>10</cfg:SQMAppId><cfg:AccountDomain>account.live.com</cfg:AccountDomain><cfg:InterruptResolutionDomain>account.live.com</cfg:InterruptResolutionDomain><cfg:PasswordReset>account.live.com/password/reset</cfg:PasswordReset><cfg:AccountPolicy>sapi</cfg:AccountPolicy><cfg:ConnectAccountPolicy>mbi_ssl</cfg:ConnectAccountPolicy><cfg:StrongAuthPolicy>mbi_ssl_sa</cfg:StrongAuthPolicy><cfg:MinPasswordLength>8</cfg:MinPasswordLength><cfg:MinPasswordCharacterGroups>2</cfg:MinPasswordCharacterGroups><cfg:CookieP3PHeader><![CDATA[CP="CAO DSP COR ADMa DEV CONo TELo CUR PSA PSD TAI IVDo OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR LOCi CNT"]]></cfg:CookieP3PHeader><cfg:ThrottleFlags>1</cfg:ThrottleFlags><cfg:ThrottleMaxRequests>250</cfg:ThrottleMaxRequests><cfg:ThrottleTotalIntervalSeconds>7200</cfg:ThrottleTotalIntervalSeconds><cfg:NegativeCacheFlags>1</cfg:NegativeCacheFlags><cfg:NegativeCacheMaxRequests>2</cfg:NegativeCacheMaxRequests><cfg:NegativeCacheIntervalSeconds>3600</cfg:NegativeCacheIntervalSeconds><cfg:ConfigVersion>16.000.28985.00</cfg:ConfigVersion><cfg:ThrottleHWBindingMaxRequests>50</cfg:ThrottleHWBindingMaxRequests><cfg:ThrottleHWUpdateMaxRequests>2</cfg:ThrottleHWUpdateMaxRequests><cfg:ThrottleHWUpdateOutOfToleranceMaxRequests>2</cfg:ThrottleHWUpdateOutOfToleranceMaxRequests><cfg:ThrottleTpmBindingMaxRequests>3</cfg:ThrottleTpmBindingMaxRequests></cfg:Settings><cfg:ServiceURIs><cfg:DisableDIDCookie>1</cfg:DisableDIDCookie><cfg:MSNDomain>msn.com</cfg:MSNDomain><cfg:DADomain>login.live.com</cfg:DADomain><cfg:WLDomain>live.com</cfg:WLDomain><cfg:SignupDomain>login.live.com,signup.live.com,account.live.com</cfg:SignupDomain><cfg:LoginSrf>login.srf</cfg:LoginSrf><cfg:InvalidName><![CDATA[\%:[],#"<>;()]]></cfg:InvalidName><cfg:InvalidDomain><![CDATA[\%:[],#"<>;'()]]></cfg:InvalidDomain><cfg:InvalidUrl><![CDATA[\[],"<>';()]]></cfg:InvalidUrl><cfg:PostSrf>post.srf</cfg:PostSrf><cfg:ManageEIDsSrf>ManageEIDs.srf</cfg:ManageEIDsSrf><cfg:SecureSrf>secure.srf</cfg:SecureSrf><cfg:LogoutSrf>logout.srf</cfg:LogoutSrf><cfg:TrustedDomain>live.com,msn.com,zune.net,windowsmarketplace.com,workspace.office.live.com,atdmt.com</cfg:TrustedDomain><cfg:PassportSecurityTokenService>https://login.live.com/RST.srf
</cfg:PassportSecurityTokenService><cfg:MSNPassportSecurityTokenService>https://login.live.com/RST.srf</cfg:MSNPassportSecurityTokenService><cfg:PassportSHA1Auth>https://login.live.com/ppsecure/SHA1Auth.srf
</cfg:PassportSHA1Auth><cfg:URL_PasswordReset>https://login.live.com/resetpw.srf
</cfg:URL_PasswordReset><cfg:URL_PassportNetwork>http://www.microsoft.com/account/default.aspx
</cfg:URL_PassportNetwork><cfg:URL_AccountServices>https://account.live.com
</cfg:URL_AccountServices><cfg:URL_PaneHelpFrame>http://login.live.com/hp.srf?format=b1
</cfg:URL_PaneHelpFrame><!-- !!! P L E A S E R E A D !!!! --><!-- IDCRL 4.5 and below cannot load more than 32 items from <cfg:ServiceURIs> node. --><!-- Add any new items in <cfg:ServiceURIs1> node below. --><!-- NOTE: IDCRL 4.5 and below will NOT be able to read items from the new node. --></cfg:ServiceURIs><cfg:ServiceURIs1><cfg:PassportMetaConfig>http://clientconfig.passport.net/ppcrlcheck.xml</cfg:PassportMetaConfig><cfg:DeviceIdTrustedDomain>*.live.com</cfg:DeviceIdTrustedDomain><cfg:DIDManagementDomain>login.live.com,account.live.com</cfg:DIDManagementDomain><cfg:PREFBINCookieDomain>c.live.com,c.msn.com</cfg:PREFBINCookieDomain><cfg:WLIDSTS_WCF>https://login.live.com/RST2.srf</cfg:WLIDSTS_WCF><cfg:MSNWLIDSTS_WCF>https://login.live.com/RST2.srf</cfg:MSNWLIDSTS_WCF><cfg:URL_DeviceTOU>https://login.live.com/didtou.srf</cfg:URL_DeviceTOU><cfg:DeviceChangeService>https://login.live.com/ppsecure/devicechangecredential.srf</cfg:DeviceChangeService><cfg:DeviceAddService>https://login.live.com/ppsecure/deviceaddcredential.srf</cfg:DeviceAddService><cfg:DeviceRemoveService>https://login.live.com/ppsecure/deviceremovecredential.srf</cfg:DeviceRemoveService><cfg:DeviceAssociateService>https://login.live.com/ppsecure/DeviceAssociate.srf</cfg:DeviceAssociateService><cfg:DeviceDisassociateService>https://login.live.com/ppsecure/DeviceDisassociate.srf</cfg:DeviceDisassociateService><cfg:DeviceQueryService>https://login.live.com/ppsecure/DeviceQuery.srf</cfg:DeviceQueryService><cfg:DeviceUpdateService>https://login.live.com/ppsecure/DeviceUpdate.srf</cfg:DeviceUpdateService><cfg:DeviceEnumerateService>https://login.live.com/ppsecure/EnumerateDevices.srf</cfg:DeviceEnumerateService><cfg:ResolveUserService>https://login.live.com/ppsecure/ResolveUser.srf</cfg:ResolveUserService><cfg:AllowGetProperty>EID</cfg:AllowGetProperty><cfg:RealmInfoService>https://login.live.com/getrealminfo.srf</cfg:RealmInfoService><cfg:RealmInfoService6_0>https://login.live.com/getuserrealm.srf</cfg:RealmInfoService6_0><cfg:URL_Retention>https://login.live.com/retention.srf</cfg:URL_Retention><cfg:URL_Registration>https://signup.live.com/signup.aspx</cfg:URL_Registration><cfg:URL_Privacy>http://go.microsoft.com/fwlink/p/?LinkId=253457</cfg:URL_Privacy><cfg:GetUserKeyDataService>https://login.live.com/ppsecure/GetUserKeyData.srf</cfg:GetUserKeyDataService><cfg:OOBESignIn>https://login.live.com/ppsecure/InlineLogin.srf?id=80500</cfg:OOBESignIn><cfg:OOBESignUp>https://account.live.com/inlinesignup.aspx?iww=1&id=80500</cfg:OOBESignUp><cfg:OOBEIfExists>https://login.live.com/IfExists.srf?uiflavor=4&id=80500</cfg:OOBEIfExists><cfg:CPSignIn>https://login.live.com/ppsecure/InlineLogin.srf?id=80501</cfg:CPSignIn><cfg:CPSignUp>https://account.live.com/inlinesignup.aspx?iww=1&id=80501</cfg:CPSignUp><cfg:CPIfExists>https://login.live.com/IfExists.srf?uiflavor=4&id=80501</cfg:CPIfExists><cfg:CPChangePwd>https://account.live.com/Wizard/Password/Change?id=80501</cfg:CPChangePwd><cfg:CPAddUserSignIn>https://login.live.com/ppsecure/InlineLogin.srf?id=80502</cfg:CPAddUserSignIn><cfg:CPAddUserSignUp>https://account.live.com/InlineSignup.aspx?iww=1&id=80502</cfg:CPAddUserSignUp><cfg:CPAddUserIfExists>https://login.live.com/IfExists.srf?uiflavor=4&id=80502</cfg:CPAddUserIfExists><!-- Auth-up URLs and all 806XX site IDs are used for versions of connect flows that can handle receiving a DA token during connect. --><cfg:OOBESignInAuthUp>https://login.live.com/ppsecure/InlineLogin.srf?id=80600</cfg:OOBESignInAuthUp><cfg:OOBESignUpAuthUp>https://account.live.com/inlinesignup.aspx?iww=1&id=80600</cfg:OOBESignUpAuthUp><cfg:OOBEIfExistsAuthUp>https://login.live.com/IfExists.srf?uiflavor=4&id=80600</cfg:OOBEIfExistsAuthUp><cfg:OOBEConnect>https://login.live.com/ppsecure/InlineConnect.srf?id=80600</cfg:OOBEConnect><cfg:CPSignInAuthUp>https://login.live.com/ppsecure/InlineLogin.srf?id=80601</cfg:CPSignInAuthUp><cfg:CPSignUpAuthUp>https://account.live.com/inlinesignup.aspx?iww=1&id=80601</cfg:CPSignUpAuthUp><cfg:CPIfExistsAuthUp>https://login.live.com/IfExists.srf?uiflavor=4&id=80601</cfg:CPIfExistsAuthUp><cfg:CPChangePwdAuthUp>https://account.live.com/Wizard/Password/Change?id=80601</cfg:CPChangePwdAuthUp><cfg:CPChangePwdOnline>https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80601&fid=cp</cfg:CPChangePwdOnline><cfg:CPConnect>https://login.live.com/ppsecure/InlineConnect.srf?id=80601</cfg:CPConnect><cfg:OOBEUpgradeSignIn>https://login.live.com/ppsecure/InlineLogin.srf?id=80603</cfg:OOBEUpgradeSignIn><cfg:OOBEUpgradeSignUp>https://account.live.com/inlinesignup.aspx?iww=1&id=80603</cfg:OOBEUpgradeSignUp><cfg:OOBEUpgradeConnect>https://login.live.com/ppsecure/InlineConnect.srf?id=80603</cfg:OOBEUpgradeConnect><cfg:CompleteAccountSignIn>https://login.live.com/ppsecure/InlineLogin.srf?id=80604</cfg:CompleteAccountSignIn><cfg:CompleteAccountSignUp>https://account.live.com/inlinesignup.aspx?iww=1&id=80604</cfg:CompleteAccountSignUp><cfg:CompleteAccountConnect>https://login.live.com/ppsecure/InlineConnect.srf?id=80604</cfg:CompleteAccountConnect><cfg:CXHSignInUpsell>https://login.live.com/ppsecure/InlineLogin.srf?id=80604</cfg:CXHSignInUpsell><cfg:NthUserSignIn>https://login.live.com/ppsecure/InlineLogin.srf?id=80605</cfg:NthUserSignIn><cfg:NthUserSignUp>https://account.live.com/inlinesignup.aspx?iww=1&id=80605</cfg:NthUserSignUp><cfg:NthUserConnect>https://login.live.com/ppsecure/InlinePOPAuth.srf?id=80605</cfg:NthUserConnect><cfg:CXHSignIn>https://login.live.com/ppsecure/InlineLogin.srf?id=80606</cfg:CXHSignIn><cfg:CXHTransientSignIn>https://login.live.com/ppsecure/InlineLogin.srf?id=80607</cfg:CXHTransientSignIn><cfg:CXHReAuth>https://login.live.com/ppsecure/InlineLogin.srf?id=80608</cfg:CXHReAuth><cfg:CXHNGCUpsell>https://account.live.com/msangcwam</cfg:CXHNGCUpsell><cfg:URL_AccountSettings>https://account.microsoft.com/?ref=settings</cfg:URL_AccountSettings><cfg:URL_ProofManage>http://go.microsoft.com/fwlink/?LinkId=248215</cfg:URL_ProofManage><cfg:InlineClientAuth>https://login.live.com/ppsecure/InlineClientAuth.srf</cfg:InlineClientAuth><cfg:InlineClientAuthEnd>https://login.live.com/ppsecure/InlineDesktop.srf</cfg:InlineClientAuthEnd><cfg:ManageApprover>https://login.live.com/ManageApprover.srf</cfg:ManageApprover><cfg:ListSessions>https://login.live.com/ListSessions.srf</cfg:ListSessions><cfg:ApproveSession>https://login.live.com/ApproveSession.srf</cfg:ApproveSession><cfg:ManageLoginKeys>https://login.live.com/ManageLoginKeys.srf</cfg:ManageLoginKeys></cfg:ServiceURIs1></cfg:Configuration></Signature>
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20100
200924191038Z
210923191038Z0t1
Washington1
Redmond1
Microsoft Corporation1
Microsoft Corporation0
E0C1)0'
Microsoft Operations Puerto Rico1
230480+4612740
Ehttp://crl.microsoft.com/pki/crl/products/MicCodSigPCA_2010-07-06.crl0Z
>http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100706204017Z
250706205017Z0~1
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 20100
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
#Vx"&6
7Z>@B1
Washington1
Redmond1
Microsoft Corporation1(0&
Microsoft Code Signing PCA 2010
https://login.live.com0
20210322202602.699Z0
Washington1
Redmond1
Microsoft Corporation1-0+
$Microsoft Ireland Operations Limited1&0$
Thales TSS ESN:FC41-4BD4-D2201%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
201015172826Z
220112172826Z0
Washington1
Redmond1
Microsoft Corporation1-0+
$Microsoft Ireland Operations Limited1&0$
Thales TSS ESN:FC41-4BD4-D2201%0#
Microsoft Time-Stamp Service0
"07E2%`NL
%@_V:0
Ehttp://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z
>http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
W-d;|s
Washington1
Redmond1
Microsoft Corporation1200
)Microsoft Root Certificate Authority 20100
100701213655Z
250701214655Z0|1
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
$`2X`F
Ehttp://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z
>http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
1http://www.microsoft.com/PKI/docs/CPS/default.htm0@
oK0D$"<
r~akow
Washington1
Redmond1
Microsoft Corporation1-0+
$Microsoft Ireland Operations Limited1&0$
Thales TSS ESN:FC41-4BD4-D2201%0#
Microsoft Time-Stamp Service
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 20100
20210323021715Z
20210324021715Z0w0=
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
Washington1
Redmond1
Microsoft Corporation1&0$
Microsoft Time-Stamp PCA 2010
7L]8{;s
VS_VERSION_INFO
StringFileInfo
040904b0
CompanyName
Microsoft Corporation
FileDescription
Passport CRL configuration
InternalName
ppcrlconfig600
LegalCopyright
Copyright
1995-2006 Microsoft Corporation.
LegalTrademarks
Microsoft
is a registered trademark of Microsoft Corporation.
OriginalFilename
ppcrlconfig600.dll
ProductName
Microsoft
Windows Live ID
FileVersion
16.000.28985.00
ProductVersion
16.000.28985.00
VarFileInfo
Translation
Legal_Policy_Statement
"ppcrlprod2021032
Legal_Policy_Statement
Dropped Files
Network Analysis
Hosts Involved
| IP Address |
|---|
| 70.186.27.9 |
| 8.8.8.8 |
DNS Requests
| Domain | IP Address |
|---|---|
| armmf.adobe.com | 23.3.84.164 |
| dns.msftncsi.com | 131.107.255.255 |
| teredo.ipv6.microsoft.com | 54.241.176.34 |
| ipv6.msftncsi.com |
HTTP Requests
| URL | Data |
|---|---|
| http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f | GET /msdownload/update/v3/static/trustedr/en/3679CA35668772304D30A5FB873B0FA77BB70D54.crt?911320f9b04be75f HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ctldl.windowsupdate.com |
Behavior Summary
Registry Key-Read
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles
Processes
registry filesystem process services network synchronization