1489525118 | 2024-11-09T11:43:20.618216
80 /
tcp
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Sat, 09 Nov 2024 11:43:20 GMT
Connection: close
Content-Length: 315
122259253 | 2024-11-07T21:21:00.290572
135 /
tcp
Microsoft RPC Endpoint Mapper
d95afe70-a6d5-4259-822e-2c84da1ddb0d
version: v1.0
protocol: [MS-RSP]: Remote Shutdown Protocol
provider: wininit.exe
ncacn_ip_tcp: 203.223.152.169:49152
ncalrpc: WindowsShutdown
ncacn_np: \\WIN-K54EIMCILQN\PIPE\InitShutdown
ncalrpc: WMsgKRpc063450
76f226c3-ec14-4325-8a99-6a46348418af
version: v1.0
provider: winlogon.exe
ncalrpc: WindowsShutdown
ncacn_np: \\WIN-K54EIMCILQN\PIPE\InitShutdown
ncalrpc: WMsgKRpc063450
ncalrpc: WMsgKRpc0635C1
ncalrpc: WMsgKRpc085DCC3
c9ac6db5-82b7-4e55-ae8a-e464ed7b4277
version: v1.0
annotation: Impl friendly name
provider: sysntfy.dll
ncalrpc: LRPC-096dfd04b0135e508c
ncacn_np: \\WIN-K54EIMCILQN\PIPE\srvsvc
ncacn_ip_tcp: 203.223.152.169:49154
ncacn_np: \\WIN-K54EIMCILQN\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
ncalrpc: IUserProfile2
12e65dd8-887f-41ef-91bf-8d816c42c2e7
version: v1.0
annotation: Secure Desktop LRPC interface
provider: winlogon.exe
ncalrpc: WMsgKRpc0635C1
3c4728c5-f0ab-448b-bda1-6ce01eb0a6d6
version: v1.0
annotation: DHCPv6 Client LRPC Endpoint
provider: dhcpcsvc6.dll
ncalrpc: dhcpcsvc6
ncalrpc: dhcpcsvc
ncacn_ip_tcp: 203.223.152.169:49153
ncacn_np: \\WIN-K54EIMCILQN\pipe\eventlog
ncalrpc: eventlog
3c4728c5-f0ab-448b-bda1-6ce01eb0a6d5
version: v1.0
annotation: DHCP Client LRPC Endpoint
provider: dhcpcsvc.dll
ncalrpc: dhcpcsvc
ncacn_ip_tcp: 203.223.152.169:49153
ncacn_np: \\WIN-K54EIMCILQN\pipe\eventlog
ncalrpc: eventlog
30adc50c-5cbc-46ce-9a0e-91914789e23c
version: v1.0
annotation: NRP server endpoint
provider: nrpsrv.dll
ncacn_ip_tcp: 203.223.152.169:49153
ncacn_np: \\WIN-K54EIMCILQN\pipe\eventlog
ncalrpc: eventlog
f6beaff7-1e19-4fbb-9f8f-b89e2018337c
version: v1.0
annotation: Event log TCPIP
protocol: [MS-EVEN6]: EventLog Remoting Protocol
provider: wevtsvc.dll
ncacn_ip_tcp: 203.223.152.169:49153
ncacn_np: \\WIN-K54EIMCILQN\pipe\eventlog
ncalrpc: eventlog
30b044a5-a225-43f0-b3a4-e060df91f9c1
version: v1.0
provider: certprop.dll
ncacn_np: \\WIN-K54EIMCILQN\PIPE\srvsvc
ncacn_ip_tcp: 203.223.152.169:49154
ncacn_np: \\WIN-K54EIMCILQN\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
98716d03-89ac-44c7-bb8c-285824e51c4a
version: v1.0
annotation: XactSrv service
provider: srvsvc.dll
ncacn_ip_tcp: 203.223.152.169:49154
ncacn_np: \\WIN-K54EIMCILQN\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
552d076a-cb29-4e44-8b6a-d15e59e2c0af
version: v1.0
annotation: IP Transition Configuration endpoint
provider: iphlpsvc.dll
ncacn_ip_tcp: 203.223.152.169:49154
ncacn_np: \\WIN-K54EIMCILQN\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
a398e520-d59a-4bdd-aa7a-3c1e0303a511
version: v1.0
annotation: IKE/Authip API
provider: IKEEXT.DLL
ncacn_ip_tcp: 203.223.152.169:49154
ncacn_np: \\WIN-K54EIMCILQN\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
86d35949-83c9-4044-b424-db363231fd0c
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: schedsvc.dll
ncacn_ip_tcp: 203.223.152.169:49154
ncacn_np: \\WIN-K54EIMCILQN\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
378e52b0-c0a9-11cf-822d-00aa0051e40f
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
ncacn_np: \\WIN-K54EIMCILQN\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
1ff70682-0a51-30e8-076d-740be8cee98b
version: v1.0
protocol: [MS-TSCH]: Task Scheduler Service Remoting Protocol
provider: taskcomp.dll
ncacn_np: \\WIN-K54EIMCILQN\PIPE\atsvc
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
0a74ef1c-41a4-4e06-83ae-dc74fb1cdd53
version: v1.0
provider: schedsvc.dll
ncalrpc: senssvc
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
2eb08e3e-639f-4fba-97b1-14f878961076
version: v1.0
provider: gpsvc.dll
ncalrpc: OLE271B537647F74D4AB90EADFE4E9A
ncalrpc: IUserProfile2
3473dd4d-2e88-4006-9cba-22570909dd10
version: v5.256
annotation: WinHttp Auto-Proxy Service
ncacn_np: \\WIN-K54EIMCILQN\PIPE\W32TIME_ALT
ncalrpc: W32TIME_ALT
ncalrpc: LRPC-ffd72aeb9532bed144
ncalrpc: OLE2CC3F85CFEC84C2897B8A524943B
7ea70bcf-48af-4f6a-8968-6a440754d5fa
version: v1.0
annotation: NSI server endpoint
provider: nsisvc.dll
ncalrpc: LRPC-ffd72aeb9532bed144
ncalrpc: OLE2CC3F85CFEC84C2897B8A524943B
2fb92682-6599-42dc-ae13-bd2ca89bd11c
version: v1.0
annotation: Fw APIs
provider: MPSSVC.dll
ncalrpc: LRPC-0ee2de43d72c2fc931
7f9d11bf-7fb9-436b-a812-b2d50c5d4c03
version: v1.0
annotation: Fw APIs
provider: MPSSVC.dll
ncalrpc: LRPC-0ee2de43d72c2fc931
dd490425-5325-4565-b774-7e27d6c09c24
version: v1.0
annotation: Base Firewall Engine API
provider: BFE.DLL
ncalrpc: LRPC-0ee2de43d72c2fc931
7f1343fe-50a9-4927-a778-0c5859517bac
version: v1.0
annotation: DfsDs service
ncacn_np: \\WIN-K54EIMCILQN\PIPE\wkssvc
ncalrpc: DNSResolver
4a452661-8290-4b36-8fbe-7f4093a94978
version: v1.0
annotation: Spooler function endpoint
provider: spoolsv.exe
ncalrpc: spoolss
ae33069b-a2a8-46ee-a235-ddfd339be281
version: v1.0
annotation: Spooler base remote object endpoint
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
provider: spoolsv.exe
ncalrpc: spoolss
0b6edbfa-4a24-4fc6-8a23-942b1eca65d1
version: v1.0
annotation: Spooler function endpoint
protocol: [MS-PAN]: Print System Asynchronous Notification Protocol
provider: spoolsv.exe
ncalrpc: spoolss
b25a52bf-e5dd-4f4a-aea6-8ca7272a0e86
version: v1.0
annotation: KeyIso
provider: keyiso.dll
ncacn_ip_tcp: 203.223.152.169:49155
ncalrpc: samss lpc
ncalrpc: dsrole
ncacn_np: \\WIN-K54EIMCILQN\PIPE\protected_storage
ncalrpc: protected_storage
ncalrpc: lsasspirpc
ncalrpc: lsapolicylookup
ncalrpc: LSARPC_ENDPOINT
ncalrpc: securityevent
ncalrpc: audit
ncalrpc: LRPC-4726a430f931f3d33f
ncacn_np: \\WIN-K54EIMCILQN\pipe\lsass
12345778-1234-abcd-ef00-0123456789ac
version: v1.0
protocol: [MS-SAMR]: Security Account Manager (SAM) Remote Protocol
provider: samsrv.dll
ncacn_ip_tcp: 203.223.152.169:49155
ncalrpc: samss lpc
ncalrpc: dsrole
ncacn_np: \\WIN-K54EIMCILQN\PIPE\protected_storage
ncalrpc: protected_storage
ncalrpc: lsasspirpc
ncalrpc: lsapolicylookup
ncalrpc: LSARPC_ENDPOINT
ncalrpc: securityevent
ncalrpc: audit
ncalrpc: LRPC-4726a430f931f3d33f
ncacn_np: \\WIN-K54EIMCILQN\pipe\lsass
367abb81-9844-35f1-ad32-98f038001003
version: v2.0
protocol: [MS-SCMR]: Service Control Manager Remote Protocol
provider: services.exe
ncacn_ip_tcp: 203.223.152.169:49340
12345678-1234-abcd-ef00-0123456789ab
version: v1.0
annotation: IPSec Policy agent endpoint
protocol: [MS-RPRN]: Print System Remote Protocol
provider: spoolsv.exe
ncalrpc: LRPC-90e3e8cafb183bbe68
ncacn_ip_tcp: 203.223.152.169:49343
6b5bdd1e-528c-422c-af8c-a4079be4fe48
version: v1.0
annotation: Remote Fw APIs
protocol: [MS-FASP]: Firewall and Advanced Security Protocol
provider: FwRemoteSvr.dll
ncacn_ip_tcp: 203.223.152.169:49343
24019106-a203-4642-b88d-82dae9158929
version: v1.0
provider: authui.dll
ncalrpc: LRPC-fd10c946ff05840c7e
906b0ce0-c70b-1067-b317-00dd010662da
version: v1.0
protocol: [MS-CMPO]: MSDTC Connection Manager:
provider: msdtcprx.dll
ncalrpc: LRPC-ceced3b4c2db16c4a1
ncalrpc: LRPC-ceced3b4c2db16c4a1
ncalrpc: LRPC-ceced3b4c2db16c4a1
ncalrpc: LRPC-ceced3b4c2db16c4a1
2f5f6521-cb55-1059-b446-00df0bce31db
version: v1.0
annotation: Unimodem LRPC Endpoint
ncalrpc: unimdmsvc
ncalrpc: tapsrvlpc
ncacn_np: \\WIN-K54EIMCILQN\pipe\tapsrv
1489525118 | 2024-11-09T00:35:39.239104
443 /
tcp
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Sat, 09 Nov 2024 00:35:38 GMT
Connection: close
Content-Length: 315
SSL Certificate
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
12:d9:8b:11:12:e0:79:8d:44:b6:98:b1:f0:f6:c1:1c
Signature Algorithm: sha1WithRSAEncryption
Issuer: CN=WMSvc-WIN-K54EIMCILQN
Validity
Not Before: Apr 29 07:01:22 2014 GMT
Not After : Apr 26 07:01:22 2024 GMT
Subject: CN=WMSvc-WIN-K54EIMCILQN
Subject Public Key Info:
Public Key Algorithm: rsaEncryption
Public-Key: (2048 bit)
Modulus:
00:b1:c9:0b:11:04:90:30:4e:18:61:99:3f:76:fe:
ef:6f:09:62:4c:6a:ef:59:a5:84:fa:5f:10:2e:f8:
22:df:70:6c:7e:89:65:57:12:57:7e:21:4f:53:b6:
36:b1:76:fa:51:0c:0c:bb:6d:5d:ac:4a:69:aa:08:
98:4c:d0:6d:b3:06:0f:8e:28:0f:83:64:52:33:0d:
9f:da:24:3c:f1:b0:b5:f5:64:39:ad:6c:ef:b1:dd:
6f:62:2e:0f:fa:bd:aa:65:f5:20:67:b5:5e:55:d0:
a7:36:6b:72:38:a9:8e:2c:c7:eb:65:e1:22:ec:54:
7c:f7:35:1b:35:74:0f:cd:39:fa:bc:75:b8:3a:ef:
dc:e0:61:4f:41:76:56:e8:18:80:28:18:5b:ab:0f:
fb:da:fe:58:c4:27:13:02:56:b0:3e:7a:a2:41:aa:
0a:83:e9:fa:4d:f8:df:e4:07:82:ba:2b:ab:7c:80:
6f:53:8e:c4:89:56:b8:51:20:ec:df:42:8f:b1:69:
d5:35:66:25:c3:21:66:95:a7:4a:08:48:61:a3:9c:
4c:6f:23:f8:64:78:fd:b3:47:cd:54:cc:f2:a5:85:
7e:99:48:22:42:44:4a:a5:9e:87:3d:fd:9c:6d:cc:
c3:1c:58:5a:be:6c:2a:5d:83:44:2d:5e:49:ae:19:
21:69
Exponent: 65537 (0x10001)
X509v3 extensions:
X509v3 Extended Key Usage:
TLS Web Server Authentication
X509v3 Key Usage:
Digital Signature, Key Encipherment, Data Encipherment
Signature Algorithm: sha1WithRSAEncryption
Signature Value:
9f:a0:e8:b2:bc:15:a2:c4:8c:2a:cb:45:63:a6:3f:d8:d2:07:
86:4a:a9:0f:95:4b:61:9e:61:09:99:72:e5:f2:e9:2a:6e:0d:
81:1d:13:fc:88:d4:56:3c:1e:32:fc:ab:2d:20:5b:50:2f:cc:
51:8d:17:f1:d3:bc:53:aa:ea:c4:6a:40:a3:85:5d:b5:8a:23:
a5:e6:3d:c5:90:39:5c:a1:12:7a:18:36:e7:bf:63:7b:63:f5:
27:de:26:e3:4e:02:99:b0:a7:0e:16:64:06:3f:06:7e:19:6d:
7b:d2:1d:e9:15:08:1e:b9:05:cd:b0:e3:f4:c6:00:48:a1:e3:
3c:31:a1:60:a8:71:c1:7b:25:6c:93:1f:ba:3d:06:dc:ad:a7:
31:ca:26:07:9e:0c:30:2b:7b:47:63:f6:e9:51:5c:03:c0:06:
07:e4:67:c9:cf:b6:d0:89:61:23:72:02:d9:43:70:fe:6e:7d:
33:d4:83:2f:9c:ca:48:b8:a4:2f:d6:7d:27:b0:dc:5c:e6:f6:
9b:18:9a:55:93:c2:04:f0:4a:88:2a:9a:aa:e1:37:59:9a:b6:
0f:b6:c4:c2:dd:80:2a:aa:2e:bb:3c:22:72:f5:5e:dc:00:eb:
cd:fb:cb:f0:cd:4a:f0:8a:00:6d:f1:4f:d6:e3:06:97:a9:8b:
00:da:7d:4d
1641389631 | 2024-10-19T00:51:59.532816
445 /
tcp
SMB Status:
Authentication: enabled
SMB Version: 1
OS: Windows Server 2008 R2 Standard 7601 Service Pack 1
Software: Windows Server 2008 R2 Standard 6.1
Capabilities: extended-security, infolevel-passthru, large-files, large-readx, large-writex, level2-oplocks, lock-and-read, lwio, nt-find, nt-smb, nt-status, rpc-remote-api, unicode
941448006 | 2024-11-06T18:43:47.380591
1723 /
tcp
PPTP:
Firmware: 0
Hostname:
Vendor: Microsoft
1489525118 | 2024-10-16T09:03:59.729362
5985 /
tcp
HTTP/1.1 404 Not Found
Content-Type: text/html; charset=us-ascii
Server: Microsoft-HTTPAPI/2.0
Date: Wed, 16 Oct 2024 09:03:58 GMT
Connection: close
Content-Length: 315
WinRM NTLM Info:
OS: Windows Server 2008 R2
OS Build: 6.1.7601
Target Name: WIN-K54EIMCILQN
NetBIOS Domain Name: WIN-K54EIMCILQN
NetBIOS Computer Name: WIN-K54EIMCILQN
DNS Domain Name: WIN-K54EIMCILQN
FQDN: WIN-K54EIMCILQN