- Local time
- 4:44 PM
- Messages
- 12
Results of Microsoft Message Analyzer monitoring NlaSvc attempting to contact Akamai servers via svchost
Code:
MessageNumber Timestamp TimeElapsed Source Destination Module Summary ProcessId Message
30 2017-01-26T12:40:30.1664213 -- -- -- Windows_Kernel_Trace Process_TypeGroup1{UniqueProcessKey=EtwPointer{pointerValue=18446738026544641808},ProcessId=1424,ParentId=528,SessionId=0,ExitStatus=259,DirectoryTableBase=EtwPointer{pointerValue=7147724800},UserSID_blob=binary[16,19,34,4,160,248,255,255,0,0,0,0,128,248,255,255],UserSID=S-1-5-20 NetworkService -- Network Service account.,ImageFileName=svchost.exe,CommandLine=C:\Windows\System32\svchost.exe -k NetworkService} 1424 .7â..úÿÿ.................*.ª......".*øÿÿ.....øÿÿ............svchost.exe.C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.s.v.c.h.o.s.t...e.x.e. .-.k. .N.e.t.w.o.r.k.S.e.r.v.i.c.e...
30 2017-01-26T12:40:30.1664213 -- -- -- Etw {3d6fa8d0-fe05-11d0-9dda-00c04fd7ba7c}, EventID: 0, ProcessID: 2156, ThreadID: 2160, Size: 204 2156 Ì[email protected]...Õ.Ún.xÒ.Шo=.þÐ..Ú.ÀO׺|................c...¾.....................ÿÿ..¬..7â..úÿÿ.................*.ª......".*øÿÿ.....øÿÿ............svchost.exe.C.:.\.W.i.n.d.o.w.s.\.S.y.s.t.e.m.3.2.\.s.v.c.h.o.s.t...e.x.e. .-.k. .N.e.t.w.o.r.k.S.e.r.v.i.c.e...
255 2017-01-26T12:41:25.8530608 -- 192.168.0.123 a1961.g2.akamai.net TCP Flags: ......S., SrcPort: 49158, DstPort: HTTP(80), Length: 0, Seq Range: 2411726965 - 2411726966, Ack: 0, Win: 8192(negotiating scale factor: 8) 1424 À..P.À.u...... ..û.....´........
255 2017-01-26T12:41:25.8530608 -- 192.168.0.123 a1961.g2.akamai.net IPv4 Next Protocol: TCP, Packet ID: 66, Total Length: 52 1424 E..4.B@.....À¨.½hcî.À..P.À.u...... ..û.....´........
255 2017-01-26T12:41:25.8530608 -- AB-CD-EF-12-34-56 (my NIC MAC) 12-34-56-AB-CD-EF (my router MAC) Ethernet Type: Internet IP (IPv4) 1424 T*PÚ À.0gvê3..E..4.B@.....À¨.½hcî.À..P.À.u...... ..û.....´........
255 2017-01-26T12:41:25.8530608 -- -- -- PefNdisProvider MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 66 1424 ........B...T*PÚ À.0gvê3..E..4.B@.....À¨.½hcî.À..P.À.u...... ..û.....´........
255 2017-01-26T12:41:25.8530608 -- -- -- Etw {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1068, Size: 158 1424 ....@...,.......0³...xÒ..[è...|F.Gí0.·vÃé..........À..................................N.........B...T*PÚ À.0gvê3..E..4.B@.....À¨.½hcî.À..P.À.u...... ..û.....´........
258 2017-01-26T12:41:25.8881029 0.0415502 192.168.0.123 www.msftncsi.com HTTP Operation, Status: OK (200), GET /ncsi.txt, Version: HTTP/1.1 1424 --
258 2017-01-26T12:41:25.8881029 0.0406232 192.168.0.123 www.msftncsi.com HTTP Request, GET /ncsi.txt, Version: HTTP/1.1 1424 GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258 2017-01-26T12:41:25.8881029 0.0000059 192.168.0.123 a1961.g2.akamai.net TCP Flags: ...AP..., SrcPort: 49158, DstPort: HTTP(80), Length: 97, Seq Range: 2411726966 - 2411727063, Ack: 3559500323, Win: 65536(scale factor: 8) 1424 À..P.À.vÔ)ª#P....P..GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258 2017-01-26T12:41:25.8881029 0.0000059 192.168.0.123 a1961.g2.akamai.net IPv4 Next Protocol: TCP, Packet ID: 68, Total Length: 137 1424 E....D@.....À¨.½hcî.À..P.À.vÔ)ª#P....P..GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258 2017-01-26T12:41:25.8881029 0.0000059 AB-CD-EF-12-34-56 (my NIC MAC) 12-34-56-AB-CD-EF (my router MAC) Ethernet Type: Internet IP (IPv4) 1424 T*PÚ À.0gvê3..E....D@.....À¨.½hcî.À..P.À.vÔ)ª#P....P..GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258 2017-01-26T12:41:25.8881029 0.0000059 -- -- PefNdisProvider MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 151 1424 ............T*PÚ À.0gvê3..E....D@.....À¨.½hcî.À..P.À.vÔ)ª#P....P..GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
258 2017-01-26T12:41:25.8881029 0.0000059 -- -- Etw {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1068, Size: 187 1424 ditto
258 2017-01-26T12:41:25.8881029 -- -- -- EtwEvent EventId: 1001, GroupId: 5590624, Length: 12 1424 é.`NU.................
258 2017-01-26T12:41:25.8881029 -- -- -- Etw [Fragment: Start] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1424, ThreadID: 1068, Size: 102 1424 f...@...,............xÒ..[è...|F.Gí0.·vÃÐ..........@....................................é.`NU.................
259 2017-01-26T12:41:25.8881063 -- -- -- EtwEvent EventId: 1001, GroupId: 5590624, Length: 54 1424 é.`NU.6...T*PÚ À.0gvê3..E....D@.....À¨.½hcî.À..P.À.vÔ)ª#P....P..
259 2017-01-26T12:41:25.8881063 -- -- -- Etw [Fragment: Middle] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1424, ThreadID: 1068, Size: 144 1424 ....@...,.......'....xÒ..[è...|F.Gí0.·vÃÐ.............................................@.é.`NU.6...T*PÚ À.0gvê3..E....D@.....À¨.½hcî.À..P.À.vÔ)ª#P....P..
260 2017-01-26T12:41:25.8881088 -- -- -- EtwEvent EventId: 1001, GroupId: 5590624, Length: 97 1424 é.`NU.a...GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
260 2017-01-26T12:41:25.8881088 -- -- -- Etw [Fragment: End] {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 2000, ProcessID: 1424, ThreadID: 1068, Size: 187 1424 »...@...,[email protected]Ò..[è...|F.Gí0.·vÃÐ.............................................k.é.`NU.a...GET /ncsi.txt HTTP/1.1..Connection: Close..User-Agent: Microsoft NCSI..Host: www.msftncsi.com....
261 2017-01-26T12:41:25.9287261 -- a1961.g2.akamai.net 192.168.0.123 TCP Flags: ...A...., SrcPort: HTTP(80), DstPort: 49158, Length: 0, Seq Range: 3559500323 - 3559500323, Ack: 2411727063, Win: 29216(scale factor: 5) 0 .PÀ.Ô)ª#.À.×P...¼3..
261 2017-01-26T12:41:25.9287261 -- a1961.g2.akamai.net 192.168.0.123 IPv4 Next Protocol: TCP, Packet ID: 23132, Total Length: 40 0 E..(Z\@.7.Ð.hcî.À¨.½.PÀ.Ô)ª#.À.×P...¼3....¶lÜv
261 2017-01-26T12:41:25.9287261 -- 12-34-56-AB-CD-EF (my router MAC) AB-CD-EF-12-34-56 (my NIC MAC) Ethernet Type: Internet IP (IPv4) 0 .0gvê3T*PÚ À..E..(Z\@.7.Ð.hcî.À¨.½.PÀ.Ô)ª#.À.×P...¼3....¶lÜv
261 2017-01-26T12:41:25.9287261 -- -- -- PefNdisProvider MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 60 0 ........<....0gvê3T*PÚ À..E..(Z\@.7.Ð.hcî.À¨.½.PÀ.Ô)ª#.À.×P...¼3....¶lÜv
261 2017-01-26T12:41:25.9287261 -- -- -- Etw {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 0, ThreadID: 0, Size: 152 0 ....@...........Ý>...xÒ..[è...|F.Gí0.·vÃé..........À....í.............................H.........<....0gvê3T*PÚ À..E..(Z\@.7.Ð.hcî.À¨.½.PÀ.Ô)ª#.À.×P...¼3....¶lÜv
262 2017-01-26T12:41:25.9296531 -- www.msftncsi.com 192.168.0.123 HTTP Response, Status: OK (200), Version: HTTP/1.1 0 HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262 2017-01-26T12:41:25.9296531 -- a1961.g2.akamai.net 192.168.0.123 TCP Flags: ...AP..., SrcPort: HTTP(80), DstPort: 49158, Length: 179, Seq Range: 3559500323 - 3559500502, Ack: 2411727063, Win: 29216(scale factor: 5) 0 .PÀ.Ô)ª#.À.×P...¿ô..HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262 2017-01-26T12:41:25.9296531 -- a1961.g2.akamai.net 192.168.0.123 IPv4 Next Protocol: TCP, Packet ID: 23133, Total Length: 219 0 E..ÛZ]@.7.Ïëhcî.À¨.½.PÀ.Ô)ª#.À.×P...¿ô..HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262 2017-01-26T12:41:25.9296531 -- 12-34-56-AB-CD-EF (my router MAC) AB-CD-EF-12-34-56 (my NIC MAC) Ethernet Type: Internet IP (IPv4) 0 .0gvê3T*PÚ À..E..ÛZ]@.7.Ïëhcî.À¨.½.PÀ.Ô)ª#.À.×P...¿ô..HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262 2017-01-26T12:41:25.9296531 -- -- -- PefNdisProvider MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 233 0 ........é....0gvê3T*PÚ À..E..ÛZ]@.7.Ïëhcî.À¨.½.PÀ.Ô)ª#.À.×P...¿ô..HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
262 2017-01-26T12:41:25.9296531 -- -- -- Etw {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 0, ThreadID: 0, Size: 325 0 [email protected]Ò..[è...|F.Gí0.·vÃé..........À....í.............................õ.........é....0gvê3T*PÚ À..E..ÛZ]@.7.Ïëhcî.À¨.½.PÀ.Ô)ª#.À.×P...¿ô..HTTP/1.1 200 OK..Content-Length: 14..Date: Thu, 26 Jan 2017 20:41:30 GMT..Connection: close..Content-Type: text/plain..Cache-Control: max-age=30, must-revalidate....Microsoft NCSI
263 2017-01-26T12:41:25.9298951 -- 192.168.0.123 a1961.g2.akamai.net TCP Flags: ...A...F, SrcPort: 49158, DstPort: HTTP(80), Length: 0, Seq Range: 2411727063 - 2411727064, Ack: 3559500502, Win: 65280(scale factor: 8) 1424 À..P.À.×Ô)ªÖP..ÿ.ï..
263 2017-01-26T12:41:25.9298951 -- 192.168.0.123 a1961.g2.akamai.net IPv4 Next Protocol: TCP, Packet ID: 69, Total Length: 40 1424 E..(.E@.....À¨.½hcî.À..P.À.×Ô)ªÖP..ÿ.ï..
263 2017-01-26T12:41:25.9298951 -- AB-CD-EF-12-34-56 (my NIC MAC) 12-34-56-AB-CD-EF (my router MAC) Ethernet Type: Internet IP (IPv4) 1424 T*PÚ À.0gvê3..E..(.E@.....À¨.½hcî.À..P.À.×Ô)ªÖP..ÿ.ï..
263 2017-01-26T12:41:25.9298951 -- -- -- PefNdisProvider MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 54 1424 ........6...T*PÚ À.0gvê3..E..(.E@.....À¨.½hcî.À..P.À.×Ô)ªÖP..ÿ.ï..
263 2017-01-26T12:41:25.9298951 -- -- -- Etw {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1540, Size: 146 1424 [email protected]Ò..[è...|F.Gí0.·vÃé..........À..................................B.........6...T*PÚ À.0gvê3..E..(.E@.....À¨.½hcî.À..P.À.×Ô)ªÖP..ÿ.ï..
264 2017-01-26T12:41:25.9299762 -- a1961.g2.akamai.net 192.168.0.123 TCP Flags: ...A...F, SrcPort: HTTP(80), DstPort: 49158, Length: 0, Seq Range: 3559500502 - 3559500503, Ack: 2411727063, Win: 29216(scale factor: 5) 1424 .PÀ.Ô)ªÖ.À.×P...»...
264 2017-01-26T12:41:25.9299762 -- a1961.g2.akamai.net 192.168.0.123 IPv4 Next Protocol: TCP, Packet ID: 23134, Total Length: 40 1424 E..(Z^@.7.Ð.hcî.À¨.½.PÀ.Ô)ªÖ.À.×P...».....D. ]
264 2017-01-26T12:41:25.9299762 -- 12-34-56-AB-CD-EF (my router MAC) AB-CD-EF-12-34-56 (my NIC MAC) Ethernet Type: Internet IP (IPv4) 1424 .0gvê3T*PÚ À..E..(Z^@.7.Ð.hcî.À¨.½.PÀ.Ô)ªÖ.À.×P...».....D. ]
264 2017-01-26T12:41:25.9299762 -- -- -- PefNdisProvider MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 60 1424 ........<....0gvê3T*PÚ À..E..(Z^@.7.Ð.hcî.À¨.½.PÀ.Ô)ªÖ.À.×P...».....D. ]
264 2017-01-26T12:41:25.9299762 -- -- -- Etw {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1540, Size: 152 1424 ....@...........²o...xÒ..[è...|F.Gí0.·vÃé..........À..................................H.........<....0gvê3T*PÚ À..E..(Z^@.7.Ð.hcî.À¨.½.PÀ.Ô)ªÖ.À.×P...».....D. ]
265 2017-01-26T12:41:25.9300266 -- 192.168.0.123 a1961.g2.akamai.net TCP Flags: ...A...., SrcPort: 49158, DstPort: HTTP(80), Length: 0, Seq Range: 2411727064 - 2411727064, Ack: 3559500503, Win: 255 1424 À..P.À.ØÔ)ª×P..ÿ.ï..
265 2017-01-26T12:41:25.9300266 -- 192.168.0.123 a1961.g2.akamai.net IPv4 Next Protocol: TCP, Packet ID: 70, Total Length: 40 1424 E..(.F@.....À¨.½hcî.À..P.À.ØÔ)ª×P..ÿ.ï..
265 2017-01-26T12:41:25.9300266 -- AB-CD-EF-12-34-56 (my NIC MAC) 12-34-56-AB-CD-EF (my router MAC) Ethernet Type: Internet IP (IPv4) 1424 T*PÚ À.0gvê3..E..(.F@.....À¨.½hcî.À..P.À.ØÔ)ª×P..ÿ.ï..
265 2017-01-26T12:41:25.9300266 -- -- -- PefNdisProvider MiniportIfIndex: 11, LowerIfIndex: 11, FrameSize: 54 1424 ........6...T*PÚ À.0gvê3..E..(.F@.....À¨.½hcî.À..P.À.ØÔ)ª×P..ÿ.ï..
265 2017-01-26T12:41:25.9300266 -- -- -- Etw {9de85b12-1202-467c-8047-ed308fb776c3}, EventID: 1001, ProcessID: 1424, ThreadID: 1540, Size: 146 1424 ....@...........ªq...xÒ..[è...|F.Gí0.·vÃé..........À..................................B.........6...T*PÚ À.0gvê3..E..(.F@.....À¨.½hcî.À..P.À.ØÔ)ª×P..ÿ.ï..My Computer
At a glance
Quad boot: XP-32-Pro, 7-32-Ult, 7-64-Ult, Ubu...
- Computer type
- PC/Desktop
- OS
- Quad boot: XP-32-Pro, 7-32-Ult, 7-64-Ult, Ubuntu-64