| File name: | 98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a |
| Full analysis: | https://app.any.run/tasks/d9fe3750-0472-4834-b15b-ec621e8825b1 |
| Verdict: | Malicious activity |
| Threats: | FormBook is a data stealer that is being distributed as a MaaS. FormBook differs from a lot of competing malware by its extreme ease of use that allows even the unexperienced threat actors to use FormBook virus. |
| Analysis date: | May 29, 2025, 05:13:39 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/vnd.microsoft.portable-executable |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive, 5 sections |
| MD5: | 3AE9B7A970165BF828C79056E3328D08 |
| SHA1: | DF6E47D6B9A10094A4B101A6E9DD73FC14BCCC8A |
| SHA256: | 98FE16BFB44E91D7C51602A2E5A9F6AC8740055AE96DC95CE5FA9D2D2B8C1F1A |
| SSDEEP: | 12288:XoqAUAiTIFhdr1gdRPRsZOf4nKUI+J/F/inzikagvzK7mNV41HAR:XiiTIFhdridHHf4KUI+Jt/inzF7K7mN7 |
MALICIOUS
FORMBOOK has been detected (SURICATA)
- explorer.exe (PID: 5492)
FORMBOOK has been detected (YARA)
- wlanext.exe (PID: 7568)
Connects to the CnC server
- explorer.exe (PID: 5492)
Actions looks like stealing of personal data
- wlanext.exe (PID: 7568)
SUSPICIOUS
Executable content was dropped or overwritten
- 98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe (PID: 7284)
Application launched itself
- afxulqov.exe (PID: 7340)
Executes application which crashes
- afxulqov.exe (PID: 7340)
Contacting a server suspected of hosting an CnC
- explorer.exe (PID: 5492)
INFO
Create files in a temporary directory
- 98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe (PID: 7284)
- wlanext.exe (PID: 7568)
Checks supported languages
- 98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe (PID: 7284)
- afxulqov.exe (PID: 7340)
- afxulqov.exe (PID: 7368)
Reads the computer name
- afxulqov.exe (PID: 7368)
Process checks computer location settings
- afxulqov.exe (PID: 7368)
Creates files or folders in the user directory
- WerFault.exe (PID: 7448)
Reads security settings of Internet Explorer
- wlanext.exe (PID: 7568)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Formbook
(PID) Process(7568) wlanext.exe
C2www.wangbaomen23.xyz/nfgh/
Strings (136)USERNAME
LOCALAPPDATA
USERPROFILE
APPDATA
TEMP
ProgramFiles
CommonProgramFiles
ALLUSERSPROFILE
/c copy "
/c del "
\Run
\Policies
\Explorer
\Registry\User
\Registry\Machine
\SOFTWARE\Microsoft\Windows\CurrentVersion
Office\15.0\Outlook\Profiles\Outlook\
NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\
\SOFTWARE\Mozilla\Mozilla
\Mozilla
Username:
Password:
formSubmitURL
usernameField
encryptedUsername
encryptedPassword
\logins.json
\signons.sqlite
\Mail\
\Foxmail
\Storage\
\Accounts\Account.rec0
\Data\AccCfg\Accounts.tdat
\Microsoft\Vault\
SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins
\Google\Chrome\User Data\Default\Login Data
SELECT origin_url, username_value, password_value FROM logins
.exe
.com
.scr
.pif
.cmd
.bat
ms
win
gdi
mfc
vga
igfx
user
help
config
update
regsvc
chkdsk
Cookies
SeDebugPrivilege
SeShutdownPrivilege
\BaseNamedObjects
config.php
POST
HTTP/1.1
Host:
Connection: close
Content-Length:
Cache-Control:
Origin: http://
Content-Type: application/x-www-form-urlencoded
Accept:
Referer: http://
Accept-Language:
Accept-Encoding:
euIes4XjTpuKfbkio3j2jvEYjA==
Tqenl62TK5E=
QhSlWAtklIfW2kmBpHk=
+hsTgo09e1L7A3Fv
71K5d8Kb3JE=
5h2qzst8CI0V7A==
keiNAk7SSNgM4frx2Eg5w72nQtI=
i5LEc/LJ2x1lC7g=
nVT1Yf9Dx/T1GNxDyML1BuI2ox2yI356
iSLd1gMvAJGVmQ==
oG4o3eLwmPwDuxmdu1NsAL6p+A==
adGWkLoHr4U=
tm4YhcQeabwm9EadTQ==
zD7u9jy93tc3E1XhsDo=
Rv+eX7FIpFVw
zIX9cOdRSOOZrbQ+qr8=
bBudlf2iJfJ4XPk+4g==
O5c7ycGExf5zPw==
a3Q7bAX04ndnL7mgVcmTGr1EjKcXAA==
msWL2kNHqCwNqA==
eBoWQx+zIt1tisNdNoNDHnBbrF4=
s50SBjt+hZX9mjCdo6q+4HA=
k6IXyX7TuJRmMw==
D3gYtH1KVEsiqvg=
hgaZQ2CUSQrhBA==
JM3EuHla613iqw==
EF7hCZUYSoq5j5DS+T8=
lEcMsXdFKwt0Cd8i
KXWet+rXorG0ZFkPVH2EkfuW
xwij60tmiCvdVmvn3ScL0q36Jg==
XyZGi3IbJ6sM+qQSzpIMQIE=
lVpRqzIOXKb4Z7f7PlK9
cVqtHjdOralMDryB8cLz
kt0oQ84U0RAIq6ounFhyYXI4
2ymxKN7lkiBVOQ==
ARlgC4TxLm5JyewH
MuhTDNFyxcqUfNNZO8u3Z3QBXB8=
ZjYjqPIbc9GqecggBqstHshRdFA=
kCIgDI/fH3NJYIud+lnrhA==
dL3slC2KzysfCZODoOxk
KD3WvQ5b5NS0/n+TEOOs1/PQ
c6yU1iqjFz5vNN3g5g==
59u/2+5k7uRqxovn6J4NxA==
rA+TG+TSZX4RTQ==
O0f4EhYcHA0a
V6kJtB9yIbc95XE5tH0sVrqQ31k=
qQep6DVAJ4nbM/TGAw==
I2+gx3Jn1NpPnTI=
kNmvK8ae9VzYOOw=
AykLRV9UZl/JQIzX
pldRXVPyBU4Luo//DsZU
nGnXxCQi4UNcMZ1SzP/+vA==
aVC6d4GQups5S1hbrAxG6g==
Bps2CfDS8k33
+TZ87/+Lu/6XyagU0vzTTA==
aHMD2/9RV1Srig==
4ctaH5Tg0n94hUE=
JNI+HyBRAf/Su7BEhp8Kq4nlDmdk
e7Do1KRkwo/JyGu7lsxJzw==
aQzs5vdpG5fepkq+qFZWKXrcm0OB
O+N9sbaRiIJSzbbthlnQlZ4GXKA=
j2SPdhhp1DpXysUuT3eYiRfCVQFjRO8=
wrdDMB8shQxn
/618Kdj1R0wLaA==
TRiD
| .exe | | | Win32 Executable MS Visual C++ (generic) (67.4) |
|---|---|---|
| .dll | | | Win32 Dynamic Link Library (generic) (14.2) |
| .exe | | | Win32 Executable (generic) (9.7) |
| .exe | | | Generic Win/DOS Executable (4.3) |
| .exe | | | DOS Executable Generic (4.3) |
EXIF
EXE
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2023:07:02 02:09:48+00:00 |
| ImageFileCharacteristics: | No relocs, Executable, No line numbers, No symbols, 32-bit |
| PEType: | PE32 |
| LinkerVersion: | 6 |
| CodeSize: | 27136 |
| InitializedDataSize: | 184832 |
| UninitializedDataSize: | 2048 |
| EntryPoint: | 0x3532 |
| OSVersion: | 4 |
| ImageVersion: | 6 |
| SubsystemVersion: | 4 |
| Subsystem: | Windows GUI |
Total processes
142
Monitored processes
10
Malicious processes
3
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2196 | C:\WINDOWS\system32\svchost.exe -k NetworkService -p -s Dnscache | C:\Windows\System32\svchost.exe | services.exe | ||||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Host Process for Windows Services Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 5492 | C:\WINDOWS\Explorer.EXE | C:\Windows\explorer.exe | — | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Explorer Version: 10.0.19041.3758 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 6476 | "C:\Program Files\Mozilla Firefox\Firefox.exe" | C:\Program Files\Mozilla Firefox\firefox.exe | — | wlanext.exe | |||||||||||
User: admin Company: Mozilla Corporation Integrity Level: MEDIUM Description: Firefox Exit code: 3221225534 Version: 123.0 Modules
| |||||||||||||||
| 7284 | "C:\Users\admin\AppData\Local\Temp\98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe" | C:\Users\admin\AppData\Local\Temp\98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 7340 | "C:\Users\admin\AppData\Local\Temp\afxulqov.exe" | C:\Users\admin\AppData\Local\Temp\afxulqov.exe | 98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Exit code: 3221225477 Modules
| |||||||||||||||
| 7368 | "C:\Users\admin\AppData\Local\Temp\afxulqov.exe" | C:\Users\admin\AppData\Local\Temp\afxulqov.exe | — | afxulqov.exe | |||||||||||
User: admin Integrity Level: MEDIUM Exit code: 0 Modules
| |||||||||||||||
| 7448 | C:\WINDOWS\SysWOW64\WerFault.exe -u -p 7340 -s 684 | C:\Windows\SysWOW64\WerFault.exe | — | afxulqov.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Problem Reporting Exit code: 0 Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7568 | "C:\Windows\SysWOW64\wlanext.exe" | C:\Windows\SysWOW64\wlanext.exe | 98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Wireless LAN 802.11 Extensibility Framework Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
Formbook(PID) Process(7568) wlanext.exe C2www.wangbaomen23.xyz/nfgh/ Strings (136)USERNAME LOCALAPPDATA USERPROFILE APPDATA TEMP ProgramFiles CommonProgramFiles ALLUSERSPROFILE /c copy " /c del " \Run \Policies \Explorer \Registry\User \Registry\Machine \SOFTWARE\Microsoft\Windows\CurrentVersion Office\15.0\Outlook\Profiles\Outlook\ NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ \SOFTWARE\Mozilla\Mozilla \Mozilla Username: Password: formSubmitURL usernameField encryptedUsername encryptedPassword \logins.json \signons.sqlite \Mail\ \Foxmail \Storage\ \Accounts\Account.rec0 \Data\AccCfg\Accounts.tdat \Microsoft\Vault\ SELECT encryptedUsername, encryptedPassword, formSubmitURL FROM moz_logins \Google\Chrome\User Data\Default\Login Data SELECT origin_url, username_value, password_value FROM logins .exe .com .scr .pif .cmd .bat ms win gdi mfc vga igfx user help config update regsvc chkdsk Cookies SeDebugPrivilege SeShutdownPrivilege \BaseNamedObjects config.php POST HTTP/1.1 Host: Connection: close Content-Length: Cache-Control: Origin: http:// Content-Type: application/x-www-form-urlencoded Accept: Referer: http:// Accept-Language: Accept-Encoding: euIes4XjTpuKfbkio3j2jvEYjA== Tqenl62TK5E= QhSlWAtklIfW2kmBpHk= +hsTgo09e1L7A3Fv 71K5d8Kb3JE= 5h2qzst8CI0V7A== keiNAk7SSNgM4frx2Eg5w72nQtI= i5LEc/LJ2x1lC7g= nVT1Yf9Dx/T1GNxDyML1BuI2ox2yI356 iSLd1gMvAJGVmQ== oG4o3eLwmPwDuxmdu1NsAL6p+A== adGWkLoHr4U= tm4YhcQeabwm9EadTQ== zD7u9jy93tc3E1XhsDo= Rv+eX7FIpFVw zIX9cOdRSOOZrbQ+qr8= bBudlf2iJfJ4XPk+4g== O5c7ycGExf5zPw== a3Q7bAX04ndnL7mgVcmTGr1EjKcXAA== msWL2kNHqCwNqA== eBoWQx+zIt1tisNdNoNDHnBbrF4= s50SBjt+hZX9mjCdo6q+4HA= k6IXyX7TuJRmMw== D3gYtH1KVEsiqvg= hgaZQ2CUSQrhBA== JM3EuHla613iqw== EF7hCZUYSoq5j5DS+T8= lEcMsXdFKwt0Cd8i KXWet+rXorG0ZFkPVH2EkfuW xwij60tmiCvdVmvn3ScL0q36Jg== XyZGi3IbJ6sM+qQSzpIMQIE= lVpRqzIOXKb4Z7f7PlK9 cVqtHjdOralMDryB8cLz kt0oQ84U0RAIq6ounFhyYXI4 2ymxKN7lkiBVOQ== ARlgC4TxLm5JyewH MuhTDNFyxcqUfNNZO8u3Z3QBXB8= ZjYjqPIbc9GqecggBqstHshRdFA= kCIgDI/fH3NJYIud+lnrhA== dL3slC2KzysfCZODoOxk KD3WvQ5b5NS0/n+TEOOs1/PQ c6yU1iqjFz5vNN3g5g== 59u/2+5k7uRqxovn6J4NxA== rA+TG+TSZX4RTQ== O0f4EhYcHA0a V6kJtB9yIbc95XE5tH0sVrqQ31k= qQep6DVAJ4nbM/TGAw== I2+gx3Jn1NpPnTI= kNmvK8ae9VzYOOw= AykLRV9UZl/JQIzX pldRXVPyBU4Luo//DsZU nGnXxCQi4UNcMZ1SzP/+vA== aVC6d4GQups5S1hbrAxG6g== Bps2CfDS8k33 +TZ87/+Lu/6XyagU0vzTTA== aHMD2/9RV1Srig== 4ctaH5Tg0n94hUE= JNI+HyBRAf/Su7BEhp8Kq4nlDmdk e7Do1KRkwo/JyGu7lsxJzw== aQzs5vdpG5fepkq+qFZWKXrcm0OB O+N9sbaRiIJSzbbthlnQlZ4GXKA= j2SPdhhp1DpXysUuT3eYiRfCVQFjRO8= wrdDMB8shQxn /618Kdj1R0wLaA== | |||||||||||||||
| 7580 | C:\WINDOWS\system32\SppExtComObj.exe -Embedding | C:\Windows\System32\SppExtComObj.Exe | — | svchost.exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: KMS Connection Broker Version: 10.0.19041.3996 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 7612 | "C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEvent | C:\Windows\System32\slui.exe | — | SppExtComObj.Exe | |||||||||||
User: NETWORK SERVICE Company: Microsoft Corporation Integrity Level: SYSTEM Description: Windows Activation Client Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
2 653
Read events
2 650
Write events
3
Delete events
0
Modification events
| (PID) Process: | (7568) wlanext.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content |
| Operation: | write | Name: | CachePrefix |
Value: | |||
| (PID) Process: | (7568) wlanext.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies |
| Operation: | write | Name: | CachePrefix |
Value: Cookie: | |||
| (PID) Process: | (7568) wlanext.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History |
| Operation: | write | Name: | CachePrefix |
Value: Visited: | |||
Executable files
1
Suspicious files
4
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 7448 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_afxulqov.exe_49edcc96ea728bfe8d1f4e31fbdf94627c3d7d4c_7293c639_4fe2a105-3c32-4c65-9d39-c899549dd381\Report.wer | — | |
MD5:— | SHA256:— | |||
| 7448 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERC160.tmp.xml | xml | |
MD5:B64A37FCF6CDD4C27EA480595B39C9A1 | SHA256:48719DF7AE9F31F692933C593EBD021FA866CE36911BD80E6471AE8A156F3007 | |||
| 7568 | wlanext.exe | C:\Users\admin\AppData\Local\Temp\0FenjId4 | binary | |
MD5:A45465CDCDC6CB30C8906F3DA4EC114C | SHA256:4412319EF944EBCCA9581CBACB1D4E1DC614C348D1DFC5D2FAAAAD863D300209 | |||
| 7448 | WerFault.exe | C:\Users\admin\AppData\Local\CrashDumps\afxulqov.exe.7340.dmp | binary | |
MD5:CC878D4D132340122DBB3433087CF6F7 | SHA256:C101B2AE1195CB6E98E937CB34991A847ECD4A3B009542B2EA2B193024AE619E | |||
| 7284 | 98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe | C:\Users\admin\AppData\Local\Temp\otycswlzm.ks | binary | |
MD5:586D8B2968B0277C7B10FF4EEEA7167D | SHA256:42FBE1A5D29E2881E9B7012549D705A4017F09579A35AC78C1C431D84937486B | |||
| 7448 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERC006.tmp.dmp | binary | |
MD5:1CC393EF7C1FAB36720D77F7A4CAB469 | SHA256:FED336FF69FC2FE7C60E908FB48D061AF9CD8A95D54F1AB50A0614F82BA35AD1 | |||
| 7448 | WerFault.exe | C:\ProgramData\Microsoft\Windows\WER\Temp\WERC111.tmp.WERInternalMetadata.xml | xml | |
MD5:48577C2A0A46A645CCD5C7D41B7E2643 | SHA256:82236B10007C55CC2D8871377F949CCBF465B9B85FCE46F9CA4798952C114CEE | |||
| 7284 | 98fe16bfb44e91d7c51602a2e5a9f6ac8740055ae96dc95ce5fa9d2d2b8c1f1a.exe | C:\Users\admin\AppData\Local\Temp\afxulqov.exe | executable | |
MD5:CB79F9C5E6CBF494DB6882504761F277 | SHA256:8A04693281D2231699704A5A57956F67804EE886CE4D474606335BA426A535EA | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
6
TCP/UDP connections
21
DNS requests
19
Threats
1
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
5496 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.28:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5496 | MoUsoCoreWorker.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
6544 | svchost.exe | GET | 200 | 2.17.190.73:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
5492 | explorer.exe | GET | 404 | 15.197.225.128:80 | http://www.rogerstrong.com/nfgh/?4jn=Q5K08CeCEMvQeVdYIjlvAxQyJUiki+FGnpnIu5dQASurcnI8MumStL7YuN8MZGHqXrcGpgQ1WAYPFRZKdARQtzzzoaKSh8Xd1w==&11p=tWLSNCcOdBnVQio | unknown | — | — | malicious |
4112 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
4112 | SIHClient.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
2104 | svchost.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
2568 | RUXIMICS.exe | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5496 | MoUsoCoreWorker.exe | 23.216.77.28:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
5496 | MoUsoCoreWorker.exe | 184.30.21.171:80 | www.microsoft.com | AKAMAI-AS | DE | whitelisted |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
3216 | svchost.exe | 172.211.123.250:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | FR | whitelisted |
6544 | svchost.exe | 40.126.32.140:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
6544 | svchost.exe | 2.17.190.73:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
crl.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
www.vevo-verify.com |
| unknown |
slscr.update.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
5492 | explorer.exe | Malware Command and Control Activity Detected | ET MALWARE FormBook CnC Checkin (GET) M5 |