File name:

_ПРИЛОЖЕНИЕ _ 1.10 К АКТУ _ 5-003_2024-О.eml

Full analysis: https://app.any.run/tasks/99f2c35b-dacb-48d6-968e-8142a12c64b2
Verdict: Malicious activity
Analysis date: August 28, 2024, 12:23:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text, with very long lines (348), with CRLF line terminators
MD5:

85B33AD419DA2A45AF3D2634667D962C

SHA1:

52E891BE6BA133E9926E88B4A686CF8E30634E04

SHA256:

0CD8004F78C67F450E867E7942096880AC39ADEBB7E75D596120806508B5C958

SSDEEP:

24576:GOb2Z26SXjOVBoarognm1vAkSCbSD/1mD6Caw:nb8PXr967SnCaw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Outlook

      • OUTLOOK.EXE (PID: 1184)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Executable content was dropped or overwritten

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Drops the executable file immediately after the start

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4128)

    • The process creates files with name similar to system file names

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

  • INFO

    • Reads the computer name

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 2248)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 4820)
      • PLUGScheduler.exe (PID: 4128)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 768)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6344)

    • Manual execution by a user

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 2248)
      • notepad++.exe (PID: 1748)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 4820)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6344)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 768)

    • Creates files or folders in the user directory

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3140)

    • Checks supported languages

      • __________ _ 1.10 ___________ _____ 24.com (PID: 2248)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 4820)
      • PLUGScheduler.exe (PID: 4128)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 768)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6344)

    • Reads the software policy settings

      • slui.exe (PID: 4440)
      • slui.exe (PID: 6680)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 4128)

    • Create files in a temporary directory

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Checks proxy server information

      • slui.exe (PID: 6680)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 7) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
269
Monitored processes
14
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start outlook.exe ai.exe no specs winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs __________ _ 1.10 ___________ _____ 24.com __________ _ 1.10 ___________ _____ 24.com no specs notepad++.exe slui.exe __________ _ 1.10 ___________ _____ 24.com no specs plugscheduler.exe no specs __________ _ 1.10 ___________ _____ 24.com no specs __________ _ 1.10 ___________ _____ 24.com no specs

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com" C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
overwander trimmer
Modules
Images
c:\users\admin\desktop\__________ _ 1.10 ___________ _____ 24.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
780C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1184"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\_ПРИЛОЖЕНИЕ _ 1.10 К АКТУ _ 5-003_2024-О.eml"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1748"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2128"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "79E9B246-2DA4-43EA-8A00-28D98701CD75" "E737EBCD-184F-477E-928A-09C69332D6FE" "1184"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
1073807364
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
2248"C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com" C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
overwander trimmer
Exit code:
1073807364
Modules
Images
c:\users\admin\desktop\__________ _ 1.10 ___________ _____ 24.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3140"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VNB4845S\Приложение № 1.10 Пикалевское ЛПУМГ 24.tbz"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4128"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4440"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4644C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
26 040
Read events
24 948
Write events
1 006
Delete events
86

Modification events

(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01941A000000001000B24E9A3E06000000000000000600000000000000
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\1184
Operation:writeName:0
Value:
0B0E10AA295B40038F564FBD45CC1939CB6EA7230046ACF39DCCD2A8BEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511A009D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:delete keyName:(default)
Value:
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:CantBootResolution
Value:
BootSuccess
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:ProfileBeingOpened
Value:
Outlook
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:SessionId
Value:
C3D8E96E-C1AF-4750-8D52-F4E28119C131
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:BootDiagnosticsLogFile
Value:
C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20240718T1116060318-1644.etl
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:ProfileBeingOpened
Value:
Executable files
2
Suspicious files
60
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
1184OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbresbinary
MD5:5FDE4035417BC5F1C38CCA0C2EDD6DE3
SHA256:538E7735D9B4650DAD0317B353B94371F9196B1971ADAAB0E8207D155B0D6031
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:1090F8D9767D2BB57FBEFA6210C94379
SHA256:8586AC3D3DA3DD3A939C8992A3D3B02B4CDFBAB1D9D7EB2A1A539110FECE4E05
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:271F3D7F70034EDD119771A3E118915D
SHA256:93961E18307782EBA6C5756C72CC20D37EBB0F680F0BC4A5CEF5FCBF7C206A6A
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_0970E8ED835C2341B6B989ECA348B928.datxml
MD5:0E092DB99AEE99FDFF9B5B222C732CFD
SHA256:D1614AD99ADED9F6F5C1BE7FE7FFA5124BD04A526580DA3818EA8A954E852AA6
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VNB4845S\Приложение № 1.10 Пикалевское ЛПУМГ 24 (002).tbzcompressed
MD5:6A6236F821DA974E3F05DC0D87D36AB0
SHA256:B13DAFA52A9B94F33C58DCB4779EBBE672152E931C595B489735C677AB700D92
6244__________ _ 1.10 ___________ _____ 24.comC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Rnense\Tfler\Ankylenteron.minabr
MD5:A17F0C1029A542E51FA5159BB5AD1C1E
SHA256:98D331F0B8DDFC24844066AF6849D8984BF44C5E7DA328D7C46B7ABABA24607F
6244__________ _ 1.10 ___________ _____ 24.comC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Rnense\Tfler\Forudanelsernes.Brebinary
MD5:9B391158A4BDB5DECE5FE6CACE27FE15
SHA256:7E1B735C7176469C6B75386FF3749F8165F26B03FCABADDDA97A6301453565E0
6244__________ _ 1.10 ___________ _____ 24.comC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Rnense\Tfler\rethaveren.txttext
MD5:79438529A7EBED3A315C0DEC4D52A5A1
SHA256:BD611EB2C382D79BD3520C4D836AA20F0EF19642F0FA27C65E71FD47D956A59A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
56
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1184
OUTLOOK.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6480
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6480
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
6416
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5408
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3352
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6856
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1184
OUTLOOK.EXE
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1184
OUTLOOK.EXE
23.48.23.18:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted
1184
OUTLOOK.EXE
52.111.232.11:443
messaging.lifecycle.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
JP
whitelisted
3352
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1184
OUTLOOK.EXE
20.42.65.91:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1184
OUTLOOK.EXE
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
omex.cdn.office.net
  • 23.48.23.18
  • 23.48.23.30
  • 23.48.23.42
whitelisted
messaging.lifecycle.office.com
  • 52.111.232.11
whitelisted
self.events.data.microsoft.com
  • 20.42.65.91
  • 20.42.73.30
  • 104.208.16.91
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.160.17
  • 40.126.32.140
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.74
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: error while getting certificate informations
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_ПРИЛОЖЕНИЕ _ 1.10 К АКТУ _ 5-003_2024-О.eml