File name:

_ПРИЛОЖЕНИЕ _ 1.10 К АКТУ _ 5-003_2024-О.eml

Full analysis: https://app.any.run/tasks/99f2c35b-dacb-48d6-968e-8142a12c64b2
Verdict: Malicious activity
Analysis date: August 28, 2024, 12:23:51
OS: Windows 10 Professional (build: 19045, 64 bit)
Indicators:
MIME: message/rfc822
File info: SMTP mail, ASCII text, with very long lines (348), with CRLF line terminators
MD5:

85B33AD419DA2A45AF3D2634667D962C

SHA1:

52E891BE6BA133E9926E88B4A686CF8E30634E04

SHA256:

0CD8004F78C67F450E867E7942096880AC39ADEBB7E75D596120806508B5C958

SSDEEP:

24576:GOb2Z26SXjOVBoarognm1vAkSCbSD/1mD6Caw:nb8PXr967SnCaw

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Unusual execution from MS Outlook

      • OUTLOOK.EXE (PID: 1184)

  • SUSPICIOUS

    • Creates file in the systems drive root

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Executable content was dropped or overwritten

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • The process creates files with name similar to system file names

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Drops the executable file immediately after the start

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • The process executes via Task Scheduler

      • PLUGScheduler.exe (PID: 4128)

  • INFO

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3140)

    • Creates files or folders in the user directory

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Reads the computer name

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 2248)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 4820)
      • PLUGScheduler.exe (PID: 4128)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 768)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6344)

    • Manual execution by a user

      • __________ _ 1.10 ___________ _____ 24.com (PID: 2248)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)
      • notepad++.exe (PID: 1748)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 4820)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6344)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 768)

    • Checks supported languages

      • __________ _ 1.10 ___________ _____ 24.com (PID: 2248)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 4820)
      • PLUGScheduler.exe (PID: 4128)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 768)
      • __________ _ 1.10 ___________ _____ 24.com (PID: 6344)

    • Reads the software policy settings

      • slui.exe (PID: 4440)
      • slui.exe (PID: 6680)

    • Checks proxy server information

      • slui.exe (PID: 6680)

    • Create files in a temporary directory

      • __________ _ 1.10 ___________ _____ 24.com (PID: 6244)

    • Creates files in the program directory

      • PLUGScheduler.exe (PID: 4128)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.eml | E-Mail message (Var. 7) (100)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
269
Monitored processes
14
Malicious processes
0
Suspicious processes
2

Behavior graph

Click at the process to see the details
start outlook.exe ai.exe no specs winrar.exe sppextcomobj.exe no specs slui.exe rundll32.exe no specs __________ _ 1.10 ___________ _____ 24.com __________ _ 1.10 ___________ _____ 24.com no specs notepad++.exe slui.exe __________ _ 1.10 ___________ _____ 24.com no specs plugscheduler.exe no specs __________ _ 1.10 ___________ _____ 24.com no specs __________ _ 1.10 ___________ _____ 24.com no specs

Process information

PID
CMD
Path
Indicators
Parent process
768"C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com" C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
overwander trimmer
Modules
Images
c:\users\admin\desktop\__________ _ 1.10 ___________ _____ 24.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
780C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -EmbeddingC:\Windows\System32\rundll32.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows host process (Rundll32)
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\rundll32.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shcore.dll
c:\windows\system32\imagehlp.dll
1184"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\admin\AppData\Local\Temp\_ПРИЛОЖЕНИЕ _ 1.10 К АКТУ _ 5-003_2024-О.eml"C:\Program Files\Microsoft Office\root\Office16\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
16.0.16026.20146
Modules
Images
c:\program files\microsoft office\root\office16\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1748"C:\Program Files\Notepad++\notepad++.exe" "C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com"C:\Program Files\Notepad++\notepad++.exe
explorer.exe
User:
admin
Company:
Don HO don.h@free.fr
Integrity Level:
MEDIUM
Description:
Notepad++ : a free (GNU) source code editor
Exit code:
0
Version:
7.91
Modules
Images
c:\program files\notepad++\notepad++.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
2128"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe" "79E9B246-2DA4-43EA-8A00-28D98701CD75" "E737EBCD-184F-477E-928A-09C69332D6FE" "1184"C:\Program Files\Microsoft Office\root\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ai.exe—OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Artificial Intelligence (AI) Host for the Microsoft® Windows® Operating System and Platform x64.
Exit code:
1073807364
Version:
0.12.2.0
Modules
Images
c:\program files\microsoft office\root\vfs\programfilescommonx64\microsoft shared\office16\ai.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\common files\microsoft shared\clicktorun\appvisvsubsystems64.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\program files\common files\microsoft shared\clicktorun\c2r64.dll
c:\windows\system32\sechost.dll
c:\windows\system32\ole32.dll
2248"C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com" C:\Users\admin\Desktop\__________ _ 1.10 ___________ _____ 24.com—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
overwander trimmer
Exit code:
1073807364
Modules
Images
c:\users\admin\desktop\__________ _ 1.10 ___________ _____ 24.com
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\user32.dll
c:\windows\syswow64\win32u.dll
3140"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\Content.Outlook\VNB4845S\Приложение № 1.10 Пикалевское ЛПУМГ 24.tbz"C:\Program Files\WinRAR\WinRAR.exe
OUTLOOK.EXE
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
4128"C:\Program Files\RUXIM\PLUGscheduler.exe"C:\Program Files\RUXIM\PLUGScheduler.exe—svchost.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Update LifeCycle Component Scheduler
Exit code:
0
Version:
10.0.19041.3623 (WinBuild.160101.0800)
Modules
Images
c:\program files\ruxim\plugscheduler.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\advapi32.dll
4440"C:\WINDOWS\System32\SLUI.exe" RuleId=3482d82e-ca2c-4e1f-8864-da0267b484b2;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c;NotificationInterval=1440;Trigger=TimerEventC:\Windows\System32\slui.exe
SppExtComObj.Exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows Activation Client
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
4644C:\WINDOWS\system32\SppExtComObj.exe -EmbeddingC:\Windows\System32\SppExtComObj.Exe—svchost.exe
User:
NETWORK SERVICE
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
KMS Connection Broker
Exit code:
0
Version:
10.0.19041.3996 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\sppextcomobj.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\oleaut32.dll
Total events
26 040
Read events
24 948
Write events
1 006
Delete events
86

Modification events

(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\ClientTelemetry\Sampling
Operation:writeName:6
Value:
01941A000000001000B24E9A3E06000000000000000600000000000000
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\Common\CrashPersistence\OUTLOOK\1184
Operation:writeName:0
Value:
0B0E10AA295B40038F564FBD45CC1939CB6EA7230046ACF39DCCD2A8BEED016A04102400449A7D64B29D01008500A907556E6B6E6F776EC906022222CA0DC2190000C91003783634C511A009D2120B6F00750074006C006F006F006B002E00650078006500C51620C517808004C91808323231322D44656300
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootCommand
Value:
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:BootFailureCount
Value:
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:delete keyName:(default)
Value:
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:CantBootResolution
Value:
BootSuccess
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:ProfileBeingOpened
Value:
Outlook
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:SessionId
Value:
C3D8E96E-C1AF-4750-8D52-F4E28119C131
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics\BootDiagnosticsDataPreviousSession
Operation:writeName:BootDiagnosticsLogFile
Value:
C:\Users\admin\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16026_20146-20240718T1116060318-1644.etl
(PID) Process:(1184) OUTLOOK.EXEKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Diagnostics
Operation:delete valueName:ProfileBeingOpened
Value:
Executable files
2
Suspicious files
60
Text files
15
Unknown types
0

Dropped files

PID
Process
Filename
Type
1184OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook1.pst —
MD5:—
SHA256:—
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\olkAD01.tmpbinary
MD5:6102F0E315FD2CC0797A39492CE0632A
SHA256:F19AD637BED7E729D82C8D30C3A9FC2C190EB2318E75D52C575152F260B53F4F
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbresbinary
MD5:1090F8D9767D2BB57FBEFA6210C94379
SHA256:8586AC3D3DA3DD3A939C8992A3D3B02B4CDFBAB1D9D7EB2A1A539110FECE4E05
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntitiesUpdated.bintext
MD5:271F3D7F70034EDD119771A3E118915D
SHA256:93961E18307782EBA6C5756C72CC20D37EBB0F680F0BC4A5CEF5FCBF7C206A6A
6244__________ _ 1.10 ___________ _____ 24.comC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Rnense\Tfler\Forudanelsernes.Brebinary
MD5:9B391158A4BDB5DECE5FE6CACE27FE15
SHA256:7E1B735C7176469C6B75386FF3749F8165F26B03FCABADDDA97A6301453565E0
6244__________ _ 1.10 ___________ _____ 24.comC:\Users\admin\AppData\Roaming\Microsoft\Windows\Templates\Rnense\Tfler\murer.preabr
MD5:D1918E040E71A5CB1B2281037C47428E
SHA256:30886A580C3883E2C68CCD80CF1545DE60E8A5903FDE011C0B6B5F45A10F727F
1184OUTLOOK.EXEC:\Users\admin\AppData\Roaming\Microsoft\Templates\~$rmalEmail.dotmpgc
MD5:4EB06C0965A60EBA97E0B1D875B27D45
SHA256:DD7A8AE1F20E5567C481B101FC02EE2033D0F4A2613CE4ED5EECB5A3ADEF2C78
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Office\16.0\AddInClassifierCache\OfficeSharedEntities.bintext
MD5:CC90D669144261B198DEAD45AA266572
SHA256:89C701EEFF939A44F28921FD85365ECD87041935DCD0FE0BAF04957DA12C9899
1184OUTLOOK.EXEC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_0FB9553B978E7F00C6B2309507DEB64Abinary
MD5:B4A6272C9E0B250A8CACC7B726EEABB0
SHA256:0487EFBEA1485BDD417BF08AB75F19E1D6D36F0652B3C802FA993A98E450797A
1184OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_TableViewPreviewPrefs_2_0970E8ED835C2341B6B989ECA348B928.datxml
MD5:0E092DB99AEE99FDFF9B5B222C732CFD
SHA256:D1614AD99ADED9F6F5C1BE7FE7FFA5124BD04A526580DA3818EA8A954E852AA6
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
5
TCP/UDP connections
56
DNS requests
34
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
1184
OUTLOOK.EXE
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAn5bsKVVV8kdJ6vHl3O1J0%3D
unknown
—
—
whitelisted
6480
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6416
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
6480
SIHClient.exe
GET
200
88.221.169.152:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5408
SearchApp.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3352
svchost.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
6856
RUXIMICS.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
51.124.78.146:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1184
OUTLOOK.EXE
52.113.194.132:443
ecs.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1184
OUTLOOK.EXE
23.48.23.18:443
omex.cdn.office.net
Akamai International B.V.
DE
whitelisted
1184
OUTLOOK.EXE
52.111.232.11:443
messaging.lifecycle.office.com
MICROSOFT-CORP-MSN-AS-BLOCK
JP
whitelisted
3352
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
1184
OUTLOOK.EXE
20.42.65.91:443
self.events.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
1184
OUTLOOK.EXE
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 51.124.78.146
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
ecs.office.com
  • 52.113.194.132
whitelisted
omex.cdn.office.net
  • 23.48.23.18
  • 23.48.23.30
  • 23.48.23.42
whitelisted
messaging.lifecycle.office.com
  • 52.111.232.11
whitelisted
self.events.data.microsoft.com
  • 20.42.65.91
  • 20.42.73.30
  • 104.208.16.91
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
client.wns.windows.com
  • 40.113.110.67
whitelisted
login.live.com
  • 20.190.159.4
  • 20.190.159.23
  • 20.190.159.71
  • 20.190.159.2
  • 40.126.31.73
  • 20.190.159.0
  • 20.190.159.68
  • 40.126.31.69
  • 20.190.160.17
  • 40.126.32.140
  • 40.126.32.133
  • 20.190.160.22
  • 40.126.32.134
  • 20.190.160.20
  • 40.126.32.138
  • 40.126.32.74
whitelisted
slscr.update.microsoft.com
  • 40.68.123.157
whitelisted

Threats

No threats detected
Process
Message
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\SciLexer.dll
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
ED255D9151912E40DF048A56288E969A8D0DAFA3
notepad++.exe
VerifyLibrary: C:\Program Files\Notepad++\updater\gup.exe
notepad++.exe
VerifyLibrary: certificate revocation checking is disabled
notepad++.exe
VerifyLibrary: error while getting certificate informations
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
_ПРИЛОЖЕНИЕ _ 1.10 К АКТУ _ 5-003_2024-О.eml