| URL: | https://microsoft.teams-live.com/en/index.html?msclkid=624d2bd6f228126bcc664c47b2293aea | 
| Full analysis: | https://app.any.run/tasks/724715d3-1ecd-4688-8358-5e62c9ddf8e5 | 
| Verdict: | Malicious activity | 
| Analysis date: | January 24, 2025, 00:46:40 | 
| OS: | Windows 10 Professional (build: 19045, 64 bit) | 
| Indicators: | |
| MD5: | 6726D898859804EE1F06D52CC961C37E | 
| SHA1: | DDECF631D6898C72CB937C74A31712E96C41A101 | 
| SHA256: | 39F66690AAE07BF9F1F4A5470409F187AFF4EB3CD4A1A9CE6B76E88C263A5ADB | 
| SSDEEP: | 3:N8aYtz4MMy+MKd5NI/6bRRBThOTHRfRGQq:21KMl+XNICbaLRfRJq | 
| PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 436 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4464 --field-trial-handle=2328,i,6030025626209034412,15483324502460575133,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 520 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.59 --initial-client-data=0x290,0x294,0x298,0x288,0x2a0,0x7ff8219f5fd8,0x7ff8219f5fe4,0x7ff8219f5ff0 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 1076 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3880 --field-trial-handle=2328,i,6030025626209034412,15483324502460575133,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 1192 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4756 --field-trial-handle=2328,i,6030025626209034412,15483324502460575133,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 1224 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2576 --field-trial-handle=2328,i,6030025626209034412,15483324502460575133,262144 --variations-seed-version /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | ||||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 1688 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6064 --field-trial-handle=2316,i,16557992341560739125,3329359375719728593,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 1688 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2428 --field-trial-handle=2328,i,6030025626209034412,15483324502460575133,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 1804 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=8016 --field-trial-handle=2316,i,16557992341560739125,3329359375719728593,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 2144 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7992 --field-trial-handle=2316,i,16557992341560739125,3329359375719728593,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
 | |||||||||||||||
| 2160 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5504 --field-trial-handle=2316,i,16557992341560739125,3329359375719728593,262144 --variations-seed-version /prefetch:8 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
| User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 122.0.2365.59 Modules
 | |||||||||||||||
| (PID) Process: | (6164) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content | 
| Operation: | write | Name: | CachePrefix | 
| Value: | |||
| (PID) Process: | (6164) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies | 
| Operation: | write | Name: | CachePrefix | 
| Value: Cookie: | |||
| (PID) Process: | (6164) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History | 
| Operation: | write | Name: | CachePrefix | 
| Value: Visited: | |||
| (PID) Process: | (6164) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main | 
| Operation: | write | Name: | CompatibilityFlags | 
| Value: 0 | |||
| (PID) Process: | (6164) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones | 
| Operation: | write | Name: | SecuritySafe | 
| Value: 1 | |||
| (PID) Process: | (6164) iexplore.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main | 
| Operation: | write | Name: | DisableFirstRunCustomize | 
| Value: 1 | |||
| (PID) Process: | (6380) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon | 
| Operation: | write | Name: | failed_count | 
| Value: 0 | |||
| (PID) Process: | (6380) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon | 
| Operation: | write | Name: | state | 
| Value: 2 | |||
| (PID) Process: | (6380) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\BLBeacon | 
| Operation: | write | Name: | state | 
| Value: 1 | |||
| (PID) Process: | (6380) msedge.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Edge\StabilityMetrics | 
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly | 
| Value: 0 | |||
| PID | Process | Filename | Type | |
|---|---|---|---|---|
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old~RF137199.TMP | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\PersistentOriginTrials\LOG.old | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF13718a.TMP | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old~RF1371a9.TMP | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\discounts_db\LOG.old | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF1371b8.TMP | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old~RF1371c8.TMP | — | |
| MD5:— | SHA256:— | |||
| 6380 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\parcel_tracking_db\LOG.old | — | |
| MD5:— | SHA256:— | |||
| PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation | 
|---|---|---|---|---|---|---|---|---|---|
| 4712 | MoUsoCoreWorker.exe | GET | 200 | 2.16.164.72:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown |  —  | — | whitelisted | 
| 4712 | MoUsoCoreWorker.exe | GET | 200 | 2.23.246.101:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown |  —  | — | whitelisted | 
| 5064 | SearchApp.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTrjrydRyt%2BApF3GSPypfHBxR5XtQQUs9tIpPmhxdiuNkHMEWNpYim8S8YCEAI5PUjXAkJafLQcAAsO18o%3D | unknown |  —  | — | whitelisted | 
| 1176 | svchost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown |  —  | — | whitelisted | 
| 7012 | svchost.exe | HEAD | 200 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6ca9004c-2afd-40c0-a9b1-4fec460952e5?P1=1738145190&P2=404&P3=2&P4=kpuD%2fXA%2fgLBXsUqcuMv9FBRDqqbozICssgQ9Rp%2bfk8tcEO%2f7gPPXVD0IBAGPulo2U7s8BUQW89BxOK%2fcSHRa3w%3d%3d | unknown |  —  | — | whitelisted | 
| 8152 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown |  —  | — | whitelisted | 
| 5836 | backgroundTaskHost.exe | GET | 200 | 2.23.77.188:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQ50otx%2Fh0Ztl%2Bz8SiPI7wEWVxDlQQUTiJUIBiV5uNu5g%2F6%2BrkS7QYXjzkCEAUZZSZEml49Gjh0j13P68w%3D | unknown |  —  | — | whitelisted | 
| 8152 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown |  —  | — | whitelisted | 
| 7012 | svchost.exe | GET | 206 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6ca9004c-2afd-40c0-a9b1-4fec460952e5?P1=1738145190&P2=404&P3=2&P4=kpuD%2fXA%2fgLBXsUqcuMv9FBRDqqbozICssgQ9Rp%2bfk8tcEO%2f7gPPXVD0IBAGPulo2U7s8BUQW89BxOK%2fcSHRa3w%3d%3d | unknown |  —  | — | whitelisted | 
| 7012 | svchost.exe | GET | 206 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/6ca9004c-2afd-40c0-a9b1-4fec460952e5?P1=1738145190&P2=404&P3=2&P4=kpuD%2fXA%2fgLBXsUqcuMv9FBRDqqbozICssgQ9Rp%2bfk8tcEO%2f7gPPXVD0IBAGPulo2U7s8BUQW89BxOK%2fcSHRa3w%3d%3d | unknown |  —  | — | whitelisted | 
| PID | Process | IP | Domain | ASN | CN | Reputation | 
|---|---|---|---|---|---|---|
| 4 | System | 192.168.100.255:137 | — | — | — | whitelisted | 
| — | — | 51.104.136.2:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted | 
| 4712 | MoUsoCoreWorker.exe | 2.16.164.72:80 | crl.microsoft.com | Akamai International B.V. | NL | whitelisted | 
| 4 | System | 192.168.100.255:138 | — | — | — | whitelisted | 
| 4712 | MoUsoCoreWorker.exe | 2.23.246.101:80 | www.microsoft.com | Ooredoo Q.S.C. | QA | whitelisted | 
| 5064 | SearchApp.exe | 2.21.65.154:443 | www.bing.com | Akamai International B.V. | NL | whitelisted | 
| 5064 | SearchApp.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted | 
| 1176 | svchost.exe | 20.190.159.23:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted | 
| 1176 | svchost.exe | 2.23.77.188:80 | ocsp.digicert.com | AKAMAI-AS | DE | whitelisted | 
| — | — | 40.127.240.158:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted | 
| Domain | IP | Reputation | 
|---|---|---|
| settings-win.data.microsoft.com | 
 | whitelisted | 
| google.com | 
 | whitelisted | 
| crl.microsoft.com | 
 | whitelisted | 
| www.microsoft.com | 
 | whitelisted | 
| www.bing.com | 
 | whitelisted | 
| ocsp.digicert.com | 
 | whitelisted | 
| login.live.com | 
 | whitelisted | 
| go.microsoft.com | 
 | whitelisted | 
| microsoft.teams-live.com | 
 | unknown | 
| config.edge.skype.com | 
 | whitelisted | 
| PID | Process | Class | Message | 
|---|---|---|---|
| — | — | Potentially Bad Traffic | ET DNS Query to a *.top domain - Likely Hostile |