URL:

http://loginmicrosoft.jabboskitchen.com/cache/css

Full analysis: https://app.any.run/tasks/25f63bf2-932d-4478-844a-203437e9558a
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:09:27
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
phishing
Indicators:
MD5:

8ADC001E76931DE8170A7C396FA83AD5

SHA1:

CAE3196B6C308F854137A0F224267FCBA728981B

SHA256:

6FB4F339D39B8179375F362BB8A9B0ED6F7B6B2FCCC34844404BD3DE413057C4

SSDEEP:

3:N1KSKCM+utALLd2ELKBWn:CSZM+ug0qPn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHISHING has been detected (SURICATA)

      • msedge.exe (PID: 7172)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
#PHISHING msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
7172"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --webtransport-developer-mode --no-appcompat-clear --mojo-platform-channel-handle=2496 --field-trial-handle=2204,i,13280900864495260754,3672259324373187194,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
14
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\29ce1d8e-166d-4541-b745-35d812cd1fbb.tmpbinary
MD5:A6A7E531ACB14AE20E91A560B84F3DBC
SHA256:103E83AD9E1C517F99BD2D6376031868BD63734678962EA9E3337F502A93697B
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f62caa65-661d-4949-a3e4-4ee7a12863a4.tmpbinary
MD5:010F9796759FB50F49BE7E26C77FA40E
SHA256:0217C31A61CA4863760C758628B29F1F91D2F0F0A2BDEF069958CB4638DD829F
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fcbinary
MD5:311F1298863858C8334BD7A8A0E34014
SHA256:846351F83ED17838A1DE223EAD4E9900D1E127B3243695DAF5A4988E965C44CC
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2957fc.TMPbinary
MD5:D0453075479429FE52D8FB780A7DA8E9
SHA256:574112CCCB36E004E93B2BCBBA7F6CEB8FF3B12E3E462BEF80F1B57044E035B1
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2d097a.TMPbinary
MD5:5EB4F59AFA1619B36914E6F1D854BA16
SHA256:47579F2AF4EA6C32ED9055C7265A6777BCB988BE97ED341F37EB30610AEF9714
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent Statebinary
MD5:010F9796759FB50F49BE7E26C77FA40E
SHA256:0217C31A61CA4863760C758628B29F1F91D2F0F0A2BDEF069958CB4638DD829F
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ebdce83f-f83e-4062-9ec6-24f2d7156a04.tmpbinary
MD5:5EB4F59AFA1619B36914E6F1D854BA16
SHA256:47579F2AF4EA6C32ED9055C7265A6777BCB988BE97ED341F37EB30610AEF9714
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\49f36aed-3fba-475c-97be-253d17b618f2.tmpbinary
MD5:FFBEC4662DB1D62A8A20A84769CA79B3
SHA256:96E5BEC4FC17FAF8043B10A3DAB460F692D23B27A3239135C8C3A9202A404AF2
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF2956f2.TMPbinary
MD5:D2615E0C4F6C46045EDB3EAA0ACE252A
SHA256:48EFA073914F67BCCE305DECBC121BE7FA6D343982BE00A666B4C5FB6A30A7A9
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2a6238.TMPbinary
MD5:010F9796759FB50F49BE7E26C77FA40E
SHA256:0217C31A61CA4863760C758628B29F1F91D2F0F0A2BDEF069958CB4638DD829F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
88
TCP/UDP connections
64
DNS requests
58
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
302
104.18.94.41:443
https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
unknown
—
—
—
7172
msedge.exe
GET
307
192.185.129.84:80
http://loginmicrosoft.jabboskitchen.com/cache/css/
unknown
—
—
—
—
—
GET
302
104.18.94.41:443
https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
unknown
—
—
—
—
—
GET
302
184.30.21.171:443
https://go.microsoft.com/fwlink/?linkid=2133855&bucket=18
unknown
—
—
—
3024
svchost.exe
HEAD
200
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736817833&P2=404&P3=2&P4=mOPu0HeXIe6Sh7Q22WmypHE3aSNgih8g%2fxTLs6sZjI7iLtsaGWRvTATGLMQdBjNAUhHgLkdg1eNbmkPD7JuYpA%3d%3d
unknown
—
—
whitelisted
—
—
GET
302
104.18.94.41:443
https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
unknown
—
—
—
3024
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736817833&P2=404&P3=2&P4=mOPu0HeXIe6Sh7Q22WmypHE3aSNgih8g%2fxTLs6sZjI7iLtsaGWRvTATGLMQdBjNAUhHgLkdg1eNbmkPD7JuYpA%3d%3d
unknown
—
—
whitelisted
3024
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736817833&P2=404&P3=2&P4=mOPu0HeXIe6Sh7Q22WmypHE3aSNgih8g%2fxTLs6sZjI7iLtsaGWRvTATGLMQdBjNAUhHgLkdg1eNbmkPD7JuYpA%3d%3d
unknown
—
—
whitelisted
7172
msedge.exe
GET
301
192.185.129.84:80
http://loginmicrosoft.jabboskitchen.com/cache/css
unknown
—
—
—
3024
svchost.exe
GET
206
199.232.214.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736817833&P2=404&P3=2&P4=mOPu0HeXIe6Sh7Q22WmypHE3aSNgih8g%2fxTLs6sZjI7iLtsaGWRvTATGLMQdBjNAUhHgLkdg1eNbmkPD7JuYpA%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5776
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
—
—
239.255.255.250:1900
—
—
—
unknown
1484
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
3080
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
unknown
4668
msedge.exe
224.0.0.251:5353
—
—
—
unknown
7172
msedge.exe
104.126.37.139:443
www.bing.com
Akamai International B.V.
DE
whitelisted
7172
msedge.exe
192.185.129.84:80
loginmicrosoft.jabboskitchen.com
UNIFIEDLAYER-AS-1
US
unknown
7172
msedge.exe
172.66.44.193:443
loginmicrosoftonlineklo.pages.dev
CLOUDFLARENET
US
shared
7172
msedge.exe
104.18.95.41:443
challenges.cloudflare.com
—
—
whitelisted
7172
msedge.exe
13.107.246.45:443
xpaywalletcdn.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 40.127.240.158
  • 4.231.128.59
unknown
google.com
  • 142.250.186.142
unknown
www.bing.com
  • 104.126.37.139
  • 104.126.37.129
  • 104.126.37.128
  • 104.126.37.162
  • 104.126.37.154
  • 104.126.37.144
  • 104.126.37.185
  • 104.126.37.178
  • 104.126.37.130
  • 2.23.227.208
  • 2.23.227.215
  • 104.126.37.153
  • 104.126.37.146
  • 104.126.37.176
  • 104.126.37.171
  • 104.126.37.161
  • 104.126.37.160
  • 104.126.37.170
  • 104.126.37.155
  • 104.126.37.145
  • 104.126.37.131
  • 104.126.37.123
unknown
loginmicrosoft.jabboskitchen.com
  • 192.185.129.84
unknown
loginmicrosoftonlineklo.pages.dev
  • 172.66.44.193
  • 172.66.47.63
unknown
challenges.cloudflare.com
  • 104.18.95.41
  • 104.18.94.41
unknown
xpaywalletcdn.azureedge.net
  • 13.107.246.45
unknown
go.microsoft.com
  • 23.35.238.131
unknown
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
unknown
msedge.b.tlu.dl.delivery.mp.microsoft.com
  • 199.232.214.172
  • 199.232.210.172
  • 23.32.238.152
  • 23.32.238.105
  • 217.20.57.42
  • 217.20.57.24
  • 217.20.57.38
  • 84.201.210.18
  • 217.20.57.41
  • 217.20.57.40
  • 84.201.210.34
  • 84.201.210.20
  • 217.20.57.19
  • 217.20.57.20
  • 217.20.57.34
  • 84.201.210.23
  • 217.20.57.36
  • 217.20.57.18
  • 217.20.57.35
  • 84.201.210.39
unknown

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
—
—
Misc activity
ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain (loginmicrosoftonlineklo .pages .dev)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain (loginmicrosoftonlineklo .pages .dev)
—
—
Misc activity
ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Domain chain identified as Phishing (challengepages)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Domain chain identified as Phishing (challengepages)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Domain chain identified as Phishing (challengepages)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://loginmicrosoft.jabboskitchen.com/cache/css