URL:

http://loginmicrosoft.jabboskitchen.com/cache/css

Full analysis: https://app.any.run/tasks/636a5ad4-233f-4033-9f5b-4023046a98b5
Verdict: Malicious activity
Analysis date: January 11, 2025, 00:01:47
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
phishing
Indicators:
MD5:

8ADC001E76931DE8170A7C396FA83AD5

SHA1:

CAE3196B6C308F854137A0F224267FCBA728981B

SHA256:

6FB4F339D39B8179375F362BB8A9B0ED6F7B6B2FCCC34844404BD3DE413057C4

SSDEEP:

3:N1KSKCM+utALLd2ELKBWn:CSZM+ug0qPn

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHISHING has been detected (SURICATA)

      • msedge.exe (PID: 7172)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
164
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
#PHISHING msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
7172"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --webtransport-developer-mode --no-appcompat-clear --mojo-platform-channel-handle=2496 --field-trial-handle=2204,i,13280900864495260754,3672259324373187194,262144 --variations-seed-version /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
122.0.2365.59
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
20
Text files
0
Unknown types
0

Dropped files

PID
Process
Filename
Type
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fcbinary
MD5:311F1298863858C8334BD7A8A0E34014
SHA256:846351F83ED17838A1DE223EAD4E9900D1E127B3243695DAF5A4988E965C44CC
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecuritybinary
MD5:3BA3C7C9FAF1B21BA43064B958A0FA37
SHA256:F08184D0E1DC131049C2C3EE53C0A323F8DFA32B61E6FDE69E5BBEA566262755
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\79785075-e1f0-4511-a200-87961653cc0f.tmpbinary
MD5:E7ECEE056DE04961FE8A337513443B69
SHA256:031E3E56DBAB94C148907748DAD6E57E632399E2E5C2780E30DAA1ED3E599890
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RF295934.TMPbinary
MD5:D2615E0C4F6C46045EDB3EAA0ACE252A
SHA256:48EFA073914F67BCCE305DECBC121BE7FA6D343982BE00A666B4C5FB6A30A7A9
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d62ab7fd-c0c0-4744-b65e-5159525f6bb1.tmpbinary
MD5:389053B904A3A59A6A763A79E86A2DDB
SHA256:7677464425DA4A337313CEFE2BB3230EE842BB8BDC80DFF2EA365A11887F8405
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent Statebinary
MD5:8EE7F14D14EE224F86D38C067D2B2647
SHA256:B88850BF245A6F247FE82AF22E4D5D64C9DBA9683C858B8FFDEE3D321D332F6D
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fbbinary
MD5:D17B5A55EC9D8608C1D2B531CCB6DE88
SHA256:DC2A3600C7CDFAEA40DB03757D6915D67518215DB51397C8A5BB3F132AE89A49
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0a7e8b97-7cb2-4585-b05e-bf40c30cdc3e.tmpbinary
MD5:3BA3C7C9FAF1B21BA43064B958A0FA37
SHA256:F08184D0E1DC131049C2C3EE53C0A323F8DFA32B61E6FDE69E5BBEA566262755
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF2a5d17.TMPbinary
MD5:8EE7F14D14EE224F86D38C067D2B2647
SHA256:B88850BF245A6F247FE82AF22E4D5D64C9DBA9683C858B8FFDEE3D321D332F6D
7172msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0c33497-ba8a-4c3b-b503-306176adaece.tmpbinary
MD5:EAA1D7594E46E74299470BC5446F093A
SHA256:EC9022CC227D6F2575B16F2312843A8C58599AAEBC47F490A977CF40168010BC
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
75
TCP/UDP connections
61
DNS requests
56
Threats
14

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
—
—
GET
302
104.18.94.41:443
https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
unknown
—
—
—
7172
msedge.exe
GET
307
192.185.129.84:80
http://loginmicrosoft.jabboskitchen.com/cache/css/
unknown
—
—
—
7172
msedge.exe
GET
301
192.185.129.84:80
http://loginmicrosoft.jabboskitchen.com/cache/css
unknown
—
—
—
—
—
GET
302
104.18.94.41:443
https://challenges.cloudflare.com/turnstile/v0/api.js?render=explicit
unknown
—
—
—
3024
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736811948&P2=404&P3=2&P4=HhtH9TjwBO93Dni1OVGSp5Ed%2fP58eFnp1SgA6ayGAJjzRvtyl9wFl1JVORw4vF4FlPg2nBtIJMiTZ1Rwa6zpCg%3d%3d
unknown
—
—
whitelisted
3024
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736811948&P2=404&P3=2&P4=HhtH9TjwBO93Dni1OVGSp5Ed%2fP58eFnp1SgA6ayGAJjzRvtyl9wFl1JVORw4vF4FlPg2nBtIJMiTZ1Rwa6zpCg%3d%3d
unknown
—
—
whitelisted
3024
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736811948&P2=404&P3=2&P4=HhtH9TjwBO93Dni1OVGSp5Ed%2fP58eFnp1SgA6ayGAJjzRvtyl9wFl1JVORw4vF4FlPg2nBtIJMiTZ1Rwa6zpCg%3d%3d
unknown
—
—
whitelisted
3024
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736811948&P2=404&P3=2&P4=HhtH9TjwBO93Dni1OVGSp5Ed%2fP58eFnp1SgA6ayGAJjzRvtyl9wFl1JVORw4vF4FlPg2nBtIJMiTZ1Rwa6zpCg%3d%3d
unknown
—
—
whitelisted
3024
svchost.exe
HEAD
200
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fd0b3f36-5596-4351-a52a-324d9881c330?P1=1737014289&P2=404&P3=2&P4=f5DaLkPAIhM6Zw6JXRDJvn8wHsZjZ6j78I%2fvllm93PtFqmDKmYNmUmEKRhNn0I7GIWiwvnzd9Q6gsFs5RufPSQ%3d%3d
unknown
—
—
whitelisted
3024
svchost.exe
GET
206
199.232.210.172:80
http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/d50ccf3e-dd06-4e6f-bb20-931c8ce33527?P1=1736811948&P2=404&P3=2&P4=HhtH9TjwBO93Dni1OVGSp5Ed%2fP58eFnp1SgA6ayGAJjzRvtyl9wFl1JVORw4vF4FlPg2nBtIJMiTZ1Rwa6zpCg%3d%3d
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
239.255.255.250:1900
—
—
—
whitelisted
5840
svchost.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
6340
RUXIMICS.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3080
MoUsoCoreWorker.exe
51.104.136.2:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4668
msedge.exe
224.0.0.251:5353
—
—
—
unknown
7172
msedge.exe
2.23.227.208:443
www.bing.com
Ooredoo Q.S.C.
QA
whitelisted
7172
msedge.exe
172.66.44.193:443
loginmicrosoftonlineklo.pages.dev
—
—
shared
7172
msedge.exe
192.185.129.84:80
loginmicrosoft.jabboskitchen.com
UNIFIEDLAYER-AS-1
US
unknown
7172
msedge.exe
13.107.246.45:443
xpaywalletcdn.azureedge.net
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7172
msedge.exe
104.18.95.41:443
challenges.cloudflare.com
—
—
whitelisted

DNS requests

Domain
IP
Reputation
google.com
  • 172.217.23.110
whitelisted
www.bing.com
  • 2.23.227.208
  • 2.23.227.215
  • 2.16.204.141
  • 2.16.204.161
  • 2.16.204.148
  • 2.16.204.134
whitelisted
loginmicrosoft.jabboskitchen.com
  • 192.185.129.84
unknown
loginmicrosoftonlineklo.pages.dev
  • 172.66.44.193
  • 172.66.47.63
shared
challenges.cloudflare.com
  • 104.18.95.41
  • 104.18.94.41
whitelisted
xpaywalletcdn.azureedge.net
  • 13.107.246.45
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
go.microsoft.com
  • 184.28.89.167
whitelisted
edge.microsoft.com
  • 13.107.21.239
  • 204.79.197.239
whitelisted
msedge.b.tlu.dl.delivery.mp.microsoft.com
  • 199.232.210.172
  • 199.232.214.172
  • 84.201.210.23
  • 217.20.57.36
  • 217.20.57.19
  • 84.201.210.39
  • 217.20.57.18
  • 217.20.57.35
  • 217.20.57.34
  • 217.20.57.20
  • 2.16.168.112
  • 2.16.168.108
whitelisted

Threats

PID
Process
Class
Message
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain (loginmicrosoftonlineklo .pages .dev)
—
—
Misc activity
ET INFO DNS Query to Cloudflare Page Developer Domain (pages .dev)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare Pages platform for frontend developers to collaborate and deploy websites (pages .dev)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing domain by CrossDomain (loginmicrosoftonlineklo .pages .dev)
—
—
Misc activity
ET INFO Observed Cloudflare Page Developer Domain (pages .dev in TLS SNI)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Domain chain identified as Phishing (challengepages)
—
—
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Domain chain identified as Phishing (challengepages)
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
—
—
Not Suspicious Traffic
INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
http://loginmicrosoft.jabboskitchen.com/cache/css