| URL: | https://gamma.app/reset?code=o18buftupqxnsuc&flow=signup&email=daniyar.bimurzin%2540ftel.kz |
| Full analysis: | https://app.any.run/tasks/2cde22f1-ae9b-4e0c-83a7-8b0c45eb223a |
| Verdict: | Malicious activity |
| Analysis date: | May 10, 2025, 01:10:55 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| Tags: | |
| MD5: | 9979BD4CA49DB472E84453BBAF635AB4 |
| SHA1: | D6F2E1AEFDC8AD27A2F3143F700B0B4F969510D5 |
| SHA256: | 7BF122871CD1944DB324FE703CD641BB17F21109887D0B66DC2F43082350969B |
| SSDEEP: | 3:N8lajIDROf77DLAc5bEUeXfKDzr:280NOf77XAc5bY83 |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
151
Monitored processes
1
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 1396 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --webtransport-developer-mode --no-appcompat-clear --mojo-platform-channel-handle=2532 --field-trial-handle=2372,i,8504447382059928769,14367336096275567116,262144 --variations-seed-version /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 122.0.2365.59 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
8
Suspicious files
73
Text files
2
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State | binary | |
MD5:3140CB797498137E330D3CAE1AD5970A | SHA256:B4C87E65FB18FF2E4028E934653089C7DE70D854E7D861D9A1063189C5212119 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\28cb37be-2b0c-4912-bb1a-40759c5d42e5.tmp | binary | |
MD5:3140CB797498137E330D3CAE1AD5970A | SHA256:B4C87E65FB18FF2E4028E934653089C7DE70D854E7D861D9A1063189C5212119 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1 | compressed | |
MD5:E3B87336D57706DF1EB036FD6D197BAF | SHA256:2F6A7BE9DEFC16E37D998F46DBFF97A3DB316A05B5F985BF843B8D0326A116F5 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bd | compressed | |
MD5:CA63D10CEDC51597FAC2ADF52AFAF17A | SHA256:7110A6CB650C6FF50113F2F28C2F41435B861ABBB26853A238EF9DDFC07410B8 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca | compressed | |
MD5:386D87873CC9E0E429740D817B49F874 | SHA256:BEC5574FB191385B3BCC2C3CB587C9F3A8D94090EDE6B4D5688189370D876362 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000be | compressed | |
MD5:033D09C1282976F3028D775062ED9A4D | SHA256:5F71A8918CCE08A127DAE21C550A4DC502E0DE207024A3E97A3AA0D12F0A2023 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2 | compressed | |
MD5:5F09D85D77C1E9467988DC7C5FB989F1 | SHA256:E8AA7C95BB3DB04211D4EA9B22442B449BC280FF01E1352BC931B4C398EAF997 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF13a711.TMP | binary | |
MD5:50823AF426E5FA5F5641C1004F470D3E | SHA256:599163927CC9E5640C868AEDD3B0B6EC79E6513970504124E417922D8AAAB7C3 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bb | compressed | |
MD5:10B84D6DDEFB33D0D3F0615CA3E91C5A | SHA256:C69A6E50A300D39721F9AE8FC5B40600DD90093F65E3A4650C9540C58C071144 | |||
| 1396 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8 | compressed | |
MD5:657FD57D7B7DED699D7546BD06AF6C00 | SHA256:930571B76497A2BFECD05CD6F7B64EF9DD72C6644E8BD1EDA0DCA21F3BF5AB57 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
194
TCP/UDP connections
253
DNS requests
185
Threats
12
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
1740 | RUXIMICS.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3080 | MoUsoCoreWorker.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
3464 | svchost.exe | GET | 200 | 2.16.168.114:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1740 | RUXIMICS.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3464 | svchost.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
3080 | MoUsoCoreWorker.exe | GET | 200 | 95.101.149.131:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
— | — | POST | 400 | 20.190.159.128:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 203 b | whitelisted |
— | — | POST | 200 | 40.126.32.140:443 | https://login.live.com/RST2.srf | unknown | xml | 1.24 Kb | whitelisted |
— | — | POST | 400 | 40.126.31.0:443 | https://login.live.com/ppsecure/deviceaddcredential.srf | unknown | text | 203 b | whitelisted |
— | — | POST | 403 | 23.35.229.160:443 | https://go.microsoft.com/fwlink/?LinkID=2257403&clcid=0x409 | unknown | html | 386 b | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
— | — | 239.255.255.250:1900 | — | — | — | whitelisted |
1740 | RUXIMICS.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3080 | MoUsoCoreWorker.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
3464 | svchost.exe | 51.124.78.146:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
— | — | 20.190.160.14:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4936 | svchost.exe | 20.190.160.14:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1104 | svchost.exe | 95.100.186.9:443 | go.microsoft.com | AKAMAI-AS | FR | whitelisted |
1396 | msedge.exe | 104.18.10.200:443 | gamma.app | CLOUDFLARENET | — | suspicious |
1740 | RUXIMICS.exe | 2.16.168.114:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
3080 | MoUsoCoreWorker.exe | 2.16.168.114:80 | crl.microsoft.com | Akamai International B.V. | RU | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
login.live.com |
| whitelisted |
google.com |
| whitelisted |
go.microsoft.com |
| whitelisted |
gamma.app |
| unknown |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
www.bing.com |
| whitelisted |
v10.events.data.microsoft.com |
| whitelisted |
challenges.cloudflare.com |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Gamma app |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Gamma app |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Gamma app |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Gamma app |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] Cloudflare turnstile CAPTCHA challenge |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Gamma app |
— | — | Possible Social Engineering Attempted | PHISHING [ANY.RUN] Suspected Phishing Gamma app |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] An application monitoring request to sentry .io |
— | — | Not Suspicious Traffic | INFO [ANY.RUN] An application monitoring request to sentry .io |