URL:

https://email.y.kajabimail.net/c/eJxskM-unCAYxZ9GNo2Gf4IuWLS5naTrPoBB-Jz7dUawgHPj2zc63qRpZ8nvcA7hZ5dlCHYGc7O_7Ih1LjHBlGIouV5S9KsrGAPxRnEnFAHDtJZSU6UYgdniffBwxwekbUBvJJVd1wreU3qm6A1nrW4ZF7042Qw52ysMZVvAPNGYovXO5nJeSZDjmhy87Gf4vUJ4hp9oHY-17_vp2z9jr5J30_tOWas7xsG1YFvVKWVBuYl7mPSkCBpOuaKCt5wKRlnjuslJ0K20TI8j6ErSrXl628ebAIXczXspS67E14pfKn7x0a0Zr6GOH1uTcLphYbvYEsPeqV2c61xb5-IaSvMR0w1Sbjw89rq4HB-oxJsln9IyBA9p8HG2GMx_7yeTcGKUccEqSa8Hd3EmCRwuCKEcRjXtpZBUcpKxnJJlp3stBSXF_MQCX368VVz8hR-G_wkAAP__zM25iQ

Full analysis: https://app.any.run/tasks/288071c5-fd8b-4f47-b59f-d8dd516c183c
Verdict: Malicious activity
Analysis date: April 22, 2026, 20:29:48
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
phishing
Indicators:
MD5:

ADC1A17BC378D582EB59614BA35B7C12

SHA1:

EE93F8BE96177DA85245DA661CDB4903E77A912D

SHA256:

A42ADB0551BAAD91B3FAB2DE54065C59DC486416F3E733B7637C0F5F2A04395D

SSDEEP:

12:2oZwpfc3gh6jqjjaEXW7KL0yEHnYrXfqSwAbRTg7OT:2o2xGTCjPXwKuwRBgc

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • PHISHING has been detected (SURICATA)

      • msedge.exe (PID: 7028)

  • SUSPICIOUS

    No suspicious indicators.

  • INFO

    No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.
No data.
screenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
154
Monitored processes
1
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
#PHISHING msedge.exe

Process information

PID
CMD
Path
Indicators
Parent process
7028"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --webtransport-developer-mode --string-annotations --always-read-main-dll --field-trial-handle=2256,i,13378875761215938322,9620771509043916482,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:3C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
msedge.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Edge
Version:
133.0.3065.92
Modules
Images
c:\program files (x86)\microsoft\edge\application\msedge.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files (x86)\microsoft\edge\application\133.0.3065.92\msedge_elf.dll
c:\windows\system32\oleaut32.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
0
Read events
0
Write events
0
Delete events
0

Modification events

No data
Executable files
0
Suspicious files
2
Text files
4
Unknown types
0

Dropped files

PID
Process
Filename
Type
7028msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5text
MD5:34135C09CBF6258C636D8D439088570E
SHA256:F4953C024B3DE41FB478C8F75419C952E2A6513C3D714F7AF64C3729DB69F925
7028msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6binary
MD5:260C81A4759BAF163C025001C4F27872
SHA256:3100E775E8616CD2611BEECFA23A4263D7037586789B43F035236A2E6FBD4C62
7028msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b8eca4a-31c8-4a48-98b0-466dc09f1e50.tmptext
MD5:F054A7D6E382DF24018FE84986B710A2
SHA256:4E5235C6B40BCE6C5FD0554D554FCDB38E8016DCDDFA9CAB63103407CAF8DAEB
7028msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RFff64d.TMPtext
MD5:8CA6AC4CD0D4F8B2EA5A9FC6FD4311D7
SHA256:EE810A451AEA499C3D6F89EDB840ED025DF0937874485A211A3BB39F915F4EA0
7028msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent Statetext
MD5:F054A7D6E382DF24018FE84986B710A2
SHA256:4E5235C6B40BCE6C5FD0554D554FCDB38E8016DCDDFA9CAB63103407CAF8DAEB
7028msedge.exeC:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7compressed
MD5:F3AD19FDBD15A27B32A4D25E49CC266E
SHA256:3A657EDDEC2905CE29950E37A3CC78C6839AFC858FE26A89490A1502BE032D13
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
74
TCP/UDP connections
59
DNS requests
45
Threats
7

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
7788
RUXIMICS.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/WSD/RUXIM?os=Windows&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&sku=48&deviceClass=Windows.Desktop&locale=en-US&deviceId=s:BAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&sampleId=s:95271487&appVer=10.0.19041.3623&OSVersionFull=10.0.19045.4046.amd64fre.vb_release.191206-1406&FlightRing=Retail&AttrDataVer=188&App=RUXIM&AppVer=&DeviceFamily=Windows.Desktop
US
—
—
whitelisted
5336
MoUsoCoreWorker.exe
GET
304
4.231.128.59:443
https://settings-win.data.microsoft.com/settings/v3.0/wsd/muse?ProcessorClockSpeed=3593&FlightIds=&UpdateOfferedDays=344&BranchReadinessLevel=CB&OEMManufacturerName=DELL&IsCloudDomainJoined=0&ProcessorIdentifier=AMD64%20Family%206%20Model%2014%20Stepping%203&sku=48&ActivationChannel=Retail&AttrDataVer=188&IsMDMEnrolled=0&ProcessorCores=4&ProcessorModel=Intel%28R%29%20Core%28TM%29%20i5-6400%20CPU%20%40%202.70GHz&TotalPhysicalRAM=4096&PrimaryDiskType=4294967295&FlightingBranchName=&ChassisTypeId=1&OEMModelNumber=DELL&SystemVolumeTotalCapacity=260246&sampleId=95271487&deviceClass=Windows.Desktop&App=muse&DisableDualScan=0&AppVer=10.0&OEMSubModel=J5CR&locale=en-US&IsAlwaysOnAlwaysConnectedCapable=0&ms=0&DefaultUserRegion=244&osVer=10.0.19045.4046.amd64fre.vb_release.191206-1406&os=windows&deviceId=s%3ABAD99146-31D3-4EC6-A1A4-BE76F32BA5D4&DeferQualityUpdatePeriodInDays=0&ring=Retail&DeferFeatureUpdatePeriodInDays=30
US
—
—
whitelisted
7760
svchost.exe
HEAD
200
23.197.142.186:443
https://fs.microsoft.com/fs/windows/config.json
US
—
—
whitelisted
7028
msedge.exe
GET
302
34.110.180.34:443
https://email.y.kajabimail.net/c/eJxskM-unCAYxZ9GNo2Gf4IuWLS5naTrPoBB-Jz7dUawgHPj2zc63qRpZ8nvcA7hZ5dlCHYGc7O_7Ih1LjHBlGIouV5S9KsrGAPxRnEnFAHDtJZSU6UYgdniffBwxwekbUBvJJVd1wreU3qm6A1nrW4ZF7042Qw52ysMZVvAPNGYovXO5nJeSZDjmhy87Gf4vUJ4hp9oHY-17_vp2z9jr5J30_tOWas7xsG1YFvVKWVBuYl7mPSkCBpOuaKCt5wKRlnjuslJ0K20TI8j6ErSrXl628ebAIXczXspS67E14pfKn7x0a0Zr6GOH1uTcLphYbvYEsPeqV2c61xb5-IaSvMR0w1Sbjw89rq4HB-oxJsln9IyBA9p8HG2GMx_7yeTcGKUccEqSa8Hd3EmCRwuCKEcRjXtpZBUcpKxnJJlp3stBSXF_MQCX368VVz8hR-G_wkAAP__zM25iQ
US
html
498 b
unknown
5168
svchost.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
7788
RUXIMICS.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
7028
msedge.exe
GET
302
172.67.141.39:443
https://docusign-owy.rifkit1-protonmail-com-s-account.workers.dev/?email=a
US
—
—
—
5336
MoUsoCoreWorker.exe
GET
200
23.216.77.21:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
NL
binary
825 b
whitelisted
5168
svchost.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
7788
RUXIMICS.exe
GET
200
23.52.181.212:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
US
binary
814 b
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
5168
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
7788
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5336
MoUsoCoreWorker.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
—
—
224.0.0.251:5353
—
—
—
whitelisted
7028
msedge.exe
34.110.180.34:443
email.y.kajabimail.net
GOOGLE-CLOUD-PLATFORM
US
whitelisted
5168
svchost.exe
23.216.77.21:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
7788
RUXIMICS.exe
23.216.77.21:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5336
MoUsoCoreWorker.exe
23.216.77.21:80
crl.microsoft.com
AKAMAI-ASN1
NL
whitelisted
5168
svchost.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted
7788
RUXIMICS.exe
23.52.181.212:80
www.microsoft.com
AKAMAI-AS
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 40.127.240.158
whitelisted
google.com
  • 142.250.154.102
  • 142.250.154.101
  • 142.250.154.100
  • 142.250.154.113
  • 142.250.154.138
  • 142.250.154.139
whitelisted
email.y.kajabimail.net
  • 34.110.180.34
unknown
crl.microsoft.com
  • 23.216.77.21
  • 23.216.77.38
  • 23.216.77.30
  • 23.216.77.42
  • 23.216.77.41
  • 23.216.77.29
  • 23.216.77.28
  • 23.216.77.25
  • 23.216.77.35
  • 23.216.77.8
  • 23.216.77.43
  • 23.216.77.16
  • 23.216.77.13
  • 23.216.77.19
whitelisted
www.microsoft.com
  • 23.52.181.212
  • 88.221.169.152
whitelisted
docusign-owy.rifkit1-protonmail-com-s-account.workers.dev
  • 172.67.141.39
  • 104.21.38.247
malicious
fonts.googleapis.com
  • 142.251.110.95
whitelisted
www.bing.com
  • 2.16.241.207
  • 2.16.241.201
  • 2.16.241.218
  • 2.16.241.205
  • 23.36.162.76
  • 23.36.162.73
  • 23.36.162.68
  • 23.36.162.85
  • 23.36.162.88
  • 23.36.162.69
  • 23.36.162.80
  • 23.36.162.78
whitelisted
login.live.com
  • 20.190.160.22
  • 40.126.32.74
  • 20.190.160.66
  • 40.126.32.140
  • 20.190.160.4
  • 20.190.160.5
  • 20.190.160.128
  • 20.190.160.67
whitelisted
fs.microsoft.com
  • 23.197.142.186
whitelisted

Threats

PID
Process
Class
Message
7028
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] DNS Query to Cloudflare Worker App
7028
msedge.exe
Not Suspicious Traffic
INFO [ANY.RUN] DNS Query to Cloudflare Worker App
7028
msedge.exe
Possible Social Engineering Attempted
PHISHING [ANY.RUN] Suspected Phishing Domain pattern (docusign + .workers .dev)
7028
msedge.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)
7028
msedge.exe
Misc activity
ET INFO Observed DNS Query to Cloudflare Developer Domain (workers .dev)
7028
msedge.exe
Misc activity
ET INFO Observed Cloudflare Developer Domain (workers .dev) in TLS SNI
7788
RUXIMICS.exe
Unknown Traffic
ET USER_AGENTS Microsoft Dr Watson User-Agent (MSDW)
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
https://email.y.kajabimail.net/c/eJxskM-unCAYxZ9GNo2Gf4IuWLS5naTrPoBB-Jz7dUawgHPj2zc63qRpZ8nvcA7hZ5dlCHYGc7O_7Ih1LjHBlGIouV5S9KsrGAPxRnEnFAHDtJZSU6UYgdniffBwxwekbUBvJJVd1wreU3qm6A1nrW4ZF7042Qw52ysMZVvAPNGYovXO5nJeSZDjmhy87Gf4vUJ4hp9oHY-17_vp2z9jr5J30_tOWas7xsG1YFvVKWVBuYl7mPSkCBpOuaKCt5wKRlnjuslJ0K20TI8j6ErSrXl628ebAIXczXspS67E14pfKn7x0a0Zr6GOH1uTcLphYbvYEsPeqV2c61xb5-IaSvMR0w1Sbjw89rq4HB-oxJsln9IyBA9p8HG2GMx_7yeTcGKUccEqSa8Hd3EmCRwuCKEcRjXtpZBUcpKxnJJlp3stBSXF_MQCX368VVz8hR-G_wkAAP__zM25iQ