| URL: | francia2028.duckdns.org |
| Full analysis: | https://app.any.run/tasks/fe32e395-770b-4866-8fa5-bb95f70554b3 |
| Verdict: | Malicious activity |
| Analysis date: | July 06, 2025, 03:58:10 |
| OS: | Windows 10 Professional (build: 19044, 64 bit) |
| MD5: | 98603DBF302092A6FC76389C8BC28005 |
| SHA1: | 4DBA7F8D34F8C67529DD7CCC43B78D2970F0CB13 |
| SHA256: | DA68269F6ED78C2F0E85C61EB2EB9A620F3EAC7C2C19672FE93415F31589FB61 |
| SSDEEP: | 3:+S96LWf:+SWWf |
MALICIOUS
No malicious indicators.SUSPICIOUS
Block-list domains
- msedge.exe (PID: 5012)
INFO
No info indicators.
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
153
Monitored processes
1
Malicious processes
1
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process |
|---|---|---|---|---|
| 5012 | "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-quic --webtransport-developer-mode --string-annotations --always-read-main-dll --field-trial-handle=2180,i,6161488519127897921,10116046693238162506,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:3 | C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe | msedge.exe | |
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Microsoft Edge Version: 133.0.3065.92 | ||||
Total events
0
Read events
0
Write events
0
Delete events
0
Modification events
Executable files
0
Suspicious files
4
Text files
1
Unknown types
0
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5012 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State | binary | |
MD5:F054A7D6E382DF24018FE84986B710A2 | SHA256:4E5235C6B40BCE6C5FD0554D554FCDB38E8016DCDDFA9CAB63103407CAF8DAEB | |||
| 5012 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05b10cd2-617d-42d6-a44f-815a6883670e.tmp | binary | |
MD5:F054A7D6E382DF24018FE84986B710A2 | SHA256:4E5235C6B40BCE6C5FD0554D554FCDB38E8016DCDDFA9CAB63103407CAF8DAEB | |||
| 5012 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RFcaa9d.TMP | binary | |
MD5:8CA6AC4CD0D4F8B2EA5A9FC6FD4311D7 | SHA256:EE810A451AEA499C3D6F89EDB840ED025DF0937874485A211A3BB39F915F4EA0 | |||
| 5012 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5 | binary | |
MD5:2F7374C60403B51F4DF29F88E94C8903 | SHA256:A810AE6B60D04A8651A208B397F235B1580F066517C23724F41CE85A7CBEF5E3 | |||
| 5012 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b6 | image | |
MD5:47F34ED7467BCBB4AADDD4E9824E971C | SHA256:B71B790FB923A4EA8B8445DCE67DF975DF29EE1DA46BA5F5BA38980448DB72EE | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
67
TCP/UDP connections
70
DNS requests
55
Threats
22
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
— | — | HEAD | 200 | 23.212.222.21:443 | https://fs.microsoft.com/fs/windows/config.json | unknown | — | — | — |
4900 | svchost.exe | HEAD | 403 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9?P1=1751247403&P2=404&P3=2&P4=KIOuyaltQzGUv9%2fRXevwe%2b%2fSXHyfYvf%2f5L%2fb6O%2fEjuA9bg7JGUT71DQcxatSu%2by%2f0Fb5ScE2gwu8%2bMYnHtBQiQ%3d%3d | unknown | — | — | whitelisted |
— | — | GET | 200 | 23.212.222.21:443 | https://fs.microsoft.com/fs/windows/config.json | unknown | binary | 55 b | whitelisted |
4232 | svchost.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
1108 | RUXIMICS.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
5336 | MoUsoCoreWorker.exe | GET | 200 | 23.216.77.6:80 | http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl | unknown | — | — | whitelisted |
— | — | POST | 200 | 150.171.27.11:443 | https://edge.microsoft.com/componentupdater/api/v1/update | unknown | text | 1.48 Kb | whitelisted |
4232 | svchost.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
5012 | msedge.exe | GET | 403 | 199.232.210.172:80 | http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/4c4fdee0-d69c-42b7-bf5c-3ec046e9dfc9?P1=1751247403&P2=404&P3=2&P4=KIOuyaltQzGUv9%2fRXevwe%2b%2fSXHyfYvf%2f5L%2fb6O%2fEjuA9bg7JGUT71DQcxatSu%2by%2f0Fb5ScE2gwu8%2bMYnHtBQiQ%3d%3d | unknown | — | — | whitelisted |
1108 | RUXIMICS.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4232 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
1108 | RUXIMICS.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
5336 | MoUsoCoreWorker.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
— | — | 224.0.0.251:5353 | — | — | — | unknown |
4900 | svchost.exe | 199.232.210.172:80 | msedge.b.tlu.dl.delivery.mp.microsoft.com | FASTLY | US | whitelisted |
5012 | msedge.exe | 104.126.37.153:443 | www.bing.com | Akamai International B.V. | DE | whitelisted |
4900 | svchost.exe | 23.212.222.21:443 | fs.microsoft.com | AKAMAI-AS | AU | whitelisted |
5012 | msedge.exe | 45.82.251.235:443 | francia2028.duckdns.org | DEDIPATH-LLC | US | malicious |
5012 | msedge.exe | 45.82.251.235:80 | francia2028.duckdns.org | DEDIPATH-LLC | US | malicious |
4232 | svchost.exe | 23.216.77.6:80 | crl.microsoft.com | Akamai International B.V. | DE | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
msedge.b.tlu.dl.delivery.mp.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
www.bing.com |
| whitelisted |
fs.microsoft.com |
| whitelisted |
francia2028.duckdns.org |
| malicious |
crl.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
edge.microsoft.com |
| whitelisted |
devtools.azureedge.net |
| whitelisted |
Threats
PID | Process | Class | Message |
|---|---|---|---|
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
— | — | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS Query to a *.duckdns .org Domain |
— | — | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Misc activity | ET DYN_DNS DYNAMIC_DNS Query to *.duckdns. Domain |
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain |
— | — | Potentially Bad Traffic | ET DYN_DNS DYNAMIC_DNS HTTP Request to a *.duckdns .org Domain |