hxxps://atlas-prod[.]auth0[.]veradigm[.]com/u/reset-verify?ticket=qzN6JPlBePW9kNt4wqHcC80F8imy6KTO

Analysis

user interaction
yes
max time kernel
4s
max time network
6s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 15:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://atlas-prod.auth0.veradigm.com/u/reset-verify?ticket=qzN6JPlBePW9kNt4wqHcC80F8imy6KTO
Sample261102-s528navve1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
620	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe
3680	msedge.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4560	3680	msedge.exe	84
PID 3680 wrote to memory of 620	3680	msedge.exe	85
PID 3680 wrote to memory of 376	3680	msedge.exe	86
PID 3680 wrote to memory of 376	3680	msedge.exe	86
PID 3680 wrote to memory of 376	3680	msedge.exe	86
PID 3680 wrote to memory of 3464	3680	msedge.exe	87
PID 3680 wrote to memory of 3464	3680	msedge.exe	87
PID 3680 wrote to memory of 2564	3680	msedge.exe	89
PID 3680 wrote to memory of 2736	3680	msedge.exe	90
PID 3680 wrote to memory of 2564	3680	msedge.exe	89
PID 3680 wrote to memory of 2564	3680	msedge.exe	89
PID 3680 wrote to memory of 2736	3680	msedge.exe	90
PID 3680 wrote to memory of 2736	3680	msedge.exe	90
PID 3680 wrote to memory of 3988	3680	msedge.exe	95
PID 3680 wrote to memory of 3988	3680	msedge.exe	95
PID 3680 wrote to memory of 1240	3680	msedge.exe	96
PID 3680 wrote to memory of 1240	3680	msedge.exe	96

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://atlas-prod.auth0.veradigm.com/u/reset-verify?ticket=qzN6JPlBePW9kNt4wqHcC80F8imy6KTO
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffd0e73c188,0x7ffd0e73c194,0x7ffd0e73c1a0
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,809126345975686324,7634001222732949025,524288 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:3
  2⤵
  - System Time Discovery
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,6924433186100379072,2089296983577140586,262144 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:2
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,8960498798630742531,7447836255848798356,524288 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,1245791809177614267,5297851010623559751,2097152 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,6011412821387786249,12795610564637628694,2097152 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,7356037497656203491,2416277352813408634,524288 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,15474111076947067302,11508817823514212382,524288 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,10774599897717811214,3452415356885184699,524288 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,10774599897717811214,3452415356885184699,524288 --field-trial-handle=2452,i,5265291637476197987,9094551759800152497,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2029ca93-3b69-4b73-b380-e4ba5c9f498d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2029ca93-3b69-4b73-b380-e4ba5c9f498d.tmp
Size 25KB
SHA256 5c8bea711f62d2ab36f0f9ba302d90b5ec5ec27461602ef9e833f351781fee17
MD5 d6b4efb8208a6b6870aee3b055f094bd
SHA1 6d6e4378da1cbb84ebf7615926d048575edc39db
SHA512 b76fc2488b7a70c6739acd56484ea9f3bb8157e4c28e86f6e0b366d85a1e3c60145b57144d6bc910c12a6baed40b730951a6d46bb86557f79aacebceb5f9df50
SSDEEP 384:n8iFiZcI63sN08TUNTUlIm25mg5anK2fMBVvrWfVp/sa+VYWzgL/7Iz/oB:nFQ63FwgSBQBVEp/hgLK
TLSH
T18BC24A76DC98D9BBECEB8FD5A78A7A03DEF01163859C8AC4DAD95D1D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

88665e35-9433-4e13-bbb3-0bdadcdcdf66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88665e35-9433-4e13-bbb3-0bdadcdcdf66.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d95f4e56-f9af-4009-9893-350ab20a1a32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d95f4e56-f9af-4009-9893-350ab20a1a32.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

ec3df359-1f35-49e8-8d4b-3344a19406e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec3df359-1f35-49e8-8d4b-3344a19406e3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 6e36c8976ad61c9cb4fc0a703faeb4caf5712de6906f7f55100ebc20c996edef
MD5 8edda3f367b7d8b9d328c1cc57c16b66
SHA1 ccbd694244613dbe0ec3db7dc22becc8bf87d9c1
SHA512 4620b95b7a534a9392ab19a7903f3764246ae1d044458bd1f209421e0e47e657d0e32a18c894e95f57ac62139e07149d078eee41815edbd87ff07271fd68df4c
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXE7vI:OtfFvpopPxrB4RhfEzI
TLSH
T1B9B2271571BA021038FE790881B5972F464232B33259EA3B7FBD14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fa7e28fc-734d-449e-a9f2-feaebdf1632a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa7e28fc-734d-449e-a9f2-feaebdf1632a.tmp
Size 26KB
SHA256 0553cb874759dc45eafc63ef135b64998b43aac2a346008309e099bb97660c08
MD5 8ce56336a07d8f4f761ff0d9fd0ef1fb
SHA1 4c251d49e58e99d8ab311baa63dca5277c98d483
SHA512 b52ece1f3a36ab3218eff45f09caad3c01ccccc14260f367eec0facbb7611f85e8f5e3e6b6a7cd5ce7a7496780f1bf736fc5cea2e66f23e24616771691f3d8f9
SSDEEP 384:nCiFiZcI63sNx8TUNTUlIm25mg5WFK2fMBVvrWfs5pZRsa+VYWzgL/7Iz/oB:JFQ634wgSHOBVBpDhgLK
TLSH
T138C23972EC98D9BBECEB8BE5A74A7A03DDF04153858C8AC4D6D95D1D009B19D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 efb2d0e9e9cdfda2e762b147fa72dc85ece64107e6d7ccc89a137cdb0459de58
MD5 6d1d4671a30a49629b707a658bd08965
SHA1 2d72d99089c83f720e8eb9ab7ab371dd0c5f228e
SHA512 618bc40e0435fa2fc1f4312ee082c63fe72b244d7149a59d20c6414175c50011e6ae0017c07c847d1c22768566cc5920efcd480870b080b581200cbe78d41692
TLSH
T14F412A5CB6E91144B3B77E5AABF7A86E487B7D732E0BD55D00110E4F0622A01C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads