| URL: | https://a.beap.gemini.yahoo.com/mbclk?bv=3.0.0&es=AQAAANK_ZSF-JvIA6dmq4PyVPc69ZqRmEhQd1jgcVNkB_4pKqf9TgPmuPt-hOnVBu3snRNgt5YhVk3vJUG4HWlrO2hfy86lJ4CjgFI2TbAhcPCCJzi_U0dPJPcP7F5_0cMo4VJaGlsa-olcehBQIaorha_kbu_7XRkFCBo3bb6oaaKm-YoXfYCgn9bh2yy-VqjTlt3_jpMi0T4myhHa5FpGM9PgOf39L1-0080J-D-1ycIx9DS91qOfd1meW79yVdzzlYsJq3_FbsLpzoslV9TFN4GtzWJd7g0kArM4-EVMVbO1a4X16NqS_-2w_xYOGjavOspr_ZE0rNQraiAGgtF0R9741aReQZwvFharrdSfljR0D0YqKU5AO-tLPK2CR39tgltsWjDbuCw2sSqSJoo85V4ifVQxigCeULsp7iyBteCtw9plLtblQrD6xnmdZeJ8zXiTByukhZ_I4fN-T1tEUAdcGsZIDX4istji32E3XlrcgkqtCYl8i_JsUWCQnZEG9DbIxfKapif4BhEbMpRt8Adx5jimvEz0c5I3nbamma86hvgNJTnsYXpYyq-I6xTJgP2NWlFnDisp7-r-xj_2YNmAQxJaZSSeJujgJ2sDcTsNySsMMdhK7n0s90buM_J6tqrW5bnc_-Ruh_hy4LuXhjhC2TW10OZh3e4b2GOCVgmhBJgP-xWt6U0grH37iGZ8SV9IzK727AwnFbt9ph3HAj4QXJonWjYx5PN0WCtTE10NcQ58gkEHeCP7nJnhPPDQtSpgQgBsPmVlb3Wlxg3n-raA9o6LmhRguzvbrgo6Dh_uWm-xrX_rYcRsQACySyPQ9YRtrCLU6W2G_qoIKgrKMXtWQTsiUqGNbcsg1PhtN3lhiRcY0wPfoYqCXU8xSVYAwNW75jRn4cmi1D_nTTpoTCETvodOQs2d14K6kJpPWz1_EseD3WCL59iNEBDOfSkk5NNGo1-473LButYZdDsVFEfKuGdsyFlV3qhPcU_LOIps9fGdewTyJIB2GeslwyycMC-_ZgkeE9VFGmUImOmfB_nT7fBYT8AKdn5okLGVbk8gxSJzAYY0AD9xjKmwAT02fBUKMjxlljBDD8i1q49kpmgtEFbR1FDQtmJfJI07HaWXpnm381rSNt-CVr-FVzsgmUMAz9nFqX-jkaFgiU7M96AJ6lvPSITVxivFqhI3_tVxihYxCBDeGU8-x9VPmV2xs2UVCyLC4No1BfsL09S734pvsJAwtopF2mRgOXJU5SM2vZxMmI8HHbjz1T8AX9ylHWSMQg3hho4XFST4I82uj4UnBCGw-AP9WUWHzgz1_3IPBCYNjJYQAVoAtK5mN5LLdkaZ6wbb913_yHHGsi0_pv4bJzAsDf-yjbnn-fsU8sFHXsBITXYXoM7mDpJLbtNpaIaStKHOU6icoyNKOD4KSbEbL0GlrI8vBMoyL5Ho2fM_OZV-4cpaceRFYQPuklPvpj8dRhWRD67IxKXHhrn0rLeRtrOomUU5zAovpgq7Hd-mRwUBXtHcyX5zW0vGDaz4z3Sy37XGi6ECgGakM983pheT-sjGG-fqbasSrGLmzZHzU4PBMXzvXn64hb1luxZivedJnex-r0fyX5ksn-ODaWA-7gmPmHvprWbEUfAOOimzuMNk37qrpAd_uaCIfj3lVpCXR79ou94PgRfR6u4cwyiJU6jMwFf2rf50krph8gUMo8Q-rkXNAulkApTyJSb61IlYUu_u_5BUsg4njXd6PeRVbuPhRKPELktjthKfcVQDGe1IsX4beFEVt_kHOmFrJ6yppFgI2bYx-gBGtvF1e5lkVycowNHRyivdAKKoKCIxw8BgCCQi9EQfTaGotWv2AWMHDcPUf-y6JGuJDRAV3WB4ppFwPXXN0XfBUENjzibgqUII7apjP6hZRwCP4vg_5dswfBQJwofQgl9qfN3U2gYA840Eui2cHcikgYDwOqyvoA2FmpZnDV1tjwHpSoGmbHd9xslWet_9kriX7XFDcuiBrqXCD3cFEso4dQz3izfU2nifrcZPuX43zMDeMWkxbZmEGAldNdkeH4QakfqzfnzRpyT9lzGtFL9Xodg-RHiQjGxeEFgb50X9ctSnOUXkeyN0sDUlTFrbay8tzLFNPtrEERt_XKzrtqjd9zaSCbVMXd1oWH31beGPHZM3atOwpZXUIOwNJc1N6CalHB_5cbBrIEM73LEa_GY0-73y2_SUTs_7A6cNkvV01Zl_5a5Vgjwzzj1sXefu_Ogd7mdW8ocq1Iy9eTZdQs40tvfFE6MKwpqFV4vNceiDPVyH9rsuYEZezDiDjcWi8dkFHMogmeiZXuVCySoKUNn6zPl8N_XqbwiNQl5qDY5IXgdaURlsp8kYWgIxvM3FF6J81mjPBueXy-7V9a9CaAZ1mK9KbiyNZqgI2rcPbR84CJyU0djpnsscgmAun53NvmaQd4olLphvdn8S8UMvnr9xKKui6jPKMs9u-lk2ha_p65MZvzza7yA_87DBA1b2lBAuxL5NUVnTRut0OY7n0DweyQABP8X-7kimXuey4y1fhCe9iUyymAgn9IlpaWfjy1Pel7CJqbg7ZY41h1tUxgdVoF5WVF_QTICLt__14JkyZBE-1Ir-nOCaFPeXJEYgm4FczDo1ctDrdwxAy94UU0aMqhgKtZW6uGi3iFsembIbiiEDSjbMuHiJzlHaZxGd97pWKBys6sfyFKYRsuhoSEeMY1IIxyCKhr93VZxxVstNlkecE_SukeqPPJIEc7xBObESf59EO8p4ZlH64YsJJx03bOh4Zi1v0hyY7ntIWF3Z9TNTQ27oJ-eAMgXehPhjHWgnGP9g_enKguIEfX2fiXYaAEir7YAsoyhweza44jrEMlysSk-xq1neOn4ewcusxzLyBXKlm4R9mx0C2Q23M0ewTTJx6UEfunkG80SNXk4Wdz1QJMl9uekwnX9lYe41h4KG3jJsa4KCLxd0J7-qGaDG26rDWRCrUe3pfOANlC2CGFcVKGB54Z6wGvttHgesN8Ep5L-u8OOR1-Gnd113B4k1IEQHoiJo1tonrY_eSFvFITQk9opVNAGeUu0PG9_y1yUovmJP43CXakQKQHA0Mmjow55eov8P-qhDmgD40U6coT1wYbolB_5yDy7w1IXUXgzdvIUFLFNy_49V9tYeN5q1OjfWL6EwAYegwwQXXAFsiwaitVqa0tCXNdTKjhYweU4mOJqIUEukzJRwg4V0pveViNDgRKlGYMtWGO80EVNISG5XXcsxPrvzavgi_dNuC5ExvmwF2nI8kqBWclKT7i3uF-59xre8h4QaE865jfNPn67DhItMzuTbmgdtlvAygxho0FADdbuhYfrdTZJuSJKwLwJRWl6xPFt3v6J0qvlVMoyjdSZwFPwCb25xdnzqrvtpUifVs3SzJVVMZG3chEkv1oFRe8s_oYGQKQhMOAqPOaAZUspFSUN9ySkyOOttVfAizVcy34fh_jlTBb0Q_YPDUMs495YvMWMWWSFzsXZmRo0beY5xfh4pCwXd-RD_GnNe42it3BU23-C9etMuTmvamjCo8xR0U5fiQIMWYCMH1pM9AhKZGK4rPLbaVm0yGRnJzWHXicjCG_c-WY1Dm79aL0CsaT5Lr30ietCfi8hDNVVCRKnxxc_0M |
| Full analysis: | https://app.any.run/tasks/82f23232-6995-4090-84ff-a3ecb0b84348 |
| Verdict: | Malicious activity |
| Analysis date: | May 02, 2024, 16:55:12 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Indicators: | |
| MD5: | 81C1E7F5606DC7A0F75944D5A3A53FDB |
| SHA1: | C2CDB595BF237A8CD4BAED9812E776A0E8FBBEC9 |
| SHA256: | D844A540B2FEEB941DC280B84E9CB6EFC4D217B23FB7460A021AC31D295F6CD6 |
| SSDEEP: | 96:BIG12IrDIOCtYOuW/1jh4LsBBfdNN+67Ph/pEjwE2wEiIZFY0:BIG1RBCtf/1t4LMdf+6PE2wRIDT |
MALICIOUS
No malicious indicators.SUSPICIOUS
No suspicious indicators.INFO
Checks supported languages
- wmpnscfg.exe (PID: 1596)
Reads the computer name
- wmpnscfg.exe (PID: 1596)
Manual execution by a user
- wmpnscfg.exe (PID: 1596)
Application launched itself
- msedge.exe (PID: 3976)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
Total processes
52
Monitored processes
21
Malicious processes
0
Suspicious processes
0
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 112 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1280 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 316 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --first-renderer-process --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 524 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2240 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 676 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4032 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1212 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1384 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:2 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1332 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=3208 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1344 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4044 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1596 | "C:\Program Files\Windows Media Player\wmpnscfg.exe" | C:\Program Files\Windows Media Player\wmpnscfg.exe | — | explorer.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Media Player Network Sharing Service Configuration Application Exit code: 0 Version: 12.0.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1948 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=renderer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3276 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:1 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Version: 109.0.1518.115 Modules
| |||||||||||||||
| 1976 | "C:\Program Files\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4016 --field-trial-handle=1248,i,12563438504894062406,7155727255082959443,131072 /prefetch:8 | C:\Program Files\Microsoft\Edge\Application\msedge.exe | — | msedge.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: LOW Description: Microsoft Edge Exit code: 0 Version: 109.0.1518.115 Modules
| |||||||||||||||
Total events
3 341
Read events
3 302
Write events
33
Delete events
6
Modification events
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | failed_count |
Value: 0 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 2 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\ThirdParty |
| Operation: | write | Name: | StatusCodes |
Value: 01000000 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\BLBeacon |
| Operation: | write | Name: | state |
Value: 1 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\EdgeUpdate\ClientState\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} |
| Operation: | write | Name: | dr |
Value: 1 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge\StabilityMetrics |
| Operation: | write | Name: | user_experience_metrics.stability.exited_cleanly |
Value: 0 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\LastWasDefault |
| Operation: | write | Name: | S-1-5-21-1302019708-1500728564-335382590-1000 |
Value: 61798FC011762F00 | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EdgeUpdate\ClientStateMedium\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\FirstNotDefault |
| Operation: | delete value | Name: | S-1-5-21-1302019708-1500728564-335382590-1000 |
Value: | |||
| (PID) Process: | (3976) msedge.exe | Key: | HKEY_CURRENT_USER\Software\Microsoft\Edge |
| Operation: | write | Name: | UsageStatsInSample |
Value: 1 | |||
Executable files
0
Suspicious files
43
Text files
45
Unknown types
11
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\c1d58f68-c546-4a8f-b60a-161b51058af3.tmp | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old~RF104cab.TMP | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\commerce_subscription_db\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF104ce9.TMP | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgePushStorageWithConnectTokenAndKey\LOG.old~RF104cf9.TMP | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old~RF104dc4.TMP | — | |
MD5:— | SHA256:— | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Default\LOG.old | — | |
MD5:— | SHA256:— | |||
| 4000 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics.pma | binary | |
MD5:C612E96CBFAC63232FC2062E15600FB1 | SHA256:DB3C05D5EC0B6719A73E7F0BE84BCE9342772DA70567E7CE08CF6573480B38FF | |||
| 3976 | msedge.exe | C:\Users\admin\AppData\Local\Microsoft\Edge\User Data\Variations | binary | |
MD5:961E3604F228B0D10541EBF921500C86 | SHA256:F7B24F2EB3D5EB0550527490395D2F61C3D2FE74BB9CB345197DAD81B58B5FED | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
24
DNS requests
26
Threats
0
HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
— | — | 224.0.0.252:5355 | — | — | — | unknown |
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
2032 | msedge.exe | 13.107.42.16:443 | config.edge.skype.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
2032 | msedge.exe | 52.30.138.181:443 | a.beap.gemini.yahoo.com | AMAZON-02 | IE | unknown |
3976 | msedge.exe | 239.255.255.250:1900 | — | — | — | unknown |
2032 | msedge.exe | 204.79.197.239:443 | edge.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | unknown |
2032 | msedge.exe | 151.101.65.44:443 | api.taboola.com | FASTLY | US | unknown |
2032 | msedge.exe | 154.38.187.105:443 | datintus.pro | COGENT-174 | US | unknown |
2032 | msedge.exe | 172.217.16.138:443 | fonts.googleapis.com | GOOGLE | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
config.edge.skype.com |
| whitelisted |
a.beap.gemini.yahoo.com |
| unknown |
edge.microsoft.com |
| whitelisted |
api.taboola.com |
| whitelisted |
datintus.pro |
| unknown |
fonts.googleapis.com |
| whitelisted |
headlinesnews.online |
| malicious |
fonts.gstatic.com |
| whitelisted |
secure.gravatar.com |
| whitelisted |
www.bing.com |
| whitelisted |