hxxps://mail[.]onelink[.]me/107872968?pid=nativeplacement&c=US_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature&af_sub1=Acquisition&af_sub2=US_YMktg&af_sub3=&af_sub4=100002039&af_sub5=C01_Email_Static_&af_ios_store_cpp=0c38e4b0-a27e-40f9-a211-f4e2de32ab91&af_android_url=hxxps://play[.]google[.]com/store/apps/details?id=com[.]yahoo[.]mobile[.]client[.]android[.]mail&listing=search_organize_conquer

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mail.onelink.me/107872968?pid=nativeplacement&c=US_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature&af_sub1=Acquisition&af_sub2=US_YMktg&af_sub3=&af_sub4=100002039&af_sub5=C01_Email_Static_&af_ios_store_cpp=0c38e4b0-a27e-40f9-a211-f4e2de32ab91&af_android_url=https://play.google.com/store/apps/details?id=com.yahoo.mobile.client.android.mail&listing=search_organize_conquer
Sample260804-p4ymas1cph

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303216301967517"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{8574DB23-2139-45CB-A2F3-EC3023C03914}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 4092	4524	msedge.exe	85
PID 4524 wrote to memory of 4712	4524	msedge.exe	87
PID 4524 wrote to memory of 4360	4524	msedge.exe	88
PID 4524 wrote to memory of 4360	4524	msedge.exe	88
PID 4524 wrote to memory of 4360	4524	msedge.exe	88
PID 4524 wrote to memory of 4236	4524	msedge.exe	89
PID 4524 wrote to memory of 4236	4524	msedge.exe	89
PID 4524 wrote to memory of 3468	4524	msedge.exe	90
PID 4524 wrote to memory of 3468	4524	msedge.exe	90
PID 4524 wrote to memory of 3468	4524	msedge.exe	90
PID 4524 wrote to memory of 4148	4524	msedge.exe	91
PID 4524 wrote to memory of 4148	4524	msedge.exe	91
PID 4524 wrote to memory of 4148	4524	msedge.exe	91
PID 4524 wrote to memory of 3184	4524	msedge.exe	92
PID 4524 wrote to memory of 2316	4524	msedge.exe	93
PID 4524 wrote to memory of 3184	4524	msedge.exe	92
PID 4524 wrote to memory of 3184	4524	msedge.exe	92
PID 4524 wrote to memory of 2316	4524	msedge.exe	93
PID 4524 wrote to memory of 2316	4524	msedge.exe	93
PID 4524 wrote to memory of 3268	4524	msedge.exe	99
PID 4524 wrote to memory of 3268	4524	msedge.exe	99
PID 4524 wrote to memory of 3268	4524	msedge.exe	99
PID 4524 wrote to memory of 3968	4524	msedge.exe	100
PID 4524 wrote to memory of 3968	4524	msedge.exe	100
PID 4524 wrote to memory of 1256	4524	msedge.exe	101
PID 4524 wrote to memory of 1256	4524	msedge.exe	101
PID 4524 wrote to memory of 3316	4524	msedge.exe	103
PID 4524 wrote to memory of 204	4524	msedge.exe	109
PID 4524 wrote to memory of 2820	4524	msedge.exe	110
PID 4524 wrote to memory of 4224	4524	msedge.exe	111
PID 4524 wrote to memory of 2368	4524	msedge.exe	124
PID 4524 wrote to memory of 2368	4524	msedge.exe	124
PID 4524 wrote to memory of 3460	4524	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mail.onelink.me/107872968?pid=nativeplacement&c=US_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature&af_sub1=Acquisition&af_sub2=US_YMktg&af_sub3=&af_sub4=100002039&af_sub5=C01_Email_Static_&af_ios_store_cpp=0c38e4b0-a27e-40f9-a211-f4e2de32ab91&af_android_url=https://play.google.com/store/apps/details?id=com.yahoo.mobile.client.android.mail&listing=search_organize_conquer
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,6199612566870282554,6607317378705452353,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,2681416559847340409,1455034993730806380,262144 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,17989333146901893007,16979579691083182624,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,7380270490476501327,3410166030881008627,2097152 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,17725931731163786333,2426053063468549809,2097152 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,8764217260731267271,12113023008570306727,2097152 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,577678725892226814,7127927548316714895,2097152 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5028,i,13512114858351374646,4460787253746223888,2097152 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3688,i,14719741311692011596,11939248569620636804,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,16464062685021149171,11290929468512806581,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,5518802514473988699,4597966326804335809,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,5518802514473988699,4597966326804335809,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,1134024611252044969,15339128967201364050,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,12481017277605786161,10863266616740215635,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4244,i,3890829508047864570,15548379030188424327,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,1841067532180585304,2675439537672828446,524288 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3660,i,14293026949523305038,5049088649245046611,262144 --field-trial-handle=2232,i,4444595807363087304,10850774404454647856,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 95e930f4888eb9c6e18f514756a153bd5a5c104ab0335efe4ebfcac4f6195941
MD5 ca4126b8f311bd3c900f5c4c9a704722
SHA1 c506525b0b8ed80acbf70fd27cc1fe892498b0d4
SHA512 b93d462e1c5f216011648991c4c36b3a3a5d305335dedc76be3b9756cd52037cf44986b522925793ca9410c4055ccb81b052fb705fc25ec2208bf93cabbacefe
TLSH
T10671B4710A9312B1EF14863294DD025C3677C5F7FA2B6E8990804933B61631EF3249AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5885d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5885d5.TMP
Size 3KB
SHA256 3811177601d2595892943bc2f207580ae02a67028ec5d4e2589b5a657645ec6a
MD5 b7bf34af31cb059b307ecda66b7e7f3d
SHA1 34950fbde1fdc403c7910452d6c6e5ad7b4512eb
SHA512 a702b323f4955f862cc011cd2935f7f19d90989be56d065d28b8580bce2f2c45bfabad29957568e7971cd691d525e11502e832a7caa716437d851f363f1aac31
TLSH
T12261A5750A9312B1EF14C63294DD025D3777C6F7FA1B6E8990805A33761231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7b3ddd88b9372d1364a8ea3f38d7928f2c2150ee31922f717bb0682cc9069f55
MD5 b960c0f03b027ec4139145df31491196
SHA1 4e922ca39d82f9da8b860723553d4f652935c971
SHA512 77cd7ddb65b2b60791bd2cfd8617c3131c840dfe9b90ea1376e1e1df700ba38ad6daf6203efd392c9d5e3280a1849025c2f964cb68109147a8078567283b3e97
TLSH
T1D631ABF783B5956E8E1152F0AA24AE1FCF5C0611836C7D79C9D0BE2793F3461E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2cbf17bde4ae0012d5ef4993b22776bbef5e0d16efa884fa03bcde2516b5eae4
MD5 c15e0eb1b4c3f4259f10f208b356cd94
SHA1 ed0dc44ae3caa0e39b355c6ab8ce533ab3f3cfd8
SHA512 57884dda2d873d7c7baf858e968d0dc9bbea08123410f6cf0e8314199635499702db73e558af924231e945632a43b210584e4a474ea76526a44e67a880cdc46c
TLSH
T13B2178F783B5956E8A1142F0AA24EE2FDF5C0611476C7D79CAD0BE2783E3462E101B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ada8661bf2540f01603a21541345ce5e350af9eea32ffe6ba5251d55b8932f0e
MD5 061b81307a4f6421319178b0b5705eaa
SHA1 6e369b79dbbb0672d00d5bc3fe149620b0d1419c
SHA512 ee6ca2c45132d957d8f92c960caf373622bcbfcc031348c434a5e501aaa7e7d4a50158358570b30d0c09fc8702bc1630d7aec7d66ad98b54d3db221045724e19
SSDEEP 192:sxZnR9yM/jK1Ml8UQRk6/fU4sFyrVwIdpWznHW6+WNnEi/YvtkjY/Ig5PJ:sxZnLqi6/ffsFybcHbV/v6j
TLSH
T1D052F911AA345977CCDBD20DFA41BF93E6F5557292900E44AAFCDA1C00E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4980f60387313e9c2c03dbada989dc6c564e0379458a563c6cf6f5c812f21241
MD5 e47a779270dbaa0660b8e11cbfab3eae
SHA1 ed93ffa62b7c5b1e823eeb8e55c61fb6e16d028b
SHA512 b4665af967c0a41062d43f16025a578fc1f82936c8090d687d7167d6176c3d2e8e937612ba51146b804d428728515371c84b18bab5e83ba55dd039620d90b235
SSDEEP 192:sxZnR9yM/jK1Ml8Mk6/fU4snWrVwIdpAznHW6+WNnEi/YvOaNjY/IgrJ:sxZnLM6/ffsnWb6HbV/J069
TLSH
T1E55209116A34A977CCDBD20DFA45BF93D6F51572A2900E549AFCDA1C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d02db38eea2efc691512d1573554702e44ac2086abe5e8dd12186b25a83155a6
MD5 5a22021f648228f7fbe2e78053821210
SHA1 133935d56cfe2e706d2335cdbbe43c0a268b310a
SHA512 069bc40d7c614a9f4e3cff8d91d15973e36a05fb0979d47d2680c8d528a606c205cd5bd3b4af9359ad9bd3fd685b6315022b31dfd6fed6d3d699cd2a92d6e2e0
SSDEEP 768:46seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp/roHU2:46seJ3xWvhfynu1jaVcL88ps02
TLSH
T172D20B2B680CCB7E4F844E5DEC2A6F966EE801CB57984D5487FA880C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8cc93b025abd469970a55759027c0ab973c4821a100730d58bc316ad39ea0c52
MD5 5bee9e586316e5262e2082b45d6f2d33
SHA1 f6b4e272f11828e321e0e54753dbc7e6af915508
SHA512 d514272b0578646a6f1f36795e59217ae9d4f1d27d9dccd0c712e5285051626f223ffc73e22a340291dfafe2173a497754b4e5fe775a16d10e2b3342553b51df
SSDEEP 48:KYHIhKggkXySdIxK+cMjyR8ILKRKsjyJz:KYH+KggmBd+K+ciS8IKRKCKz
TLSH
T139915302747E02023D7E298CA6D1A6364E4271A37458A5AFFFB840612E67E150FFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

746926fc-c07e-4ffe-a5c7-0fd29409ce73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\746926fc-c07e-4ffe-a5c7-0fd29409ce73.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 7e1aa8f719261917162d097687ab67d802d1895cfb66e4ed9043b7755d07449f
MD5 0e9c239ba19d86d75e951a236fb74882
SHA1 a6a2d966b71c76fb31a3e9adf57d3e2a7014f9cd
SHA512 2e092a79dbedf06af86058868e5d494bfc4ef90024665b648abb3e32b6b0723c0124e36f778834797dd9f7abd9618dec1580a2fb593485fd1013904140485ce1
SSDEEP 192:umm+xasuheOwQxMGsNEjQnbM7TFlBQmiU19HRZ4MTobWCIK++Wyifq8z1Sq52hYy:AZcIhsNEjuo7TrfrxGzFIKPlWp2j
TLSH
T1B1627CB2AC689C7A98B7F145F58A33134EF4912BA2C49B50E5DC7F2D01DA5AC130791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 d88afb4606fac7b06bf99a711f34978502b90121918779ae0967093eccdb90fb
MD5 a5aa903ec87454d602d900143e23b66c
SHA1 203347ae33d591df5bd56fd846ae6b1608bb1d1e
SHA512 15c9a55789903c00ee1bf80fad19158206e1a9af4aa5ec8f55157487f45e79fd12a43edd99454a69911eb89ce700cdb9beb77d85eb0ed93023dd2093c1482ef9
SSDEEP 192:uNm+xasuheOwQxMGsNEuQnbM7TFlBQmiU19HRZ4MTobWCIK++Wyifq8z1Sq52hYy:jZcIhsNEuuo7TrfrxGzFIKPlWp2j
TLSH
T10C626CB2AC689C7A98B7F145F58A33134EF4912BA2C49B50E5EC7F2D01DA5AC130791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 301a76b2abbf58fdf103f7c707ee97fc9a49c825d03e3b220b15e50eff6c7852
MD5 2a49e86c18ad54bbdca7f27addcc4a09
SHA1 24b5c6eeda25a701b15f7f7770477028ba870313
SHA512 6c79a3b6dfd2d0b34efb29ebb7a103fb69090337e193c4a63519f246a4673c845ac76555263ea668d96a17e7b1b92330f6370bffb04935a2831a9e0c71c14758
SSDEEP 384:JiFiZcI8zsNM8TUNTUlIluuo7TrfrjGzFIKPl2p2j:gFQANwgW3TsFxl2p2j
TLSH
T141B21AF258D7883AD8AEA747E77D2E024EFCD167B5809650B3C8691CCC961BFC306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e8b175c70e54d42da16ddebb6636686198e2574d78b20b49d8793c46928c30a3
MD5 7c160e1cf75680827d307f9e1589499f
SHA1 1ff89945e7d433c856229c0609769f8fd6ba5742
SHA512 5149c40851651c1dd4eb1dc4256914c0f29269126d503bfa4f57523491d730c9a688ff55b873cb2c8a5302bd6835566de5196d20a1811d035a959ae5fa044940
SSDEEP 192:lONG6vMtPQmiUy2jThTobWCIKp847nLU/u:lONG6UtRxTiFIKRLU/u
TLSH
T103020875BC786C7B9AA3BE45F58E27171FE421AFA5905B50EAE82F1C00D765C2303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 12f3e5c12f55a570341bd531fefe4b5786865b04f4254a89f9178d920d2f56e3
MD5 73fd1edf79d28b8f9ad8316d4dac1918
SHA1 4316c818f816f655c5fd0cf9aefe14263869e0e2
SHA512 a6a17f1509efa779f298e32a3387e16df8deb0173cb018da062b306e5139ecd2e1878bbccb20fba6827d4bdeeb93709f981a7bb787361b56b21aacf36c35e265
SSDEEP 192:yON16vMnPQmiUybUjShTobWCIK++Wyifu80ISq5U/u:yON16UnRyISiFIKPl2pU/u
TLSH
T188121B72BC649C6B5DA3B155F48E32171EB0926BD6849B50EADC3F2C01DF56C2307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b84c4d49-0be7-4e2f-9e06-d8f85a291e6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b84c4d49-0be7-4e2f-9e06-d8f85a291e6f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7d8f7475798b2aff1b256cb1cddc4899682cd37cb399dd7dadd459f7330fda49
MD5 f643ab8fa94195acb4116b51d8997737
SHA1 5534b3065c247882867175e9344a9339c0cb9934
SHA512 4cda585bed9fbb76968628ab464f0d85504683090d8814518cf68ecb3caed3c24a279bfb9ccee864d1e3f41d31902d23e32041ad4913636c4d1cf3823036fe62
TLSH
T17841F859B6F91148B3B77F5A9BF7A86D487BBD372E0A955E00110E4E0A23B00C871777
MD5 SHA1 SHA512 TLSH

Submit Download