hxxps://mail[.]onelink[.]me/107872968?pid=nativeplacement&c=US_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature&af_sub1=Acquisition&af_sub2=US_YMktg&af_sub3=&af_sub4=100002039&af_sub5=C01_Email_Static_&af_ios_store_cpp=0c38e4b0-a27e-40f9-a211-f4e2de32ab91&af_android_url=hxxps://play[.]google[.]com/store/apps/details?id=com[.]yahoo[.]mobile[.]client[.]android[.]mail&listing=search_organize_conquer

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mail.onelink.me/107872968?pid=nativeplacement&c=US_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature&af_sub1=Acquisition&af_sub2=US_YMktg&af_sub3=&af_sub4=100002039&af_sub5=C01_Email_Static_&af_ios_store_cpp=0c38e4b0-a27e-40f9-a211-f4e2de32ab91&af_android_url=https://play.google.com/store/apps/details?id=com.yahoo.mobile.client.android.mail&listing=search_organize_conquer
Sample260818-brkm1styex

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
592	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314897959233603"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{111848FC-7C92-4DA7-A8E8-27163AC642D6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3300	msedge.exe
3300	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe
2408	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2408 wrote to memory of 2676	2408	msedge.exe	87
PID 2408 wrote to memory of 592	2408	msedge.exe	88
PID 2408 wrote to memory of 5056	2408	msedge.exe	89
PID 2408 wrote to memory of 5056	2408	msedge.exe	89
PID 2408 wrote to memory of 5056	2408	msedge.exe	89
PID 2408 wrote to memory of 1364	2408	msedge.exe	90
PID 2408 wrote to memory of 1364	2408	msedge.exe	90
PID 2408 wrote to memory of 4736	2408	msedge.exe	91
PID 2408 wrote to memory of 4736	2408	msedge.exe	91
PID 2408 wrote to memory of 4736	2408	msedge.exe	91
PID 2408 wrote to memory of 988	2408	msedge.exe	92
PID 2408 wrote to memory of 988	2408	msedge.exe	92
PID 2408 wrote to memory of 988	2408	msedge.exe	92
PID 2408 wrote to memory of 3928	2408	msedge.exe	94
PID 2408 wrote to memory of 3936	2408	msedge.exe	95
PID 2408 wrote to memory of 3928	2408	msedge.exe	94
PID 2408 wrote to memory of 3928	2408	msedge.exe	94
PID 2408 wrote to memory of 3936	2408	msedge.exe	95
PID 2408 wrote to memory of 3936	2408	msedge.exe	95
PID 2408 wrote to memory of 4116	2408	msedge.exe	99
PID 2408 wrote to memory of 4116	2408	msedge.exe	99
PID 2408 wrote to memory of 4116	2408	msedge.exe	99
PID 2408 wrote to memory of 4212	2408	msedge.exe	100
PID 2408 wrote to memory of 4212	2408	msedge.exe	100
PID 2408 wrote to memory of 964	2408	msedge.exe	101
PID 2408 wrote to memory of 964	2408	msedge.exe	101
PID 2408 wrote to memory of 4292	2408	msedge.exe	103
PID 2408 wrote to memory of 4920	2408	msedge.exe	104
PID 2408 wrote to memory of 4920	2408	msedge.exe	104
PID 2408 wrote to memory of 4920	2408	msedge.exe	104
PID 2408 wrote to memory of 5048	2408	msedge.exe	114
PID 2408 wrote to memory of 4108	2408	msedge.exe	115
PID 2408 wrote to memory of 2752	2408	msedge.exe	116
PID 2408 wrote to memory of 4620	2408	msedge.exe	118
PID 2408 wrote to memory of 4620	2408	msedge.exe	118
PID 2408 wrote to memory of 2020	2408	msedge.exe	119
PID 2408 wrote to memory of 2020	2408	msedge.exe	119
PID 2408 wrote to memory of 3300	2408	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mail.onelink.me/107872968?pid=nativeplacement&c=US_Acquisition_YMktg_315_SearchOrgConquer_EmailSignature&af_sub1=Acquisition&af_sub2=US_YMktg&af_sub3=&af_sub4=100002039&af_sub5=C01_Email_Static_&af_ios_store_cpp=0c38e4b0-a27e-40f9-a211-f4e2de32ab91&af_android_url=https://play.google.com/store/apps/details?id=com.yahoo.mobile.client.android.mail&listing=search_organize_conquer
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,14398183474772059904,12546634881649623706,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,10791131828926782310,14871149403268694632,262144 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,4427612548176011003,17217592799715105093,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,5856546772228736708,4022948990609346291,2097152 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,1476311022069794609,7551473857444577101,2097152 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,8544202777125720418,265416721000942718,2097152 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,627858524945263896,15460802580706752784,2097152 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5116,i,14680865352795077829,18156142285037514628,2097152 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,12553721415542065175,12865483988159018286,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,13368981835587740214,7969962853243160937,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,12689147890615506939,18205575823495092265,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,12689147890615506939,18205575823495092265,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6212,i,11195576212610677502,10010606651499064350,2097152 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,418767251157136676,14905793139360123303,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,5910169836498586606,13459549207352617616,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,14788685228963468903,1712653234819517228,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,14775754288628378798,15581148668697293143,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,16827226696867987400,18435147393857678218,524288 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,15555940251752394038,8763546228251697312,262144 --field-trial-handle=2220,i,15228242158054558249,10536596214400604876,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 116KB
SHA256 e4abdcfecd4d727eab8ef8c326b637db7541f360aabc4e055b9a473ca7ad42a3
MD5 19a4622d53b3447dd65d0f8bfc530aec
SHA1 8041be83379390e42078e58e75e3faba90dceeb4
SHA512 388c07227f717e29ad57cae893f5aadf50c13fa498bab4933b5ec87d444948e18ed917acb3e19bcba7dca781fe6bec073f6f74a442dd400883cf6d577ffc1301
SSDEEP 3072:BqhBFjgunwCQCNSVJGgbEGNvlHrfOrLZ85XFZe:BqNDeQ85/NvlLWR8vw
TLSH
T18DC302A2BB110432C978063885D6138C62EBED71E20FA353BA9EDCA7E6D77C54DB1251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e64c91f87c3d8852bf383e1c4f463fd59b7613b3da2c1445a279943cde771735
MD5 10c747b42edb0fad3ac571b4d32328c6
SHA1 17dffd7c626593aeb1c9dfc4cc5b48e9b19ee6dc
SHA512 287410d9b20a7e940fe52385a5b443747871f23f8b4c9d1a5ee878b124f51d091248d5ce6b728d174e04a49fb4fa40e5bceaaa910e4ab822b5b2820bb4fcf7ab
TLSH
T13B718FFD2A6151ABF354C1BA64F2C20439F195E8F44FCEC9BD684D702517BA0C269BD8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fab7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fab7.TMP
Size 3KB
SHA256 2c47bc944762188e990fb4aaae0f7a30155c62b35fc15274aaa24f0afa4bdaa5
MD5 f5dd4ba76da12b0ce808ca74e7b81d76
SHA1 f6146f8701b2a613912f964cf570d69e4e611c94
SHA512 af28a46f49b4b6fa9c1de268102f3da76249b976e72e883579f5f400aca46d836e55ae2055f00092f487b618eb69b3653d9de83f39f78deca077417896cd236f
TLSH
T14E714CFD2A52419FF354C2BA40F2C10479F195E8F41FCECABDA05C302A56FA5C269B98
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1459f660f9f2744bfda1350ea27bad477e03db152871f660f448c0c18b5f1ea0
MD5 a9e5f00270ab01c6a67505e0cace77a4
SHA1 663979abda9479f1af30e1255654ed108c55674d
SHA512 bf8a6726610847960c29e3f7b4204ebc99cfb12db55864e786c1c3a2ae72db78b20e1025cca29b6f5094bf082b8ef0d9e50219b6eb7ed30935b53ca7e59de4b6
TLSH
T1EE819FF783F5852D8A2652F0DA24BE1BDF5D0921832C7D798DD57E0793E2461E201A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1943349858379579448a278deec27eaaf11c5d6050f2f9f684e7fe5f14d5f63e
MD5 2fe2035c9c117bca2439f7cc9b729a05
SHA1 40b64205327427b3266a916c07b439b4cf33bb3b
SHA512 fea80138e1d3b3aba040e3b1afc821579f2d52bce9072e48e93089b0a0002e21570a899ff7859bf3251c162a4be5a1e7ccd8042585cd10f95fe2471a112aacc0
SSDEEP 192:sxZpRYyM/jK1Ml8Mks/fWslECOmIdpAqGHW6+WNG9j/YCdJaxrIgrJ:sxZpaMs/fWsmCOHEHbs/ap9
TLSH
T1E952E9116A38A9B7CCDBE209F945BF53D6F9057296940D44AEFCCA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5ce91e434e47aa4d020049fa778830afa75cc39f5ab886180ee07cf0be7030f4
MD5 4901b0096fea53fea9204007c24ec1eb
SHA1 bed466036ed96f0fb1207bb692a3667e177c7244
SHA512 5db388428a8eaca92a7d5506bce08185bcafd8a449b7b54dfbda2f28509ab55cf66f735ddbda483af40fc1ecc46d38ffbaa657d3f19c776ec30db3b2a425348a
SSDEEP 192:sxZpRYyM/jK1Ml8UQXks/fWsRECOmIdpWqGHW6+WNGiahYCxqRxrIg5mJ:sxZpaqUs/fWsaCOH+Hbqhepg
TLSH
T10452E9156A3899B7CCDBE209F941BF53D6F9097295940E44AEFCCA1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 797f2db3f63f5c73361f85c04b5d082c3bd700fa57f40bc74c2d3c1f595db920
MD5 18367aec09e91204176661e353454908
SHA1 23540f46528e0d7df02272c09ae89b74e96a71be
SHA512 2aad8579e41d665ac36550bbc3dadf6fc2cdf90389e2598cd524500e9fc711409688ffe2aff7467c13831aadae1b8f8a30b549820edabb2c14bd15e6a9ad17b1
SSDEEP 768:rg8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVGroV:rg8bqn+WvSCt6u1jaCZLbWV9V
TLSH
T177D20A3B280CCB7E4F845E5DDC26AF962ED801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 acb666b935c68245555554d98c6903d3c698c64a3f8f7f4fc2aca423b151d806
MD5 d291ac29e0fb5d90d41f150bcf2bd43b
SHA1 0382515fc40f3109822678adf7cb96d9058ae439
SHA512 42a5c064a6d2dbeae163aaf092604fdd3729904a8936dc9a442afd262751abc666764ae38e81f5b9c3b957f81a2cf6fa48f4fbf82a24d704ffa6972f6df00673
SSDEEP 96:KA/ArPNhtY5p+L/HYKn9/lYTHnOlP1W9KKe8CaMAKdqp:ynBtXS
TLSH
T14191F322727B130338BE690DA659873B9E5132E33865A46F7BFD40510A77E212EBC4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5971cb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5971cb.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4112f9e24e41cd100d0741527c2359d88c5ddbde37735b33fdcfbe6fef732260
MD5 9dedfd5124d31caaec2b56a87c0a048a
SHA1 b4e2150654b8e9fb67665ea9f590c4147a12794d
SHA512 417a0ae7a0a11e10c4e73db140d5a858b7e860d298528c1742fd57cab7bb78cc64a0788ebdab430b891738a455c03912a60dbebcc3de47d812e09ba6e8de60ef
SSDEEP 192:vONJ6Db6QmiUyKezHBa+joOmw+4sRgcCU6:vONJ6u2HBa+UOH+WzU6
TLSH
T11C02D835693C6CB79EE26E45F88B37279F94203BD9566B94D6D81F0C00D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cd105bad8caf2ac68099dffdbfdd9b8df004815c2dddb32947df1d8dc13c354e
MD5 9d95082b56e3190fd6d2756ae9de906f
SHA1 5cbc116da4515540d7ab90dca3a1e1772b361ac8
SHA512 16d36f260c9a76396a1d4fe713ea7dab10e4674a11939bc215229fb0e4bb2cf494e71a5774be811844572b8e78d7900f1c85b4162e100cc1138135b3af042e27
SSDEEP 384:kiFiZcIpsNn8TUNTUlIlZq0+uaEa+UOH+MHLOySllYJTfY81F/n9xRBuH:/FQpmwgusRaJOHZrOZuTHN9PBuH
TLSH
T1B7D23AF218D74876D9AE6747EB7E2D038EBCC163B545A540B3D85A0DCC9A4BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5506be0e30679427c87df0f52009ff5d6fe57bd46a57a45c7b6857381c37addf
MD5 deac0c3236916be806a575024423cd41
SHA1 802edaa861bfeb8a09f421b9249d80b862d69af4
SHA512 0c6c3237935973198d35f56baf71a2ae31855c204586dee263d5d678de04cb910309a8cdb622b468ab08a3f859a4d26e90fd120340ac3e2c38f71692d1adda67
SSDEEP 384:hZcIhsNdkq0+faEa+UOH+MHIOySllYJTfY81F/n9xRBuH:phsVRaJOHZoOZuTHN9PBuH
TLSH
T175928D722C385CB7A9A77145F84B3A178FF89137838D6A80D5DC5F0E01EF9AC131A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2e0e706b562d66dc7691e34077bb44c702ae97b20427a82283c726c6f1429f44
MD5 7197e04d1f7a116e364b6658507d075c
SHA1 983b4c9f639158a6e35bf43fdf7f6357117bb980
SHA512 2848688cf0e0c50fba75557371e043e64ef5fdf22c4ea56e5a57cd897636090e1daef7235eeb8000358dbb24eccb8d990e3ba8c152f5c16b689c26ef3621c40d
SSDEEP 384:UZcIhsNdZq0+faEa+UOH+MHIOySllYJTfY81F/n9xRBuH:ShPVRaJOHZoOZuTHN9PBuH
TLSH
T16F927E722C345CB7A9A77155F84B3A178FF89137878D6A80D5EC5F0E01EF9AC131A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 05b2e61dfdb2a80d4d7dc4ea172f92b5bbf800fc2a1a796bce483adda6429c12
MD5 4ffe7ccd73496571c0bffbf6276e37c8
SHA1 d41c557a070ca866425f0c0ac6a168d6c856083d
SHA512 760be2c7c92f6b0c91523a3194fc3bb707b475c577b23352da026beeca985453f537bb8bc9c3cccc94630998d478a26a7fa8c7557045a32b0f8032dbe0419dbb
SSDEEP 192:fON46DbZQmiUyUezGBa+joOmw+4z5FINzBrqvU6:fON46P2GBa+UOH+MHoOU6
TLSH
T13C120836783C5CB75DE27584F88736239FE85127DA8A6B91D6DC1F0C01EFA5C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b15d315-3163-4adf-8adb-9e1aa2615051.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3b15d315-3163-4adf-8adb-9e1aa2615051.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 faa02c8fc86491712d340b239bc4f3ff8e60a11d852212b1db44161bd08f5c1c
MD5 1260d52c219d6c824bd5e86328da651d
SHA1 767a87add671966abdd3393817ea8190b8ce35b9
SHA512 c2e02d9c92faaebbf49a80978dc0c48d10778fb5052746b71abb3a82176c4e6e93c83cc52d1ed7ea624c908d41349eb17b5915546431549cdf1b13189a98da1c
TLSH
T1CA41095CA6F9114CB3B77E5A9BF6A96E487BB8332E0AD45D00110D4F0A62B00D971737
MD5 SHA1 SHA512 TLSH

Submit Download