hxxps://wonderlink[.]de/@linda-chayer-1wmbuh

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wonderlink.de/@linda-chayer-1wmbuh
Sample260723-ssp3kasake

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3848	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292938899427160"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{0A981BF9-1DE8-435F-96EE-CBCC7FBB5872}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe
2464	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2672	2464	msedge.exe	84
PID 2464 wrote to memory of 3848	2464	msedge.exe	85
PID 2464 wrote to memory of 5060	2464	msedge.exe	86
PID 2464 wrote to memory of 5060	2464	msedge.exe	86
PID 2464 wrote to memory of 5060	2464	msedge.exe	86
PID 2464 wrote to memory of 4076	2464	msedge.exe	87
PID 2464 wrote to memory of 4076	2464	msedge.exe	87
PID 2464 wrote to memory of 2052	2464	msedge.exe	89
PID 2464 wrote to memory of 1040	2464	msedge.exe	90
PID 2464 wrote to memory of 2052	2464	msedge.exe	89
PID 2464 wrote to memory of 2052	2464	msedge.exe	89
PID 2464 wrote to memory of 1040	2464	msedge.exe	90
PID 2464 wrote to memory of 1040	2464	msedge.exe	90
PID 2464 wrote to memory of 5032	2464	msedge.exe	91
PID 2464 wrote to memory of 2284	2464	msedge.exe	92
PID 2464 wrote to memory of 5032	2464	msedge.exe	91
PID 2464 wrote to memory of 5032	2464	msedge.exe	91
PID 2464 wrote to memory of 2284	2464	msedge.exe	92
PID 2464 wrote to memory of 2284	2464	msedge.exe	92
PID 2464 wrote to memory of 2292	2464	msedge.exe	96
PID 2464 wrote to memory of 2292	2464	msedge.exe	96
PID 2464 wrote to memory of 2292	2464	msedge.exe	96
PID 2464 wrote to memory of 2768	2464	msedge.exe	98
PID 2464 wrote to memory of 1580	2464	msedge.exe	99
PID 2464 wrote to memory of 2768	2464	msedge.exe	98
PID 2464 wrote to memory of 1580	2464	msedge.exe	99
PID 2464 wrote to memory of 628	2464	msedge.exe	101
PID 2464 wrote to memory of 2740	2464	msedge.exe	116
PID 2464 wrote to memory of 2740	2464	msedge.exe	116
PID 2464 wrote to memory of 2740	2464	msedge.exe	116
PID 2464 wrote to memory of 836	2464	msedge.exe	119
PID 2464 wrote to memory of 3256	2464	msedge.exe	120
PID 2464 wrote to memory of 3300	2464	msedge.exe	121
PID 2464 wrote to memory of 3120	2464	msedge.exe	127
PID 2464 wrote to memory of 3120	2464	msedge.exe	127
PID 2464 wrote to memory of 3120	2464	msedge.exe	127
PID 2464 wrote to memory of 1732	2464	msedge.exe	128
PID 2464 wrote to memory of 1732	2464	msedge.exe	128
PID 2464 wrote to memory of 1732	2464	msedge.exe	128
PID 2464 wrote to memory of 3932	2464	msedge.exe	129
PID 2464 wrote to memory of 3932	2464	msedge.exe	129
PID 2464 wrote to memory of 3784	2464	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wonderlink.de/@linda-chayer-1wmbuh
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd397cc188,0x7ffd397cc194,0x7ffd397cc1a0
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,16863942937203538725,13169037380906038896,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7903926794990073467,7152011131124506682,262144 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2508,i,11941751050474053732,3571951035209237279,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,7747734483482400962,4007977770187880903,2097152 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,10016141293473202438,4821265009548893672,2097152 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,10671153501191548533,8323558733040750913,2097152 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,1205305029751025936,5468521640201867494,2097152 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,17509656300956519279,12056821589792389210,2097152 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,9098801414083064378,5031550326418276330,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1690544406222002413,12532290903960202651,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,12986147986438947323,16080477599172478277,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,12986147986438947323,16080477599172478277,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4312,i,8500493700257337353,8886067252563933040,2097152 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,927410474950663877,3436525711510225761,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,17734367648216430032,15939668901295816520,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,3397287123960616380,9919972446229893730,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6212,i,5206760128637168131,6510833682799590371,2097152 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6372,i,16150379932570339369,6297888016154818833,2097152 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,1949844328473019564,13865624580914847589,524288 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,2734399804792062658,12144959533373732037,262144 --field-trial-handle=2168,i,3485406005629198212,15377049849645407592,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2a280e8cad25322211a1295337ad004b55e3224ed8bf1927fc1e28267487d7ca
MD5 b82d75b6036b437099d952ac5dd689f1
SHA1 889de7d700d259477d3f192d9589c19fcf92450c
SHA512 3748a35eb19698d7344a016f736d37f2e96782a19f31486c80a4b93d97aca6677339b18844c49a2f7ec7a05a65f6edd5157b32202ddfced6dc49981660289a8e
TLSH
T1D5514B2883720881E37C15B093E2173DF47E819A3AE7EE1682500DFD691EB36743F15A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0bccf2bc4cef82e63d32633ca67b089f3371d6152086ae1e8baae31e6fe1bbb9
MD5 9278d3594584e372d80bd06a0209e2eb
SHA1 e870de67c9973550b56808d52d8a026719ee7fe5
SHA512 1dd26b385b0f7f50ea88035747ed7df4a66dfd38315e4cd30155a4d0ec20ef504e07ff6abf970dec3c9d5d07818312fe762f8e493a288adecc461be6893a0484
TLSH
T11F515D2883724881E37D15B093E1273DF03E959A3AE7EE1682901DFD651EB32743F159
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e049.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e049.TMP
Size 2KB
SHA256 3eb7af63e2f29a83e5c61821a6081574ed4efde2f82c71f4acb87fbcd9032ae8
MD5 b7bca808f05c85fd4c74ddd95f01f02c
SHA1 5ca033c56467bd7aee3f2bdd0037c9e6e2e90826
SHA512 5533575f3a9a6ef87f84ec85a74b18cb74ae3ce2b15ef7b0b1b375a16c9c91c0bf6174ceef5ab251a7e595c107663cd2199fa5e404be007e77ca7f2059db98fd
TLSH
T18C515B2883720881E37C5171A3E1133DF07E809A3AE7EE1642900DFD691EB36783F159
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 1b0b513f2346b5ad8aaee546b56fbc6da7b851f4dba8d20e9bd9d79b56410a0b
MD5 7d9a822f6069e5ea05edde232043d426
SHA1 eba2f814c472a82d89ad511364b76fe01633cc02
SHA512 14822dd54044e7094181069c8a7e611e0af6d08110d2d237ffb5611ed08b28fac5010fb992c1c1223d536d244d6f997028882f8cbf0a4ecba95fcbf21b869550
TLSH
T169419BF387E48A6DCA1152F0AA14AE2FCE1D0925832C396AC9E4FF5793E3471E10565F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4e16fe88e79add94af7bb77a523287e527885557e3d2c518e2e43b6907e48a44
MD5 09223e28c38106aac09663f6abfb954e
SHA1 431ac863813257e8f83d7abe198084d75ed6844f
SHA512 7c00b077c8e1c81988a9ab04342577c4e93d7fdf2a4822bc228032404af64106585c9fc1e01edc56a8d3249c58ef83adef6005b200adac60c00502ba3dff454b
SSDEEP 192:sxZARryM/jK1Ml8UQzki/fksnUATIdpqOFcHW6+WNnrZ4bjXY9IHWDs+hIg57EJ:sxZAFqYi/fksnUJoHb9wX/JY1I
TLSH
T13552D9566A345977DCCBD20DFA45BB53D6F51472D2900E84A9FCCA1C00E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f36619970c55236f4f818f964c325e437fbef89336f73996ede4051dcf53ac4
MD5 008e40e1e91e9ca4661b49b46ef455d7
SHA1 334493f0893be0e4bf871580ea4e7dc7a635e4b9
SHA512 7e4cc955f4fe192f0f28cea0232745b9ecbd36c95d1691f55e5e080acd30698a18e7832354d174f4915c16a2186085b4c3cf8175160877ec65ff483e639af26f
SSDEEP 192:sxZARryM/jK1Ml8Mki/fks8+JTIdpMcHW6+WNrg2/Y9IYgs+hIgrJ:sxZAFMi/fks8++NHbf/eY9
TLSH
T1D742E8166A34597BCCCBD209BA55BF53D6F5057292940E88E9FCCA1C00E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9f0739f9142bf0c6558cc07c09e0c4580a883064145b8b1337130833ea461a7d
MD5 30986798a22498f7d37fcf5ad0fc8587
SHA1 7cb65d9959659bf2f864e6e979184dd4685f6354
SHA512 0d323e834c348beb7f89bddaa82eb0894b379a07460305474c2bbaa627629cc5dd2c5b13929bb37fbe2802bdd6a0f32041003f3b51c92b2d59ec5822b857e878
SSDEEP 768:B+cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNyroGg6z:B+cv21wWvu+Z+u1jaeFLeRNpGj
TLSH
T1AED2FA2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5d61a0eff734a045affdf8eb4ea8dd80686544e57a59d3772112918110a23a24
MD5 b68426985eab1157d0e84f7c70cafa28
SHA1 65c85eaaca71ffd198e4f842cd4d88358fa3f570
SHA512 e491f2e61b3e647b8ee87028eae0935dc531c8466da66344ba527de601e8045687f1840a16807193f125107031c6cc6e1cc753f2ba2e8d0563c57fe7e6b2f0c3
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+1eKe0CyWkKzSe:mTJlnd
TLSH
T18B91545170774641397E680CABA2853A8F8771A3781CB5AF7BBC00514E2BE521DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a50f4d47e400fccd79ce9f3b34e9581e795584b308d4a2c082c0c5b6bff9604d
MD5 c1b4cc2ced17d33445ce8fe4cec0c01b
SHA1 095b802fec674ac484bdb0b6af52446be2a46aaa
SHA512 18d8f6bc93370f3eaa53d49eef71618348af4c7ac425205e56138ac27c792c383f9c73e34c889d93945449c0973fce113a6fe60ce6e91366320ed90b03df94fa
SSDEEP 384:NZcIhsN6Ux2+ziPH0P2e+CTdIe9JrHNOObjI9G6w7mUAp:Vhn+VPBrV9hHN29MpY
TLSH
T1C2929D36AC341D766AE7A511F48A35134EF89177D7D92F84E1EDEF0C02AB9AC1306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7ed2eae51e95718b4825eebb9665e097fdab7d702467b9c56d038e3c15090876
MD5 8d6f8ab3c4be76826bada9fcb0389c4e
SHA1 b0cf413b8b80ead8f0f6b868f731685700eaaa2d
SHA512 1d5af33f0540ff59203d58f7e9cbb04e2c1cf20c87e2e713a93c3412a0d83e0dedaf63ea69d776600cf45f47ddd977f9c14dca005fbe6667c499fd3285917231
SSDEEP 384:sFiZcIvzsNf8TUNTUlIlx2+ziPH4ie+CTdIe9JrGNOObjI9G6w7mUAp:sFQL+wgu+HVrV9hGN29MpY
TLSH
T17DC239F648E74936EAAE5703B77D2D134EBCC067B5956A80B3D88A0CCD964BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1e386087d3dababfc9e1d617558ca3f11c037c3bb62799a956f9aa5dceaac2b
MD5 e01721a910a76c50c4da493d6896fba2
SHA1 51abd33946c846db2a1776a7a3ca79050c1091e9
SHA512 6ba8b794558482fea5b3fb447acccd901f46e86e327474b4b56f9434122417123d21d9b7b8c1ccc669b8778c3114659508ac111119b8d232b6cf5f571d0d1f5a
SSDEEP 192:JONr6v+YLNQmiUyFC9Zh+CGN+FdeX9oEusFiU6:JONr6vz/6oZh+CTdIe6gU6
TLSH
T16F02D835AD381CBB9FF2AE45F58736175FA82177EA962F80D9E81F1C01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 36d4c6ac152df646ba3cf2a15d83fe998e077963e8270edc5269f25e79070446
MD5 c8e6e4597e19e3b0dc1e1947bc059652
SHA1 ffe23852847032264329bf89025ee2a1f15cf839
SHA512 549152be4830265d94a10cd91f965621816a0550c647d7fff0f2e872f1a9be5a8b3649973752267ce7d4b0b6fab094c62ef1716cbe2f675775ececc1c7c547cc
SSDEEP 192:oONw6v+YLHQmiUyFj9Kh+CGN+FdeX9oIHSJrZxyCH+q5U6:oONw6vz96xKh+CTdIe9Jr/NU6
TLSH
T1B2121A36AC785C6B5EE26941F48735135FA85177EE8A3F80E5EC6F1C01EF6AC1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6bfde40d1e2df1a659c31b547f0916d6191608e5fb32bf7dfce3771f167581e4
MD5 3aad984f12ddf60bd1021ba3bddc4329
SHA1 9eefefc7c359eda98d6ba43222c0320d702aa845
SHA512 60daff63d08fa00d2c17734e258606d1d8c39150753155e8d2266182b3ed81edf71e9f55dcce1a79a9c1b2af15778fabcf10b94818d332d53d3b72e20b150f1c
SSDEEP 384:yZcIhsN6UA2+ziPHzue+CTdIe9JrHNOObjI9G6w7mUAp:AhI+uprV9hHN29MpY
TLSH
T1CC928D36AC381D766AE7A511F48A35134EF89177D7D92FC4E1EDEF0C02AB9AC1306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e5ec094f70a0553e54e2efe79d9bb9b6c33eccf5839b46f13962656c8b1c7a2e
MD5 22edd6b53c504cec82e78d83ee467e58
SHA1 afb83ee9f70fe380fc5250588b5c0f14c0a500f0
SHA512 d186999a230b94942405a495ed301e78017e1a4e435ca7397732358234df9e65e6156bb036de6513c7495b0c430195a5b86fa1acdd81bac87631f45b46f4b028
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5980bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5980bf.TMP
Size 392B
SHA256 d795f190aae4f863d428bf21abcb2a30514c61a4f3b9c0ff99a1cb8263c57b7b
MD5 bf6a18ca4c127405170ccb469ce9c7a1
SHA1 791520505716d2480bf9f3ea0ae235da4630e525
SHA512 88bfd83b6daf490e1044828936c20c3df0bf9f67d895180243cda2ec48a1f4246e62e4a3509f721f2ece39a579aeb6ca7ab19ab2f5d7f052b6b971ac91ccaac4
MD5 SHA1 SHA512

Submit Download

35bd9b53-3127-4d4e-a653-b5b9895ff6cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\35bd9b53-3127-4d4e-a653-b5b9895ff6cb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 897670bd3d15d038d5e1e62726811f96f869cbf70d6e0d25bba6f9a4735d7626
MD5 52937c03749d51248af8eb5c81910387
SHA1 b60003bcd6c449a7e5c1224eac50e06065701a91
SHA512 3476d50cb5c29804ccf6f79b2e30ec743da2ef05ace6d1624725d46e970426857ff1e8952eebc6f69185200f229f0c26a14ea53d1da2cac083776d91f864472b
TLSH
T18A41E798A7E91148B7B77E9A9BF6A86E487EB8772F17D55D10010D4F0A23B00C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download