hxxp://singleview[.]site

Analysis

user interaction
yes
max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 15:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://singleview.site
Sample260910-s5dv3asajb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335286581802780"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{EAE8257A-CA4F-46A3-9ACD-83A9A085776F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1500	3288	msedge.exe	86
PID 3288 wrote to memory of 1856	3288	msedge.exe	87
PID 3288 wrote to memory of 5032	3288	msedge.exe	88
PID 3288 wrote to memory of 5032	3288	msedge.exe	88
PID 3288 wrote to memory of 5032	3288	msedge.exe	88
PID 3288 wrote to memory of 3412	3288	msedge.exe	89
PID 3288 wrote to memory of 3412	3288	msedge.exe	89
PID 3288 wrote to memory of 3772	3288	msedge.exe	90
PID 3288 wrote to memory of 3772	3288	msedge.exe	90
PID 3288 wrote to memory of 3772	3288	msedge.exe	90
PID 3288 wrote to memory of 3384	3288	msedge.exe	91
PID 3288 wrote to memory of 3384	3288	msedge.exe	91
PID 3288 wrote to memory of 3384	3288	msedge.exe	91
PID 3288 wrote to memory of 3112	3288	msedge.exe	92
PID 3288 wrote to memory of 4724	3288	msedge.exe	93
PID 3288 wrote to memory of 3112	3288	msedge.exe	92
PID 3288 wrote to memory of 3112	3288	msedge.exe	92
PID 3288 wrote to memory of 4724	3288	msedge.exe	93
PID 3288 wrote to memory of 4724	3288	msedge.exe	93
PID 3288 wrote to memory of 4848	3288	msedge.exe	97
PID 3288 wrote to memory of 4848	3288	msedge.exe	97
PID 3288 wrote to memory of 4848	3288	msedge.exe	97
PID 3288 wrote to memory of 2836	3288	msedge.exe	100
PID 3288 wrote to memory of 2356	3288	msedge.exe	101
PID 3288 wrote to memory of 2836	3288	msedge.exe	100
PID 3288 wrote to memory of 2356	3288	msedge.exe	101
PID 3288 wrote to memory of 3560	3288	msedge.exe	103
PID 3288 wrote to memory of 4832	3288	msedge.exe	105
PID 3288 wrote to memory of 4832	3288	msedge.exe	105
PID 3288 wrote to memory of 4832	3288	msedge.exe	105
PID 3288 wrote to memory of 4140	3288	msedge.exe	106
PID 3288 wrote to memory of 4140	3288	msedge.exe	106
PID 3288 wrote to memory of 4140	3288	msedge.exe	106
PID 3288 wrote to memory of 3056	3288	msedge.exe	109
PID 3288 wrote to memory of 3208	3288	msedge.exe	110
PID 3288 wrote to memory of 2956	3288	msedge.exe	111
PID 3288 wrote to memory of 4688	3288	msedge.exe	112
PID 3288 wrote to memory of 4688	3288	msedge.exe	112
PID 3288 wrote to memory of 2812	3288	msedge.exe	119
PID 3288 wrote to memory of 2812	3288	msedge.exe	119
PID 3288 wrote to memory of 2652	3288	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://singleview.site
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe9e19c188,0x7ffe9e19c194,0x7ffe9e19c1a0
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,6515929581062280934,2006150950427119078,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,10106192202890636154,8031422629320594286,262144 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,9683116971277449652,11286815461827652758,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,3163730206194744181,3678787490703902933,2097152 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,1074793340748360068,10653077058766494626,2097152 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,257862324288143353,9293143168746704274,2097152 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,8423469432852300974,9306433516955837195,2097152 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3600,i,15541203961234490243,16117719071812061441,2097152 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,11819532014892453418,10659980181901511070,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,16377751366490723128,11325704772786153192,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,17209603884938901612,7843673810177716622,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,17209603884938901612,7843673810177716622,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5920,i,8656613766273844867,12935672594401542172,2097152 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4244,i,14161675625371622316,13222181188232035784,2097152 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4208,i,15096197107776756883,5508482018955131249,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,11560110770569552922,2212710330224777001,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,10844432686308022752,10728032313647431976,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,11850382436275723598,1477674936866149172,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,9371236487009238231,13897080806256266198,524288 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=748,i,16331945555104601781,17517592141768505530,262144 --field-trial-handle=2236,i,6917443429714761516,7205993949832550221,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2652

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 557B
SHA256 4a2042a2f7d614d8df398c487076a26976aa6acfb68aec8c52f8e61b8d95bee9
MD5 659d7f97108db48f7fb69ce641931fb6
SHA1 903eefbf689c4121aa360cf25fd97ff591ec1831
SHA512 75cc0cf4cd91dd9366862687526c739ae9d4d1bcc011ef9d35b98b79a0d30cc13353dd1f54b12734064bc46e0464d6a396c5152ad47feb997195546be7e756c3
TLSH
T1FCF0EB4703F5C766825183D7802A663988157B46EACCCB0D330C7C8438C03085D881C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 76eb514e400264b67aa81277139bd41abd622b8b20ba067801ecd1bb51b79cea
MD5 fb7f9cb3ed7a9a599eb452efab8932d4
SHA1 0f34a07827fa2f9bdda964a56a7b27fdf93f3acb
SHA512 006246d484236f153043233f8d028204c11fdfaaecde1686a0b461b0b415841c5d42ef583e7b9df2c21335805b3bff59b9cfa3b5f0e967be14080ebd36306218
TLSH
T13D711B3806960DECF35D033E5CF2065674B589E8F423EEFA3160E874E929F106619DB9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b94779d5682cfe55f955b59172702bb5ee0d8d1d900f60c3205aca5d04032931
MD5 4b2aac547c13da52557035990cccaaad
SHA1 6007a1b33d8a86ccde330f6ab6a4a182b1646cce
SHA512 cc2512e92729a7394190af5e59d35d5ae194aa44c39a5cb9632f22fe4a68ed70f06b5b4c16ea2949dfd5a67c2484eee51fc247a81916c6e614c99719599944b4
TLSH
T1E521ADF3C7D5866EC91116F05A28AE1BDE1D090582187C1985D4EF6B93F3475E10265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6422520bac619eb9ca267e894c72c7c7be9b4e3b576f0eaddb80ad7b13dc0acf
MD5 1e33f0e128b1fa086f3dad44f071f60f
SHA1 2b5ddefee36e5aa063f2c881d5eca56680bfc8a3
SHA512 f91409e0d24684ea4b54c1609de82406ac982a24f53bf7280a13567c1ffb9db0cd4cea230b932d067b12befaf190d8e832006c16cabf9deb8e784fe0904ce070
TLSH
T1B4D02223128AB1B7ADFC3E81406AAC8FC72B50700803DED420D4AD9C093586E662B241
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe594731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe594731.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7252fc4e963273849cfc4c11ffe534d102e1393e6fea1729ee8683d4a91f0d95
MD5 cecb3ce0af3f656198cf6fff945cc865
SHA1 3d31d20a0b8feace6d9caef710f398d1ea2884b5
SHA512 eb11ec1a6f05944a1964f0dc7a4794361dbce42bbd44eabc7bb0f8da574ae80f565d72cea6137de14af397498afb47ebac590c2a204549de10dd8d6f7ca70d1f
SSDEEP 192:sxZbRdyM/jK1Ml8MWc/fYsXsIdpxyHW6+WNWIk4/YCw9VtD+3IgrJ:sxZb/uc/fYsX1UHbq4/OtDY9
TLSH
T13D42F811AA34AD77CCDBD209FA517F53D6F94572E2900D48AAFCCA1C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 44ba376de11b753495d974225f27431b9a934fea0ce6e60c6633f8fb04927024
MD5 c01a70550dff2b25bc305b062d90dd2d
SHA1 09ffa7fa18e154e2bafb4994716b141316cb7f83
SHA512 54b5f7cb0a4c3a260923eb2b4ca39d2d319413d65b721e0b04dd828d52680b4244c967f8655e03395c36f5fa25958e3559265ea324b2c89341ff9bf2860b97c8
SSDEEP 192:sxZbRdyM/jK1Ml8UQJWc/fYsmsIdpk7OHqn6+WNozu88xEDdYCdmVaD+3Ig5aJ:sxZb/qAc/fYsm1hHlTSdCaDY0
TLSH
T18B52E815A9345D7BCCDBD219B941BB53E2F85572D6900E48AAFCCE1C04E6BEE210781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 348b4cd4a4387059d6d0ee34c0cb86ad65eb8f8784dc9de27862718d4291b310
MD5 d3a2bddea2ef8d0c1b50137cc5352db3
SHA1 6d3fdca27a37d3a296af1d97393e14f2334d5757
SHA512 0f9faa12b3cfb2c1c9173f7ee20f156b7d11a7bbbf03d7c53ee5d3c61572ff3fdcadf30ae67d9bf7cd225e2b19740709d3469edf7502a0f2f0e09ba801af24b2
SSDEEP 768:BS8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVKrod:BS8bqn+WvSCt6u1jaCZLbWVhd
TLSH
T1E0D20B3B280CCB7E4F845E5CED266F966DD802CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2968f84a2c447510f93743e9fb97ab029d153962a6b74f80d6814d4aa1d3bc6d
MD5 ae5dd3b834cac8a6532122b40c3b85b5
SHA1 97106d985c7c77877b3e605438cde2eaaf011100
SHA512 054ddbec6c7495acb579e11aeccc0c6d4703b738b081b2abbe95813a67e418edca07fa61de686b89386a36c3b6ab60a2b18fe00b664ce8e9b7e7904d3132914c
SSDEEP 48:K4aIfK3qAry1/IxKkY87yB4InK52E5+N8ouYk:K4aUK3qGm/KKkYii4QK52A
TLSH
T13791072732B7024138BD251DA2D996779E4531633428A56F7BF860F15F6AE212CFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

761a2de8-393e-4546-85b1-9b8496ac5e9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\761a2de8-393e-4546-85b1-9b8496ac5e9b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1ec1d5bdfbb2f89de56f7487276d224542958381b929bf14389eb65d9acdf2f9
MD5 451e5575ed2522d5b07327d83f0047bf
SHA1 571b1cd4081fcd85ef5e061e5e95199b5e84d65a
SHA512 7ea750045e3c4b215d40b7d32cf5097141b20b8874fd5ab1ab3cd397172dde99df9f64ae3505e8bf31d76f38de8253291afafa1c828ac32f480ecd2ee7749e4c
SSDEEP 192:uNLsN5UgQyY90IbiM0QmiU1bu94Ea+jeOmEtmy8bamzqN7WpL9:0sN5UgZ3lJ0SEa+qOfZiWEL9
TLSH
T1014229366C389C775DE29288F54A36139EF891ABDAC92F88D6DD5F0C00DB29C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c960a3c4da4600361e7b047f4fd333699e67d2011fd5fdbb9b77f8f6b365f6b0
MD5 00e0639ebb597f779b03c19670937497
SHA1 8d2650a302f0031f0ac052265fa73455a13c0066
SHA512 b13125dbd5c096ac362d54f508cf7654fc52df302fdd285b8ca13b7fce528607c3c851512791e1f251d86880778672380517e0e6b0a0f03b7c12ba763d6f6e4f
SSDEEP 384:viFiZcIisNa8TUNTUlIl1Z3lJTSEa+qOfZVWsa+VYwoh:6FQiDwgpZafORVWhgvS
TLSH
T1C9C22AF219DB8876D8AE9787EB7E2E134DBCC067B585A550B3885E0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 66650c9c5a1aae12fd288dae270fada40863a82bbae7f639f68b9cbacbf117be
MD5 2260cea48c1b4bda4fc24596d02385b9
SHA1 cca6d51edf2157f6ddcfb02a22799f0c60902e6a
SHA512 65e8882cd6d13a66321155a93fee621a265336f993ba33aaf366dfb31b909ebf54b47dc3b4bcf10b3bdd953bdd1e6b8318fbdac2fa052a2e4ef33bbb42bae8b5
SSDEEP 192:uNLsN5U4QyY90IbiM0QmiU1Su94Ea+jeOmEtmy8bamzqNqva+4LcYLWAdcL01:0sN5U4Z3lJXSEa+qOfZiWsa+VYV
TLSH
T1D66239326D389C775DA39694F94B36239EF490AB96C92B98D6DD5F0C00DA29C130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 31b8023c05456d6f3987a3f1a0b08c3eaec69ff4845edef3a01559d88c446d09
MD5 d24def2c39e9bf650cac68266c3b138c
SHA1 460d8fa8471e9de7b0ba53560eba7f65a9d4388e
SHA512 30a6f4dd3f16b4183886eacef54dcc0e8384380bc7fe34309401e2de5da103bd05d2e936628cf6283b9178079d6cd1f5dbc8e04009c6dc208c1c3c69bf050724
SSDEEP 192:WONz6DbeQmiUyqHOBa+jeOmEtmy8dNzzqNU6:WONz6ihOBa+qOfZOWU6
TLSH
T16B122A36793C9C775DD2A584F48736179EE4512BDA8ABB84E5DC1F1C00DB69C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43df82922b4fefae0f1ef2ec1f96910418d41f5b1ed744d5cc976c28092a37dc
MD5 ee162c185f22046440f96097036200fe
SHA1 167a69a69437bb23b849f37fb6e7cadf4ce3958a
SHA512 8bfe27646f08fbd7e9367b3c30c98f933310297388fe7e5fd629aa40c07ce9325453ba5d1cc6ac728a0738a50a01c5c959ee1469641c395e15688a243ec034f2
SSDEEP 192:vONI6Db6QmiUyfHHBa+jeOmEtm8RgZDU6:vONI6uSHBa+qOfWxU6
TLSH
T11802FA3569386CB79EE29E89F4873B275FD4207BD9566F84D6D81F0C00D764C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 99522cf524f23cd73f7d7145d9164c44b078b032e58c2a68becfe2870c3e815c
MD5 44fa811d20f9603cb7be898af7ae766d
SHA1 a48b3eaca4dd7209d42a8d7ccab61158799e3438
SHA512 cd6f53b7ec9209d3c8ef496e19e644a48286ac19a2a2f9ec4481e9653b0efd71e17b43cd47b531169abde7b121157f57186ddd62c0b79061f6860c674fbcfec6
SSDEEP 384:BZcIhsN5U1Z3lJASEa+qOfZiWsa+VYwoh:JhWZafORiWhgvS
TLSH
T12D826C326D389C7758E3A284F98736178EF8906B97C96B94D5DC6F0D00DA698130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fd0959f5fd2d5f954071c1efc526ec710773372ade1a9661ba40c2cc9ea247f6
MD5 856dc2da25fb104052433036476d9f28
SHA1 d8c43d2e91fc14e34d947891bc427c008de313c6
SHA512 cb28ec8757b565aa17bb6a61b0673d33a87201af019ef21f2002c481986d41223b39f297b7e668f315a3fc32fb58e625f844f5833b806a0d423c9afdafc20b02
TLSH
T1EA41F859A7EA1148B3B76F5AABF7A96D487FBC772E46D45D00010E4F0632B40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download