hxxps://saybzb[.]xin/SPOTIYPANEL/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 17:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://saybzb.xin/SPOTIYPANEL/
Sample261027-wdbheaez5x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
620	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{E303ECEB-766F-4F07-BBE6-EE63508FFC62}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe
5248	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 5248 wrote to memory of 4564	5248	msedge.exe	84
PID 5248 wrote to memory of 620	5248	msedge.exe	85
PID 5248 wrote to memory of 376	5248	msedge.exe	86
PID 5248 wrote to memory of 376	5248	msedge.exe	86
PID 5248 wrote to memory of 376	5248	msedge.exe	86
PID 5248 wrote to memory of 1212	5248	msedge.exe	88
PID 5248 wrote to memory of 1212	5248	msedge.exe	88
PID 5248 wrote to memory of 4084	5248	msedge.exe	89
PID 5248 wrote to memory of 2600	5248	msedge.exe	90
PID 5248 wrote to memory of 4084	5248	msedge.exe	89
PID 5248 wrote to memory of 4084	5248	msedge.exe	89
PID 5248 wrote to memory of 2600	5248	msedge.exe	90
PID 5248 wrote to memory of 2600	5248	msedge.exe	90
PID 5248 wrote to memory of 5704	5248	msedge.exe	93
PID 5248 wrote to memory of 5704	5248	msedge.exe	93
PID 5248 wrote to memory of 5704	5248	msedge.exe	93
PID 5248 wrote to memory of 4940	5248	msedge.exe	94
PID 5248 wrote to memory of 4940	5248	msedge.exe	94
PID 5248 wrote to memory of 4940	5248	msedge.exe	94
PID 5248 wrote to memory of 3968	5248	msedge.exe	95
PID 5248 wrote to memory of 3968	5248	msedge.exe	95
PID 5248 wrote to memory of 3968	5248	msedge.exe	95
PID 5248 wrote to memory of 2848	5248	msedge.exe	100
PID 5248 wrote to memory of 3764	5248	msedge.exe	101
PID 5248 wrote to memory of 2848	5248	msedge.exe	100
PID 5248 wrote to memory of 3764	5248	msedge.exe	101
PID 5248 wrote to memory of 1524	5248	msedge.exe	103
PID 5248 wrote to memory of 4308	5248	msedge.exe	109
PID 5248 wrote to memory of 4308	5248	msedge.exe	109
PID 5248 wrote to memory of 4308	5248	msedge.exe	109
PID 5248 wrote to memory of 4812	5248	msedge.exe	114
PID 5248 wrote to memory of 1440	5248	msedge.exe	115
PID 5248 wrote to memory of 3596	5248	msedge.exe	116
PID 5248 wrote to memory of 3808	5248	msedge.exe	118
PID 5248 wrote to memory of 3808	5248	msedge.exe	118
PID 5248 wrote to memory of 5960	5248	msedge.exe	119
PID 5248 wrote to memory of 5960	5248	msedge.exe	119
PID 5248 wrote to memory of 4932	5248	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://saybzb.xin/SPOTIYPANEL/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd0e73c188,0x7ffd0e73c194,0x7ffd0e73c1a0
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7933895216729518803,9247215049866196866,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,4155635847899657416,13382576633286012678,262144 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,881929102825455686,13811374779956110173,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,9880800346009063845,7490737688850492945,2097152 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,5690866771286482879,9271101422982654827,2097152 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4952,i,312992481362350984,802218770853035838,2097152 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5108,i,3519148682221929092,10237617466627764224,2097152 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5204,i,10636081949485590745,13531617781247377612,2097152 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,12897383299444446445,7845932006023681418,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,9211722161721482337,4486759844134390035,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,7001050901755197829,8182979241784003833,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,7001050901755197829,8182979241784003833,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6268,i,8776691252912178655,12949445664748074454,2097152 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,8809622522467638095,2457932859267480997,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,16803717172719575023,12696202346835075345,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,11592838892937916626,3626675876810373096,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,9181691600008493647,4997484111973671356,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,5284212518664509664,2370832963801009723,524288 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,2417221644210319365,12909068147512544729,262144 --field-trial-handle=2296,i,9579365786993915178,16066057647980903101,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

439349da-6e8f-4b07-a990-57c5ae9408a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\439349da-6e8f-4b07-a990-57c5ae9408a1.tmp
Size 26KB
SHA256 5642d0409d8b5fdf11c0513d76ba947219e34d06fce2f74ebc1355f73674e4cc
MD5 27795a49ad6083fa19dd04c47572446f
SHA1 fddcd6886aafb05206af702afd7564a5415173aa
SHA512 0b1a2707139f4af62d39c131669040a130d1d692c3952d640c83243e5ab9113e1992fb3dde4923523603732c943275c1a1fb0d5fcda6ef2d8dd7337a70c6445d
SSDEEP 384:n1iFzQkUSvK3sN/8TUNTUlI435mgmilK2fMBVvrWfsAHvaTZcRgL/7IzOIIln:8FdK3+wgrYuBVoHvaTZcgLp
TLSH
T1E9C24A32D8A9DEBBEDEB8AA5A34A3643DEE04153C98C4AD4D6DD5C1C00CB1DD174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61d6f6d8-3f86-4420-ac2f-9a7ae4630bf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\61d6f6d8-3f86-4420-ac2f-9a7ae4630bf6.tmp
Size 25KB
SHA256 4e5e86d76475312b037f92ec626021ec06cba091cc85d4cf4d8d9d882a5b0ea9
MD5 f3f9aad0737b85c5fd5a54ee22cebae5
SHA1 8e1d5b14b6636826109254ed159022627fe37e64
SHA512 0bac8d543f8cedf18f54ba611236ecb173e228427b56b9161622a1d49b69c07565540aaa470a8d9766d52d79d595341d85ff6dc1b7ba9691572abdc542578f4a
SSDEEP 384:n8iFiZcI63sN08TUNTUlIm25mg5CnK2fMBVvrWfVtsa+VYWzgL/7Iz/oB:nFQ63FwgS5QBVEthgLK
TLSH
T119C24A36DC98D9BBECEB8FD5A74A7A03DEF01163859C8AC4DAD95D1D008719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74bf2528-5009-4a27-8677-05ab38b2d0ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\74bf2528-5009-4a27-8677-05ab38b2d0ab.tmp
Size 32KB
SHA256 a1fe3b54b071acf9d5d7db7686630465ea46099eb5cf8075f8d9bc2b341e1a27
MD5 bc1544ad415734267d7f2501e73459aa
SHA1 e0bc4df7f64470b23863de8b88432d5774625e0b
SHA512 f1ea404f5ccee84f60a0d2e5da13c5146ef766a397ea322ad6783bcdf3275ff420fb8787bb412dc59e5a0a07c2a5c5d0b67a027edc0c9d8378d08258001ebc17
SSDEEP 384:nliFzQkUSvI9sN/8TUNTUlI435mgtClK2fMBVvrWfs+HvaTZcRgL/7IzOIIln:sFdG+wgr/uBVWHvaTZcgLp
TLSH
T1B8E2A1F198DB9977D9AE8B97A33D2D0299FCC153B9884A84B7C95C1CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cbf2477-3e04-4ac0-a7a3-017bc5e62632.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9cbf2477-3e04-4ac0-a7a3-017bc5e62632.tmp
Size 26KB
SHA256 ec0c7f6d5e1d5a2d04b5ee182c6491eb40ed196476da7d11f7448bd95351a995
MD5 68030b9c312ce43c40fde98933981d05
SHA1 24d74dbe596842acde45feb5affd1737c5c7b250
SHA512 426484bade43bd7c692c856690f6b58c3bfbda0afd896858ae31bb974933ef3f6b932e1b4520aec0d4985dbb5b6ea01ea8a1ae07e98bbac417232ac827bc82e7
SSDEEP 384:nJiFzQkUSvGsN/8TUNTUlI435mgtilK2fMBVvrWfsAHvaTZcRgL/7IzOIIln:gFdG+wgrPuBVoHvaTZcgLp
TLSH
T1A0C24A32D8A9DEBBADEB8AA5A34A3643DEE05153C98C4AD4D6DD5C1C00CB1DD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

137ca4db-77fa-4ea1-9c9f-bfa5946a4bc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\137ca4db-77fa-4ea1-9c9f-bfa5946a4bc9.tmp
Size 414B
SHA256 2c81f63bf32f33a1e6e6b2d64ec7c6580703097e9c35fbf42dbf16c0150b5b00
MD5 2a1ee6b61b470796aaf17631db924762
SHA1 97dbfad0ffcb6425ed032120512dc2db37524d1d
SHA512 dc759e31cd0b3fd6bfe3566023f8afaa8d718ad08d323c57806f3f8a840436c1897098a678189607617d99af5b912ecdb0a9a58c5cfa4b3f681f129aaad088ed
TLSH
T100E02BE9DC35AC3709FD4B2850540645EB4103572A80884F373C910D8FB5636418686C
MD5 SHA1 SHA512 TLSH

Submit Download

20c94ba3-eb5a-47b3-ab38-9b735c1abf75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\20c94ba3-eb5a-47b3-ab38-9b735c1abf75.tmp
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ef39452-d017-4a75-b6de-99f0444d4ef4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ef39452-d017-4a75-b6de-99f0444d4ef4.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5255d37b-47b5-4599-ad79-f6064d4cf7a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5255d37b-47b5-4599-ad79-f6064d4cf7a4.tmp
Size 12KB
SHA256 ca857127e47503417c336b6a4900e7f89d807c1ee2d5c643b4b5271ff932596b
MD5 b86f8f9dddba8601451a7ca1045585d0
SHA1 5f651a74b854183364070176e89aff701d1d9a05
SHA512 a76879d21277ee1f1c9563622160a60375e01f5fefc774e195f24cfa7ad72dc5f79b18fa0caf34313b7427443fd7d87934617c3cba7f6b5403dc0d10acaef292
SSDEEP 192:sxZDRTk0/f3sZtnQZZc3zodpZtLHW6+WNaX3/YbICJuYkuIg5+xJ:sxZDi0/f3sZZOZccjHbu/FPYTQ7
TLSH
T15542E815AD386A7B9CCBD209FA15BF52D7FD503290D41E48A6FC8A1C15EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

888b61c6-9452-479e-aabf-1b4ef7118302.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\888b61c6-9452-479e-aabf-1b4ef7118302.tmp
Size 12KB
SHA256 2ec959c2eb9a6a95e116bb7c2e5a55710e1f44f9435bbcd77990ea6bd094d1c9
MD5 186ab022cfdd8e7129be9cdd51921deb
SHA1 b4b6c96a205672d76be2e41d2f6b078ff4a812eb
SHA512 d88defd31f52f46695b8b2964dcc036e5caef351d3972c1822fb1dc51975b80e86d9fbe5206e9321bc6afc00c7ee9b2ae5fdcca7d7e6e1d1d813581265006f8e
SSDEEP 192:sxZDRTk0/f3s9nQZZc3zodpZteHW6+WNaX3/YbICJuYkuIgjxJ:sxZDi0/f3spOZccWHbu/FPYTj7
TLSH
T1B242D825AD38697B9CC7D209FA15BF52D7FD5032A0D41E48A6FCCA1C15EBADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4d87b76ac611a019d98fbc956df8e6a2ea3786238ff7e75297354aa0fdfee97a
MD5 dc4fd30f449255cdceaa8cbf8026fb50
SHA1 5544eb2ee72f8913f053b7d9b1b0b51841da92c9
SHA512 06576ecea5f0535180193975164d01080139e60fb18f9e16fc59700e41726d655bdc64f6d708cd85e2d23f1d2782d59dc2f2c7e9fb672fed30b75d47ebc9a059
TLSH
T1B5E026C44AD9C32FB31C689B01AC670CD391263A97C07A2E1700C684724B840F3AB690
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 85c91956180eb5ecf32c302ab6ef9c2d1ab249af9339a63562614b01bc4af2b7
MD5 87ed80bd9cc2f7050897a7654f772d79
SHA1 cffceaceaf79e643c642f778456a0fe71eba3c59
SHA512 0fb9c228d458c6403fd32ba51ebf045d61e95a1ffc31b815070e07c3f180e900fdee56057fc5285002f9c166ba31fe97c13dd7f6187f7c2937886385e128e41a
TLSH
T17861A480C4D05875FF98403983DC9E7B37F054ACAC875F4E31B6FA798A0AF84A1840B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2e9160f5d4e0e076fbedfd9b1312073305ced3d239e26bc342a19398bed7df28
MD5 2a296b205e8b4abe8415ad159ab22fa4
SHA1 281a54d1e62aeaba6130f06cb513ccefd7a4a4b8
SHA512 98f64e28b6739bf2c5600e1df56ed99183469ca8c0de3347103ad5edb882ed408fbd90a9d860595b2204fa9901c0dfc1c0bd6f9648e13763f61b51ab50832dfa
TLSH
T150616180C4D04C75FFA8807983DD9E7B37F455A8AC875F4E35B6F9798A0AF80A1440B4
MD5 SHA1 SHA512 TLSH

Submit Download

8b90756f-a5e7-4c25-adbe-4f1c0b607fbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8b90756f-a5e7-4c25-adbe-4f1c0b607fbf.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

07d61f28-dfae-4fe4-8282-b9f16ca44063.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\07d61f28-dfae-4fe4-8282-b9f16ca44063.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

43b3af3f-296f-417f-9a78-10da83a92840.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\43b3af3f-296f-417f-9a78-10da83a92840.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6967979f-b388-4449-b90f-a5ff5bd51f59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6967979f-b388-4449-b90f-a5ff5bd51f59.tmp
Size 2KB
SHA256 6b7106a3f3e03a4ccc1391b38625d68c611cc0f3e05efcf13e588e0dc3d3b58b
MD5 6945ec8f3aa542b7b004d23cba9d1d6d
SHA1 4ba8d8f993543410b19895abfdd41c323a2582ad
SHA512 8959c255610d8dd6460a8f8795bea929581deafc0fb5ffa2c646b9b984be29d69491c64da9e87da527d59cd145d0a0fc20ea7c7760c962b05bf582a105bacc3e
TLSH
T192519EF387F8866DC91256F06A54AE2BCE5C0514432C3DAA89D5EF5BA3F3071D10275E
MD5 SHA1 SHA512 TLSH

Submit Download

7c4a6a17-fa68-4765-943f-7826578f2d1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7c4a6a17-fa68-4765-943f-7826578f2d1d.tmp
Size 3KB
SHA256 d260a43bc2771b658f410eb18ce6996d367dff6851e1988be5161dfdf640c03d
MD5 1eee92214f33813e64703134f3a0c20d
SHA1 efbdf153a64d3285b49413b293ec34f74ab69099
SHA512 2460c96d9d710823bad0e0b10f37ad67b61988b74c618e3b32dc4d3e36f96fdd0d6eb92817ff683bd1c9036cdcdbefed23aaafbe5b66e8ffa46315598fafe65f
TLSH
T17061CDE3C7F8866DC91256F05A54AE2BCE5C0914432C3DAA89E5EF5BA3F2071D20275E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e4777846378ba4f7c5dec2f9383fba73bf1e2265568f6fb3157ae87ab388a6f1
MD5 9c376b49966277158358ad6f26c6e90d
SHA1 4d96cafc53fe7b796f5288a12d3fd712ac47860b
SHA512 daeedac7b2480dc11234e54091717c0859361874c8d07ddac38bff12edcf5c710636ed891c9ca41987a71869053c363538530e59ac242c553cfa7002573d0b5d
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXE7vL:OtfFvpopPxrB4RhfEzL
TLSH
T1CAB2261571BA021038FE790881B5972F464232B33259EA3B7FBD14A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b48e5844-5269-4b71-94ca-80f1ff0621c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b48e5844-5269-4b71-94ca-80f1ff0621c0.tmp
Size 12KB
SHA256 675e52dbb51e1a70c32b41cee8231489988cacbb2e718b4213e3c4dcaff2be1d
MD5 675145434577f9034267710a0a961f39
SHA1 a32cefd5635bc2c338e0cf872d90da1ff575a01e
SHA512 ce5880a2ed1205de9532988f738214aac39b970c68d15754327143b30021db41fc3b9748a0d42b5ae881fe56f0a0dbeb169de21aba12a3eb8c3b73cbbc433335
SSDEEP 192:sxZDRTk0/f3sZtFQZZc3zodpZtLHW6+WNaX3/YbIdJuYkuIg5+xJ:sxZDi0/f3sZjOZccjHbu/FeYTQ7
TLSH
T13942E955AD38697B9CCBD209BA15BF52D7FD5032A0D01E48A6FC8A1C15EBADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4508f03-196e-4ac2-9c23-bce4ebb761f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f4508f03-196e-4ac2-9c23-bce4ebb761f6.tmp
Size 26KB
SHA256 5ca099ae4b8f4a20f7a7ae816252027fe620260f9d18c4c0c7263638ec0b455e
MD5 c3241fefe674f6668121e5fc54f1072f
SHA1 c5b96fae1cc831f7b9e0168deb57fbd7a2674ad6
SHA512 9da7cd0cebc01002a25f97b2897e26a2dbfe8533ae932cd6f4fb4821016839619a49a5a7dd3d022c1768f7688ceea86048bcc7d2d391c4cffde4a9c9d664d650
SSDEEP 384:nKiFiZcI63sNr8TUNTUlIm25mgx2GK2fMBVvrWfspHsa+VYWzgL/7Iz/oB:BFQ63OwgS7/BVBHhgLK
TLSH
T118C23A32D898D9BBECEB8BE5A74A7A03DEF04163858C9AC4D6DD5D1D00DB19D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ac9f37a2fa45bf2844dbce624c922a424e697c2687a31834eed33b376de013d7
MD5 2b4c75ab6c5fce82298a44ffb61683cc
SHA1 87ffa0424e89120524e102967884ad67353b654e
SHA512 1d6568c415425c43da545c10bbab49280593693dbabf8ffad8fea9abb13db01a9b852c2666542ced1c21218914429e59d5b447d7568832a663d11a9989b29645
TLSH
T122411759BAFD1148B3B76F9AAFF6A86E087ABD772E06D45D00110D4F0A72A00C971773
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1524-223-0x000001C4AE410000-0x000001C4AF410000-memory.dmp

Download