hxxps://grffyux[.]s3[.]us-east-1[.]amazonaws[.]com/z[.]html?cms=chris[.]yc[.]zhao%40apexshipping[.]com[.]cn&auth=gl3FtmqughaAgPmssbKMAGSaLfTgdpul95zH2RUvvl8IQyKmbscxEuhF1Dm3IOxB24daHx8bqFfHgm2929Yh4IgwvM2ziKIhsMN4xmrhMQ60277nuVMiXcrjN6DbDy4SU83L9zy5G0lWXtDcEOgQakp6AVrNwpdkLq8nObg08OdkPZeSnGSgp5MbdcCMo1woUMOMWPI8eXnNMDaiD1MLWHWUhr23da1dTpKBecxr2pV6QoWPnUzfU0mXU8cnNbj6ChvmsVAC5LrCD4dXfZe94jGddBhjGOzckXVu5ZJrpzj9itVeah6A7DzfWQ9NvtrjPSic2B1g9kd28GP3L4nQXXF5Ffk6a7

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://grffyux.s3.us-east-1.amazonaws.com/z.html?cms=chris.yc.zhao%40apexshipping.com.cn&auth=gl3FtmqughaAgPmssbKMAGSaLfTgdpul95zH2RUvvl8IQyKmbscxEuhF1Dm3IOxB24daHx8bqFfHgm2929Yh4IgwvM2ziKIhsMN4xmrhMQ60277nuVMiXcrjN6DbDy4SU83L9zy5G0lWXtDcEOgQakp6AVrNwpdkLq8nObg08OdkPZeSnGSgp5MbdcCMo1woUMOMWPI8eXnNMDaiD1MLWHWUhr23da1dTpKBecxr2pV6QoWPnUzfU0mXU8cnNbj6ChvmsVAC5LrCD4dXfZe94jGddBhjGOzckXVu5ZJrpzj9itVeah6A7DzfWQ9NvtrjPSic2B1g9kd28GP3L4nQXXF5Ffk6a7
Sample260701-e7qezset8p

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
42	api.ipify.org
40	api.ipify.org
41	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4644	msedge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3916	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273541209932301"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{5A11200E-8354-4E26-A169-050CF14AC35B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe
4644	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 4644 wrote to memory of 2280	4644	msedge.exe	87
PID 4644 wrote to memory of 3916	4644	msedge.exe	88
PID 4644 wrote to memory of 1016	4644	msedge.exe	89
PID 4644 wrote to memory of 1016	4644	msedge.exe	89
PID 4644 wrote to memory of 1016	4644	msedge.exe	89
PID 4644 wrote to memory of 5028	4644	msedge.exe	90
PID 4644 wrote to memory of 5028	4644	msedge.exe	90
PID 4644 wrote to memory of 4444	4644	msedge.exe	91
PID 4644 wrote to memory of 2844	4644	msedge.exe	92
PID 4644 wrote to memory of 4444	4644	msedge.exe	91
PID 4644 wrote to memory of 4444	4644	msedge.exe	91
PID 4644 wrote to memory of 2844	4644	msedge.exe	92
PID 4644 wrote to memory of 2844	4644	msedge.exe	92
PID 4644 wrote to memory of 1620	4644	msedge.exe	94
PID 4644 wrote to memory of 1620	4644	msedge.exe	94
PID 4644 wrote to memory of 1620	4644	msedge.exe	94
PID 4644 wrote to memory of 4428	4644	msedge.exe	95
PID 4644 wrote to memory of 4428	4644	msedge.exe	95
PID 4644 wrote to memory of 4428	4644	msedge.exe	95
PID 4644 wrote to memory of 972	4644	msedge.exe	98
PID 4644 wrote to memory of 3776	4644	msedge.exe	99
PID 4644 wrote to memory of 972	4644	msedge.exe	98
PID 4644 wrote to memory of 3776	4644	msedge.exe	99
PID 4644 wrote to memory of 4164	4644	msedge.exe	101
PID 4644 wrote to memory of 1608	4644	msedge.exe	110
PID 4644 wrote to memory of 848	4644	msedge.exe	111
PID 4644 wrote to memory of 3064	4644	msedge.exe	112
PID 4644 wrote to memory of 3804	4644	msedge.exe	114
PID 4644 wrote to memory of 3804	4644	msedge.exe	114
PID 4644 wrote to memory of 4548	4644	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://grffyux.s3.us-east-1.amazonaws.com/z.html?cms=chris.yc.zhao%40apexshipping.com.cn&auth=gl3FtmqughaAgPmssbKMAGSaLfTgdpul95zH2RUvvl8IQyKmbscxEuhF1Dm3IOxB24daHx8bqFfHgm2929Yh4IgwvM2ziKIhsMN4xmrhMQ60277nuVMiXcrjN6DbDy4SU83L9zy5G0lWXtDcEOgQakp6AVrNwpdkLq8nObg08OdkPZeSnGSgp5MbdcCMo1woUMOMWPI8eXnNMDaiD1MLWHWUhr23da1dTpKBecxr2pV6QoWPnUzfU0mXU8cnNbj6ChvmsVAC5LrCD4dXfZe94jGddBhjGOzckXVu5ZJrpzj9itVeah6A7DzfWQ9NvtrjPSic2B1g9kd28GP3L4nQXXF5Ffk6a7
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffd884c188,0x7fffd884c194,0x7fffd884c1a0
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3650051879427442990,467055637361060008,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,5533050407395405010,6888191812575479653,262144 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,18409721645419638777,3446206413047494429,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,6230107437128255160,4153895852315933168,2097152 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,13736405533067728719,7972189893474503515,2097152 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,7605142524054022002,1655072538677530477,2097152 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,17782244047303964519,6032889056785087715,2097152 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,12287555023406283839,2585278439958010543,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,15595171961779120975,15650581954053781381,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16047971565260287756,17144101676946797194,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,16047971565260287756,17144101676946797194,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,9771218856651495673,772869793770837171,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,11547104744403698414,1658830735714533272,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,1330052381222576123,13816441463359795481,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1212,i,7199909835306340927,17115704475917596665,524288 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6224,i,7345186015396249025,1839826262788078660,262144 --field-trial-handle=2316,i,16756974478842314643,14353942495385922105,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 12cba1d0d85816bceeca609ed874dcdf4ea43be8bad77355de08b534e25e4f70
MD5 eb422bd5062877f755f342bd2a6bd914
SHA1 614f3ffbe30f1585f77299924b90d9258ca80ec6
SHA512 5bac057c0345874165c42378ce9fd8d8ccf7844e10cb4549dfec866b8a3242626b43f0601ea58fd8aeaf40f5005b7f544e0a1e0fc463e9f92cab04d6f59ca378
TLSH
T184614DCB0A0644B1FF2501B0DDE0D6903573C49C5A1F19DA0D005775B742BE1CAF67DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585762.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585762.TMP
Size 3KB
SHA256 ea6814e18da69ffe20e6f56cf6855bcd76a22a9a77dd7aed3cc7ab15bfc425db
MD5 f1ab803a472aaec58207af31c87199df
SHA1 48c5542ed2f14dfd4836661ac214fedfaaaa3b81
SHA512 b1c6114729f7f0e6661fc208536448e09e1e469e9c64752889296f1bfe22e39255801c992ed5a653400abeb5e57919bf88aa2bd8d51e3e8a7a01633be608de09
TLSH
T181613CCB0A0A44B1FF1501B0DEE5E69035B3C49C5A1F19DA4D145775B702BE1CAF67CA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d3513a0b025e9063f40949e0270fe5899abbc3dff721dbb140c966409412878c
MD5 0cdc143ea747c3e0c9a18dd8c30eeaf0
SHA1 ea94ceed130251d9ab7369dc76bcd390c88bae01
SHA512 8b516c514db0d260f4f6235ab6874708fea428d9d4b0b8ad5e16db4aa6fcc71d1d717dc48b6ee32f4b738f2889d49dc87c8d676da07e4a5ddf2c798407bf2f64
TLSH
T1EB31ADB387B2952E9A11D6F1AA28FE1BCF1C050A036C785E49D87F1393A3971E005F5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 662886863ffc868226795112cb4d63ecca4b4f66ea67ef7c65ff35cce2e9f63c
MD5 c80e86e97e569e16b0a3fecc52be3430
SHA1 237e62c745c426482470111cfab11ef4c347a622
SHA512 f2c81d7fa6f4110700427822a8a81ac1f17297461c653a7f414aa764979a4c2a3a538437fd3ba45faaff879969261976c5cc062af4d740a334bcd2753fd4b5f4
SSDEEP 192:sxZVUsRIHyM/jK1Ml8MkYx/f4AseHCpVDZUIdpuVwHW6+WN9VkU/YHcfVjERampn:sxZzAMC/fts4EJhHbP/u9
TLSH
T1F052C6166A3499778CDBD309BA55BF53D6F51472E2900E44A9FCCB0C05E6AED320782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bdc0ac38acd2dcfe9205c031b89fe59dd110c43a2ee450c6fc62d65a04d1f5c8
MD5 8d1ed58fe8fa308054b99fd040af72bf
SHA1 574173978c5ba0dec1155f6f9ef62b7ab5fa6964
SHA512 f16ca26f4025e55333c914500cfc3dbdf06461898f7a5612787fd23ff9b19fe506f91f256f46a9a08373d25a1d19e54414f9edabf60d74be701e5a2da2811fe5
SSDEEP 192:sxZVgsRIHyM/jK1Ml8UQYPkYx/f4AsY3HCZ5VDZUIdp0VwHW6+WN9VGcdYHc1VqG:sxZHAqFC/ftswWJTHbFd6S
TLSH
T14852B6166A3499778CDBD209BA45BF53D6F514B2A2900E44A9FCCB0C01E7AED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0641ff6b137fa50965637d3f74028db9aed25ce4342038f6592c57dccac48156
MD5 ecfeed7efc41ab7bf8fc7216188e885c
SHA1 4973e6214f72a8f1198ec397d9f4f4f987c8a07c
SHA512 9b50ba1cc011cdd22bacd138413855ccdced6a5e5b07330a83fb6024013b342c6f589de4edd8d95e0b469213ef38c0acb9f5d74661817c5d151083a022259c59
SSDEEP 192:sxZVgsRIHyM/jK1Ml8MkYx/f4AsY3HCZ5VDZUIdp0VwHW6+WN9VGcdYHc1VqE3SE:sxZHAMC/ftswWJTHbFd6S
TLSH
T18852B6166A3499778CDBD209BA45BF53D6F514B2A2900E44A9FCCB0C05E7AED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 aab8910e393b567037c263cd2992c285e6ff732067e5a7dfe46c639d70756ad1
MD5 47f03a54469c1b08dd5444647a54156f
SHA1 974771c427277ca80b9befe6dd5df98a871a6a2e
SHA512 f686e437db66370088e62148087b8c9050d4aa5501816d9fc860e6b130811ca1527b8db6bed4a91d2f0096f4cb4d005db8029c2fb49172593e69a05c627364fe
SSDEEP 768:xcUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4ReroVE09:xcUZYTMWvg0Pou1ja7eLZmR1V9
TLSH
T114D21B3B280CCB7E4F844E5DEC2AAF867DD801CB5A984D5447EA894C03C76EB112B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 8be6f66bc825f3fbf55dac803c3b4bb889037decac8e42849b81cde39506f27c
MD5 5ac7d60a7c611afb93abce2fd63d5736
SHA1 c88de971f97c756d003621464af6545ade16de3c
SHA512 b74ae146b0beef3c6085cc19c55202a92c7e208adadc96df96d5a22c1c05689faa2c1b3b9bdee6675a5e46586a4061ab265ea5ff9506cf111f1b928644874b16
SSDEEP 96:KA1eK2AIhWKi8i2tGKOYrkPwE+e+6g25JS06K6PSC6uEsRqUzHIDsoqiS2git9S2:Eol9gJBdjsJ9rhhY1ahl3cgLyzLiVhmg
TLSH
T15FF1470171FA06523C7F3A0C91D6AB569A8172637214E42F3BED01B64E7AE209DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed057d7b-3366-4618-b643-1b9259e0cf17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ed057d7b-3366-4618-b643-1b9259e0cf17.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8450bb7f146fcfb615f22adc552aa1503f00081fab2f0ed8ed364f2fca5fbb01
MD5 768a835a5cfe439afa790d74f4a4b5ee
SHA1 c53b6ae04d5c9fef366734d2f92d5da91b41ff4d
SHA512 385baaa49c3c20d0d94b575cb985dfafd04233e3cc3b37e2423f371eb57d1934374a1b40ebe96fb6c84147a96f569f62e9d5278d3fe8bf007eaef6c5471f6b60
SSDEEP 384:4tNn/s3n9SfsNX5rPAkFu44zX5od+zOIdqXX0IidKzvaJxR0:4j+9UQPAT4gOyO0qX78Kzan+
TLSH
T109927D3369249D674DE2A598F54B3B279FB891B7E3422F90D1DC2F1C01DA7AC230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3452571f6df0131dfc4a372ada1418e13cff2528df2ba8bd38e29bf04e0221c6
MD5 d55ae97a1e8e6309cbf698b178327aba
SHA1 30f476858bd15d06a281c3a0677d73536c57ad63
SHA512 14aab41d98a2571d2ffd66adb2a1ac151cff2809325f77df4c48276fc6bcd14795580c85b3f53fc05bb4791d58560c9825ea558ddda579a265d3fedf51df9bbb
SSDEEP 384:iiF1tNn/s3n9SUzsNp8TUNTUlIl8rPAkFz44zX5od+zOIdIXX0IidKzvaJxR0:pF1j+9DgwgwPA+4gOyO0IX78Kzan+
TLSH
T161C2F8F259D78936C99E5B47A73E2E138EBCD1A3F6416A50B3881A0CCD861BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 35f7f5bf67b4b3711fd444ff7dd97767a2fee487d758a71ec12a99e7d4aa86ad
MD5 f80b2f73d640a95c2228b7367bf76145
SHA1 280c09f86ac2631b66274de99cd249de0c3ddc70
SHA512 0822ee60c904ff3f5963c05bea77bf5fd9fbf37756d898fdf39cdbde88898f9e5ffa75917854ac4584c1797eb14b2cb41d67bed9eed45152bb1abe3588adf0fe
SSDEEP 192:yONZ61VWQmiUyVGVegGX5Obd+jvOIF/aiw3+YU6:yONZ6WqgGX5od+zOIIQYU6
TLSH
T15802E83568286C67CEF2BE49F58777235FA4206BEA512F80DAEC1B1C00D769C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c417348741e21727cca21477768575bd7a99e023a18115b86b9c699c723c465a
MD5 9b872a4b1cfc4fe71bea78b07a8e0ceb
SHA1 00e02a7d51a73ead97fd8161c6926fbe875b265b
SHA512 32b357e2f91d23fa715cfc2b3519c99af272c14fcd93862535e5712bfd3840c4abbd27474c2fe32d247c2f6659554292451a14450e8615a7be6401379b2d4608
SSDEEP 192:fCONrDS61O6WQmiUyVmVefTGX5Obd+jvOId8jJiBqxU6:6ONa6I0rGX5od+zOIdUXU6
TLSH
T12A12FB326968AC774EE2F994F48732135FA55167EA857F80D5DC2B1C01EB69C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 df5821921d8e8607d258ef5e0d7f40f9e631dcaac353c483b5c5ecd587d92ea2
MD5 9c1a9ed57faa619ce2a2c9dfed886b87
SHA1 3df635dc7ac528872512032e8c438d0f856b46db
SHA512 7173e41610e0b8a0ac2b1a0714eed6baa8de38d05807bf9c02e2c726def36f765e6bfd4af19bd73c06a9a83bea24b8a31c9784af9eaafdd944edf6f3aa3c5e62
SSDEEP 384:CtNn/s3n9SfsNX8rPAkFu44zX5od+zOIdqXX0IidKzvaJxR0:Cj+9UBPAT4gOyO0qX78Kzan+
TLSH
T1C5927D3369245D674DE2A598F54B3B279FB891B7E3822F90D1DC2F1C01DA7AC230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cd2ad6ea30c60d43968593ed5718575556bf16ba7ee774bea620507abd3c918a
MD5 19ad9aaf5199e402184c951cf57d8e62
SHA1 f8e4ea110f9b7e5816d244c235b77ce7102c5ebb
SHA512 11e8a8edf7b05374b5c7b76c1f293376ca670095f86e37851173a96a8442479fff770577d0b367bb4af524ff59a5367f60289cf848ecbe07318244a3d5bb150b
TLSH
T15D412C68B7E91148B7B77F569BF6A86D887BB8372E06C05E10110D0F4A23B01C861B37
MD5 SHA1 SHA512 TLSH

Submit Download