hxxps://speechma[.]com/

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://speechma.com/
Sample260720-xj87asdy21

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
101	ipapi.co
102	ipapi.co
106	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4048	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290472672114321"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{85E28D98-A8E6-4346-9BD3-147108B3F5A8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
436	msedge.exe
436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe
1360	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 3832	1360	msedge.exe	87
PID 1360 wrote to memory of 2292	1360	msedge.exe	88
PID 1360 wrote to memory of 4048	1360	msedge.exe	89
PID 1360 wrote to memory of 2292	1360	msedge.exe	88
PID 1360 wrote to memory of 2292	1360	msedge.exe	88
PID 1360 wrote to memory of 2552	1360	msedge.exe	90
PID 1360 wrote to memory of 2552	1360	msedge.exe	90
PID 1360 wrote to memory of 1440	1360	msedge.exe	92
PID 1360 wrote to memory of 1440	1360	msedge.exe	92
PID 1360 wrote to memory of 1440	1360	msedge.exe	92
PID 1360 wrote to memory of 3056	1360	msedge.exe	93
PID 1360 wrote to memory of 3056	1360	msedge.exe	93
PID 1360 wrote to memory of 3056	1360	msedge.exe	93
PID 1360 wrote to memory of 4428	1360	msedge.exe	94
PID 1360 wrote to memory of 4428	1360	msedge.exe	94
PID 1360 wrote to memory of 4428	1360	msedge.exe	94
PID 1360 wrote to memory of 1208	1360	msedge.exe	95
PID 1360 wrote to memory of 1208	1360	msedge.exe	95
PID 1360 wrote to memory of 1208	1360	msedge.exe	95
PID 1360 wrote to memory of 3776	1360	msedge.exe	98
PID 1360 wrote to memory of 5012	1360	msedge.exe	99
PID 1360 wrote to memory of 3776	1360	msedge.exe	98
PID 1360 wrote to memory of 5012	1360	msedge.exe	99
PID 1360 wrote to memory of 2380	1360	msedge.exe	101
PID 1360 wrote to memory of 884	1360	msedge.exe	102
PID 1360 wrote to memory of 884	1360	msedge.exe	102
PID 1360 wrote to memory of 884	1360	msedge.exe	102
PID 1360 wrote to memory of 2476	1360	msedge.exe	103
PID 1360 wrote to memory of 2476	1360	msedge.exe	103
PID 1360 wrote to memory of 2476	1360	msedge.exe	103
PID 1360 wrote to memory of 2100	1360	msedge.exe	104
PID 1360 wrote to memory of 2100	1360	msedge.exe	104
PID 1360 wrote to memory of 2100	1360	msedge.exe	104
PID 1360 wrote to memory of 864	1360	msedge.exe	107
PID 1360 wrote to memory of 4864	1360	msedge.exe	108
PID 1360 wrote to memory of 4248	1360	msedge.exe	109
PID 1360 wrote to memory of 864	1360	msedge.exe	117
PID 1360 wrote to memory of 864	1360	msedge.exe	117
PID 1360 wrote to memory of 436	1360	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://speechma.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffd884c188,0x7fffd884c194,0x7fffd884c1a0
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,599518633919947411,9170140054665777068,262144 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,3869322338325154349,2795896509076968460,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,10599924753714435162,12063123727448911425,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3392889921521627624,8060577395605136786,2097152 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12943180175195722582,6202089526080446530,2097152 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,18005675691126379437,405430994634091539,2097152 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,16461006655227330439,18066273235965570367,2097152 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,7142276729141578068,12022668652812729158,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,13181127036575400796,17619367172377760638,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,8317023536934016291,432501801844624341,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5572,i,8317023536934016291,432501801844624341,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6348,i,9469922707477059531,5875125644668406659,2097152 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5956,i,2938742443078646933,597935489447117674,2097152 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6520,i,9694236710906547071,6663313095155966141,2097152 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,3814750544282262075,9633963826074530150,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,13795676352578479464,574599572986075727,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,6971678102022765204,12911019246815629881,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,5143750655081770922,18004729874816797005,524288 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5256,i,9008362533142399442,13949898606014464261,262144 --field-trial-handle=2316,i,1561483013519598276,12527360596479229699,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 612e56f284743b2545c033c1ed8ec6eeacce68aa60732fa309be7a3df7ea53b8
MD5 456f40db5007a78ed3da583e59a4a9ac
SHA1 b17736b3fb55e9f91190f4876cc1755964028347
SHA512 888971baaea207519c7347bc2ca10aee1aae68bde5c0c3393b36cf8c61388c36680618edcebaadcb60114841653b71ccc76f7458a974d6e7c9d63d90fce13165
TLSH
T122815CCB0A0A44B6FF1601B0EEE5E6943573C46C9A0F1ECA48101771B702BE1C9F57CA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589cf7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589cf7.TMP
Size 3KB
SHA256 8d520a5558940369b8fc9ef352548d05959e324edc9e3ba9eb662aff43e5e877
MD5 0c55cb516e0fc4cde5acdf4badb339f0
SHA1 703def390277470131433067fa4ad2423636032c
SHA512 26ddcbf8ecd45dce575e4aa82d7a9bf5648da7930e2e1fa0f1a29d26cd6c99cf56f5515f86d6fd67ccf90f6f5ce2e5e786e2b54081a03662651a71ee53fcc0f8
TLSH
T11C613CCB0A0A44B1FF5501B0DEE5E69035B3C49C5A1F19DA0D145775B702BE1CAF67CA
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 41f7baae1e132f9605e607a0bd0c1bd13bb1459d48c9094c307e9d9a352d2aee
MD5 2ea6bdc5f8166855399601d63c03a7df
SHA1 a5ba2980f30d94cf7ba08cb27102c03aa2fc7476
SHA512 f775209127ea7d5aa69e81bb391198e280779e3dfcf606aaff11a52f81bf24a372ee484904fbe869565e8995bdc2531e1ecdbd8363533c52304d14373a787879
SSDEEP 384:DI0KYfT8HkeSKeQeWVqHGpOm38e/ICNu4AGG5rgG4s4GVcyL01Gz32CR27GKSv0b:afGPHb69Fl
TLSH
T17D6289F787E4662D8D2156F0F61A2D5FCE6E0D1892183C6E88D4AF1B63E1470F205B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0331cacdd6f344409016919bfc95ee9a0c12ae4cf3f250752c68886aad0ab559
MD5 a081d7ff0b464d3a179e4473a58e2b35
SHA1 e83ba629637a9ddf0225455f0d8b0ae5169a0039
SHA512 43a7d85a0d2264fbbe2c77032d6bfd8214744ce315c9ce35861fea803cb065815318127da72293073b7c216dd2565a871f01a409b6487065b8a7992c2b0e5472
SSDEEP 192:sxZIazRLQyM/jK1Ml8MkbB/f7QsMEi7IEEIdp8IuHW6+WNbI+f/YH3MI7fn1hIg9:sxZNmMV/fksMEi7jOHbB/y9
TLSH
T16C52D6166A349977CCCBD209FA55BF53D6F90472E2940E48A9FC8A0C05E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 077f6214220c55baea50231dc8f9a443b188789621833a9f7c64ae213ff1111d
MD5 ca92318499024e5e6268db4c2336eeca
SHA1 6229228c24e12c00acdadf652a80cadc9ec0b6fc
SHA512 70e21f874669a16162235ac6ac866c58cbb5cef69820668889226c60b54febb09b3e731b9a2c0fdeafb708951eb758ab8f0edd587b4614b3b200747f258c918b
SSDEEP 192:sxZIazRLQyM/jK1Ml8UQbkkbB/f7QsbqEidOIEEIdpSIuHW6+WNbI+f/YH3PIif7:sxZNmqbV/fksOEisjgHbB/gR
TLSH
T14752C6166A389D77CCDBD209FA45BF53D6F50472E2900E44A9FC8A0C05E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 06612a1243b2f0fb7630cf8245ea64b5798218b81f223f2f4c0f7c04542f7788
MD5 fa771ae7032609f6cc5f14f2350c732a
SHA1 cac6c8727ce43a33cbc41ab14ef3e1e7e12be6c9
SHA512 c3fb30eed5ecae0ad8f8967985f82772c9cc3d85a4807ceb21b79a5f6be16e2ecf5cf74ff6bd9d4bc0dfa2083076628365b46e8fce59c09d2222d9fc7b1aabf4
SSDEEP 768:IDUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RrroVg07:IDUZYTMWvg0Pou1ja7eLZmRY17
TLSH
T146D20A3F284CCB7E4F844E5DEC2A6F963ED801CB9A584D5447EA894C03CB2EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c0fece84631c95118ae2d586d95496b03d2561a5ab02164ccd200ced9f8ba879
MD5 c076e0affbdb98a43b83ea319c1e491a
SHA1 5287d1a6d5a06d3ac9a63d5e49c085d20906b4c2
SHA512 36eb88aab19f57b51daabdb244cb5236dd6690b26fafb3b428eacf78caac3a76045154c0b0dba018564c4e21a652fdeb3d6a7328401946e5ff2fb3002678eb9c
TLSH
T16BA002502154C011D0A402B455D186453B206C6053017B12E7D10CAAA850159C116501
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 91e8208c174413cb85f09949454c4ff738270406d8a6dce19a981346567ebb46
MD5 461cfd53d2b462f46e09795bd636aee2
SHA1 01b7bf8a3d6c90e110d4df12501acc7ff186ce75
SHA512 41920b954865cca2d859322ae8a2588adedf83b5d5cbe43c0334061f5e47ad53363d9b51689fb3220a9f64c505e61e6422568c316b49881c2d6fc3d5630c9f29
SSDEEP 96:KA1eK2AIhWKi8i2tGKOYrkPwE+e+6g25JS06K6PSC6uEsRqUzHIDsoqiS2git9ST:Eol9gJBoX+r3Bp
TLSH
T146D1E60271FA02513C7F2A0C92D6AB569E8172637214E42F3BED04B74D6AE209DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 152B
SHA256 76f07d9d7db2316bab4ca693062bd743229074074b9d6c125cf4eb9920a7b814
MD5 faaafb92b4deced8c9a8181a5b41a9f7
SHA1 fe1cf8fb07a908a5ac3087270403bccd71b76034
SHA512 4c6457fdd5b11a335003b1f97050a93730f91523afcc5554159a7f30140124755084585cd573cd0476fe2ad5a4a4e727ac5fb632cbaa7f2e3fafad62d88fd0e7
TLSH
T163C08CE30910488B4B34ADC96054731EE547928C8CC4CCE4890850472034A226446A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5876e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5876e1.TMP
Size 159B
SHA256 7fab666875545ad00034b70dca60d61a690389189fe3f24d637f3e7458ae1faa
MD5 2b458887690f284522ea8693fab185bf
SHA1 6eb95fc9f54986ab0d0b018e1ce4992c17ee2605
SHA512 29149ebc3010a1e798417699555108a6e635222c58ef206ce96f52420d884a719be9a44346294cf26dcbeab9db812734e223fd81d20337567cbe346c8c1889ac
TLSH
T1A5C08CE30920088B4B30A8C66064738EE5878E9C8CC8CCE88A0D70472034A23A949A24
MD5 SHA1 SHA512 TLSH

Submit Download

5cc8f32e-3666-43b2-bd1c-eb07d7f8234d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5cc8f32e-3666-43b2-bd1c-eb07d7f8234d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ac1fba7425f3928407364384448b63fa69e0685ff15a8e05626b9488229c46aa
MD5 0489340a5928e6adde3c09327882d8f5
SHA1 25a6691c60624e104a5070b7c27842c4977b5657
SHA512 3bcd97949a838a4b0bf3a184bf7a0bf0eeb2a37dbbf2845160649ff143552ada6e1b10aacb821013b6d8bc354516f35a93360051753ac0c5ecb07bd07ed1b2fe
SSDEEP 384:VtNn/s3n9SfsNFtVvB/V3zX5od+zOIdMkOObjI9G6w7GE:Vj+9UQLOyO0Mk29MGE
TLSH
T1C1927C366C38AD734DD3A9A5F58B36278FF8506BD3852F80E1DC6F0C05DA6AC5316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 072bbd0320c3c4fce6aac6037537be653d731dc63c9f455dc22751e185250577
MD5 fb607c62417af69d4ea0eb39d5240b5d
SHA1 f475c182bc09bdc32b00caaa4211edda7c7ddc37
SHA512 71bd8857dac4cb51e3d5c74c55bc54699b14ddea6a50b68ab5143ddf7facc94e31977c8756ccca5b74e1931a47438197852cc18a6b03be4299449ef7fe961760
SSDEEP 384:AiF1tNn/s3n9S8UzsNf8TUNTUlIlYVvB/Y3zX5od+zOIdAkOObjI9G6w7GE:bF1j+9aewgvLOyO0Ak29MGE
TLSH
T13AC229F258D78976C99E5B57B77E2D178EBCC067B6816A80B3885A0CCD861BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2f6b205593d0656936109667a9b8f81efac731057844d6b897945a0834b6b439
MD5 d31c4b1fb323306a2af9e8d9503f4282
SHA1 312ef32c11f5d7e9aa854d0b7a8deadedd4bc508
SHA512 24357eb6e81f2c3d6d723e68b6384e090a4b203bd1bf0adc6fbd76ce9380842ab7675a4367432e6ef1f3b162aec540c382cf119a4a78eac22006e635c1643896
SSDEEP 192:yONZ61VWQmiUyIrIugGX5Obd+jvOIF/aJS3+YU6:yONZ6WbgGX5od+zOII9YU6
TLSH
T18802D83568286C77CEF2BE49B58737235FA5206BEA516F80D9EC1B1C009769C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e44d4a356007a191f19276a377d3f16704bd4e73e12eeeeed271341116747f7
MD5 c0fb4aa2b51ad51c0e0be371171e2105
SHA1 05e2c91dcfd739f71562c0552f685ef69ad31cff
SHA512 420cf7ef1e5465575c015c2b043c7324c8179319a35736797ef6778237fc6f01389b1ea3d9c00de55f57f9d7da6866e846b6163370c424c84b6210eaad4e8949
SSDEEP 192:XuONSR61N2WQmiUyI9IueyGX5Obd+jvOIdhjJJLqZU6:+ON46tRFGX5od+zOIdjkU6
TLSH
T18012FA366428AC774EE2B994F48732135FA55167EA857FC0D5DC2F1C01EB6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 48dc958d2e6a29a86860d5a577a458e00fc139ca7231a10af8443e48349eb1fe
MD5 ad60ef6553a2e7bd0b57e1208c18d08a
SHA1 c7ff967ab24339d889cde3e5c07730a4eeb07636
SHA512 5dba6bcdf19fdd1a692da272225bbdb2bbf3f0b4c25340fdff51276bdd02bf77f46707d328a1c26c8a9c5294a404ccaeff4289203bd3fe5820539dd98aa1d951
SSDEEP 384:ctNn/s3n9SfsNFYVvB/V3zX5od+zOIdMkOObjI9G6w7GE:cj+9U9LOyO0Mk29MGE
TLSH
T159928C366C389D734DD3A9A4F58B36278FF4506BD3852F80E1EC6F0C05DA6AC5316816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c9f53c8-adb0-4fd0-9d69-e8d5960e8c5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1c9f53c8-adb0-4fd0-9d69-e8d5960e8c5e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ad7a162626f65bceaf813c47c77491a95fdbcf8b1479fbfd26934bddc85f6525
MD5 186381816f321a5c5437c78995d3f3f9
SHA1 845bbadde008b5c4f66cab9f53c75cac395dffbb
SHA512 cc1b40ce68777d01f4e0998106a049eb0574351f98fc749826bea8e39978bdd30d2332742246f9b2919ec9fd0ebf5aa2f4c34f2126a6cf8c1eb2a0776f8a15d8
TLSH
T176412A5CA6E91149F3B76E5A9FF6A86D887ABC772E06945E00410E4F0A62B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download