3de7ae802f4e79ee688723e0ee99e26bc986f59984719843b61c6bf5c361b410

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/09/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-23_805e495da109513f864b414aa25f501f_mespinoza.exe
Size 2.7MB
Sample260924-gpbj8afd55
SHA256 3de7ae802f4e79ee688723e0ee99e26bc986f59984719843b61c6bf5c361b410
MD5 805e495da109513f864b414aa25f501f
SHA1 fdddd40942c7138477b5c0d5efe5b458ef799604
SHA512 543df71ccf5dafb02e6bcdef6746cb97679f2aeef6ce7a6fe18ce1693f4bfc49fdf3cb110dda98a17f8c96adadab2e21ffb8871b227b93b754d6adc81844a5ad
SSDEEP 49152:ALSuF8IZ9lNQt1QajqOoQ+pTFNgeihK92TmLADw:gZDgYgea8RA
TLSH
T183D5AD9AFA5741DCC059C4BC87079B5AA630389A1F14E6EF01D856B82F7BAF51F38309
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
10	discord.com
17	discord.com
20	discord.com
31	discord.com
43	discord.com
9	discord.com

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5520_2094236994\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5520_99928417\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5520_99928417\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5520_168110380\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5520_168110380\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5520_2094236994\deny_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5520_2094236994\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5520_2094236994\deny_full_domains.list	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347031318044696"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{ECB98D50-2C9B-48F6-9487-81FD340C7387}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5520	msedge.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5916 wrote to memory of 5520	5916	2026-09-23_805e495da109513f864b414aa25f501f_mespinoza.exe	86
PID 5520 wrote to memory of 4256	5520	msedge.exe	87
PID 5520 wrote to memory of 5556	5520	msedge.exe	88
PID 5520 wrote to memory of 3016	5520	msedge.exe	89
PID 5520 wrote to memory of 3016	5520	msedge.exe	89
PID 5520 wrote to memory of 3016	5520	msedge.exe	89
PID 5520 wrote to memory of 1316	5520	msedge.exe	90
PID 5520 wrote to memory of 1316	5520	msedge.exe	90
PID 5520 wrote to memory of 5884	5520	msedge.exe	91
PID 5520 wrote to memory of 3468	5520	msedge.exe	92
PID 5520 wrote to memory of 5884	5520	msedge.exe	91
PID 5520 wrote to memory of 5884	5520	msedge.exe	91
PID 5520 wrote to memory of 3468	5520	msedge.exe	92
PID 5520 wrote to memory of 3468	5520	msedge.exe	92
PID 5520 wrote to memory of 2492	5520	msedge.exe	102
PID 5520 wrote to memory of 5156	5520	msedge.exe	103
PID 5520 wrote to memory of 2492	5520	msedge.exe	102
PID 5520 wrote to memory of 5156	5520	msedge.exe	103
PID 5520 wrote to memory of 4376	5520	msedge.exe	106
PID 5520 wrote to memory of 1960	5520	msedge.exe	117
PID 5520 wrote to memory of 2856	5520	msedge.exe	118
PID 5520 wrote to memory of 3292	5520	msedge.exe	119
PID 5520 wrote to memory of 5228	5520	msedge.exe	122
PID 5520 wrote to memory of 5228	5520	msedge.exe	122
PID 5520 wrote to memory of 2172	5520	msedge.exe	125
PID 5520 wrote to memory of 2172	5520	msedge.exe	125
PID 5520 wrote to memory of 4068	5520	msedge.exe	128
PID 5520 wrote to memory of 4068	5520	msedge.exe	128
PID 5520 wrote to memory of 4864	5520	msedge.exe	133
PID 5520 wrote to memory of 1696	5520	msedge.exe	134
PID 5520 wrote to memory of 1696	5520	msedge.exe	134

C:\Users\Admin\AppData\Local\Temp\2026-09-23_805e495da109513f864b414aa25f501f_mespinoza.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-23_805e495da109513f864b414aa25f501f_mespinoza.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1487474867912839439&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%3A9587%2Fcallback&scope=identify
  2⤵
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x35c,0x7ffeb007c188,0x7ffeb007c194,0x7ffeb007c1a0
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,7077950016624202370,12042455994209716715,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10220402130378944103,1026417982161872816,262144 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,7572035117483013680,11026922745600488651,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9584912629207986587,9374474158370916603,2097152 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
    3⤵
    PID:5884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10755076125821754721,9647761084245427404,2097152 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,17644763602625309424,12701064900778909454,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
    3⤵
    PID:2492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,2950435551901706184,9071532389447318252,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,8376176696065193490,402416379636198951,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:3708
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,8376176696065193490,402416379636198951,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,3954795769664563092,1321324984478322275,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,16700387213721624640,10593424615671745004,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
    3⤵
    PID:2856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,8238436562181052152,1339113730143226384,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
    3⤵
    PID:3292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,17984384963445972102,8466041382804765891,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,14939163984705231219,13926065803784735471,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=852,i,17626950078516252947,13608959485988511857,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
    3⤵
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5644,i,6472359869490640720,8271442744356555295,262144 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,10753153933101672326,9042282745328453750,524288 --field-trial-handle=2192,i,11638088913405503495,7730048132169965472,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
    3⤵
    PID:1696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5520_168110380\manifest.json
Size 118B
SHA256 f40a24d5c9f1188be55ed33af602ab23868f69014eaaa8c66dd9e0b7e7eda0ed
MD5 eccfa0022c321905ac4db22a780a86af
SHA1 39e56d8e3211b32dcd5eb4172775653a38a9eba1
SHA512 72942e1f0b5cee1f760e90cafc25b1a7d0a2b2639f121c10674ef354e5835a9cf6fff92aa57720ecf67fba21e00835dd105d45f3387d35e653cb87b790d369a9
TLSH
T1AAB092B00C1AA03B22809760ECA0668283F8021AE8025B1E088036481F8827881362B2
MD5 SHA1 SHA512 TLSH

Submit Download

deny_domains.list

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5520_2094236994\deny_domains.list
Size 12B
SHA256 f51a7acfffec56d6751561966d947d3fd199b74528c07dabdcf5fcb33d5b2e85
MD5 085a334bdb7c8e27b7d925a596bfc19a
SHA1 1e4ad53dc335af5c6a8da2e4b4a175f37fafe2f2
SHA512 c883cb43c97a136825c6fd143f539210c234c66f9b76dfd8431f6ff014094e20b9410d7462aadee2344df8ca158def6b9a807e7cadbdfa947f6f8592e7283e34
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5520_2094236994\manifest.json
Size 177B
SHA256 0e9ec9e79542b4a26ff5da5ff91ed23c0fc9d4ee655cc135b64726daafb364a0
MD5 b06cf477c7639438f14301777daaaeb4
SHA1 77f7a86139f01bf8838df12e4c839143c0958932
SHA512 526576792f56bae509e5de7936815bacbdb262884c7b06110b5ad649b8ea8260622eba0244043ee6a972395297cbcbdc830cc105bd2526b619885c6c0ce42ce5
TLSH
T18CC012DFDC509DB119EB4332156D43C4D733CF0B1546450935FB66082E25985C193500
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping5520_99928417\manifest.json
Size 53B
SHA256 7612538ef6ea25a2078adf4ebda2b0565546d80189b6af46bb0e1c9744d720d5
MD5 46b34a0f2dbd5b58337d4cf05bdb4797
SHA1 b190fc81ede34f9fe8f4f5dee1b915331b76cc19
SHA512 49d0691d8eea580f863190f3073552b74bd550ec8b0a1b748fa0c5a18f05a515390735264f62f1aee0590017a1e4e85e470c32bfd49dfd371a47d1493ecab664
TLSH
T1B79002600414921716C10E906571B895A391661955850D1D04551558029586CE150298
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 799e19c0ae6de3befb0fd4c45e05f8f2279fc0ce2a04fe07b1c3e58811937dd4
MD5 d8ad5cf6f7e614ca042adb7ff7f0a244
SHA1 ddbe2ff0f3667e41f0590af2996cc0cacbb0f76f
SHA512 e18c3f8d25acf0c41c79ff63d848e283c607eace333c3b6436c7b7c2cb3d1c567a2d0f973eacd7d57ede6ade314a103b5b80397ed734ba409cc4d4593b9c30df
TLSH
T176F02DB5CD25BC7B08FC1B1950640B46F75113572780888B3B3D911D8FB1A3B868682C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 af0530d99fc02f467e15106781eff393e5562c5addb5d54c4ace756509f65bb1
MD5 769c41773c33aef1f22e755b4ef0e37d
SHA1 074921c10bb67bb0b25a15fdc88cdd8d7ad623a7
SHA512 f65734af72106279eb27873300641b272825ef755a4bcb5aaeea448fb8edcf4adf6ea2a9a2b2b43009c85c29918cf68b3766e46d434b156924c443a768417a59
TLSH
T15B8173A4369058F0F77C6830D9D85247BDF4A1EC3D933E091457F678E96A7B8E0B0860
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590e00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590e00.TMP
Size 2KB
SHA256 ece8866c4dd44c8f712ec56e8e7c676136e9e4d67313b578ea333e2f27e49636
MD5 011eb002ea7f8784f5dcb6049e93fa4a
SHA1 028fdca6032d98e2be4cf2c2766ac455f51891ca
SHA512 8b8d1c0c240dc99ed8d9f94e6a211a8c09d2e1a30d235d4592dcf21089e9a0976f79c5f3b9c8405158982b3c8f237e046a41c7404d25bf510028c47dea5e21c7
TLSH
T10F51D7B87A9088D0FB6C4831D9DC2287FEF485843E931E461597E8B8A87A77CC0B1850
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d950844f54600fc3c0275b994cd6aec3c8af125ffca75f7994959e96d10199b2
MD5 d5024f3dc4d3e9ed8db2d8d23c383a92
SHA1 7b379837b3808ff5233ccf6fdbfd66e5fd48f849
SHA512 b6620d163fda27f57a3099397571e0e8d7fd9ca6adf1142c6819f8e3227d99d9739d52360890ca7f3710c668b517ae633656f3b074b47968417293d97d2b65ca
TLSH
T13E31D1F7C3E4C66E890096F0A718AE2BCE2D0914432C7D9AC5E4AF2B93E3471D14159F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 29ff4708776ba7f84791d6cc5854e479acc9378f805f5abafdb6cd250158fa48
MD5 6aefca6d28206b9b10ed9c04cb0b916b
SHA1 56e943cc7e37f0c1835c49d38df84e66cc0f5cdf
SHA512 63e51fd6fa6dc5a173ac773d59d405f8946d83f259f3d63fe3b19682c2adaf1156cf41f52e92944663df372d4b58077e83418ee611e81ea3bf2cf0602f104cb4
TLSH
T111519EF7C3E8862DC91196F4A7187E1BCE2D0954432C3D6AC8D4AF5B93E2471E28159E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1f4ccb3ec543af4ed97374509cbdd34dc3f1c73a8934aa3e40b7199fe4fa8096
MD5 6d06f0cdb8d6970555fd9aeaa2832eb1
SHA1 2c7585d08a886fd366c6ac23e63469edef91a115
SHA512 54aafc6a21c0aff296befb39c07a59c394e1f94567d4fa3cf4bcd4b7a7b650758e74b4130274248c89a5bc1d626e22d4567c074d63454ea4ef474860ff0e3e52
SSDEEP 192:sxZxaRlj3/fAxsCQZZNINXkzodp+JHW6+WNz9t/YbIbFYKWIgjgJ:sxZxa33/fAxsCOZNUXKHbv/FZY1jE
TLSH
T17D42D815AD38A97B8CC7D219FA55BF53E3F9507290941E44A6FC8A2C14E7ACD230741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e7d7b765261da0883e62be311f93273a12892e2904bd1b014d869377936d9d88
MD5 56b4d1fbfcce55b6bcc81deea62f8272
SHA1 31177bce30dcd0b4b02f3e63347a7b5994e788b6
SHA512 ab558baea35609fc64007f879d23c682bd5c45a448a90735e002daeec34781db36a356245f2a0b6bd1fa084c15218fbeff2166996821af262180b7b91f537b13
SSDEEP 192:sxZxaRlj3/fAxso/QZZNINXkzodp+JHW6+WNz9t/YbI8FYKWIg5gZ4J:sxZxa33/fAxssOZNUXKHbv/FKY1Ac
TLSH
T12542E815AD38A97B8CC7D219FB55BF53E3F9107290941E44AAFC8A2C14E7ACD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d3c79291ab8f5ded0b0af41180f9c8b24223342375e454a9906897ccc097e991
MD5 11ad3070388edb7a7b68bab8a2d2d3b6
SHA1 de3bd06cae9601a35dd28b597c087638b152dba0
SHA512 ef358ab65da347392421c158346dba528df47ef9d5f8d2d96bc18b5c86fff10c6f0a66a5272ff197b1762023c72ea87c174e717d45c6782722d1547295e95a27
SSDEEP 192:sxZxaRlj3/fAxsoyQZZNINXkzodp+JHW6+WNz9t/YbIbFYKWIg5kgJ:sxZxa33/fAxshOZNUXKHbv/FZY1mE
TLSH
T12E42D815AD38A97B8CC7D219FB55BF53E3F9107290941E44AAFC8A2C14EBACD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 97a874382790281b83133c922ae7558d5c19fbed49bab293b3a096284f80da0a
MD5 0ea7556a95f6898e441bb9604cd24039
SHA1 9f96a8d1e7809539d9c0a0e23293250e684c4a65
SHA512 e513507eeaddef7bdeafd6c36d2f5443272441f9e2b8a1760b4e2e06af99e92e311c21859ac5be3e08772399b080bfd88b0db10743fe6de4683f1ecf143c778c
SSDEEP 768:0RyktjU7pLuLbvnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4wLWLlMC7fnroX:0RyktjYEbvnWvDBttu1ja5wLWLywf0LD
TLSH
T1ABE2EA3F780CCA7E4FC04E9DDD6A7E8B6DA802CB9698894047FA945C02C67EA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 4bbfd97696ea80f2b3dd7116b1e52db678257a52ddabd6cb988b5819541a5854
MD5 b172725815fbca8c574c30bb70995dfb
SHA1 16d1d1496c700382630818872d06fce6a6c5c796
SHA512 e0f08cd33b80d43f1515dc37792cd48c722b4c2997ec4d0cb5b3584bdde69b798353211c22a5e9248d551851ab17cc5e4ee17877e7f738a6fb953151fe67f9c2
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXgDP8:OtfFvpopPxrB4Rhfgr8
TLSH
T17DB2351571BA021138FE690C81B6872E064232B37158E67B7FBD14B69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.25\data.txt
Size 152KB
SHA256 4e932235a6fefae59866c98f69253bf2d3d0e7e2a2a9ae546685bc4646f9a297
MD5 b5394eb229ba53caf4fc321b5087e299
SHA1 b84ae45b51a9d200639a10ea487b1ba9b94ed3eb
SHA512 6e6f890c6fc57d470e2bedaf5b022d13e54762c8d424a4a43493b7eb68f2d22be2a1641f5ffa25a1756fef938841ec50c908e97161da28158a2c7e3b258b39d0
SSDEEP 3072:wPAgDcCHaLHl65aynyosxb3+BLvf55rOiWF4Vkia/UFwK:cX1aI5aZoKzMDXrOiW1igUB
TLSH
T1AAE3F240C9D0AFDDCEA8161C90BE0F1963E1CA8EC13A958ADB23FD4B6FD3A045A175D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 d61c6117f39a4770fc02fd2d96663f9ff99517771b1826228138e3b046bef364
MD5 3d9f676d45f948a6db889dfc1b7e788d
SHA1 65af10e843f64ed7176efbd1707f3e74c8009324
SHA512 561ae1a6a38e3641cbd139eb8aaf835addaf5679eaddf18513a29a0e502fbae2d291dd4e6ff3d37daaffc580ccdc0106f2055889c2e244753c94e27118a8ba1e
SSDEEP 384:nkiFiZcImY3sNV8TUNTUlI4A5mgw9g4zfMBhFd1rv0cLMYPcz0/upa7dLKk6AgLa:/FQj3kwgmBOBhFdOc4Ykz0Sa7dLKk68/
TLSH
T17CE2A3F198E78976E8AE4797A37D2D0299FCC163B4884984F7C54D0DCC821BFD70A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 0b6b6159e357a11641d21581b7d606abbdfd033bc69c49a2bf02d523391ec661
MD5 19eee90bbcb5c69f3209e52779e072ad
SHA1 31d39f896fed8ad401a8b0b34d7a23f4378015ae
SHA512 c0b1d26a3fb6eb70b807331f71f9d9c1d34970dae1c8b2e790d499eb28d548e7825abf3132aa50b271a40868c346f134ea1cb4b54286670e344f6b8b45165746
SSDEEP 384:nWiFiZcIu3sNV8TUNTUlI4A5mgMwg4zfMBhFd1rv0cLMYPKzEON+gL/7Izlo1:9FQu3kwgmgOBhFdOc4YyzEAC2
TLSH
T138C23A71E8A9D9BBACEB8BD5E74A3A43DEF011A3858C8AC4D5D95D0D00871DD170BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 43ca4d8ef65de5ad4be67367e67d13a429f1df85ca444173ed4c758a53180c23
MD5 2241bf377bbc7b04dcfadd00ce25b1b8
SHA1 2c0e0e475bd7d5a57184501f9b82a50714d992aa
SHA512 b5f007619aec0cd30b9c1f24d27a2b0a78990cb81cffdb8c16c5630f2ed80e0dfd54a4aa536b8f12adc95278a5e6549342b3cbe6cde1691886535d58a8e636c6
SSDEEP 384:nQiFiZcI63sNp8TUNTUlIm25mg5bn4zfMBhFd1rv0cLMYtPsa+VYdzgL/7Izhop:rFQ63wwgSIxBhFdOc4YtPhg++
TLSH
T195C23972EC98D9ABE8EB8FD6E78A7A03DEF0016381DC59C4DAD85D5D009319D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 57c473b062cd4ac72b1b3199212396e44fc42d7dcf7551003c5f8935e0b2ac33
MD5 3d1352668a2c7c9ba92574ff32bdba06
SHA1 6b863867c182ee56e95a93c394737b7b7ce5450a
SHA512 688d8642ed7bc14b89db929c48a0d53e927c66633515dc4f591a2e69ba80fcf18e968999f9f6a7c74b1afbf42ba9cef19465b8ff35466e054ece2db6d30cbd3a
SSDEEP 384:n1iFiZcIu3sNV8TUNTUlI4A5mgwwg4zfMBhFd1rv0cLMYPjz0/upa7dLKk6AgL/y:8FQu3kwgmcOBhFdOc4Y7z0Sa7dLKk68/
TLSH
T177C24B71E8A9CDB7ACEB4BD5E64A7A43EEF011A3858C8AC4D5D95E0D00D31DD170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.9.23.1\typosquatting_list.pb
Size 1.4MB
SHA256 8edde56330fcf8d3292ca20a8020c89e23f8835eb5c088e0f837300f1f81b6f1
MD5 ceea696b4fc3c8532f115da4fafd13c0
SHA1 025f9003c572e2cf3c01b1456c6b13789aebc57a
SHA512 57267a43a339f784bc9250bd8cccaf9af834b0cbb3f16768c8f5c3c9861a34755fab633545e06d0e4f843524b326cc3cc79f581b5c903f7866c9791b910b0388
SSDEEP 12288:sJH1o/AtTKm9uuIE8juZOnUniHSYKoDJcYz:3gKm938j+OnbSe
TLSH
T16265B5B9DFC00184DBB8112D20BE71D8181412A540E9DFEAFE7C859F2BC6AC977E45E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 9564e6fb4eb883201ac503fe5bd9fb287137c349216aad920bafa4ac4430615d
MD5 b7aaf65a01a2d87fbcf9804c5b4577a0
SHA1 d1e1d61f0b22833e63c6136e837e9b47a3dc1ec4
SHA512 8272a33fc1fcd6d377fdf4c6ec244aa93d355b1450e4df54b352d7e2231a5951548c747f75f9ef327622d3a85fc53e3d73fdd6d1dbc6bcb71ddbd0f71b22fe50
TLSH
T1424111E05C3C1AD1D4BD0DBEB49735EC94EC9722B8A4343D7858EDA89A3A50E214083F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 a00d72fe546bf342a8d1917f267e374d24012b0780fd2528cff9d35d605db679
MD5 b3b8dfb5085cec30c39fc09b47ee2f78
SHA1 9bb6f243f330f5eef7f7db7c863cc0653d7869b7
SHA512 8d2ab99cc859e0684f3994914a1c871431ac2f16b6c9a6cbde8e36a6897eee8422ea9c7d08b63b5a6883175922aca8f3409598f4288db70942664d149e34cbbd
TLSH
T1784124E05D3C1AD1D0BD0DBEB09739EC94E89722B8A43479689CED989A7A61D604183F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 7c951369a8a85c4eefa0d436c5028512724cc4d226d6786023f08c373ecb7b3e
MD5 f5ed10a3883deb99cb39642c58d8bdee
SHA1 86cee67f4e7c3f024c6b836095aef3a0a23a35eb
SHA512 4cb267177f8b87dbabffbbf299758e1b16cc8f87b894de8edf7d5e70c5ab89f4eeb90001925c340d81cc415bae7646e1479952e2bb9a85158d2cacb070e0c989
TLSH
T11A4112E05C3C1AD1D4BD0DBEB49739EC94E89722B4A434796859ED98867A61D214083F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 56127b3a58e212b439681fdf30cdd6ae795ac81c386a3120f7de9b6a4c70cf13
MD5 717c9dc1e945eb95f918788a9843af36
SHA1 20979f655b540eac22de52bfed38ee431010076f
SHA512 0d59e4ee01c42439253008310f1c19d68957a06e84a47e1a8a3113ec37f74689a4f5912ae175d8cb01bbbe6ee0aab151727b9c49ef287c48f32ed4ed7812e0e7
TLSH
T10C414A58BAE91148B3B76F5AAFF6A86D547AB8732E0AD49D10010E4F0A62B40C871733
MD5 SHA1 SHA512 TLSH

Submit Download