hxxps://ispdindia[.]org/wpimages/none/bonne/index[.]html

Resubmissions

25/03/2025, 15:30

250325-sxj24s1rz5 10

25/03/2025, 15:26

250325-svk7ds1rx7 10

25/03/2025, 15:25

250325-stqeqa1rw8 10

Analysis

max time kernel
144s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 15:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://ispdindia.org/wpimages/none/bonne/index.html

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_497067532\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_497067532\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_227292827\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_227292827\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_227292827\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_227292827\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_497067532\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_309325343\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_309325343\sets.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_309325343\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_309325343\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_227292827\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1561435185\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1561435185\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_309325343\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1561435185\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873902248612022"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-308834014-1004923324-1191300197-1000\{BE06D7C1-7E83-46C2-B419-0FFF4B41F89A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6136	msedge.exe
6136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe
5904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 2676	5904	msedge.exe	87
PID 5904 wrote to memory of 2676	5904	msedge.exe	87
PID 5904 wrote to memory of 5044	5904	msedge.exe	88
PID 5904 wrote to memory of 5044	5904	msedge.exe	88
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 4460	5904	msedge.exe	89
PID 5904 wrote to memory of 3168	5904	msedge.exe	91
PID 5904 wrote to memory of 3168	5904	msedge.exe	91
PID 5904 wrote to memory of 3168	5904	msedge.exe	91
PID 5904 wrote to memory of 3168	5904	msedge.exe	91
PID 5904 wrote to memory of 3168	5904	msedge.exe	91
PID 5904 wrote to memory of 3168	5904	msedge.exe	91
PID 5904 wrote to memory of 3168	5904	msedge.exe	91
PID 5904 wrote to memory of 3168	5904	msedge.exe	91
PID 5904 wrote to memory of 3168	5904	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://ispdindia.org/wpimages/none/bonne/index.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffac7eef208,0x7ffac7eef214,0x7ffac7eef220
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1820,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2472,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3360,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3368,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4876,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4220,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5492,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5596,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5596,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6000,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5532,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5280,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6244,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5788,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5368,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=6184,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5348,i,12662942844680791170,3823588677063010973,262144 --variations-seed-version --mojo-platform-channel-handle=1044 /prefetch:8
  2⤵
  PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\chrome_Unpacker_BeginUnzipping5904_1561435185\manifest.json

Filesize
53B

MD5
22b68a088a69906d96dc6d47246880d2

SHA1
06491f3fd9c4903ac64980f8d655b79082545f82

SHA256
94be212fe6bcf42d4b13fabd22da97d6a7ef8fdf28739989aba90a7cf181ac88

SHA512
8c755fdc617fa3a196e048e222a2562622f43362b8ef60c047e540e997153a446a448e55e062b14ed4d0adce7230df643a1bd0b06a702dc1e6f78e2553aadfff

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5904_227292827\manifest.json

Filesize
79B

MD5
7f4b594a35d631af0e37fea02df71e72

SHA1
f7bc71621ea0c176ca1ab0a3c9fe52dbca116f57

SHA256
530882d7f535ae57a4906ca735b119c9e36480cbb780c7e8ad37c9c8fdf3d9b1

SHA512
bf3f92f5023f0fbad88526d919252a98db6d167e9ca3e15b94f7d71ded38a2cfb0409f57ef24708284ddd965bda2d3207cd99c008b1c9c8c93705fd66ac86360

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5904_309325343\LICENSE

Filesize
1KB

MD5
ee002cb9e51bb8dfa89640a406a1090a

SHA1
49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2

SHA256
3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b

SHA512
d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5904_309325343\manifest.json

Filesize
85B

MD5
c3419069a1c30140b77045aba38f12cf

SHA1
11920f0c1e55cadc7d2893d1eebb268b3459762a

SHA256
db9a702209807ba039871e542e8356219f342a8d9c9ca34bcd9a86727f4a3a0f

SHA512
c5e95a4e9f5919cb14f4127539c4353a55c5f68062bf6f95e1843b6690cebed3c93170badb2412b7fb9f109a620385b0ae74783227d6813f26ff8c29074758a1

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping5904_497067532\manifest.json

Filesize
118B

MD5
3004ab7c9e3747e5109246e7f6b3859b

SHA1
ac4c574c03611b8bc675e878a1be8124bc32fb48

SHA256
1cb88f273e7906a853670161b6c75fabdd67f67c91b96a78171e2877b88eee96

SHA512
f81e8de5d3010bce31b311de7545353b72a9befd01249cca99e870f141090ba66913991c458f4b5cdfb80902fd116fecd54981cc0a0f4049102247c273f905e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
01cc3a42395638ce669dd0d7aba1f929

SHA1
89aa0871fa8e25b55823dd0db9a028ef46dfbdd8

SHA256
d0c6ee43e769188d8a32f782b44cb00052099222be21cbe8bf119469c6612dee

SHA512
d3b88e797333416a4bc6c7f7e224ba68362706747e191a1cd8846a080329473b8f1bfebee5e3fe21faa4d24c8a7683041705e995777714330316e9b563d38e41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ec3a2b5aed1a25ea282250de8e83cab8

SHA1
35493be0da26f35b8893f39263a63e1fc456bd0f

SHA256
e15411fe7ac9a5eda9e4c6db6600aa4a67e088508e74844a7741d7b47f503f4e

SHA512
20b6770c211ae4385ed45a008b5065a9c2aeeb1795803e3d1b9278d07a4c931c94d39289ba15a92af453a9151fe59aa3c308143bc5858a1fca16205d41fe9ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57d88d.TMP

Filesize
3KB

MD5
0f14142385091fc1e70e71615157e896

SHA1
fc1fb45963325523e0bad896fa334b2e0b1dd4b3

SHA256
f580eeb82670fec2aab3730b0e99c0dcb0c040383b34ef18e2f8307eb52115a8

SHA512
9d64a5446e8910bba04d281bd517035e27199594123b0df69b0d9016401d0895c244f8c84d6f5e7c7ab43ca7cdf607ac9d60ae8f5082633dc20d440f521c3873

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\507076b6-f83a-40bc-b839-4821b75e0ba3.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
dd3130ff2fca6efe71f8056169735448

SHA1
426ca7fa9a02f0fd904d64b5459166e3b33b213a

SHA256
7763e8c979db48a8abe32aa7ecbdddf1aeef29813b8108da64bd9243384b0da6

SHA512
2a8d5f8dd4e9dc4c422f502bac9f3344a52cef9f2737ef1b0aa18f242dc9902606fa91b972f461a7d8b8526b27d6ab49f2bebfe6be3b5d84196bd18e645c207c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
65f15a45a0e26a051fa9e2a50f0c5197

SHA1
245b2aa55d953133eb107499d011ea6592219725

SHA256
8f423fb1fb4f79d9a0dedfade11851e435ef5785817d3e2026c899deb05e5d8d

SHA512
2c224d9bd296bfaf72ae063bdc45875b49551aff06ffcd53f4bb43581669ff44066b59bcfa2282c78f92a76d038cfb0de46d1eab5dcc82cb50bf18aa53a71681

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
e2fb7c20f9d6397d6336447068791ff2

SHA1
92845b5188659e6cfd50df77ff0e3283f5f9c974

SHA256
910ea132db156136392ae1c6b8394d385e895da2aa88e87f9c85f535876c7a6e

SHA512
084a8ab9357d4717c25e7b5a3baf6797f7c9f58bef414717a7c9f968a5950fef11b2b2d81d808b576d435de80107f479f2c9e03be8cd2da14739281f25ee3dc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
3f729c0b0eb75a942084938e6c27ab70

SHA1
e2bddada1ffb2c66638c29a2beb618fc5c0e0cc9

SHA256
4461e4d6f1dea27ebf4793a63f3839c6d35c4cfa4638b52350b46966e5f9ff5a

SHA512
e4e88aea4a073b4b03373f2cc1eb6b672532a7a5de7458345b960d26ed00b73b555b7e5fdbfd24e87cf3273b6b6003690b60c9130fe3440f6210775de36537aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
a6f9015e7f837be1c45b66a6924be70f

SHA1
801341338aecc66d2fbb74bed777d464b342a494

SHA256
a7da1c6ee207d2a399c7b004375937cd2ddeeaff458851b551e054de789467f1

SHA512
bfebf2bf66a642916950a52ea57649e607d1c377bdd308fa5a5020658e8cf9968b31164f21ef9390a1d638ecbaff61de5fdb51a00f8b7fc8dd48be1836f2beee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
bd523e41e60dec5c0eb609451d22d749

SHA1
ac2f0cd8ecf9303e8ae7cc81633e5d5f8bfdfec2

SHA256
00e798d4c5ff55b8ced9ae63f70b84ca24f27eabb253787b12a6bda6c41d6f5e

SHA512
435605f659d385860faced6ac34665fcfb6c8ba06011647ebfd62b23d4340f5e0368d4e22f236ebd0b86aceb1e8b08cfa128b4fd235c9cbf6e08c2f0bf5ddd7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.3.10\data.txt

Filesize
113KB

MD5
60beb7140ed66301648ef420cbaad02d

SHA1
7fac669b6758bb7b8e96e92a53569cf4360ab1aa

SHA256
95276c09f44b28100c0a21c161766eda784a983f019fc471290b1381e7ed9985

SHA512
6dfa4eca42aea86fba18bc4a3ab0eed87948ea1831e33d43426b3aca1816070ecb7fd024856ad571ca2734214a98cc55e413502b3deef2c4a101228a7377e9d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
469B

MD5
c1990fa82c4fd1cbebace0c8d52d9499

SHA1
0613ea0b2f1d754d37b862500db36fde16e5485b

SHA256
a84c1c254fca98cb1d0f818fedff2a35520b4ae8886a322bc83390cae7028684

SHA512
a3c560211d0ef9e017da2265834fdc4958155d6875e878ceb4fbe2192878afd5143ddc33eb0ae4c3e697df2e45923e0cbf5db57bc5904da67cc34aa986a0f486

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
23KB

MD5
9010de66bc8de43d92d79b95c3447bcd

SHA1
03c202ccb7363569b445437b968a0977c3b36313

SHA256
0926858dd99e027fa9f7f4f0f2cd2188b450fe1e26cc396bad56e0a57ecb0f7b

SHA512
cbf4dca5710a21669746e918a692b5c8bf151bcb16e0e37206fc1d874e56a0b6c91ff96ea233aa3091921401943faf25d0057e7119c36cbf35fa83eed1246324

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog

Filesize
902B

MD5
06b622486e12443219314e76c264720c

SHA1
37052f17faf16d22e02b1e89f582327401a3212b

SHA256
e00f80d9b7b5293588d407edc5ef605b4750c357084b90c7fb23e829270362ba

SHA512
8a6364a011200e911273e421ee9b7e4b72d02d8100a0721e59699abb791975da992f6f684363a4d310a254f8675f8021d7bc8a29c7d5a49d9c72cd4b1cbee92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig

Filesize
19KB

MD5
41c1930548d8b99ff1dbb64ba7fecb3d

SHA1
d8acfeaf7c74e2b289be37687f886f50c01d4f2f

SHA256
16cee17a989167242dd7ee2755721e357dd23bcfcb61f5789cc19deafe7ca502

SHA512
a684d61324c71ac15f3a907788ab2150f61e7e2b2bf13ca08c14e9822b22336d0d45d9ff2a2a145aa7321d28d6b71408f9515131f8a1bd9f4927b105e6471b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
49KB

MD5
b7f7982cc8d406d9d5657aa1b236dc0a

SHA1
c643f0978200b7d3177c10bfeaad4eeb2a52fcbd

SHA256
4e1541f2d43e0ba81dfb09bf1db2d5aa425f12ba79737c9b5e3e1a4000d75442

SHA512
e565cedf3f68f4b2043b02071f1e8dcb490a9434ab7bc5e95d98e7c0af19ce03c326f27172b4d6c8240acc68b4194b014e2a11dcafe91a30d37db63ca7b1d860

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
50f7425995ed4b704b777d5e8c0e8b70

SHA1
1ec8edfef9f9ba2a73499468345a4c31cf9683e8

SHA256
ce7456b7fe5abf2e916a287394f9c93c39e9c2f0913adc393b0180b7c7272f76

SHA512
a52aba6fefee6d076b2d3a5b4a6216a9b1a1c682803350ef310d0a91f759a825d7851c370056bfda6501d062d635fa7ffb9d891dbd07c1954bb05ae9954f0c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
55KB

MD5
88d0f1a0eeda362caecbc67c845329c0

SHA1
9f746b7d1c1c9f0ad431a80f027ab631d78a43b9

SHA256
06900434ce22d87523db1e8eb87374e04b76e8421cd2d52a967b8852a6975d74

SHA512
4fdac6bfe6ff702d22773c38c0f61c7641004e26bc501ce8335bf90513a3aa44975ded35725c35ae003c84cd8d638f7dc950698e62632621800f2d41368b747b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.1.17.1\keys.json

Filesize
6KB

MD5
bef4f9f856321c6dccb47a61f605e823

SHA1
8e60af5b17ed70db0505d7e1647a8bc9f7612939

SHA256
fd1847df25032c4eef34e045ba0333f9bd3cb38c14344f1c01b48f61f0cfd5c5

SHA512
bdec3e243a6f39bfea4130c85b162ea00a4974c6057cd06a05348ac54517201bbf595fcc7c22a4ab2c16212c6009f58df7445c40c82722ab4fa1c8d49d39755c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.3.25.1\typosquatting_list.pb

Filesize
628KB

MD5
c26015b2460d1acf6859aad730dc8f4a

SHA1
9c772753b62eaf995e39ea5ce1ef86454b58f169

SHA256
5d816db5713aa5d2fa0c1de5461729250439d7609d95bd65623c0ea62da192c7

SHA512
ef72f6e7a4ac1eab4c59ef0d90f884e29880a305ca262869b87a90462897d182a45b38fb074d704205a422cb886214c05aea6d0701715917b3092cb15559a6d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
c97844dc16e25a2db454c9504d86f0fc

SHA1
986e20d80924bf93617bc5203a2d62988f93c754

SHA256
dee38aee832d08f8c6ac9b104f1c68c8c8f8db2eaf865d0b18e524e3604708ca

SHA512
bc2935824d2bfd97529c11d73a0c848d0dad92073fc1f71a3b0c640c863b131db433eada79d9cae2fd649de18d0b5503688c44cc1ca02c9718b7663799d553cb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit