ateraagent | b248e4a7dbd681c28777a7d318bd0f1c06d7a7fd27f46daa02a1136fe21676d3

Analysis

max time kernel
148s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20251016-en
resource tags

arch:x64arch:x86image:win10v2004-20251016-enlocale:en-usos:windows10-2004-x64system
submitted
25/10/2025, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 13KB
Sample251025-phcspscy3d
SHA256 b248e4a7dbd681c28777a7d318bd0f1c06d7a7fd27f46daa02a1136fe21676d3
MD5 c88f517d241ddf9691237ed7515b4739
SHA1 077748b1fd09a2c34a12d144ab58fd2e8c06397c
SHA512 9bfc264b5e7cfa948bff047b29abca92671d949c029537362cce5540bd1aac2543e8e92cd59905530e94460497dee8cc7f446dd0aa15c1f0d5bc4abc44fe182a
SSDEEP 192:Jh0ND2eX0s93o/m3o/eMb575aMb22kBBuGE2xGz5K92lN4u12QHhy:JCQekD5eM974MCBctwkltQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery ateraagent rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Detects AteraAgent 1 IoCs

resource	yara_rule
behavioral1/files/0x00090000000242bc-54.dat	family_ateraagent

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
55	raw.githubusercontent.com
56	raw.githubusercontent.com
58	raw.githubusercontent.com

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\shopping.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\shopping_iframe_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1692738465\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\shopping.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\edge_checkout_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\edge_confirmation_page_validator.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\edge_driver.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\product_page.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\shopping_fre.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1439737267\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1439737267\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1439737267\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1692738465\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1692738465\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\auto_open_controller.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\edge_tracking_page_validator.js	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134058683712463206"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-756542885-431777018-975678197-1000\{79E71C6D-772C-4158-8A0C-B714AE7D6273}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4620	4296	msedge.exe	84
PID 4296 wrote to memory of 4620	4296	msedge.exe	84
PID 4296 wrote to memory of 4800	4296	msedge.exe	86
PID 4296 wrote to memory of 4800	4296	msedge.exe	86
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 4380	4296	msedge.exe	87
PID 4296 wrote to memory of 2004	4296	msedge.exe	88
PID 4296 wrote to memory of 2004	4296	msedge.exe	88
PID 4296 wrote to memory of 2004	4296	msedge.exe	88
PID 4296 wrote to memory of 2004	4296	msedge.exe	88
PID 4296 wrote to memory of 2004	4296	msedge.exe	88
PID 4296 wrote to memory of 2004	4296	msedge.exe	88
PID 4296 wrote to memory of 2004	4296	msedge.exe	88
PID 4296 wrote to memory of 2004	4296	msedge.exe	88
PID 4296 wrote to memory of 2004	4296	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffa4695f208,0x7ffa4695f214,0x7ffa4695f220
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1928,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2288,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2632,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3408,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3416,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5024,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3636,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4140,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5636,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5512,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5652,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6260,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6260,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6396,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6352,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6368,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4292,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5768,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6012,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5876,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5668,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3612,i,3563181246919220937,11146886725118951498,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:1372

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

data.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1439737267\data.txt
Size 140KB
SHA256 27dd78ee466ad514c627b5315dc6806283618b517721e20c680a5eae85bfa087
MD5 42a86079936750ac5819d88b242a3b57
SHA1 27b6b4baa864c3ef3dca2118f57f2b9263bb8ce0
SHA512 513f0c9d1b7d37893a4336e1f3910ea59c1ab21ffe77e1995b9efc26c3a16a09a0bb91292298dc224c5fc2c160519ae93a5b69ef5bf5d225d5a4b32e81d560d8
SSDEEP 3072:KOmkTNO7NHrMziBxfPURO+/bAipYbzFCSJL+yNxadxI3kX5ONyzsSU2tIYz:K7kMRIziBxfPe/sipYbYByN8dxI365jD
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1439737267\manifest.json
Size 53B
SHA256 6099008680f5d76ff2c21b93b06183b6082f91fd3afd5c8324f82afcf9648a53
MD5 4101fbac1248b1946a6f67a4e6c1ce14
SHA1 11a4ae615df907e9e6bcc72c57628992cfec8375
SHA512 c07b192571c940905db291df91e641aa89e551ac37bd489baf5347eea01a92a21dcf1a8285d73b8d41c40f13584327e5665ccde6eb53dfd23a1dc2bbaedb1ecf
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4296_1692738465\manifest.json
Size 119B
SHA256 8ed6c5db7f988cd2a969e1134ed165c7ec9e91a61ff0f81fd5e9e8e82eec568e
MD5 a2c4cbafc5420b3bb657efca716adcf7
SHA1 b8d2f6c3fb218fda78824e1e6f4826d3d34c4855
SHA512 843431c4c550c8185b8ae46cfcf42d36e4992a44251b34942b3f7d5506c6edb50c669ff575dee18f21424ad64c1a0d17a7a047026656837445c1204ad571691f
MD5 SHA1 SHA512

Submit Download

edge_checkout_page_validator.js

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\edge_checkout_page_validator.js
Size 982KB
SHA256 0822a7c2065b9b584302061a5da963c11c17b011ec60d9ff071ce816cb85a20a
MD5 7c216e6b24c62c857f18864f15aca57f
SHA1 b5ce68574883b4d7153b2c393e35b637a9b1b52e
SHA512 a8c1a704e4b24fa08b78948cb28a419b3b73e64e1757d2b0a21094a17a93bfa992835ea52c696280a3a7a2038130c13562f538a03e8df2fc3c1c41ade7767702
SSDEEP 24576:cs41wRApBLvGKkrQAfHQQMlwaEBvE9kPL4w60w4xuV6oapGq9KLRzHEiJsfasuP7:cs41wRALLvGKkrQAfHQQMlwaEBvEiPLO
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4296_370236460\manifest.json
Size 145B
SHA256 ff97da55b41e5e90a744457737c4eb1adb1daaf982ea49790a456d46be721914
MD5 29e4a0bc87a15659245ca3f4368c7c68
SHA1 7a187cce2cee985bd647fda8ea84ae6efca7f0aa
SHA512 bb9d841167f0894c2879784406553a2392e66b7c23d31ab962f893aa68771eea9635e8e9d8cb34eb1e9c02f106eeb248c8f1dae1d5e711a07bb029f835577546
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ced387eaa76e6be8d625335b51a1984cb392649a91262901b7fdd38e61c0ce98
MD5 32f70bf1456b1bd2761eb3d369276bc7
SHA1 e5020a6506e0ec89c259cd8c9f0d946e164759ba
SHA512 362083606c719e02fdd1bb699ce3d1ee1bac8150d99845b29c28012b96c9257a7af4891d1cab36bfbde370a98a3fae9dd14ca91a0bba2379d68c5de00d345242
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f3e34a910aff592d6e20f637c61b53df9b2fa463cd8485af54dd13df9ceb4dcd
MD5 a27247c66055dc9926f6893673edbc4d
SHA1 79b45202b4f9294dbc807a35d630eda14e8eee78
SHA512 7cacdd4914b9a23c7abea94f498b57ffc6e085fd418aeadd98436414092843b060b17df4a9d169f69f6ddb17aeec8b51a3770717b91acfc6a783c23ef7e2c5e7
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fdafe36d9f9878e8924f011aadc3a00801955d2d12b67455770e513fda841fa8
MD5 de355c3321acd9942ccd6664c449fa7f
SHA1 6b848cbb556f1eedc3ea03c406fc3e3397ea530a
SHA512 9199b160481f9a1e7ae2323adf1b7b42a49a4c724065515ecb239b3b05839b59a2ccedd40b0a2747dad5524d74b6783d18df7a85cf59e984a50a42c0e842b05a
SSDEEP 192:sV7RB7yMqv/K1Ml8UQUu0sVjSZ4jV2VzoZ8pzmHY+WNre39gr3D6S0X5KIgCZJ:sV7wqX0slcW2JaHSreN9JKk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 368b52f10e56d6a0e15f9b624b9e54e9ebc4f96d4f91955ab960246b08ccf335
MD5 fdb0ca5a4d1b84561b167d6a4ee518cd
SHA1 aeb46ed6f2757cea10c69651a0906c1ee470318d
SHA512 02c4eee797929e9c298c0fac7944c22f696c4774b658076b12b5fd54846fab0660e219b2b31b06faf6d3c5de169aff45e90103ab4465cbac01e2873b0f1e655c
SSDEEP 192:sV7RB7yMqv/K1Ml8Mu0sVj/Z4jV2VzoZ8pzmHY+WNre39gr3DMJS0X5KIgLJ:sV7wm0slhW2JaHSreNBJKd
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 7fa04d26c36312ae7a58f9064bb94c7e15bd916c55d3cd9eb2d4df898fed6513
MD5 47aac97b13f47db4a1e3ebfbfb3d9bc1
SHA1 476012f944fb27405109473158f442f8fd4795d1
SHA512 79dfa0a11980243c0ec561d15024024f9952f7e8421ead14529c566317df2712c4e7ef906358248b5cb2302b43191978f639c920f9370429a93c59eaa6ce37e6
SSDEEP 768:BnHxUWbk7pLuLlVXWF3RHd8F1+UoAYDCx9Tuqh0VfUC9xbog/OVVh1GLlUS/OnC2:BnHxUWboElVXWF3RHdu1jaqh1GLiIOnz
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 fe74c424149a018068f8521c86c95eef1aab3f192d113419b792c1b3952b68ed
MD5 636c5428306ad39814f3c2bfbda3055f
SHA1 bed0805521d4332d5cf0bfe576fb17eb4560d7b1
SHA512 bd12a07164c06dd3405b121be6e19b295179f1b7d9c03ea0278f8de4b60d2b2359e78b4adba95e94ac7494493282b6792764be130df383ee7bb9b638f634fab9
SSDEEP 192:/jZ3SKvOEghkQSOCXmTkI8OaIj6/ANXN67v9/TuL4fnlnRNg7uIg:F
MD5 SHA1 SHA512 SSDEEP

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 466B
SHA256 b0eb8997eb1f63573cf92d991cacef91e0e5cd1c1941259df47e10e141486938
MD5 7d9ad7c59c2fd4e9e118480bbdf5e531
SHA1 f9406db44d0e27581edcdd0435f9fbe705108fb1
SHA512 33e76a5cd194bf51117d213344853cd595790bb32b9525bff3b1c6a718b8ae0ccd5846ec6fb828011c1a7cb628b3ea17c5930ab1769e936787fb9ed5d265d518
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 510d6ef4e39c0b170c0abac211ea8cfd9012230be4306a0d6ef382734e02dd06
MD5 64923b6354bc6ba44fa19e520e796efe
SHA1 45d59c3f22a9cf4550ab07ffb935fb77c0574dc9
SHA512 0e076e6ad9ceabc24850a4946f5b09f36f1568d955b3bc871e55c555f0ca9efbf966e120dd68a1dc78c4ad5ffd1cde74b85379d0960e880dccade27739cc68b7
SSDEEP 768:9F5BLv7I5wCPFdV6ZiSPCgMIazZ3xIHZTqDTyQhONjwsaO2g:tJUV6ZB2E1qfyoQjwx4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b64d9777c1d1b49a6691fff439b2626555afb0843e23f8e86ba27ccc9afd0800
MD5 1ce81e188f8f9176e8ca93923c85b0a2
SHA1 7586a133e1f9b4dd9a4b8b56c7e6804dcc410dd0
SHA512 a279656e41871f17be9da4453d778b7a399eb85aaca761592a7c74f2f9c7a5749a486f8a1439e26d0096a4ba37f1e2794c70002ba280d8e119b53e5754c7ccdf
SSDEEP 768:jF5BLv7I5wCPFdV6ZinPCgHIazZ3xIH0TqDTyQhONjwsaO2g:jJUV6ZAtEyqfyoQjwx4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 99a71b9da213306c83be8cf413f81e8920f583bb0c26e4234ee76fab1c09f884
MD5 d52537682369031f46fada3317bbb9cf
SHA1 f0d2d1aa30338378f99b211ba9e84cb51a7d6d1d
SHA512 85f525ec93fea6a0f2e44df4673b83ecab4e28c3aa8f06ebfe6a45e39f4ed4db766ac984f79d9a542eb2b78d2b5bf41f0e5df9c37ce1c5b49eca823c1c35f907
SSDEEP 768:6F5BLv7I5wCPFdV6Zi63ECgNdazZ3xI4ImsaO6jW:KJUV6ZL3PElmxpjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2025.10.25.1\typosquatting_list.pb
Size 1.4MB
SHA256 56c035566c4bb9c32e521beaff8302e407e1aa28c5a21edc2852308304bccf75
MD5 9dc38ee42e89a72b268eeecad09e282c
SHA1 4865101a8363ed5dd2b6bfba27d8cb4c57ae87af
SHA512 6be51fb2f62c22a049ee39de86659453e489d558012a9e3a5e01ac6d472505d01a15d831a255346092346ce98ee994426935f665e7b37e6582c58ebbd3125657
SSDEEP 6144:Z6iBsPJiF9ImRSG3+Gdjt06ojt2ky5ZWLjjDwVd5U6534IlPuGCL/LsjeLXgJG1V:ciBciF96GOG3+y5Za8HLjRgPBSYS1jO
MD5 SHA1 SHA512 SSDEEP

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff9afa7985342e7df2343cbd719e4d6485ce770b12b02dbb2a18ac1a50df9d87
MD5 2f3467ba73bf90c3515c709b34dc455c
SHA1 7870baa2bc41c91898950ee4dec56de4543fb3be
SHA512 91dd027612fe095ea49d47edcfdd30e4a3ff11c48c5261c70736cbd11b2a6261c3d03635a663baa16e1ddae1553037cb2dde7ab9d6c02dcb86bcb22a7c4f0c14
MD5 SHA1 SHA512

Submit Download

Finalized Agreement & Payment Terms.msi.crdownload

Path C:\Users\Admin\Downloads\Finalized Agreement & Payment Terms.msi.crdownload
Size 2.9MB
SHA256 989d81f5afd7267ac516aedf3741d9cca0bccea9e1221cb0becb557febd6d230
MD5 77d1c880cf8292b51d1cf20b356caaf6
SHA1 24c82738c328e0093ed41ba667a208451a4694f1
SHA512 d5d3aca4481a90df12c0d3328376967616ff46154f7ed0132b1e786999951ca7f9b01a7454a5b99471992fb6a9ed5e8ce73c6bce59254a0a0b792dcf336e969a
SSDEEP 49152:O+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:O+lUlz9FKbsodq0YaH7ZPxMb8tT
MD5 SHA1 SHA512 SSDEEP

Submit Download