ateraagent | b248e4a7dbd681c28777a7d318bd0f1c06d7a7fd27f46daa02a1136fe21676d3

Analysis

max time kernel
148s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
25/10/2025, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 13KB
Sample251025-phcspscy3d
SHA256 b248e4a7dbd681c28777a7d318bd0f1c06d7a7fd27f46daa02a1136fe21676d3
MD5 c88f517d241ddf9691237ed7515b4739
SHA1 077748b1fd09a2c34a12d144ab58fd2e8c06397c
SHA512 9bfc264b5e7cfa948bff047b29abca92671d949c029537362cce5540bd1aac2543e8e92cd59905530e94460497dee8cc7f446dd0aa15c1f0d5bc4abc44fe182a
SSDEEP 192:Jh0ND2eX0s93o/m3o/eMb575aMb22kBBuGE2xGz5K92lN4u12QHhy:JCQekD5eM974MCBctwkltQ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

discovery ateraagent rat

Malware Config

Signatures

AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent
Ateraagent family
ateraagent

Detects AteraAgent 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b1f6-50.dat	family_ateraagent

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
53	raw.githubusercontent.com
54	raw.githubusercontent.com
55	raw.githubusercontent.com

Drops file in Windows directory 19 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_325467146\sets.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1536733088\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1536733088\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_2013576523\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_2013576523\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_349138188\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_325467146\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_325467146\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_2013576523\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_2013576523\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_349138188\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_325467146\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_325467146\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1536733088\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_2013576523\manifest.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1536733088\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1536733088\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_349138188\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134058684083501461"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1418876453-2228697459-2788511057-1000\{664743C0-65F0-4BFB-8165-8F467487C011}	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Finalized Agreement & Payment Terms.msi:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 228 wrote to memory of 4560	228	msedge.exe	78
PID 228 wrote to memory of 4560	228	msedge.exe	78
PID 228 wrote to memory of 4424	228	msedge.exe	79
PID 228 wrote to memory of 4424	228	msedge.exe	79
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 5396	228	msedge.exe	80
PID 228 wrote to memory of 4140	228	msedge.exe	81
PID 228 wrote to memory of 4140	228	msedge.exe	81
PID 228 wrote to memory of 4140	228	msedge.exe	81
PID 228 wrote to memory of 4140	228	msedge.exe	81
PID 228 wrote to memory of 4140	228	msedge.exe	81
PID 228 wrote to memory of 4140	228	msedge.exe	81
PID 228 wrote to memory of 4140	228	msedge.exe	81
PID 228 wrote to memory of 4140	228	msedge.exe	81
PID 228 wrote to memory of 4140	228	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x264,0x7ffd40d1f208,0x7ffd40d1f214,0x7ffd40d1f220
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1824,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2296,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2416,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3376,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3400,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4804,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5020,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=5028,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4956,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5324,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5488,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5852,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5852,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6268,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6436,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:14
  2⤵
  PID:3500
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=568,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6656,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6684,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:14
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6252,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4836,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=1076,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4972,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5932,i,15366284170362671087,12751152183960843095,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:14
  2⤵
  PID:876

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

protocols.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e373291cec4f23986133c23daa353551f05eda26aac4a4e3686c40f8bfda576e
MD5 03b6ceee6d3294b477cb96be0a4821a2
SHA1 17508a8b887dac0d5b2fdf62cce6ee7989564165
SHA512 581fbd959baff647df5ac757c03b071653bca94c529807775b30e0f4b88ade1f0dd99850daaea1fa0861ce83d3e9d505a004e6c78d45e923ee39728a2d9efda9
MD5 SHA1 SHA512

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 108KB
SHA256 a5f47979e3d9dc7c49694d8e9e4dd8e98b45470f93161940daff0b96bfc84a91
MD5 3692b82273b09514a7212381ba0e0098
SHA1 5abf2cbf0bfd404c62a99944e2653830865eb23b
SHA512 d3611f1b0d1c4740eef4bb7d25dffc69de0afabb5f62164acb0d7e947175822cffdadfd607249028c6c6f9f39486e0e7dec0368f225793245ee820f59dcac4d7
SSDEEP 1536:IJcH74ohBGZqW3iPPDuVvpBI/S8tZsA62UYPq:PHSRiPjU1
MD5 SHA1 SHA512 SSDEEP

Submit Download

6a11d8f6-2c16-4d03-adff-1a317bd42cf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6a11d8f6-2c16-4d03-adff-1a317bd42cf2.tmp
Size 3KB
SHA256 4002ac0daea33af69aed7438f841af4b91cb952913ee9ce532c02f188f7d9dfe
MD5 a14a6e71bb19b9d20fa7f6aaa42c3024
SHA1 38a2de75be86328d5e96f9dc567e6532c3028552
SHA512 5e348dd24d1735e5a5474b6056f8f3758312da8eaf5c078db95385693eb3cdfff9733620ffa75817ee56f297cf1afd101d8a0b2262c4fe5bf0dc5872aff30737
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 d7a7ac2c84776ca9c88565186502ca873062a77283400013779ef709a63fcda7
MD5 8fe61b20e8828f34beb51f092bcd6b60
SHA1 9f936e2fd7a755107a3ec75483b358a76aee268e
SHA512 1598ef30871c19f1fd1c5e6f5c19ceb9b03cfa95306caf27d9b0cdd96cc096bb6721a38a91f5d11710fa65590184e6e6e3314c75f04bc2286379cb5d3a49d009
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f93d576abeb916dbe8205d8d2fa5dd214f19428a193e7280b9af00786dfa819e
MD5 3e4d64070508aa2eb4df18513e808b56
SHA1 d847c0a317204148a17b0a635a213e4f5b3d3003
SHA512 3694c7dc2e0dd9b2602d6038546a871e2a41feef20be997e59956275d6a6dc9de9b920502f69de2de455d53b326b9c18ca2e4100d30f331d59b10ae5e5e1fe8d
SSDEEP 192:sVkRQyMqv/Ky0Ml8UQhX3yitsZihRgvP12zoZ8p6c/Y+WNregA0z+e4/fvhjvqID:sVkTLqhnyitscjACx/SreY2fvZvqe
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4971f5dc82ec43d38dd433c5e45956b32f6f978583a2b8c909b44f01dbb4d8a3
MD5 f8184136f0bc5dea38ea2dfbed28ce17
SHA1 7f7ee81b21c8d6e6b5dc68b9bcf72099ae23ab2f
SHA512 445471b3f1431ee79d312fc8530406b32ce659fd54dba8e145c1591e69556316634b57de01c2bcc619d26ac30acb402cf08dcccc04c6f461325303627d621ecb
SSDEEP 192:sVkRQyMqv/Ky0Ml8M3yitsZihSgvP12zoZ8p6c/Y+WNregA0z+QBrfvhjvqIgyQJ:sVkTLPyitsc0ACx/SreY/fvZvqv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 37KB
SHA256 cd3e100deb7bb24911b4b25342d92ad60298dd4003dc8c9212045258aef88531
MD5 7ea1926260f4dcc2406ac57bc8c7264d
SHA1 ce1afe42502c4d83a2a9ddf8d7bc6d063fda21d2
SHA512 f6a74adb61c9e67a68a1442675fff8bd4bf85787d346773b9ca05bacd2ed22fecbe75fd801c4dea7ce43c8453a51c04c35875aec4d68dff07a2a2a65bd28cad1
SSDEEP 768:KdB7a8GX2WR7pLuLE8qWRWFTQBD8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3+22oLlv:KdB7a8GX2WHEE8qWRWFTQBDu1jaK+22e
MD5 SHA1 SHA512 SSDEEP

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 713cbb195a46b3500436e2890c20b15850a3d0579dca7398dd1a4facccbcbf3a
MD5 1cb113bb90735b17c633c7c69de6082a
SHA1 a83f3b6034cf89a90747bd67d58eb2a6e8d75d45
SHA512 f46dabcf6001de2e032be11ace22de61e5d712399976587b5945882c0b4e1435b38c3e7694347c4f7b43bc650e4b5f9a8d3365b22e5e5659cc78eb08e62bc6b3
SSDEEP 96:iQZ8gKe6QO2DcYQKQeyYzSnQyPSfmyU0EyOc5CCyKQ4w6xYxkevCusY8g4Q9CGgI:yT44iToES3
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ahokoikenoafgppiblgpenaaaolecifn\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CloudConfigLog

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\CloudConfigLog
Size 464B
SHA256 c7410d0fef6d396b90cad01a503a0fdc46a2e6e6884a9cea7996710133f3d0c5
MD5 70b6bebd7530c46f1910629802d90652
SHA1 013346eb84b3c7c5b2afb1fe36dc6044dcd005dc
SHA512 3da9703144292fe3fb69cb8911d65fa3a02bf47d7fb3a69816b92abc8699dedb2ab991b90b92d4557d9a6f3d00ba2e03b4e8a0d4725c0021cd04778720d55a27
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 8d11ef9c6954e1e24f5de3781f212680dfde3e11d9e3bbff225edb150f31ebf1
MD5 b64638585697fe95877e38d2fb8b4678
SHA1 a74ce8df3c87b1807c302368526ffbb4d2336af1
SHA512 8ae3e1c471005e89f8c17efd6194a510bc08907489092a45e47d736be870ef83c8887d430d252d9f4d431c872d4b073b31be4440a9cd1541cf07e0a88a0a16a3
SSDEEP 768:hFGBLv7I5wCPFdV6ZiL/CgG/8hGwbdweZYu14JqDTyoSfL9qE1novGqsW7iIKu8l:mJUV6Zo7giYpqfydfJqE1nWGeiAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 273187226079c525705a86030b6fa75c520c5944a0d6d5d7c58d7cb752d93237
MD5 0f7b0a752465b086fdd7500c459b319d
SHA1 0aeba97a4dc7a05a6cd1536fd321b6426ba4b07c
SHA512 b70b4ded6d1473e5797067bc1c14d9d6b6b9b1b81f0bc4f05de7d7163a26d57befadffe1dd8a4a00e5af6e1da95c2a0df32fbfa02a1a90037cf234d957a7b05d
SSDEEP 768:VFiE6esE8lDldUGz3UCgck8hGwbdweZYu14JZovGqsW7iIKu8CE1x4L:8eB85d735giYpZWGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 77c128b4c858a6ca150f79148c5f4514f9a881ebafedd381c8fe8bde53fa65d9
MD5 1f7bcbb487d30ad373d7076c9500526b
SHA1 95b1a6c312d3d792accd6d37d721c75c0657a0f9
SHA512 983baaaf60e46dfb77a290d8c4e92908c2af7af0112b30a7ce62f6a133f9c5f403ee9c97f13e0c7d6fb2f4e2e3a80072405d00a492489a5b533b6c84da3dd13b
SSDEEP 768:kFiE6esE8lDldUGz3UCgtpB8hGwbdweMHMKAO9Pe/ovGqsW7iIKu8CE1x4L:teB85d73sIgzMK/8WGeiAtE14
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 85ec9aad7a4dca63fc2a48b1d5ea9348678cc622e7d4f7cde5a25a7f2643abc2
MD5 2134228b25493cb44bdef1146df282d9
SHA1 a667b27572de970a080b2e59526f5383c9bf76e3
SHA512 00b40f6273fca789552c013cf21335e30945af0f7fa05ad9528692b59749969454e99e475a5b97a5a36c96d9e4cc4f6ea6357340f1844521c55a90b1674491ce
SSDEEP 768:hF5BLv7I5wCPFdV6Zik/CgU/8hGwbdweZYu14JqDTyoSfL9qE1novGqsW7iIKu8l:ZJUV6ZD1giYpqfydfJqE1nWGeiAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 aca7ecb92581087bdf60812edc331afe348f23d7af0a4d5d26617e29298ba193
MD5 861d37a5ff7e087804f8d135dc4191b7
SHA1 9bd73a7e943428229ae95f6b7c8624c9bf7f5915
SHA512 054c830d2f36633b8fa737779385408e9473abe6a695092fb3d76f6e94630256d6f09a4b3b84adbacd5b23f89e5bc0e171a029b7f02e17d66624d30ca6865b66
SSDEEP 768:uFGBLv7I5wCPFdV6Zii/CgG/8hGwbdweZYuJ4JqDTyoSfL9qE1novGqsW7iIKu8l:HJUV6Zj7giYXqfydfJqE1nWGeiAi
MD5 SHA1 SHA512 SSDEEP

Submit Download

keys.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2025.9.29.1\keys.json
Size 8KB
SHA256 e5b57a8978e405e9487c43e6b0b3685c4c71cdaa2e74e25d7fbed75ffaea01b2
MD5 80068ae175438916aff814972b76e6f6
SHA1 39336911d02ae3c5b038aa31c73c4757dcfadab6
SHA512 7cd55dc8c37fbaf9675d08fd2346ee45721338e1e70cf6aa351e54b45630ada5ada1243d738742cbda258c830e25ee8e09f57fc3cf21948e62c3c552ba9cd18d
SSDEEP 192:uNtGbRmmhGfHPJyR9Pm4lOvMwkoR9PuGMXcy:Ohm+0KjA
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finalized Agreement & Payment Terms.msi.crdownload

Path C:\Users\Admin\Downloads\Finalized Agreement & Payment Terms.msi.crdownload
Size 2.9MB
SHA256 989d81f5afd7267ac516aedf3741d9cca0bccea9e1221cb0becb557febd6d230
MD5 77d1c880cf8292b51d1cf20b356caaf6
SHA1 24c82738c328e0093ed41ba667a208451a4694f1
SHA512 d5d3aca4481a90df12c0d3328376967616ff46154f7ed0132b1e786999951ca7f9b01a7454a5b99471992fb6a9ed5e8ce73c6bce59254a0a0b792dcf336e969a
SSDEEP 49152:O+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:O+lUlz9FKbsodq0YaH7ZPxMb8tT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finalized Agreement & Payment Terms.msi:Zone.Identifier

Path C:\Users\Admin\Downloads\Finalized Agreement & Payment Terms.msi:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1536733088\LICENSE
Size 1KB
SHA256 3dbd2c90050b652d63656481c3e5871c52261575292db77d4ea63419f187a55b
MD5 ee002cb9e51bb8dfa89640a406a1090a
SHA1 49ee3ad535947d8821ffdeb67ffc9bc37d1ebbb2
SHA512 d1fdcc436b8ca8c68d4dc7077f84f803a535bf2ce31d9eb5d0c466b62d6567b2c59974995060403ed757e92245db07e70c6bddbf1c3519fed300cc5b9bf9177c
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_1536733088\manifest.json
Size 79B
SHA256 7c00a941d7a04048f469ffb986ff7e8bf349f149639cc474a463da4a607c0a70
MD5 0726a393d6366788cb47da5897d1af64
SHA1 022ebd4d118261b871d50479868d502b797e6d14
SHA512 adaaf0c40793c606d44fd7112b42040f01dd483a7c4c678e811f824e2fbad722ee3faf50984615731d71425eb3a1e4a9090962249e673fe8e7290713c8f75d9f
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_2013576523\manifest.json
Size 176B
SHA256 cd3bfb95cabb4cce04ae822443c4e7ef5c16ef8364804b3907bf37775f821eac
MD5 f99766abe08dd2f4607288031ffcb71d
SHA1 40f82d7a810175043004f10366a763180f4cbe13
SHA512 a6cde975e71a816377c2837d0941b0c7e68d730dec93d157b4171839e6a0314fb599053111b2e1951b0b90b23ae5cd06e23e7b7cbd01d6f9a6928cad82bf5e17
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_325467146\manifest.json
Size 85B
SHA256 2d905d7b28b1afd313753d14f6a916a2e56ec4c1316bfa43046b09214ceb6090
MD5 8ce95626b39ebc2401eee0b34c24fc7c
SHA1 f97a2fefe756f7a03e388e1333573b884730c2b0
SHA512 f04e4f695977918adf6e0603386b6f9c75a4a2202b0fe7215b642f3db491a1db398039cc28633b8e2541749403581622d28c1400f3f8fc66a3daab200e27266d
MD5 SHA1 SHA512

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_349138188\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping228_349138188\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
MD5 SHA1 SHA512

Submit Download

memory/1440-187-0x00000292C8B70000-0x00000292C9B70000-memory.dmp

Download