ateraagent | hxxps://zoomeventlive[.]com/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
79s
max time network
82s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/09/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://zoomeventlive.com/
Sample260917-eldjasha95

Score

10^/10

discovery ateraagent rat

Malware Config

Signatures

Family: AteraAgent
AteraAgent is a remote monitoring and management tool.
rat ateraagent

Detects AteraAgent 1 IoCs

resource	yara_rule
behavioral1/files/0x001900000002b4c6-157.dat	family_ateraagent

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4072	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340912938524085"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\ZoomWorkspace.msi:Zone.Identifier	chrome.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeCreatePagefilePrivilege	1852	chrome.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 1808	1852	chrome.exe	81
PID 1852 wrote to memory of 3576	1852	chrome.exe	82
PID 1852 wrote to memory of 4072	1852	chrome.exe	83
PID 1852 wrote to memory of 3576	1852	chrome.exe	82
PID 1852 wrote to memory of 2488	1852	chrome.exe	84
PID 1852 wrote to memory of 2488	1852	chrome.exe	84
PID 1852 wrote to memory of 864	1852	chrome.exe	87
PID 1852 wrote to memory of 864	1852	chrome.exe	87
PID 1852 wrote to memory of 1300	1852	chrome.exe	86
PID 1852 wrote to memory of 1300	1852	chrome.exe	86
PID 1852 wrote to memory of 3748	1852	chrome.exe	88
PID 1852 wrote to memory of 3748	1852	chrome.exe	88
PID 1852 wrote to memory of 1472	1852	chrome.exe	90
PID 1852 wrote to memory of 4440	1852	chrome.exe	92
PID 1852 wrote to memory of 2192	1852	chrome.exe	93
PID 1852 wrote to memory of 3280	1852	chrome.exe	94
PID 1852 wrote to memory of 1436	1852	chrome.exe	95

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zoomeventlive.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd60b6c728,0x7ffd60b6c734,0x7ffd60b6c740
  2⤵
  PID:1808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,7742908244277004100,3515302498075441679,262144 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,603615296346247143,1558218533673646882,524288 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2052 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,5464462556547393977,10167203430194268667,524288 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:2488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3216,i,18218549443459331958,10914179098751357963,2097152 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,10552951105597603512,9026390851919708481,2097152 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,14811917295985380915,5678743865423055023,2097152 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4428 /prefetch:9
  2⤵
  PID:3748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5320,i,10492722140989358332,1777757751522244186,524288 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5324 /prefetch:14
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,12709470612912286044,7228432816591319029,524288 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:4440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,4720715667752435829,14112526223484862174,524288 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5324,i,4529938349238306596,7559022360514135635,524288 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:3280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,14315134265618192511,327633585885554263,524288 --field-trial-handle=1932,i,7366313706329731929,4150187207602163255,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1436

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3cd1d228-24fa-48b2-9aca-97a3c99b64dd.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3cd1d228-24fa-48b2-9aca-97a3c99b64dd.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 38b062fcb99e93cbc05bb043c4308ff697474d87ceca570d57d5b1ee9f2a1dee
MD5 70e6ce69bd33068401dda0f240078e1e
SHA1 a5f6d31ac71b76b04078ef25cf87aa0c2cba2c09
SHA512 990ce9e2aae91e55944c91bfc8247748ae99cface6ee55ac130d7df1145fe446e9828267792a93ff4edce32f4484389774b1a04cf4bc0fb28a7dc1930fe4aac5
TLSH
T11FE02BBADD20DD2B0CFD475854640B05E65013572A40899F3B3C970E8FB9A36069585C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 9a284efbf6bec2d7830a8eaf288da55ae76f08b48e96557192e10b8205fabf86
MD5 40b38ad3af7ee669b81b9b8e253b9189
SHA1 cb2f20aa759f9c99582db439b1b21dd03bccb6db
SHA512 6fe0d19b67b598026143b25565f30f1c27737afd94a6934fa865d18f903555f8aa5a0f703de4bc5e6b22819095a6874b27e4dd0f18c7fb9a50e8090435074147
TLSH
T196B01250A0990042CB0493350897090222940D184249424A619080908403AB08200400
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 9f26bf245d94cdb6e35b047eefca2a306ea4df5b2ac67ee70a858811e941cd68
MD5 9d194a643810290c7602dab944a697b7
SHA1 7f62c3f498181511c882f4ac1c4f54f1cb13131d
SHA512 a0abbee33294f664d930ef61a9fb0f5f76549ccee7fafe38e903abd18f0ea264c515d1914587c0cee9d703c9fb0ed049a24da87d883696cd3fdaa3534ffbdaa1
TLSH
T199B0127070C70199DF10623614520A001648592C404D474B5AE94C80B913DF4C522553
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 626b13ceffbd73ebba0537680de3e65754bc4ac1cd7b07cb3012907f7aef1fbb
MD5 9b4080302e451a8a3aebe36512035d51
SHA1 9d70e3a4463df6cba2ff4391c2eef242c726fa2b
SHA512 ece29536dac0bd59290b869f3e8de8cfa8a1ae53a7225a43a686eddc6a70742e6438b00afee40d3bbaa92a19af2a1b2dbf69287c40f589f8f4fc464bd75d7d81
SSDEEP 96:DsLswZUGsQV/eLsHMr9isfszKxs6spvsusYss:DWJZp/eLsHm9iieotwv/fx
TLSH
T1CFA178B7C7E8866DC90152F4A6247E1BCE2E0969532C3C56C8D8FF9FA3E64B1D24054E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 3851e81f25b09740d5eec108cde16ee80eea8d972fc2456dc6b1c8c9d809e4df
MD5 8a248d7ffa175dcbf2e93efa60aef6fa
SHA1 0f0318274f9a747a373732a027c5f2b939a76e5f
SHA512 970b2918d77c80d884b538527accf8698dee711ff050929b5b2b3ade56d143856773b4abaccb4f80b389bb750270011bbfe546a368b857a3eb830ddd277d193b
SSDEEP 192:kRcEOLNVGzZv7BpAPRp2KZy92Hsb+WNnx6+bIk2oHeP+VyIsnAUge:kRcET5dUXdyww8kr2z2e
TLSH
T1A542A52DBD24753B6CDBD229FA657B63D3F5102220902E84EAFC897D21EB9CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 2e27523964d0dacb7ce924796aa52dd7d5f9d1bcd706b379e0ec0fb5feb97b24
MD5 a766624bc24c0d59d954beba8d41372f
SHA1 92055296dab7f208ebaa225110873ca4205eb4af
SHA512 fb1263f9eb41e0b5019e85bccca0eb6e90adfa1f12c7af080266eea63e16ba9e3ef88b9eba782538ef17351c4e9ef23f06d399b4d51df3bcf0eff6b710a3bd5f
SSDEEP 192:kRcQOLNVGzbzv7BpAPRp2KYy92Hsb+WNnx6+bIk2mHeV+VyIsnAUgE:kRcQTbLdUX8yww8kr2f2E
TLSH
T1C342A42DBD24753B6CDBD229FA657B63D3F5102220902E84EAFC897D21EB9CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 6b7cee8b1a5eb6f1d44c20ace754a545db0a1024ec3af9927adcfd7fb5491934
MD5 6ebf767a844f07086ae64536124c4a52
SHA1 dfdc2ed2621b56af7ab86ee74a08835c5544579a
SHA512 3d3a2843ec32079f785bc015a3dfab1b143f21902675eeccd9fb84c1a22147178feb9f7d146c1c8203d46344ff8432180128aefaab9fd51e9a50a3c74b2f5ee5
SSDEEP 384:Uijon7KxkXqKf/pUZNCgVLH2Hfgsl3i7pLuLceSijXODoL+ErU3pTHGsUXIoi0lA:Uion7KxkXqKf/pUZNCgVLH2HfgsFi7p9
TLSH
T1D1721A677C4C993B0F94C9CCDC2A7E4FADB5024B61E9886483FA5C2A03D5ADB11062F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 294f51d758085d6cf17f51dcb53ef7871218f429741f7b8b8af5df892a4ca2ed
MD5 8457a5d31051cf04d1652fa9cb30b53b
SHA1 dac7a74988432b80a022d21a512c5093bf2b15d5
SHA512 10b4d75308711ee1b894dbbf3649bc804e0ead6256bb8be86af2e890993fab4a63037873f5f945cd6629258a4c6e18d2d02b10c8c9e57f911fe30303ed89ce93
TLSH
T17AB01216C0815301C06602F8215014A83554DF14A706130581F01E11C835171806B0D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b476.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b476.TMP
Size 96B
SHA256 7dee97b81b531866753ac0d12b0960063e89c36a5423f45a6c8164acea07be27
MD5 08e1fc469ed9ea35b78a0de616794777
SHA1 8f89a909d044617b27ed857c58444bf3412a249d
SHA512 9f2c96fcdfedad9f62cda35a61bbf30123824f37095eca539ae1c5d0173b35260dcca3400cc1d4045c3316a9ed2b60833fbce0ca8d6f70a6d84797fa32899938
TLSH
T1CEB02200C0022203C00303B828CC88C83020EF38CB03030382E02B22EC2023000200B0
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 517bb5b346ea345d2a05a77785a270b7564351b12aed7f4272536b7c00872a1b
MD5 72e1e64bbdd526eba93a50433311114f
SHA1 9c36fa624c957982a09d07c8a3328bd4515061f6
SHA512 404112b1732cbe16b9a6e4fb2ac66df70751e9644443f5ef482c5c56d0a34bcba286a6b6391c8f45992a2d37e90f6770b72721be09599594709358aba2f4ac36
SSDEEP 3072:zw7H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:zwZt4fLJ0L6nGJxi3bzqapJja
TLSH
T166D302F1D1E06C2ACBF7EE4145756E908E71D5C689CDBE2409FD8D1806CEA384A17E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 178KB
SHA256 b9acbbf29601c1f70880c507e5e96bc44d045368d6ebf73c9cf8a7c2aebaef73
MD5 0244c045d87ff821840c0734f352c552
SHA1 100cb8029bd6f0f2af97b9671483cc3dc04a7531
SHA512 23c5d8b6c5258fb22409fe689f68298c693f63fba159b44f99ade8033336eeda7da44a4203e02644c444f339be1cb9ff8ef7c1252587c345d128a4d7476d40ce
SSDEEP 3072:G23HAvk2PwqqKA+ZFgH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:GUHok2PwHKAMot4fLJ0L6nGJxi3bzqam
TLSH
T15A0412B0E5E07C7E8BF3EE4548716E959EB194C68C4DB97804ED4C5402CEA389A17EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 f4ad42df549bc9ecf6fe930fd1fd6b710b86ddbae38eed564e91e01fd76620fc
MD5 faa457f94a2ef1e3b211f38fb60d7f43
SHA1 c2fb498e44a690b37713e853b7cac486205c1fad
SHA512 20f685e67bd4f67dc665c305da35bfc02c77bf3ffb0a5c1bdf4efd9aa0743f70eb36a5856a25510386d838bc58090e14e53154f4577d247748ecabd359559609
SSDEEP 3072:zqH2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:zKt4fLJ0L6nGJxi3bzqapJja
TLSH
T141D302F1D1E06C6ACBF7EE4145756E908F71D9C689C9BE2408FD8D1816CEA344A13EA3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 131KB
SHA256 c307b2473612e47b924af1d5c7e72f1927c8f2b1847eba3a6eba59ef9ae71e61
MD5 11c35e4b0b2c56337581ce7ab0255a55
SHA1 f9233e706b3b5e6a0775bf4399c6f74f22967d20
SHA512 18c9d74cba1e956ee335f1d32ae8346bb61872e38911e8844e106531fceb98fcbb940c82482de270dcb068c6e3649adda17c0bc979e58d6d9eab9773f4a9144f
SSDEEP 3072:Gw7H2By3RJD4diWs9aJ0xN6nGvw8xUNTfd3OUhLHfS60ApJja:GwZt4fLJ0L6nGJxi3bzqapJja
TLSH
T12AD302F1D1E06C2ACBF7EE4145756E908EB1D5C689CDBE2409FD8D1806CEA384A17E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZoomWorkspace.msi

Path C:\Users\Admin\Downloads\ZoomWorkspace.msi
Size 2.9MB
SHA256 f09550f82262273556f0bf861a598163877d7a5277a05b068db76fc1c13dab56
MD5 f39a16dc9873d14eb27bcf2fa3916695
SHA1 f1173113041420a6b51be315e9275b7d09bb966a
SHA512 cedf268f105ec4e9e47ff8b63cc5e36f89479f5c8f3c0cb8099da70575b79aab2d9c3c3ddc07551eeaf12ca65da5a5eca0cfbffc6c7c2a1be799a630fb8a3649
SSDEEP 49152:j+1Ypn4N2MGVv1zyIBWGppT9jnMHRjOOozjcqZJN8dUZTwYaH7oqPxMbY+K/tzQz:j+lUlz9FKbsodq0YaH7ZPxMb8tT
TLSH
T1D6D523127584483AE37B0A318D7AD6A05E7DFE605B70CA8E9308741E2E745C1AB76F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ZoomWorkspace.msi:Zone.Identifier

Path C:\Users\Admin\Downloads\ZoomWorkspace.msi:Zone.Identifier
Size 149B
SHA256 b3630693bf0afc892f931c00374a3f95af7c24e37dc6bc0734f776d9f689355c
MD5 e0507d17645794ad84c5c116618bd1b1
SHA1 ea5ce0de66cbf80f53f0f90c6066726e57912071
SHA512 fca9af521deae37680d016cda485dfeefd1ec733381d2fb292ed614ab7d927d462742a46129f7a965be30d08e70939aaff490fe87f6abca5ce203115289f0ef3
TLSH
T104C08C4B8C0441283E2D31C4A34EB11CB12A235B4E05C684E4800C57F9C016F80620E7
MD5 SHA1 SHA512 TLSH

Submit Download